What Is an Abliterated Model? How AI Refusal Removal Actually Works

If you have browsed Hugging Face lately, you have seen the word everywhere: Llama-3-8B-abliterated, Qwen-abliterated, and now abliterated builds of DeepSeek. These models answer the questions their originals refuse. They do it without a jailbreak prompt, without a new round of training on spicy data, and, when done well, without getting noticeably dumber.

So what is an abliterated model, exactly? This guide explains the idea in plain English, walks through how abliteration works under the hood, covers what it costs in quality, and compares it to the other ways people try to uncensor AI. At the end you will see how Cleus uses it to run Cleus Smartest v3, an abliterated DeepSeek V4.1 Flash.

What is an abliterated model?

An abliterated model is a language model that has had its built-in refusal behavior surgically removed from its weights. The word is a blend of ablate (to remove) and obliterate. It caught on in 2024 after open-source developer FailSpy published tools for doing it and Maxime Labonne wrote a widely shared Hugging Face tutorial.

The key point is what does not change. The model keeps the same knowledge, the same reasoning ability and the same writing style. What it loses is the trained-in reflex to answer certain requests with "I can't help with that."

That is very different from how people usually try to get around refusals:

• A jailbreak leaves the model untouched and tries to trick it with a clever prompt. The safety training is still there, fighting you on every turn.
• An uncensored fine-tune retrains the model on new data that never refuses. That works, but retraining can blur what made the original model good.
• Abliteration edits the weights directly, but only along the one internal direction that carries the refusal.

Why refusal lives in "one direction"

The idea comes from a 2024 research paper by Andy Arditi, Neel Nanda and colleagues, titled Refusal in Language Models Is Mediated by a Single Direction. They studied 13 popular open-source chat models, up to 72 billion parameters, and found something surprising.

Inside a language model, every word you type is turned into a long list of numbers (a vector) that flows through the network layer by layer. The researchers found that, across all 13 models, the decision to refuse was mostly carried by one single direction in that space.

Their evidence was simple and striking:

• Erase that direction while the model is running, and it stops refusing harmful requests.
• Add that direction to a harmless request, and the model refuses something perfectly innocent.

In other words, refusal is not spread across the whole model like knowledge is. It behaves more like a switch. And if it is a switch, you can take it out.

How abliteration works, step by step

Here is the same process with a bit more detail.

1. Collect two sets of prompts. One set is made of instructions the model refuses. The other is made of normal instructions it happily answers. Both are run through the model, and the internal activations at the last token are recorded for every layer.

2. Take the difference. For each layer, the average activation on the "refused" prompts minus the average on the "answered" prompts gives a candidate refusal direction.

3. Pick the best candidate. Not every layer's direction works equally well. Each candidate is tested by removing it and checking which one stops refusals while keeping the answers sensible. In Labonne's walkthrough on an 8B Llama 3 model, the winning direction came from a middle layer.

4. Remove it from the weights. The direction can be removed at run time with hooks, but abliteration usually goes one step further: it rewrites the weight matrices so they can no longer write anything along that direction. This is called weight orthogonalization. The result is a normal model file that anyone can load and run with no special code.

5. Test it. A good abliteration is checked against the original on knowledge, reasoning and writing benchmarks, plus a refusal test. If quality dropped, the builder can try a different layer or a gentler edit.

Does abliteration make a model dumber?

Sometimes, a little. The honest answer is that it depends on how carefully it is done.

In Labonne's original 2024 experiment, the abliterated 8B model scored lower than its source across the benchmarks he ran. He then "healed" it with a light round of preference training (DPO) on about 40,000 examples, which took around 6 hours and 45 minutes on six A6000 GPUs. That recovered most of the lost performance, though math (GSM8K) did not come back.

The tooling has improved since then. Heretic, an open-source project, automates the search: it tries many edit strengths and layers and scores each attempt on two things at once, the refusal rate and the KL divergence from the original model. KL divergence is a measure of how much the model's answers drift away from the original on normal prompts. Low refusals plus low KL divergence means you removed the refusals without changing everything else. Its README says a default run on a 4B model takes about 30 to 40 minutes on a single RTX 3090.

The practical takeaway: a careless abliteration can damage a model, and a careful one is close to invisible on everyday tasks. Always prefer abliterations that were tested against the original.

Abliteration vs jailbreaks vs uncensored fine-tunes

A short way to think about the three approaches:

• Jailbreaks are free and need no setup, but they are fragile. They fight the model on every message, they break whenever the provider updates the model, and they waste part of the context window on arguing. Answers often come out hedged or half-finished.
• Uncensored fine-tunes are reliable once made, but they need training data and GPU time, and the new data can shift the model's personality and skills.
• Abliteration is cheap compared to training, targets only refusals, and gives consistent behavior across long conversations because nothing is fighting the model anymore.

This is why most "uncensored" open-weight models released since 2024 are abliterations, sometimes followed by a light healing step.

What abliteration does not do

It is worth being clear about the limits, because there is a lot of hype around the word.

• It does not add knowledge. An abliterated model knows exactly what the original knew. If the original was never trained on a topic, abliteration will not teach it.
• It does not remove every refusal. Refusal is mostly one direction, not perfectly. Some topics, and some phrasings, can still get a soft no or a disclaimer.
• It does not change the law or the service's rules. A model being willing to answer is not the same as an answer being legal. Hosted services still have terms of use. On Cleus, for example, there is no content involving minors, no non-consensual imagery of real people, and nothing designed to hurt someone.
• It only works on open weights. You need the actual model file. That is why you see abliterated Llama, Qwen, Mistral and DeepSeek models, but never an abliterated GPT or Claude.

Can you abliterate a model yourself?

For small models, yes. With FailSpy's abliterator, Labonne's notebook or Heretic, a 7B or 8B model can be abliterated on a single consumer GPU in under an hour, then uploaded to Hugging Face.

For frontier-size models it is a different story. DeepSeek V4.1 Flash has 552 billion parameters. Even though only 8 to 16 billion are active for each token, the whole model has to be loaded to measure and edit it, which means a multi-GPU server with hundreds of gigabytes of memory, and then a full round of quality testing. That is a lab-sized job, not a weekend project.

Try an abliterated DeepSeek V4.1 Flash: Cleus Smartest v3

If you want the result without the GPU bill, Cleus Smartest v3 runs an abliterated build of DeepSeek-V4.1-Flash-1017, DeepSeek's October update. It is the Cleus model with the fewest refusals, and it still thinks before it answers, so it handles coding, math and long arguments as well as dark fiction and blunt adult questions.

You can use it in normal chats, in long-form stories in Story mode, and in end-to-end encrypted chats. For the full background on the base model, read our guide on how to use DeepSeek V4.1 Flash uncensored.

Abliterated model FAQ

What does "abliterated" mean?

It describes a model whose refusal behavior has been removed by editing its weights along the single internal direction that carries refusals. The name blends "ablate" and "obliterate" and came out of the open-source community in 2024.

Is an abliterated model the same as an uncensored model?

Abliteration is one way to make an uncensored model. Others include fine-tuning on data that never refuses, or merging models. Abliteration is popular because it is cheap and leaves the rest of the model mostly untouched.

Are abliterated models worse than the originals?

A careful abliteration is very close to the original on normal tasks. A careless one can lose some quality, especially in math. Good builders measure benchmark scores or KL divergence against the original before releasing.

Can ChatGPT or Claude be abliterated?

No. Abliteration needs direct access to the model's weights. Closed models like GPT and Claude only run on their companies' servers, so the technique only applies to open-weight models such as Llama, Qwen, Mistral and DeepSeek.

Is it legal to use an abliterated model?

In most places, yes. Open-weight licenses like DeepSeek's MIT license allow modification. What you do with the answers is still governed by the law and by the terms of whatever service you use.

Where can I use an abliterated DeepSeek without setup?

Cleus Smartest v3 is an abliterated DeepSeek V4.1 Flash 1017 that runs in the browser. Sign up for free, open the model picker and choose Smartest v3.

Sources

• Arditi et al.: Refusal in Language Models Is Mediated by a Single Direction (arXiv, 2024)
• Maxime Labonne: Uncensor any LLM with abliteration (Hugging Face blog, 2024)
• Heretic: automatic refusal removal for language models (GitHub)
• DeepSeek API change log: V4.1 Flash and V4.1-Flash-1017
• The Next Web: DeepSeek launches V4.1-Flash