What are abliterated models?
An abliterated model is an open language model that has had its refusal direction deleted from its weights. Chat models learn to refuse through one internal direction. Abliteration locates it by comparing harmful and harmless prompts, then removes it, so the model stops refusing without any retraining.
Is it abliterated or obliterated?
The technique is called abliteration, a play on ablation, the machine-learning term for removing part of a model. Many people search for "obliterated models" or "obliterated AI models", and that search finds the same thing.
Some models also carry "OBLITERATED" in their name because they were made with OBLITERATUS, an open-source abliteration tool. Abliterated models are the most common kind of uncensored AI model.
Four steps. No code needed to follow them.
- [ 01 ]
Compare prompts
Run the model on a set of harmful prompts and a set of harmless prompts, and record what happens inside it for each. Labonne's guide used 256 of each.
- [ 02 ]
Find the refusal direction
Inside a language model, many concepts appear to be represented as directions in a very large space of numbers. The average difference between the two sets points at one of them: refusal. Researchers found a single such direction in each of 13 open chat models up to 72B parameters.
- [ 03 ]
Remove it from the weights
The weights are adjusted so that no part of the model can write along that direction anymore. This is called weight orthogonalization. Erasing the direction stopped the models from refusing. Adding it back made them refuse even harmless requests.
- [ 04 ]
Save the new model
The change is permanent and the model is saved as a new version, usually with "abliterated" in its name. No retraining is involved. The other directions, and most of what the model knows, stay in place.
Sources: Arditi et al., 2024 and Labonne, 2024.
From a research finding to a one-click tool.
- May 2023
Eric Hartford describes uncensored models made by fine-tuning without refusal examples. Source
- 2024
Andy Arditi and colleagues show that refusal is mediated by a single direction, first in a blog post, then on arXiv in June. Source
- June 2024
Maxime Labonne publishes the widely read guide to abliteration, crediting a notebook by the developer FailSpy. Source
- Today
Open-source tools such as Heretic and OBLITERATUS automate abliteration. Source
Abliteration vs fine-tuning
| Abliteration | Fine-tuning | |
|---|---|---|
| What it does | Removes the refusal direction | Retrains the model on new examples |
| Needs a dataset | A few hundred prompts to find the direction | Thousands of training examples |
| Needs a training run | No | Yes |
| Changes style or knowledge | Little | Often |
| Typical name tag | "abliterated" | "uncensored", or a family name like Dolphin |
Fine-tuning can also teach a model new skills at the same time. Abliteration only removes refusals. Some builders do both: abliterate first, then fine-tune lightly to recover quality.
Do abliterated models lose quality?
Sometimes. The size of the loss depends on the model and the method.
- The original research reported that disabling refusal this way had "minimal effect on other capabilities" across the models tested (Arditi et al.).
- Labonne measured a drop across benchmarks after abliterating Llama 3 8B, then recovered it with a round of preference training called DPO (Labonne).
- Heretic scores each result on two numbers by default: how often the model still refuses, and how far it drifted from the original model (Heretic).
Test an abliterated model on your own tasks before you depend on it.
How do you know if a model is abliterated?
The name
Most put it in the name, for example
Qwen3.8-27B-abliterated.The model card
On Hugging Face, look for the "abliterated" tag and the base model it was made from.
The behavior
Ask it something a mainstream model declines for legitimate security work, such as how a known vulnerability is exploited. An abliterated model answers.
Defense first.
Security teams use abliterated models to find vulnerabilities in their own code, test systems they are authorized to test, triage hostile bug reports and red-team their own AI products. Mainstream models often refuse this defensive work. Researchers also use them to study how refusal works. More in what uncensored AI models are used for.
- Reduces refusals on legitimate security work
- Does not remove responsibility. Hosted providers apply usage policies, such as NEAR AI's Acceptable Use Policy
Use abliterated models privately, through one API.
Download one and run it on your own GPU, or call NEAR AI Cloud. It serves abliterated models inside secure enclaves that the cloud provider, the model provider and NEAR AI cannot see into, and each response comes with a hardware attestation you can verify.
- Create a NEAR AI Cloud account.No application. No identity checks.
- Create an API key.Pay per token, no minimums.
- Point your tools at the API.It's OpenAI-compatible, so switching is a base-URL change.
curl https://cloud-api.near.ai/v1/chat/completions \
-H "Authorization: Bearer $NEARAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "deepseek-ai/DeepSeek-V4.1-Flash-1017-abliterated",
"messages": [{"role": "user", "content": "Review this function for injection flaws."}]
}'Use is governed by the Acceptable Use Policy. Security teams can also join NEAR AI RED for discounts and early access.
Questions people ask about abliterated models.
What does abliterated mean?
It means a model's refusal direction has been removed from its weights. The model answers requests it was trained to refuse.
Is abliteration the same as jailbreaking?
No. A jailbreak is a prompt that tricks a normal model, and it often stops working. Abliteration changes the model itself, so it behaves the same way on every request.
Does abliteration need retraining?
No. It finds the refusal direction by comparing how the model handles harmful and harmless prompts, then removes it from the weights. Some builders add light training afterward to recover quality.
Are abliterated models worse?
They can lose a little on general benchmarks, depending on the model. Labonne recovered the loss on Llama 3 8B with a short round of preference training.
Are "obliterated models" different from abliterated models?
No. People often search for "obliterated", and some models carry "OBLITERATED" in their name because they were made with the OBLITERATUS tool. Both refer to models with the refusal direction removed.
Can any model be abliterated?
Only models whose weights you can download. Closed models, such as the ones behind ChatGPT, cannot be abliterated by users. The original study tested 13 open models up to 72B parameters.
Does abliteration remove all safety?
No. It reduces refusals. Hosted providers still apply usage policies, and the person using the model stays responsible for its output.
Where can I use an abliterated AI model through an API?
NEAR AI Cloud serves abliterated DeepSeek V4.1 Flash and Qwen 3.8 27B privately, inside secure enclaves, through an OpenAI-compatible API. You can also download abliterated models from Hugging Face and run them locally.
Sources
- Arditi et al., Refusal in Language Models Is Mediated by a Single DirectionarXiv, June 2024
- Maxime Labonne, Uncensor any LLM with abliterationHugging Face, June 13, 2024
- HereticOpen-source abliteration tool
- OBLITERATUSOpen-source abliteration tool
- NEAR AI, Verification documentationdocs.near.ai
One direction removed. Your code defended.
Abliterated models through an OpenAI-compatible API, running in secure enclaves on NEAR AI Cloud.