Qwen3.5: 397B-A17B, Gated DeltaNet and open multimodal agents
Technical Qwen3.5 analysis: 397B-A17B MoE, native vision-language, hybrid attention, 201 languages, model family and secure self-hosting.
- AUTHOR
- Karol Rapacz / CEO of Breachroad · OSCP · PNPT
- PUBLISHED
- 16 February 2026
- READING TIME
- 16 min read
- TOPIC
- AI Security
The Qwen team released Qwen3.5 on 16 February 2026, beginning with the 397B-A17B MoE model. 122B-A10B, 35B-A3B, 27B and smaller 9B, 4B, 2B and 0.8B variants followed. The family combines native vision-language capability, hybrid Gated Delta Networks, sparse MoE and Apache 2.0 open weights.
“397B-A17B” means roughly 397 billion total parameters and 17 billion active per token. Weight memory follows total size, while much step computation follows active size plus routing, attention and communication overhead.
Hybrid attention and multimodality
Qwen documents Gated Delta Networks combined with periodic full attention. Linear mechanisms reduce long-sequence cost while attention preserves precise distant relationships. This is an engineering trade-off rather than free context; performance depends on kernels, batching, length and model variant.
Qwen3.5 used early-fusion training over trillions of multimodal tokens. One model handles text, image, video, reasoning, code and tools. Qwen claims coverage of 201 languages and dialects. Treat that as a testable hypothesis for your domain and language, not guaranteed parity with English.
A family, not one checkpoint
397B-A17B targets quality on distributed serving. 122B-A10B and 35B-A3B reduce active compute, 27B offers a simpler dense path and small variants enable edge or specialised deployment. Choose by evaluation and SLA, not the largest number.
Compare text, vision and tool use separately; VRAM at the actual quantisation and context; prefill/decode latency; function-call parsing; non-thinking behaviour; multi-turn KV-cache reuse; and licence/runtime dependencies.
The project moved quickly enough that the Qwen3.5 repository later redirected to Qwen3.6. A model registry must therefore pin model ID, revision, tokenizer, chat template and runtime. “Qwen3.5” alone is not reproducible.
Self-hosting does not finish privacy work
Local weights reduce prompt transfer to an external provider, but logs, tracing, cache, tools, SDK telemetry and agent outputs can still leak data. OpenAI-compatible endpoints are sometimes left unauthenticated on flat networks. Add identity, mTLS or a gateway, rate limits, tenant isolation and egress policy.
Obtain weights and adapters from official sources and safe formats. Pin revision and hash, scan runtime images, separate model cache from customer data and review any trust_remote_code requirement. A third-party quantised artefact is a distinct supply-chain dependency.
Multimodal agent security
An image can carry prompt injection, a malicious QR code, click-bait UI or a background secret. Do not pass extracted instructions directly to tools. The policy layer must distinguish user intent, data and tool output.
Use domain allowlists, schema validation, mutation approval, separate credentials and memory hygiene. Test image instructions conflicting with the system prompt, obscured text, multilingual attacks and multi-stage exfiltration.
Build a defensible evaluation
Use at least 100 examples matching production: language-specific documents, screenshots, charts, code, function calls and long context. Score factuality, citations, refusals, JSON validity, unnecessary calls and infrastructure cost. Run repeated trials because sampling and MoE routing introduce variation.
What the inference layer must measure
Average active parameters are insufficient for MoE capacity planning. Collect expert-load distribution, memory utilisation, inter-GPU traffic, queue depth and prefix-cache effectiveness. Uneven routing can create hot experts and reduce throughput even when other devices retain free memory. Measure image and text prefill separately, plus first-token latency and degradation as batch size grows.
Pin tokenizer, chat template, Transformers/vLLM version, dtype and generation parameters in every deployment test. Changing one can alter function calling or token usage without changing the model name. A canary that sends a small traffic share to a new revision exposes regressions before full rollout.
Minimum threat model for open weights
Consider checkpoint substitution, loader code execution, vulnerable inference servers, unauthenticated endpoints, cross-tenant cache and tool-based exfiltration. Download artifacts into quarantine, verify signatures or hashes, generate an image SBOM and promote the same digest across environments. Self-hosting provides data control only when the entire path from gateway to telemetry remains governed.
Use vendor benchmarks as a filter, then govern the decision through a model registry, safe model formats and an LLM gateway. For checkpoint evaluation on your workloads, contact BreachRoad.
Primary sources: QwenLM — official Qwen3.5/3.6 repository, Qwen3.5 model documentation.
