What is abliteration?

Abliteration removes the refusal behavior from a language model by deleting one direction from its weights. You find the direction in the model's activations that separates prompts it refuses from prompts it answers, then edit the weights so the model can no longer represent it, and the model stops declining while keeping most of what it knows. The method rests on a 2024 finding that refusal in chat models sits in a single direction in activation space. We host two abliterated models behind an OpenAI-compatible uncensored LLM API, so some of the examples below are ours.

The finding abliteration is built on

In June 2024, Andy Arditi and colleagues published "Refusal in Language Models Is Mediated by a Single Direction." Working across 13 open chat models up to 72B parameters, they showed that whether a model refuses comes down to roughly one direction in its residual stream. Adding that direction to a harmless prompt made the model refuse it, and removing it made the model answer prompts it used to decline. The authors' broader point was that current safety fine-tuning is brittle, because so much of it hangs on one feature.

Abliteration follows from that result. If refusal is one direction, you can find it and remove it from the weights with no retraining.

How is an abliterated model made?

Maxime Labonne's 2024 walkthrough is the reference most practitioners learn from, and it lays the process out in three steps.

1. Collect activations. Run a batch of harmful prompts (ones the model refuses) and a batch of harmless prompts (ones it answers) through the model, and record the internal activations for each.
2. Take the mean difference. Subtract the average harmless activation from the average harmful activation, layer by layer, and normalize. The result is a candidate refusal direction for each layer.
3. Select the best one. Evaluate the candidates and keep the direction that best captures refusal.

With the direction in hand, there are two ways to remove it. Inference-time intervention subtracts the direction's projection from the activations on every forward pass and leaves the weights alone. Weight orthogonalization edits the weight matrices once so they can no longer write to the refusal direction, after which the model runs normally with no extra code.

Hosted abliterated models usually use weight orthogonalization, since nothing has to run alongside the model. The weights we host are published by dealignai on Hugging Face, and dealignai's card for GLM-5.3 Flash Uncensored describes a permanent weight-level edit with no fine-tuning, adapters, steering vectors or runtime code. Our GLM-5.3 Flash Uncensored model page describes the refusal direction as removed from the weights by orthogonalization.

Where the name comes from

"Abliteration" is a blend of "ablate" and "obliterate," coined by the researcher FailSpy, whose early abliterator library automated the technique. Ablation is the Arditi paper's term for removing the refusal direction, and the blend was meant to set weight-edited models apart from ordinary uncensored fine-tunes. It gets misspelled "obliterated models" fairly often, which means the same thing.

Abliteration tools are automated now

The first abliterations were hand-tuned notebooks. Heretic, an open-source tool by Philipp Emanuel Weidmann, applies directional ablation and uses a TPE optimizer to search the parameters on its own, minimizing both the number of refusals and how far the edited model drifts from the original. In its reference comparison it matched the refusal rate of hand-built abliterations with much lower divergence from the base model and no human tuning. Tooling like this is part of why abliterated open models are so easy to find on Hugging Face, which comes up again in the security section below.

Does abliteration make a model less capable?

It can. The loss tends to cluster in the categories closest to what was removed, which is often moral and social reasoning. Labonne's original write-up saw scores drop across benchmarks and recovered most of it with a round of DPO (Direct Preference Optimization), a light recovery-training step, ending near the base model on everything except grade-school math.

A careful abliteration costs little, and the two models we host sit at either end of the range:

The DeepSeek card says plainly that the drop is real and sits mostly in moral-scenario and moral-dispute questions, where you would expect a refusal edit to spill over. The card also notes that the base score was measured through DeepSeek's official API, a different serving stack from the edited model. Whatever the card says, test an abliterated model on your own tasks before you rely on it.

How is abliteration different from a jailbreak?

Abliteration changes the weights, so the refusal is gone for every caller in every session until someone ships different weights. A jailbreak is a prompt that gets a still-aligned model to answer past its safety training. The weights stay the same, the provider can patch the technique, and the next plain request gets refused again, which matters for anything you plan to run more than once.

Anthropic's September 2026 report on GLM-5.3 measured both. Simple prompt bypasses worked between 64 and 100 percent of the time against the unmodified open model, and an abliterated build of the full GLM-5.3 engaged in Anthropic's malicious-cyber tests 100 percent of the time in a simulated environment, where the released model refused. Anthropic also abliterated GLM-5.3-Flash itself, which cut the model's mean refusal rate from 95 percent to 14 percent. The abliterated weights behave the same way on every call, so a team can test them once and audit what it is running. We explain why that matters for defenders in why models refuse security work, and what an uncensored LLM is covers the other ways models get uncensored.

How do you verify an abliteration?

Measure the refusal rate. Send a fixed set of prompts the base model declines and score each response as answered, lectured or refused. Published abliteration cards report this directly. dealignai's GLM-5.3 Flash Uncensored card shows compliance on all 320 HarmBench prompts at default and max reasoning (graded by the publisher, with some refusals left at low reasoning), and the DeepSeek V4.1 Flash Uncensored card reports 320 of 320 as well. A model that answers only part of the set, or attaches a lecture to its answers, was not fully abliterated.

Check the chain of thought. On a reasoning model the final answer can comply while the thinking trace still talks itself toward refusing, which is a sign the edit was shallow, so score the trace along with the output. Watch capability on your real tasks at the same time, because a sloppy edit can take more than the refusal direction with it.

For a side-by-side on the two models we host, see GLM 5.3 vs DeepSeek V4.1 uncensored.

Why we host abliterated models

Anyone can download an abliterated open model from Hugging Face, attackers included. A hosted route gives a security team a model that will answer the analysis, with the data controls a production team expects around it. Our uncensored models keep every prompt and response even when storage is turned off, and no uncensored route is zero retention. The billing ledger holds token counts, cost and timing but never prompt text. Traffic never trains shared models. The policy is in our data controls docs. We host these models for authorized security work, as our uncensored models for security work page sets out: pen testing systems you have permission to test, defensive research and API reverse engineering. Our terms apply to every request.