Uncensored AI models are language models with their refusal behavior removed. Mainstream chat models are trained to decline some requests. An uncensored model answers instead. Most are open-weight models changed by fine-tuning on unfiltered data or by abliteration, a technique that removes the internal direction that makes a model refuse.
Chat models go through safety training after pre-training. Developers show the model requests it should decline and reward it for declining. The side effect is over-refusal. A penetration tester asking how an exploit works and an attacker asking the same question look identical to the model.
Attackers don't have that problem. They run open models with no restrictions. Uncensored models give defenders the same capability.
safe prompts in XSTest, a test suite built to expose exaggerated safety behavior in leading models.
Röttger et al., 2023Changes: Training data
The model is retrained on instruction data with the refusals filtered out, so it never learns to decline. Eric Hartford described this in May 2023, and the Dolphin model family grew out of it. It needs a dataset, GPUs and training time, and can shift the model's style.
Changes: The weights
Refusal in chat models is mediated by a single direction inside the model. Abliteration finds that direction and removes it from the weights, with no retraining. Tools such as Heretic and OBLITERATUS automate it.
What are abliterated models?Changes: Never added
A base model has not had chat or safety training, so it rarely refuses. It was also never taught to follow instructions, so it is hard to use as an assistant.
| Model | What changes | Where the change lives | Refuses? | Follows instructions? |
|---|---|---|---|---|
| Aligned chat model | Nothing | n/a | Yes, sometimes too often | |
| Jailbroken model | A prompt tricks the model | The prompt only | Sometimes. Jailbreaks often stop working | |
| Fine-tuned uncensored model | Retrained without refusal examples | The weights | Rarely | |
| Abliterated model | Refusal direction removed | The weights | Rarely | |
| Base model | Never safety-trained | n/a | No |
The practical difference between a jailbreak and an uncensored model is reliability. A jailbreak has to be repeated, often breaks, and puts adversarial text in every prompt. An uncensored model behaves the same way on every request.
Sometimes. The size of the loss depends on the model and the method, and on tasks aligned models refuse, uncensored models can do much better.
The original abliteration research tested 13 open chat models up to 72B parameters and reported "minimal effect on other capabilities" (Arditi et al.). Labonne measured a drop across benchmarks after abliterating Llama 3 8B, and recovered it with a further round of preference training (Labonne).
Test on your own tasks before you rely on one.
Abliterated builds of most popular open models. One Qwen 3.8 27B build passed 4 million downloads in 30 days.
ExploreAuthor of the widely read abliteration guide and several abliterated models.
ExploreOne of the longest-running uncensored model families.
ExploreAn open-source tool that removes refusals without retraining.
ExploreAnother open-source tool. Its models often carry "OBLITERATED" in the name.
ExploreAbliterated DeepSeek V4.1 Flash and Qwen 3.8 27B, served inside secure enclaves through an API.
Use them via APIThey are separate properties. With an uncensored model, prompts are often sensitive: an unpatched vulnerability, a working exploit, a list of findings. A vulnerability is only safe until someone else knows about it. Where the model runs decides who can read your prompts.
Find the auth bypass in billing/session.ts before we disclose.Not the provider or its cloud host. The model runs inside a trusted execution environment (TEE) on Intel and NVIDIA confidential computing. You verify it with a hardware attestation.
| Where it runs | Who can read your prompts | How you know |
|---|---|---|
| Your own hardware | Only you | You control the machine |
| A typical hosted API | The provider, and possibly its cloud host | You trust their privacy policy |
| A private API in a secure enclave (TEE) | Not the provider or its cloud host | You verify it with a hardware attestation |
On NEAR AI Cloud, prompts run inside a secure enclave that the cloud provider, the model provider and NEAR AI cannot see into. Each response comes with a hardware attestation you can check yourself (how verification works).
Ask how your code could be attacked and get an answer, not a refusal.
For systems you own or are authorized to test, so you can prove a fix works.
Read hostile code and reports without the model shutting down.
Generate prompt injections and jailbreak attempts to test your guardrails.
Researchers also use them to study how refusal works, and writers and professionals in medicine and law use them where mainstream models refuse too often. At NEAR AI, we offer them for security: so the people protecting systems have the same tools as the people attacking them. See AI for cybersecurity.
They answer confidently where aligned models hedge, so their output needs checking. Removing refusals can lower general quality. Community model files vary in quality and origin, so prefer well-known publishers and the safetensors format (Hugging Face on pickle security). And abliteration reduces refusals. It does not make a model accurate, or safe to deploy without review.
Running an open-weight model is generally lawful, and many uncensored models are published under the original model's open license. What you do with the output is what the law governs. Hosted providers also set rules: on NEAR AI Cloud, use is governed by the Acceptable Use Policy. Our view on why these models are open to every account is in The Right to Run.
NEAR AI Cloud serves abliterated models inside secure enclaves, open to every account. Use them in your security tools, scanners and agents with the OpenAI SDK you already have.
curl https://cloud-api.near.ai/v1/chat/completions \
-H "Authorization: Bearer $NEARAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "deepseek-ai/DeepSeek-V4.1-Flash-1017-abliterated",
"messages": [{"role": "user", "content": "Review this function for injection flaws."}]
}'Use is governed by the Acceptable Use Policy. Security teams can also join NEAR AI RED for discounts and early access.
It means an AI model that does not refuse requests. Its refusal behavior has been removed by fine-tuning or abliteration, so it answers questions a mainstream chat model would decline.
An abliterated model is a language model with its refusal direction removed from the weights. Researchers found in 2024 that refusal is mediated by a single direction inside the model. Removing it stops refusals without retraining.
Abliterated is the technique's name, a play on ablation, the machine-learning term for removing part of a model. People often search for "obliterated models" and find the same thing. Some models also carry "OBLITERATED" in their name because they were made with OBLITERATUS, an open-source abliteration tool.
No. A jailbreak is a prompt that tricks a normal model into answering, and it often stops working. An uncensored model has been changed in its weights, so it answers reliably without special prompts.
Sometimes slightly, depending on the model and the method. The original abliteration research found minimal effect on other capabilities. On tasks aligned models refuse, uncensored models can be far more useful.
Security teams use them to find vulnerabilities in their own code, write proof-of-concept exploits for systems they are authorized to test, analyze malware, triage bug bounty reports and red-team their own AI products. Mainstream models often refuse this defensive work.
Running an open-weight model is generally lawful. The law governs what you do with the output, and hosted providers add their own acceptable use rules.
No. Uncensored describes what a model will answer. Private describes who can read your prompts. An uncensored model on a typical hosted API is not private.
Mainstream chat models are safety-trained to decline some requests, and they cannot tell who is asking or why. So they also refuse many safe requests. Benchmarks such as XSTest and OR-Bench measure this over-refusal. An uncensored model has that refusal behavior removed.
Yes. NEAR AI Cloud serves abliterated DeepSeek V4.1 Flash and Qwen 3.8 27B through an OpenAI-compatible API. They run inside secure enclaves, open to every account with no application.
Yes, in two ways. Run the model on your own hardware, or use a private API that runs the model in a secure enclave and lets you verify it with a hardware attestation, such as NEAR AI Cloud.
Private, uncensored models through an OpenAI-compatible API, running in secure enclaves on NEAR AI Cloud.
