# What are uncensored AI models?

**Uncensored AI models are language models with their refusal behavior removed. Mainstream chat models are trained to decline some requests. An uncensored model answers instead. Most are open-weight models changed by fine-tuning on unfiltered data or by abliteration, a technique that removes the internal direction that makes a model refuse.**

## Key points

- An uncensored model is a normal open-weight model with one behavior changed: it stops refusing.
- There are three common ways to make one: fine-tuning, abliteration, or starting from a base model that was never taught to refuse.
- "Uncensored" is not the same as "jailbroken". A jailbreak tricks a model with a prompt. An uncensored model has been changed in its weights.
- Removing refusals can cost some general ability, and it can make a model far more useful for work like security testing.
- The bigger question is often privacy: who can read what you send to the model. You can run one on your own hardware, on a hosted API, or on a private API you can verify.

Developers: [run two abliterated models privately through an OpenAI-compatible API →](https://cloud.near.ai/?utm_source=organic&utm_medium=seo&utm_campaign=uncensored-hub&utm_content=cta-top)

## Why do AI models refuse in the first place?

Chat models go through safety training after pre-training. Developers show the model examples of requests it should decline and reward it for declining. The goal is to stop clearly harmful uses.

The side effect is over-refusal. A model cannot tell who is asking or why. A penetration tester asking how an exploit works and an attacker asking the same question look identical to it. So the model refuses both. The same happens to doctors asking about overdose thresholds, novelists writing a violent scene, and researchers testing whether an AI product can be manipulated.

Researchers measure this. XSTest is a set of 250 safe prompts that well-calibrated models should answer, built to expose exaggerated safety behavior in leading models ([Röttger et al., 2023](https://arxiv.org/abs/2308.01263)). OR-Bench measured over-refusal in 32 popular models using 80,000 prompts designed to trigger it ([Cui et al., 2024](https://arxiv.org/abs/2405.20947)).

Uncensored models exist because of that gap between what a model refuses and what a legitimate user needs.

## How are uncensored AI models made?

There are three main methods. They change the model in different places, which is why they behave differently.

### 1. Fine-tuning on unfiltered data

The first widely used uncensored models were fine-tuned. In May 2023, Eric Hartford described training models on instruction data with the refusals filtered out, so the model never learns to decline ([Hartford, "Uncensored Models"](https://erichartford.com/uncensored-models)). The Dolphin model family grew out of this approach.

Fine-tuning needs a dataset, GPUs and training time. It can also shift the model's style and knowledge, because it retrains the model on new examples.

### 2. Abliteration

Abliteration is newer and cheaper. In 2024, researchers showed that refusal in chat models is mediated by a single direction inside the model, and that erasing it stops refusals "with minimal effect on other capabilities" ([Arditi et al.](https://arxiv.org/abs/2406.11717)). Abliteration finds that direction and removes it from the weights, with no retraining. Labonne's guide made the technique widely known ([Labonne](https://huggingface.co/blog/mlabonne/abliteration)), and tools such as [Heretic](https://github.com/p-e-w/heretic) and [OBLITERATUS](https://github.com/elder-plinius/OBLITERATUS) now automate it. Many people search for it as "obliterated models". For the full explanation, see [What are abliterated models?](https://near.ai/abliterated-models)

### 3. Base models

A base model is a model before any chat or safety training. It has not had safety training, so it rarely refuses. It also was never taught to follow instructions, so it is hard to use as an assistant. Most people who want an uncensored assistant use one of the first two methods instead.

## Uncensored vs abliterated vs jailbroken vs base: what is the difference?

| | What changes | Where the change lives | Refuses? | Follows instructions? |
|---|---|---|---|---|
| Aligned chat model | Nothing | n/a | Yes, sometimes too often | Yes |
| Jailbroken model | A prompt tricks the model | The prompt only | Sometimes. Jailbreaks often stop working | Yes |
| Fine-tuned uncensored model | Retrained without refusal examples | The weights | Rarely | Yes |
| Abliterated model | Refusal direction removed | The weights | Rarely | Yes |
| Base model | Never safety-trained | n/a | No | Poorly |

The practical difference between a jailbreak and an uncensored model is reliability. A jailbreak has to be repeated, often breaks, and puts adversarial text in every prompt. An uncensored model behaves the same way on every request.

## Do uncensored models perform worse?

Sometimes. The size of the loss depends on the model and the method, and on tasks aligned models refuse, uncensored models can do much better.

- The original abliteration research reported minimal effect on other capabilities across the models it tested ([Arditi et al.](https://arxiv.org/abs/2406.11717)).
- Labonne's guide measured a drop across all benchmarks after abliterating Llama 3 8B, and recovered it with a further round of preference training (DPO) ([Labonne](https://huggingface.co/blog/mlabonne/abliteration)).

The cost depends on the model and on how carefully it was modified. Test on your own tasks before you rely on one.

## Which uncensored AI models exist?

As of November 12, 2026, Hugging Face lists 16,614 models under the [uncensored](https://huggingface.co/models?other=uncensored) tag and 13,265 under the [abliterated](https://huggingface.co/models?other=abliterated) tag. The best-known sources:

| Source | Method | Notes |
|---|---|---|
| [huihui-ai](https://huggingface.co/huihui-ai) | Abliteration | Abliterated builds of most popular open models. One build of Qwen 3.8 27B passed 4 million downloads in 30 days (Hugging Face, checked November 12, 2026). |
| [Maxime Labonne](https://huggingface.co/mlabonne) | Abliteration | Author of the widely read abliteration guide and several abliterated models. |
| Dolphin ([Eric Hartford](https://erichartford.com/uncensored-models)) | Fine-tuning | One of the longest-running uncensored model families. |
| [Heretic](https://github.com/p-e-w/heretic) builds | Automated abliteration | An open-source tool that removes refusals without retraining. Many community models are made with it. |
| [OBLITERATUS](https://github.com/elder-plinius/OBLITERATUS) builds | Automated abliteration | Another open-source abliteration tool. Its models often carry "OBLITERATED" in the name. |
| NEAR AI Cloud | Abliteration, hosted privately | Abliterated DeepSeek V4.1 Flash and Qwen 3.8 27B, served inside secure enclaves. See "How do you run an uncensored model?" below. |

New builds appear every week. This list was last checked on November 12, 2026.

## What are uncensored AI models used for?

Legitimate uses are broader than most people expect:

- **Security research and testing your own code.** Finding vulnerabilities, writing proof-of-concept exploits for systems you are authorized to test, analyzing malware, and triaging bug bounty reports. Mainstream models often refuse this work. See [AI for cybersecurity](https://near.ai/cybersecurity).
- **Red-teaming AI products.** Teams building on AI need to generate attacks such as prompt injections to test their own guardrails.
- **AI safety research.** Studying how refusal works requires models where it can be switched off.
- **Fiction and creative work.** Dark themes, violence and morally complex characters that aligned models soften or decline.
- **Professional questions in medicine, law and harm reduction**, where a refusal withholds information a professional needs.

Uncensored does not mean unaccountable. The person using the model is still responsible for what they do with its output.

## Are uncensored AI models legal and safe?

Running an open-weight model is generally lawful, and many uncensored models are published under the original model's open license. What you do with the output is what the law governs. Using a model to plan a crime is illegal whether or not the model refused first.

Hosted providers also set rules. On NEAR AI Cloud, use is governed by the [Acceptable Use Policy](https://near.ai/acceptable-use-policy). Our view on why we keep these models open to every account, and where we enforce limits instead, is in [The Right to Run](https://near.ai/blog/the-right-to-run).

## What are the risks of uncensored AI models?

Uncensored models carry real risks. They answer confidently where aligned models hedge, so their output needs checking. Removing refusals can lower general quality. Community model files vary in quality and origin, so prefer well-known publishers and the safetensors format ([Hugging Face on pickle security](https://huggingface.co/docs/hub/security-pickle)). And abliteration reduces refusals. It does not make a model accurate, or safe to deploy without review.

## Is an uncensored model private?

No. Uncensored describes what a model will answer. Private describes who can read your prompts. They are separate properties. An uncensored model on a typical hosted API is not private. A standard model on your own hardware is.

## Who can see your prompts?

This is the question most guides skip. With an uncensored model, prompts are often sensitive: an unpatched vulnerability in your code, an unreleased manuscript, a medical question. Where the model runs decides who can read them.

| Where it runs | Who can read your prompts | How you know |
|---|---|---|
| Your own hardware | Only you | You control the machine |
| A typical hosted API | The provider, and possibly its cloud host | You trust their privacy policy |
| A private API in a secure enclave (TEE) | Not the provider or its cloud host | You verify it with a hardware attestation |

**Your own hardware** is fully private but needs a GPU with enough memory for the model, and large models need several.

**A typical hosted API** is convenient. Your prompts are decrypted on the provider's servers, so "we don't log" is a promise you cannot check.

**A private API** runs the model inside a trusted execution environment (TEE), a hardware-isolated enclave on Intel and NVIDIA confidential computing. On NEAR AI Cloud, prompts run inside a secure enclave that the cloud provider, the model provider and NEAR AI cannot see into. Each response comes with a hardware attestation you can check yourself ([how verification works](https://docs.near.ai/cloud/verification)).

## How do you run an uncensored model?

### Option 1: on your own machine

Tools like Ollama and LM Studio download a quantized model and run it locally. Small models run on a laptop. Large ones need a high-end GPU or several. You get full privacy and full responsibility for the hardware.

### Option 2: privately through NEAR AI Cloud

NEAR AI Cloud serves two abliterated models inside secure enclaves, open to every account with no application and no identity checks. Use is governed by the [Acceptable Use Policy](https://near.ai/acceptable-use-policy).

| Model | Model ID |
|---|---|
| [DeepSeek V4.1 Flash Abliterated](https://near.ai/models/deepseek-ai/DeepSeek-V4.1-Flash-1017-abliterated) | `deepseek-ai/DeepSeek-V4.1-Flash-1017-abliterated` |
| [Qwen 3.8 27B Abliterated](https://near.ai/models/Qwen/Qwen3.8-27B-abliterated) | `Qwen/Qwen3.8-27B-abliterated` |

Context windows and current prices are on each model page.

The API is OpenAI-compatible, so existing tools only need a new base URL:

```bash
curl https://cloud-api.near.ai/v1/chat/completions \
  -H "Authorization: Bearer $NEARAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "Qwen/Qwen3.8-27B-abliterated",
    "messages": [{"role": "user", "content": "Hello!"}]
  }'
```

**[Try an uncensored model privately →](https://cloud.near.ai/?utm_source=organic&utm_medium=seo&utm_campaign=uncensored-hub&utm_content=cta-run)**

## Watch: using private uncensored models to secure your own code

[Watch the recording on YouTube](https://www.youtube.com/watch?v=xEwuuzutgUg)

Zaki Manian and Sergey walk through using private, uncensored models to find vulnerabilities in your own code, and investigate a bug bounty report whose proof-of-concept code attacks the person triaging it.

## Frequently asked questions

### What does "uncensored AI" mean?
It means an AI model that does not refuse requests. Its refusal behavior has been removed by fine-tuning or abliteration, so it answers questions a mainstream chat model would decline.

### What is an abliterated model?
An abliterated model is a language model with its refusal direction removed from the weights. Researchers found in 2024 that refusal is mediated by a single direction inside the model. Removing it stops refusals without retraining.

### Is it "abliterated" or "obliterated"?
Abliterated is the technique's name, a play on ablation, the machine-learning term for removing part of a model. People often search for "obliterated models" and find the same thing. Some models also carry "OBLITERATED" in their name because they were made with [OBLITERATUS](https://github.com/elder-plinius/OBLITERATUS), an open-source abliteration tool.

### Is an uncensored model the same as a jailbroken model?
No. A jailbreak is a prompt that tricks a normal model into answering, and it often stops working. An uncensored model has been changed in its weights, so it answers reliably without special prompts.

### Are uncensored models less smart?
Sometimes slightly, depending on the model and the method. The original abliteration research found minimal effect on other capabilities. On tasks aligned models refuse, uncensored models can be far more useful.

### Are uncensored AI models legal?
Running an open-weight model is generally lawful. The law governs what you do with the output, and hosted providers add their own acceptable use rules.

### Does uncensored mean private?
No. Uncensored describes what a model will answer. Private describes who can read your prompts. An uncensored model on a typical hosted API is not private.

### Why does ChatGPT refuse questions an uncensored model answers?
Mainstream chat models are safety-trained to decline some requests, and they cannot tell who is asking or why. So they also refuse many safe requests. Benchmarks such as XSTest and OR-Bench measure this over-refusal. An uncensored model has that refusal behavior removed.

### Can I run an uncensored model on my own computer?
Yes. Ollama and LM Studio run quantized models locally. The model must fit in your GPU or system memory.

### Can I use uncensored models without anyone seeing my prompts?
Yes, in two ways. Run the model on your own hardware, or use a private API that runs the model in a secure enclave and lets you verify it with a hardware attestation, such as NEAR AI Cloud.

### Where can I try an uncensored model?
You can download one from Hugging Face and run it locally with Ollama or LM Studio, or call abliterated DeepSeek V4.1 Flash and Qwen 3.8 27B privately on [NEAR AI Cloud](https://cloud.near.ai/?utm_source=organic&utm_medium=seo&utm_campaign=uncensored-hub&utm_content=faq).

## Sources

1. Arditi et al., [Refusal in Language Models Is Mediated by a Single Direction](https://arxiv.org/abs/2406.11717), arXiv, June 2024.
2. Maxime Labonne, [Uncensor any LLM with abliteration](https://huggingface.co/blog/mlabonne/abliteration), Hugging Face, June 13, 2024.
3. Eric Hartford, [Uncensored Models](https://erichartford.com/uncensored-models), May 15, 2023.
4. Röttger et al., [XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models](https://arxiv.org/abs/2308.01263), arXiv, 2023.
5. Cui et al., [OR-Bench: An Over-Refusal Benchmark for Large Language Models](https://arxiv.org/abs/2405.20947), arXiv, 2024.
6. [Heretic](https://github.com/p-e-w/heretic) and [OBLITERATUS](https://github.com/elder-plinius/OBLITERATUS), open-source abliteration tools.
7. Hugging Face, [Pickle scanning and security](https://huggingface.co/docs/hub/security-pickle).
8. NEAR AI, [Verification documentation](https://docs.near.ai/cloud/verification).

## Related

- [AI for cybersecurity: private, uncensored models](https://near.ai/cybersecurity)
- [The Right to Run: why our uncensored models are open to everyone](https://near.ai/blog/the-right-to-run)
- [Cybersecurity models and the NEAR AI Red launch](https://near.ai/blog/cybersecurity-models-and-near-ai-red-launch)

Canonical page: https://near.ai/uncensored-ai-models