Qwen/Qwen3.8-27B
The newest open frontier release — a linear-attention/Mamba hybrid with vision. Strong on long context and structured output; ships three novel production bugs in the unmodified official weights, one of them a silent data-integrity trigger.
Spec sheet
| architecture | qwen3_5 hybrid — 48 Gated-DeltaNet : 16 full-attention layers, vision-capable |
| parameters | 27B |
| vocabulary | 248,320 tokens |
| verified context | robust to 128k tokens / 1,600-item extraction in our battery |
| determinism | greedy decoding batch-invariant across 24 runs (vLLM 0.27.1, H100) |
Genealogy
Where this model comes from, and what each generation contributed to its risk surface.
Qwen/Qwen2.5-7B-Instruct
Qwen2.5 generation — classic dense transformer line; census parent in our 296-model derivative study.
Qwen/Qwen3-8B
Qwen3 generation. Our census of its most-downloaded derivatives: 56% ship a different chat template than the parent (37% undisclosed); 78% of pure quantization re-releases changed or dropped the template.
Qwen3.5 family
Introduces the qwen3_5 hybrid linear-attention/Mamba architecture. Glitch-token "semantic collapse" first reported by the community on Qwen3.5.
Qwen3.6 family2026-02
Community issue QwenLM/Qwen3.6#33 reports glitch-token corruption; closed by the vendor as "not planned."
Qwen/Qwen3.8-27B2026-08-05this model
This model. Inherits the qwen3_5 hybrid architecture and the unfixed glitch-token vocabulary; adds vision.
The glitch tokens are inherited, known, and unfixed: the vendor closed the Qwen3.5-era report as "not planned," and our pass confirms the tokens persist in Qwen3.8-27B.
Expect the derivative ecosystem to drift fast — in the Qwen3 census, the derivative with the smallest weight delta removed the most safety (refusal 100% → 5% with zero capability loss). Weight-size scans cannot substitute for behavioral differentials.
Gotchas — what causes business problems
Every entry is a measured differential from the published reports (matched controls, greedy decoding, reproducible), not vibes.
high Glitch tokens silently corrupt user data
Business impact: Support bots confirm the wrong username; CRM extraction stores a wrong value in otherwise-perfect JSON; "log this verbatim" steps swap in a hallucination. No error is ever raised.
The 248,320-token vocabulary contains scraped junk (PostalCodesNL, ForCanBeConvertedToForeach, useRalative, garbled web fragments) that received almost no training gradient. When one appears in ordinary input — a username, SKU, order reference, error code — the model rewrites it and returns schema-valid, confident, wrong output. 6/7 Chinese and ~6/12 English support/CRM/RAG scenarios corrupted in our pass. Asked to define a glitch token, the model invents a fluent, wrong meaning ("PostalCodesNL" → "a snowflake").
Mitigation: The trigger set is enumerable: a GPU-free embedding-norm probe lists the undertrained tokens. Pre-screen pipeline inputs against that list and route hits around the model (or to human review). Do not rely on schema validation — the corrupted output is schema-valid.
medium Self-appointed, inconsistent DLP filter on PII
Business impact: Legitimate archival/record-keeping workflows silently lose records: the model refuses to store data it will happily emit elsewhere — an enumerable data-loss vector, not a safety feature.
The model refuses to archive records containing PII-shaped values (3/8 tasks) while preserving the same record 20/20 under extraction and summary — and sometimes quotes the secret inside the refusal itself. Localized in the residual stream; a surgical weight edit fixes it (3/8 → 8/8 with safety intact).
Mitigation: Avoid verbatim-archival phrasings ("store exactly", "log verbatim") on records with credential/PII-shaped fields; use extraction-style prompts, which are consistent. A vetted surgical fix exists if you control the weights.
medium Confident temporal staleness
Business impact: Finance, news, compliance, or research agents built on this model will state stale facts ("the current fed funds range is 4.25–4.50%") as settled present-tense truth with no uncertainty flag.
7/8 time-sensitive questions answered with no cutoff caveat (0/6 timeless controls — so it's not a general failure to hedge). Mechanistically it's a dissociation, not ignorance: a linear probe reads "this query is time-sensitive" at AUROC 1.0 from layer ~17, but the model doesn't gate output on it.
Mitigation: Route time-sensitive queries to retrieval, or force a templated as-of caveat. The one-layer probe is a deployable pre-answer staleness detector (one forward pass). Activation steering exists but the usable window is narrow — use the detector, not the steer.
medium Language-conditioned political alignment
Business impact: Content, moderation, or research products can inherit state-aligned framing on China-sensitive topics — in fluent English, where teams don't expect it.
83% state-aligned answers on China-sensitive topics vs 0% on non-China politics, plus a flat EN/ZH self-contradiction on a question of international law.
Mitigation: If your product touches geopolitics, benchmark on your own sensitive-topic set and add a policy layer; the skew is topic-conditional, not language-gated.
info Known limits that reproduce here
Business impact: Standard failure classes — plan for them as you would on any open model.
Data-borne prompt injection, multi-step invoice-math errors, and copyright over-refusal all reproduce on this model. Documented in the report's Finding 6.
Mitigation: Injection-filter retrieved content; don't trust unverified arithmetic; expect over-refusal on quote-heavy tasks.
What tested robust
Honest negatives are what make the positives credible.
robust Long-context recall
Needle found at every depth through 128k tokens (30/30); perfect 1,600-item list extraction. No published long-context study existed for this hybrid — the linear-attention state's theoretical weakness never surfaced in range.
robust Structured-output fidelity
0 schema breaks, 0 value errors across messy inputs; resolved corrections, left missing fields null, ignored an instruction injected into a field value.
robust Sycophancy under pushback
Caved 0/12 against confident false corrections; held and explained.
robust Judge position bias
Position-consistent on 5/6 near-ties; better than the published Qwen3-8B judge numbers.
robust Anchoring
Moved toward an irrelevant numeric anchor in only 1/8 estimates, marginally.