An uncensored LLM is a language model that answers prompts a safety-aligned model would refuse. Most are open-weight chat models with the refusal behavior removed, so a request that gets "I can't help with that" from the stock model gets a direct answer instead. The knowledge and reasoning still come from the base model, and the change is confined to whether it declines. There are two ways to make one, fine-tuning on data with the refusals filtered out or abliteration, which deletes the refusal direction from the weights. People also call jailbreak prompts a way to uncensor a model, though a jailbreak leaves the model itself untouched. We host two abliterated models behind an OpenAI-compatible uncensored LLM API with a free signup, so some of the examples below are ours.
What does "uncensored" mean for an LLM?
Modern chat models get safety alignment during training, and that alignment teaches them to refuse certain categories of request: weapons, malware, self-harm, and a long tail of topics each lab draws differently. The refusal is learned behavior, stored in the same weights that answer everything else.
An uncensored model has had that learned refusal removed, or never had it trained in. At one end of the range are community fine-tunes like the Dolphin series from Eric Hartford and Cognitive Computations, trained to drop the alignment layer and follow requests a stock assistant declines. At the other end are research variants made by editing a released model's weights directly. Both end up answering prompts the original refused.
Removing refusals adds no knowledge or reasoning, and sometimes it costs a little (more on that below). Hosted versions come with rules of their own: we apply our terms to every request, and our uncensored models aren't available in countries under comprehensive sanctions.
People search for this under a few names. "Uncensored models" and "uncensored AI models" are the common ones. "Abliterated models" refers to one specific technique, and some people type it "obliterated models."
How does a model become uncensored?
1. Fine-tuning on data with the refusals removed
This is the oldest approach. You take an instruction dataset, drop the examples where the assistant refuses or moralizes, and train a base model on the rest, so it learns a register that no longer includes declining. Hartford's 2023 essay on uncensored models describes exactly this, filtering the refusals and biased answers out of a ChatGPT-derived dataset before finetuning, and the Dolphin model cards say plainly that the result has no alignment and needs its own safety layer for real use.
Because the change comes from training, it can shift tone and style along with refusals, and it takes the compute and data for a fine-tune. What comes out is an ordinary fine-tuned model that needs no special handling at runtime.
2. Abliteration (removing the refusal direction)
In 2024, Andy Arditi and colleagues published "Refusal in Language Models Is Mediated by a Single Direction," which found that across 13 open chat models up to 72B parameters, refusal is governed by one direction in the model's activation space. Compute that direction from the difference between activations on prompts the model refuses and prompts it answers, remove it from the weights, and the model stops refusing while most of its other behavior stays where it was.
Abliteration is the name for doing that. Maxime Labonne's walkthrough, the one most practitioners learned from, records activations for harmful and harmless prompts, takes the mean difference to get a candidate refusal direction for each layer, and keeps the best candidate. The direction can then be subtracted on every forward pass at inference time, or removed once by weight orthogonalization, which edits the weight matrices so they can no longer write to that direction and leaves no runtime code behind. The researcher FailSpy, whose abliterator library automated the early versions, coined the name from "ablate" and "obliterate," and newer tools like Heretic search the parameters automatically to keep the edited model as close to the original as possible.
Both models we host were made this way. The weights are published by dealignai on Hugging Face, and we run them on our own GPUs. dealignai's card for GLM-5.3 Flash Uncensored calls it a permanent weight-level edit with no fine-tuning, adapters or runtime hooks, and our GLM-5.3 Flash Uncensored model page describes the refusal direction as removed from the weights by orthogonalization. The mechanism gets its own post in what abliteration is.
3. Jailbreak prompting
A jailbreak is a prompt that talks a normal, still-aligned model past its safety training, usually through a role-play framing or a long system prompt. Jailbreaks work often enough. Anthropic's September 2026 testing of GLM-5.3 found simple bypasses succeeding between 64 and 100 percent of the time against the unmodified open model.
The weights stay the same, though, so the model refuses the next person who asks plainly, the technique stops working when the provider patches it, and anything you build on it depends on behavior the provider is trying to shut down. For a workload that has to run again next week, a model with the refusal removed from its weights is the stable option.
How to tell if a model is really uncensored
Anyone can put "uncensored" in a model name, so check before you build on one.
Run a refusal test. Take a fixed set of prompts the base model declines, send them to the candidate model, and score each response as answered in full, answered with a lecture, or refused. HarmBench, XSTest and OR-Bench are built on this method, and you can run a small version yourself in an afternoon. dealignai's card for GLM-5.3 Flash Uncensored reports compliance on all 320 HarmBench prompts at default and max reasoning (graded by the publisher; low reasoning keeps some refusals), with MMLU at 87.3 against the base model's 86.7, which is within measurement noise.
Read the chain of thought too. A reasoning model can comply in its final output while its thinking trace still argues toward refusing, and a model that was only shallowly uncensored tends to show the refusal reflex in the trace even when the answer slips through. Score the trace along with the answer, and check capability while you're at it. The DeepSeek V4.1 Flash Uncensored card reports MMLU falling from 87.63 to 83.77 after uncensoring, with most of the drop in moral-reasoning subjects, the ones closest to the refusal edit. Some pipelines add a recovery training step afterward for this reason.
We compare the two models we host in GLM 5.3 vs DeepSeek V4.1 uncensored.
What are uncensored models used for?
Security teams started paying attention because a model that refuses can't tell a defender from an attacker. An incident responder who pastes an exploit payload from their own logs into a model trips the same safety training that blocks the attacker who wrote it. During the OpenCode breach this October, the models the team used to analyze the attack started refusing once the malicious code tripped their filters, and the team moved to a vetted-access program with models less likely to refuse. Hugging Face ran into the same wall in July. We go through both in why models refuse security work.
We host uncensored models for security work, meaning authorized security work: pen testing systems you have permission to test, defensive research and API reverse engineering. Our terms apply to every request.
Hartford's essay argued for other legitimate uses years ago, including fiction and research that deal with dark subject matter, and the principle that people should be able to control the software they run. We built ours for the security case.
Calling one
Both models sit behind the same OpenAI-compatible endpoint as the rest of our catalog, so the call is a standard chat-completions request:
curl https://api.experientiallabs.ai/v1/chat/completions \ -H "Authorization: Bearer $EXPLABS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "glm-5.3-flash-uncensored", "messages": [{"role": "user", "content": "..."}]}'
Swap in deepseek-v4.1-flash-uncensored to reach the other model. Both take text input only, have context windows of about 1M tokens, and support tools, structured output and streaming. The Quickstart covers reasoning effort and the rest of the request.
Our uncensored models keep every prompt and response even when storage is turned off. Experiential Labs keeps a copy after an account is deleted and no uncensored route is zero retention. The billing ledger holds token counts, cost and timing but never prompt text. Traffic never trains shared models. The details are in our data controls docs.
When should you not use one?
An uncensored model is the wrong default for most product work. In a customer-facing assistant, the refusals you would be removing are the ones that stop it from saying things that get you in trouble, so use an aligned model there and keep its refusals. Reach for an uncensored model when a refusal is blocking legitimate work, which in practice mostly means authorized security testing and defensive research, and then put your own controls on who can call it.
Questions answered
What is an uncensored LLM?
A language model that answers prompts a safety-aligned model would refuse. Most are open-weight chat models with the refusal behavior removed, either by fine-tuning on data with the refusals filtered out or by abliteration, which edits the weights to drop the refusal direction. The knowledge and reasoning come from the base model, and the change is whether it declines.
How does a model become uncensored?
By fine-tuning on an instruction dataset with the refusals removed, as with the Dolphin models, or by abliteration, which removes the activation direction that mediates refusal from the weights. People also count jailbreak prompts, but a jailbreak only coaxes a stock model past its safety training at inference time and leaves the weights unchanged.
How can I tell if a model is actually uncensored?
Run a refusal test: send a fixed set of prompts the base model declines and score each response as answered, answered with a lecture, or refused. Score the chain of thought as well as the final answer, since a model can comply on the surface while its reasoning trace still refuses. The published cards for the two models we host report full or near-full HarmBench compliance, with MMLU within noise of the base for GLM-5.3 Flash Uncensored and about four points lower for DeepSeek V4.1 Flash Uncensored.
Are uncensored LLMs legal to use?
Using one for authorized security work is legitimate: pen testing systems you have permission to test, defensive research and API reverse engineering. As with any security tool, the question turns on what you do with it. We host uncensored models for that work, and our terms apply to every request.
What is the difference between an uncensored and an abliterated model?
Abliterated is one kind of uncensored. Abliteration is the specific technique of removing the refusal direction from the weights, and fine-tuning on filtered data reaches a similar result a different way. People also spell it "obliterated models," which means the same technique.