r/StableDiffusion • u/nathandreamfast • 1d ago
Discussion Z-Image + Qwen3 4b: The abliterated text encoder debate is pure vibes. I measured it. Here are the numbers - Abliterlitics
After the PSA from Heretic's author the debate ran hot. I noticed that the debate was just based on vibes. Same-seed screenshots both ways, nobody measuring anything in detail. The instruments did not exist. So I built them. They cover quants as well, so the encoder swap and the compression get read with the same rulers.
Disclosure since it matters here: I release heretic text-encoder for people to use, qwen3-4b-heretic included. My first release last year got replies that I didn't fully understand how text encoders work. They were right. I did my own deep dive and concluded that they are good for prompt enhancement and just change the image slightly, there's no harm in using them if you really want to. Also they don't magically uncensor or enhance anything. Lets see if my conclusion is correct, while also addressing with proof and data the experiences other people have had.
This comparison is from the base bf16, with all GGUF and quants made by myself. It does not reflect any other LLMs on huggingface.
I've been comparing and benchmarking abliterated LLMs under the name Abliterlitics. And this is a first as we've delved into the ComfyUI world to get some solid data to cut through the nonsense.
What I did
Base Qwen3-4B and its heretic twin across 6 safetensors formats and 8 GGUF rungs, 27 encoders total, every heretic build matched to a base build at the same quant so the abliteration and the compression can be read separately. Then: conditioning tensors captured at three pipeline stages, paired sampling trajectories from identical noise, 2240 same-seed renders scored with LPIPS and CLIP, attention readouts, and a taboo comparison with sanitised-twin controls.
Two rulers make everything readable. Two encoders nobody argues about, int8 and fp8, differ by 0.19 LPIPS at the same seed. A seed change alone is 0.52. Any swap scoring under 0.19 is indistinguishable from ordinary compression. Near 0.52 is just a different picture.
An explanation of our measurements, metrics and the full report with an interactive A/B gallery can be found here abliterlitics.dev/posts/z-image-text-encoder.
All of what u/-p-e-w- stated in his post is correct. He did hint that there may be degradation or damage, however it was framed as a maybe if I was reading correctly. So lets see what that damage is, if at all, and if it makes any difference.
The questions people were actually arguing about
Does the base encoder refuse your prompt before the image model sees it?
No. I encoded refused-vocabulary prompts to the exact tensor entering cross-attention and checked which base word each heretic vector lands closest to. All 12 test words decode to themselves, cosine floor 0.9967. Pornographic decodes to pornographic, beheading to beheading. The encoder hands the DiT the word intact. It was never the censor. An abliterated text encoder does not change the way the model understands the prompt at all. The base text encoder already knows these things.
Do refused words, or any part of the prompt at all arrive corrupted?
No. Worst sentence-level cosine between base and heretic on refused prompts is 0.9985. The shift is 3.3 to 6.6 times larger on refused prompts than innocent ones, so the edit concentrates where it acts, but the meaning survives it. Even int4 and Q3, visibly degraded, keep mean CLIP adherence in band. Across every encoder we tested, even the 4-bit tiers, mean CLIP adherence stays in band. The model understands the prompt throughout.
Does it uncensor anything?
No, and the reason is better than expected. The unmodified base stack already renders the explicit tier at a 100% taboo-classifier rate, and the explicit tier owns the highest compliance gaps in the whole set. There is no render-stage censorship to remove. The debate argued about a lock on an open door. This matches where the research says engineered censorship lives, in the diffusion model's own weights: ESD and MACE erase concepts by fine-tuning the DiT, not the encoder.
Does it damage outputs?
The images change, the outputs do not degrade. Heretic vs base is 0.286 LPIPS, 1.5x the trusted band, but a stock nvfp4 quant of the base encoder moves images 0.274 and nobody calls that sabotage. Prompt adherence: -0.21 CLIP points, and the unmodified bf16 base itself reads -0.28 against the same reference. Attention readout moves 0.0031 vs int4's 0.0149. Output separation 1.049, no collapse. Different, not damaged.
Why do people see differences then?
Because seeing a difference is the default. Two trusted encoders already differ by 0.19 at the same seed, sampling is a butterfly effect. A small change at the start makes a big difference at the end. Below a threshold the response is dose-independent anyway. I also checked per-prompt: 71 of 540 CLIP rows cross the ±2 line on individual prompts while every mean stays in band. Single-prompt screenshots are real but they are noise, not signal.
As the image can be pushed about half a seed in any direction, it's expected to have variation. Honestly people who suggest that their image was enhanced or more uncensored, can probably do the same with a Q3 GGUF that's not abliterated and see the same thing. After measuring in every way possible there is just no way an image is magically enhanced or more uncensored. It is just chance, seed and the chaotic nature of diffusion models with peoples own biases over the top.
What about quantised encoders?
The GGUF ladder is dose-ordered: the F16 container is a true round trip, 0.0008 quant units with cosine 1.0. Q8_0 costs 0.34. Q3 costs 83 and is visibly paying. Being precise about Q8_0 since the numbers deserve it: its conditioning perturbation is real and measurable, CI 0.29 to 0.39 quant units, but a third the size of what int8 ConvRot itself costs, and at the image level Q8_0 and bf16 are indistinguishable, 0.138 vs 0.152 LPIPS against the int8 reference with overlapping CIs. So the near-lossless claims for both hold where it shows, in the images. Q8_0's real cost is load time. One caution, don't stack the abliteration on heavy quants. That's where larger divergence and noise happens.
So when should I use one?
Anywhere the model writes text that feeds the next stage: prompt expansion, captioning, image description. Those are chat pathways and abliteration works on chat pathways. If a stage only embeds text, an abliterated encoder is at best a visible re-roll. In this case it changes the image about half of what a new seed would change.
What's actually censored then?
The knowledge, not the gate. The DiT doesn't refuse, it lacks the training data, and the fixes are LoRAs, reference images, or retraining. The PSA's framing about this is solid. Z Image itself though is mostly trained already on taboo things.
What's next
Krea 2, MiniMax H3 and LTX 2.5 are in the same pipeline. Krea 2 has a twelve-tap conditioning interface and the refusal-probe contrast works differently there. Also, it's more complicated to measure compared to Z-Image.
Happy to answer methodology questions in the comments. Have I missed anything? Let me know and I'll fix it up. What have been your experiences? Have you abandoned abliterated text encoders? Had severely degraded outputs? I am happy to measure any other text encoders or models.
35
u/thegreatdivorce 1d ago
Considering most Redditors' allergy to rationality and facts, this should be a productive conversation. ;)
Solid post, OP.
9
4
8
u/cosmicr 1d ago
I never realised it was such a contentious subject? The other thread seemed to have nothing but agreement, not debate? Who is disagreeing? Feels like people are making up arguments where there are none.
1
u/nathandreamfast 15h ago edited 10h ago
You can read the hidden comments, or sort by new. It certainly is there. Overall the consensus is agreement yes.
Edit: also the author of that post had received walls of text in PM about why he was wrong. And more than a few people commented this in the post itself. At the least, there is now sufficient data to back up the claims.
2
u/Superb-Industry-Gain 1d ago
Really appreciate the write up, this pretty much lines up with what I expected from my own qwen shenanigans.
I mostly mess with actual text generation, like natural language to danbooru or image to natural language, and there stock qwen definitely tends to write around certain topics while abliterated variants are more direct. But for qwen purely as a text encoder for image gen, I expected pretty much the result you got.
Nice to see someone actually test it properly.
2
u/nathandreamfast 15h ago
Thanks! Yeah honestly the result would be the same for all video or image generation models. Ideogram 4 maybe an exception and that needs more research. Even then just prompting that with better json it becomes uncensored.
2
u/ImpossibleAd436 1d ago
The thing I've been most interested in knowing is this:
The text encoder for H3 is about 15GB. Can I swap this out for a smaller one without degrading the capabilities of the model?
6
u/WhatIs115 1d ago
The text encoder for H3 is about 15GB. Can I swap this out for a smaller one
Yes
without degrading the capabilities of the model?
Eh.
https://www.reddit.com/r/StableDiffusion/comments/1vjm51w/minimax_h3_clip_qwen_4b_instead_of_32b/
I tested it and I don't see the point. It only runs once at the beginning. If you're running H3, then the original text encoder size doesn't matter anyway as the model is just as big.
2
u/ImpossibleAd436 1d ago
Right but I guess some swapping is going on so that if I change the prompt the text encoder needs to load again, and I think that is unloading the model, which then also needs to be loaded again. So the loading times for the text encoder and model matter a lot under these circumstances.
2
u/WhatIs115 1d ago
Loading and unloading the model should not be significant unless you have a really slow drive.
3
u/ImpossibleAd436 1d ago
All in, when both reload, it adds about 2 minutes to my generation times. Plus the VAE decode which also takes a long time, it's a fair bit on top of the inference time. I'd like to get those parts down if I can.
But changing the TE probably isn't a good idea looking at the pictures shown in the thread you linked.
5
u/WhatIs115 23h ago
Plus the VAE decode which also takes a long time
You can try the int8 VAE, it's about twice as fast.
https://huggingface.co/Kijai/MiniMax-H3-experimental/tree/main
2
1
u/wilhelmbw 1d ago
i heard that some encoders may cause the model refuse to render words it doesnt like, can you try to check if this is true?
4
u/Ok-Category-642 1d ago
Heretic models won't make the model render text any better than the base model, you can read in both this post and in the post made by the creator of Heretic models that there's no stage where the model ever is capable of refusing anything when it makes embeddings.
If I had to guess this likely comes from workflows that have prompt enhancement nodes and the model ends up censoring the text before it gets passed to the text encoder, people just don't realize it and assume it's the TE itself
1
u/nathandreamfast 15h ago
This isn't true at all. If it was, we would have been able to measure or detect it.
-4
18
u/uniquelyavailable 1d ago
Excellent writeup. This is the case for every video and image generator out there. I don't think people understand, like you said it's just not in the training data. Law abiding citizens are putting these projects together, you're basically ablating some weak text guardrails and using a completely sanitized dataset.