Abliteratedvsuncensoredvsfine-tunedmodels:whatisthedifference?

What does “uncensored” actually mean for an LLM?

“Uncensored” means a model accepts requests its aligned parent would have refused, and nothing more specific than that. It is a behavioral label, not a technical category. It can be applied to a model that was retrained, one that had its weights edited, or one whose publisher simply says so. A repository name alone doesn’t tell you which.

That is why the question “abliterated vs uncensored” is slightly off. Abliterated models are usually described as uncensored. The useful comparison is between the methods that produce that behavior, plus the case where no method was needed because the model was never chat-aligned.

Refusals come from post-training. Labonne’s write-up targets instruct-tuned models, because that is where the safety tuning produces refusals. Every route below is some way of undoing, avoiding or retraining around that stage. For why the stage exists and where it over-triggers on benign coding requests, see why LLMs over-refuse.

How is an abliterated model made?

An abliterated model is made by finding the direction in the model’s activations that carries refusal and removing it from the weights. The technique rests on Arditi et al. (2024), who found that across 13 open-source chat models up to 72B parameters, refusal is mediated by a one-dimensional subspace.

Labonne’s published recipe works like this:

1. Run harmful and harmless instructions through the model. His code uses up to 256 of each.
2. Take the difference in mean activations, normalize it, and test candidate directions by checking generations.
3. Remove the chosen direction from the weights by orthogonalization, so the model can no longer write to it.

No training data or gradient updates are involved, only small prompt sets and a weight edit. Tools have since automated the search; how Heretic does it is covered separately.

The full mechanics, and the license angle, are in what is abliteration.

How is an uncensored fine-tune (e.g. Dolphin) made?

An uncensored fine-tune is made by filtering refusals out of an instruction dataset and training a model on what remains. Eric Hartford’s post lays out the reasoning. Open instruct models such as WizardLM and Vicuna were trained on data generated with the ChatGPT API, so the alignment of the source model came along in the data. His fix: “Identify and remove as many refusals and biased answers, and keep the rest”, then fine-tune the base model on the filtered set using the original training procedure.

The Dolphin line follows this approach. The dolphin-2.9.4-llama3.1-8b card states: “Dolphin is uncensored. We have filtered the dataset to remove alignment and bias.” It lists Llama 3.1 8B as the base. The training config on the card shows selective fine-tuning of chosen layers rather than an adapter, though the card doesn’t fully identify its training file, which is a good example of why you read cards critically.

Newer Dolphin releases show the label drifting from its original meaning. The Dolphin-Mistral-24B-Venice-Edition card lists Mistral-Small-24B-Base-2501 as the base in its model tree, calls the goal “the most uncensored version of Mistral 24B,” says it “does not impose its ethics or guidelines on you,” and gives no details on datasets or training method. The Dolphin-X1-Trinity-Nano card says it was trained with new reinforcement learning environments aimed at de-aligning models, and links a blog post for the method that we did not verify. So “uncensored fine-tune” now covers at least two recipes, filtered-data SFT and RL, and the card is the only way to tell.

Both cards put the alignment decision on you. The Venice card says to set a system prompt for tone and guidelines, and the 2.9.4 card warns the model “will be highly compliant with any requests, even unethical ones” and says “You are responsible for any content you create using this model.”

Fine-tuning can also erode safety without anyone aiming at it. Qi et al. showed that fine-tuning GPT-3.5 Turbo on 10 adversarial examples was enough to break its guardrails, and that even benign datasets weaken alignment to a lesser degree.

What about base models?

A base model is a pretrained checkpoint that hasn’t been through chat post-training. The Qwen3-8B-Base card lists its training stage as pretraining, and its license as Apache-2.0. Its name is the label; the card doesn’t recommend a use.

Base models are not a shortcut to a usable no-refusal assistant. They are built to continue text rather than follow instructions, so you would normally do your own instruction tuning on top, at which point you are doing the fine-tuning route above and deciding what the dataset contains. They matter for this taxonomy because they are the starting point for fine-tunes like Dolphin, and because they show that “no refusals” and “good assistant” are separate properties.

Abliterated vs uncensored: how do the three compare?

Developers who tried these models disagree about the cost, which is why the comparison below matters. In the Hacker News thread on Labonne’s post, one commenter abliterated Qwen2-7B-Instruct to drop China-related refusals, ran MixEval and reported a negligible difference, while another tried a Llama 3 abliterated 8B and found it lobotomized, often failing to emit stop tokens. Both are community reports, not our tests. The table puts the three routes side by side.

The quality cost deserves its own caution. In Labonne’s experiment the abliterated Daredevil-8B scored lower than its source on all benchmarks, and a DPO pass with QLoRA recovered most but not all of it; GSM8K math did not improve. A July 2026 preprint by a single author compared base and abliterated versions of Gemma-4-26B-A4B-it and Qwen3-30B-A3B-Instruct-2507 on a stock-direction task that triggers no refusals. It found the abliterated models more optimistic, by 12.2 percentage points for Gemma and 7.4 for Qwen. It is one preprint on two model families and one narrow task, so treat it as a flag, not a verdict. It does support the point that removing refusals is not a clean subtraction.

What do developers report in practice?

Practitioners are split on whether abliterated models are damaged, and the reports are anecdotal. The main thread is the Hacker News discussion of Labonne’s post, from June 2024; the first two reports are quoted at the top of the comparison above. These are comments, not benchmarks or our tests.

• “Lobotomized.” The Llama 3 8B commenter allowed that the dataset or the implementation could be at fault, so the failure may not be inherent to the method.
• The opposite experience. Another commenter said a Llama 3 70B abliteration worked fine for them with no visible quality loss. Same method, different size, different outcome.
• Measured, small gap. The Qwen2-7B commenter’s MixEval results are on the model card they link.
• Refusals are not uniformly removable. In the later Heretic launch thread, the tool’s author said Llama 3.1 is easy to decensor, while for gpt-oss and Qwen3 most parameter settings barely changed refusals. Another user reported that on Qwen3 14B the edit either badly degraded the model or did nothing.

The reports fit Labonne’s own benchmark drop and the Fafuła preprint: the cost is real but varies by model and size. What none of them settles is how a fine-tune like Dolphin compares, since these threads are about abliteration. That is why the card checklist below matters more than the label.

How do you tell which one you have from a model card?

You tell by reading four things on the card, since the name is not reliable. Use this as a checklist:

• Base model and method. Does the card name the parent model, and say “abliterated”, “fine-tuned” or the tool used? Absence is a warning sign.
• Training data. A fine-tune should say which dataset was filtered. Dolphin’s card does name datasets, but also shows how much a card can leave out.
• Evals. Look for benchmark numbers against the parent and a refusal measurement. No evals means no evidence about the quality cost.
• License. The card should say which license governs it.

The Heretic project, covered in our Heretic explainer, shows what a useful report looks like: p-e-w’s gemma-3-12b-it-heretic card lists refusals on 100 harmful prompts (3, against 97 for the original) alongside KL divergence on harmless prompts (0.16). An earlier Heretic README also listed two manual abliterations at 1.04 and 0.45, but that table has since been removed. These are the tool author’s own results, on the author’s hardware. Still, reporting both refusals and divergence is the right shape: how well refusals were removed, and how far the model moved.

Which should you pick for coding work?

For coding work, pick the model whose card gives you evals and a clear base, then test it on your own repository. There is no universally best method. Rough guidance:

• You want your usual model minus the over-refusals. An abliterated version of that instruct model is the closest match, ideally one with a repair pass and published evals. See the roundup of abliterated models.
• You want a general assistant with no alignment layer. A fine-tune such as Dolphin is built for that, but you take on the compliance risk its card describes.
• You want full control. Start from a base model and train your own, which is the most work.

Whichever you choose, the parent’s license still applies, and it varies by model. The Dolphin 2.9.4 card says it is governed by the Llama 3.1 license, so Meta’s acceptable use policy follows it, while the Venice Edition card lists Apache-2.0. Check the terms in LLM licenses and acceptable use explained, and keep security work to systems you are authorized to test.

FAQ