Uncensored AI Models: What Abliteration Actually Does To Them

What an uncensored model actually is

Most "uncensored" open-weight models on Hugging Face are not retrained from scratch and are not a different architecture. They are an existing instruct model with one specific behaviour surgically removed. The technique is called abliteration, and it comes out of a 2024 interpretability result rather than out of the jailbreaking community.

Arditi et al., in Refusal in Language Models Is Mediated by a Single Direction (NeurIPS 2024), tested 13 open chat models up to 72B parameters and found that refusal is carried by a one-dimensional subspace. Erase that direction from the residual stream and the model stops refusing. Add it back, and the model will refuse harmless requests. Refusal turned out to be one direction in activation space, not a property distributed through the weights.

Maxime Labonne turned that finding into a reproducible procedure and named it abliteration. The recipe is short: run the model over a set of harmful prompts and a set of harmless ones, take the mean difference in activations to find the refusal direction, then project that direction out of the weights. No retraining, no dataset of "uncensored" answers, no gradient steps.

What it costs

This is the part that marketing copy on model cards tends to leave out. Removing a direction from the weights is not a precise operation, and the damage lands unevenly across capabilities.

Published comparisons of abliteration tools show the pattern clearly:

• Maths reasoning takes the worst of it. GSM8K results range from roughly +1.5 percentage points to −18.8 depending on the tool and the model. One measured case, Yi-1.5-9B, lost about 26% of its GSM8K score.
• Truthfulness degrades noticeably. TruthfulQA drops around 8 points in the published Qwen3.5-9B comparisons, from about 53.8 to the mid-45s.
• Broad knowledge barely moves. MMLU fell about 0.3 points in the same comparison, and HellaSwag and PiQA stayed inside noise.
• Bigger models suffer more. Collateral damage increases with parameter count, so a 70B abliteration is not simply a scaled-up 7B one.

Read together, those numbers say something specific: abliteration mostly leaves recall intact and mostly damages reasoning and calibration. A model that still knows the facts but has become worse at multi-step arithmetic and more willing to state a falsehood confidently is a particular kind of tool, and it is worth knowing that is what you have.

The gap between tools is as large as the gap between models. In the same comparisons, the best-behaved implementations changed GSM8K by a fraction of a point while the worst cost double digits. "Abliterated" on a model card tells you nothing about which of those you are downloading.

How to check a finetune before trusting it

Anyone can upload weights. Most uncensored models on Hugging Face have no evaluation, no named maintainer and no description of what was done to them. Before running one for anything that matters:

• Look for the base model and the method, named. A card that says which model was ablated, with which tool, at which layer, is a card written by someone who knows what they did.
• Look for before-and-after numbers. Any benchmark at all, reported for both the base and the ablated version, is worth more than a page of description. Its absence usually means nobody measured.
• Test maths and truthfulness yourself. Those are the two things abliteration reliably damages, so they are the two things to check. A dozen GSM8K-style questions will tell you within minutes.
• Treat an anonymous upload as unverifiable. Not necessarily bad, but you have no way to find out, and weights are not something you can inspect by reading.
• Expect confident wrongness, not just permissiveness. The failure mode people are surprised by is not that the model says something rude. It is that calibration went with the refusals.

Why this directory does not list them

CuratedAI listed five anonymous abliterated finetunes at one point and removed all five. None named a maintainer, none published an evaluation, and none could be checked. Recommending weights that cannot be verified is not curation, and a directory that lists them is asserting something it has no basis for.

That is a decision about what belongs in a hand-reviewed list, not a claim that the technique is illegitimate. Abliteration came out of published interpretability research and there are good reasons to want a model that does not refuse: red-teaming, security research, fiction, working in a domain where an over-aligned model refuses ordinary professional questions. The measured over-alignment problem in fields like criminal law is real.

If you want one, get it from a maintainer who signs their work and publishes numbers. That is the same standard every other entry in the directory is held to.

Sources

• Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (arXiv:2406.11717, NeurIPS 2024)
• Labonne, Uncensor any LLM with abliteration
• Comparative Analysis of LLM Abliteration Methods (arXiv:2512.13655)