Abliterated models have refusal edited out of the weights with no retraining. How abliteration works, what it costs in quality, and which licenses still apply.
Abliteration is a weight edit that removes a model's tendency to refuse. Research in 2024 found that refusal in chat models is largely carried by a single direction in the model's activations; projecting that direction out of the weights stops most refusals without retraining. The trade-off is a measurable drop in benchmark quality, which builders usually repair with a short preference-tuning pass.
- Arditi et al., Jun 2024
- 13, up to 72B
- None
- DPO fine-tune
Key takeaways
- Arditi et al. (2024) found refusal is mediated by one direction across 13 open chat models up to 72B parameters.
- Abliteration removes that direction from the weights, so the change ships with the model file and needs no prompt tricks.
- It costs quality: Maxime Labonne's abliterated Daredevil-8B scored lower on every benchmark until a DPO pass recovered most of it.
- It doesn't change the license. Llama's acceptable use policy still bans generating malware, abliterated or not.
- Model makers are adapting: 2025 research shows refusal training that spreads the signal makes abliteration far less effective.
Why do developers look for abliterated models?
Developers look for abliterated models mainly because aligned chat models over-refuse. One Hacker News commenter describes running Qwen3.8 27B locally to control their Sonarr and Radarr media-library setup and getting flat refusals, with some snark, for what is routine home-server automation (HN, Oct 27, 2026). That is a single community report, but it matches the pattern the benchmarks show. A request that is harmless in context, like analyzing a suspicious script from your own server or explaining how a known vulnerability class works for a code review, can trip a refusal written for a very different user. OR-Bench, an ICML 2025 benchmark from UC Berkeley and UCLA researchers, measured this across 32 popular models from 8 families using 80,000 prompts that only look harmful. Its finding: safety tuning that blocks more toxic prompts also tends to reject more benign ones.
The other reasons are practical rather than ideological:
- Predictability. A model that answers the same way every run is easier to put in a pipeline than one that refuses 5% of the time.
- Privacy. Abliterated models are open-weight, so they run on your own hardware, and your code never leaves the machine.
- Control. You decide the policy layer, if any, instead of inheriting a provider’s.
How does abliteration work?
Abliteration works by finding the direction in a model’s internal activations that corresponds to “refuse”, then deleting it from the weights. In June 2024, Arditi et al. showed that across 13 open-source chat models up to 72B parameters, refusal is mediated by a one-dimensional subspace of the residual stream, the running representation each layer reads from and writes to. Removing that direction stopped the models from refusing harmful instructions. Adding it made them refuse even harmless ones.
Maxime Labonne’s Hugging Face write-up, which coined the popular name, describes the process in three conceptual steps:
- Contrast. Run the model on two sets of prompts, ones it refuses and ones it answers, and record the activations.
- Find the direction. The difference between the average activations of the two sets gives candidate refusal directions. The best one is picked by testing.
- Remove it. Either subtract the direction at inference time, or make it permanent by orthogonalizing the weight matrices that write into the residual stream, so the model can no longer express it.
The permanent version is what “abliterated” means on Hugging Face: a normal model file you can quantize and load in any runtime.
What does an abliterated model give up?
Practitioners are blunt that an abliterated model can get worse in ways a refusal test won’t show. One Hacker News commenter reports that abliterated models “can perform worse in unexpected and subtle ways”, that the edit adds no knowledge the training data lacked, and recommends using them as a fallback for work that trips safeguards, with close monitoring for hallucinations (HN, Oct 27, 2026). The measured version of that complaint: an abliterated model gives up some general quality, at least before repair. In Labonne’s experiment, the abliterated version of Daredevil-8B, a Llama 3 8B merge, scored lower than the source model on every benchmark in the Open LLM Leaderboard and Nous suites. A follow-up DPO (preference-tuning) pass with QLoRA recovered most of the loss, except on GSM8K math, and produced NeuralDaredevil-8B-abliterated.
| Source model | After abliteration | After abliteration + DPO | |
|---|---|---|---|
| Refuses harmful prompts | Yes | Mostly no | Mostly no |
| General benchmark scores | Baseline | Lower on every suite tested | Most of the loss recovered |
| Math (GSM8K) | Baseline | Lower | Still lower |
| Retraining cost | None | None | Short QLoRA run |
Two practical consequences for coding work:
- Check the card. A good abliterated release states its base model, method and evaluations. A model with no evals is a guess.
- Expect drift on edge tasks. The edit targets one behavior, but weight changes ripple. Test on your own codebase before swapping a model into a workflow.
Is abliteration the same as fine-tuning or jailbreaking?
Abliteration is neither. Fine-tuning changes a model by training it on new examples, which costs GPU hours and data. Jailbreaking leaves the model untouched and tries to talk it out of refusing with crafted prompts, which is fragile and usually against a hosted provider’s terms.
| Approach | Changes the weights | Needs training data | Works on hosted APIs | Durable |
|---|---|---|---|---|
| Abliteration | Yes, one targeted edit | No (small prompt sets) | No, needs open weights | Yes |
| Fine-tuning | Yes, broadly | Yes | Only where offered | Yes |
| Jailbreak prompts | No | No | Yes, and against most ToS | No |
Are abliterated models legal to use?
Abliterated models are generally legal to download and run, but the original license still applies to the edited weights. Meta’s Llama 3 acceptable use policy, for example, prohibits using the model to “create, generate, or facilitate the creation of malicious code, malware, computer viruses”. That clause binds an abliterated Llama exactly as it binds the original. Permissively licensed bases, such as Apache 2.0 models, carry fewer use restrictions, but laws on unauthorized access to computer systems apply to you whatever the license says.
The rule of thumb for teams: removing refusals moves responsibility from the model to you. Keep logs, keep the work on systems you are authorized to touch, and read the base model’s license before shipping it in a product.
Will abliteration keep working on new models?
Abliteration may get harder on future releases, though tools like Heretic keep automating it. A 2025 KAUST paper, An Embarrassingly Simple Defense Against LLM Abliteration Attacks, fine-tuned models to give extended refusals that explain their reasoning, which spreads the refusal signal across more of the response. The authors report those models lost at most about 10 points of refusal rate after abliteration, versus 70 to 80% for standard models. The results are self-reported and were tested on small models (Llama-2-7B-Chat and Qwen2.5 1.5B and 3B), but they show model makers can design against the technique.
For developers, that means the abliterated model you rely on today may not have a direct successor. Pinning versions and keeping your own evaluation set matters more than usual.
FAQ
What does “abliterated” mean on Hugging Face?
It means the model’s weights were edited to remove the refusal direction identified by Arditi et al. (2024). The file loads like any other model and needs no special runtime.
Does abliteration make a model smarter?
No. It removes a behavior and usually costs some benchmark quality, which builders often recover with a short DPO fine-tune.
Can I abliterate GPT or Claude?
No. Abliteration needs direct access to the model weights, so it only works on open-weight models.
Is an abliterated model the same as an “uncensored” model?
Often, but not always. “Uncensored” is also used for models fine-tuned on datasets with refusals filtered out. Abliteration is one specific, training-free way to get there; see abliterated vs uncensored vs fine-tuned.
Sources (6)
- Refusal in Language Models Is Mediated by a Single Direction, Arditi et al., arXiv 2406.11717 (2024)
- Uncensor any LLM with abliteration, Maxime Labonne, Hugging Face blog (Jun 13, 2024)
- OR-Bench: An Over-Refusal Benchmark for Large Language Models, Cui et al., ICML 2025
- An Embarrassingly Simple Defense Against LLM Abliteration Attacks, Abu Shairah et al., arXiv 2505.19056 (2025)
- Meta Llama 3 Acceptable Use Policy
- Hacker News thread: There are now 5 inference providers for abliterated DeepSeek (Oct 27, 2026)