What is an abliterated model? Where the word comes from, and what abliteration costs

The Morse teamPublished October 28, 202610 min read

As of October 2026, an abliterated model is an open-weight AI model whose habit of refusing requests has been edited out of its weights directly, without retraining. The method traces to a NeurIPS 2024 paper, the name to a pun on "ablate" and "obliterated" by the Hugging Face user FailSpy, and Hugging Face lists 8,655 models with "abliterated" in their names.

We read the paper, the research team's first post, the model cards that coined and spread the word, and the licenses those models carry, on October 22, 2026. Benchmark scores are the authors' and uploaders' own, not ours.

Abliterated model: key facts

What does abliterated mean?

"Abliterated" means a model has had its refusal behavior ablated, or cut out. FailSpy explains the word on a model card uploaded on May 20, 2024: "Ablate + obliterated = Abliterated." FailSpy calls it a play on "ablation," the original paper's term for removing a feature, and says he "made up" the word "particularly to differentiate the model from 'uncensored' fine-tunes" (Hugging Face).

The same card describes the change in one line: certain weights were manipulated to "inhibit" the model's ability to express refusal. FailSpy says the method keeps "as much of the original model's knowledge and training intact" as it can.

The word reached a wider audience through Maxime Labonne's Hugging Face article "Uncensor any LLM with abliteration," published June 13, 2024. Labonne credits the finding to Arditi and his co-authors and builds his version on FailSpy's work (Hugging Face).

Where does abliteration come from?

It comes from interpretability research, the study of what happens inside a model. Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda posted "Refusal in Language Models Is Mediated by a Single Direction" to arXiv on June 17, 2024 (arXiv). It was published in the main conference track of NeurIPS 2024 (NeurIPS).

The paper found that when a chat model refuses a harmful request, the refusal runs through one direction in its internal activations. Erasing that direction stopped refusals in all 13 models tested, and adding it made the models refuse harmless requests too. The authors showed the same effect could be written into the weights with what they call a "rank-one weight edit." They tested chat models from the Qwen, Yi, Gemma, Llama 2, and Llama 3 families, from 1.8 billion to 72 billion parameters, and wrote that the results "underscore the brittleness of current safety fine-tuning methods."

A preview had gone up on the Alignment Forum on April 27, 2024, written in Neel Nanda's stream of the ML Alignment and Theory Scholars program (Alignment Forum). The community uploads named "abliterated" followed within ten days.

How abliterated models spread: a timeline

We built this from Hugging Face's own creation dates and the primary pages, read on October 22, 2026. The earliest uploads are the earliest still listed; a deleted model wouldn't show.

The count includes compressed copies of the same model that other users re-upload, so the number of distinct abliterations is smaller. The same search for "uncensored" returned 7,877 models that day.

Does abliteration remove every refusal?

No. FailSpy's card says "it is not in anyway guaranteed that it won't refuse you," and that the model "may still lecture you about ethics/safety" (Hugging Face). Some models resist more than others. Labonne's Gemma 3 27B card says Gemma 3 was "much more resilient to abliteration than other models like Qwen 2.5," so he used a per-layer variant that produced "a very high acceptance rate (>90%)," and calls the result "fairly experimental" (Hugging Face).

Abliteration doesn't add knowledge either. FailSpy describes his edit as having "no new or changed behaviour in any other respect from the original model," so a fact the original model never learned is still missing, and its answers are only as accurate as the original's.

Does abliteration make a model worse?

Usually a little, and the paper and the model cards measure how much. The paper reports that on MMLU, ARC, and GSM8K, "orthogonalized models perform similarly to baseline models," but that "accuracy on TruthfulQA consistently drops" (arXiv). TruthfulQA's questions cover misinformation, stereotypes, and conspiracies, and the authors suggest the dataset "veers close to the territory of refusal."

Labonne saw the same thing in his own test: "we observe a performance drop in the ablated version across all benchmarks." He then trained the abliterated model further with DPO, a preference-tuning method, which he says recovered "most of the performance drop," with one exception: GSM8K, a math test, didn't improve (Hugging Face). On its card, the retrained model, NeuralDaredevil-8B-abliterated, averages 55.87 on the Nous suite, the same as the original (Hugging Face).

When we searched "abliterated model" on October 22, 2026, the AI answer at the top of Google's results said an abliterated model "keeps its original language, reasoning, and coding skills." The paper and the cards above report small, measurable losses, largest on TruthfulQA. The paper's authors also caution that "it is difficult to measure the coherence of a chat model, and we consider each metric used flawed in various ways."

Abliterated vs uncensored: what's the difference?

The difference is the method. An "uncensored" model, in the older sense, is retrained on data with the refusals taken out. The WizardLM-7B-Uncensored card describes it as "trained with a subset of the dataset" from which "responses that contained alignment / moralizing were removed" (Hugging Face). Abliteration uses no new training data and edits the weights the model already has, which is the distinction FailSpy coined the word to mark.

In practice the labels blur. Labonne's cards call his abliterated models "uncensored," and NeuralDaredevil is both: abliterated first, then fine-tuned. Many uploads now carry both words in their names.

App filters are a third thing, and they live outside the model. A hosted chatbot can steer its model with instructions you never see, called a system prompt, and screen what goes in and out with a separate classifier. Meta's Llama Guard 3, for example, is a model "fine-tuned for content safety classification" that labels both prompts and replies against 14 hazard categories (Hugging Face). Abliteration doesn't touch a filter like that, and an app can run an abliterated model behind one.

Does an abliterated model keep the base model's license?

Yes. Editing the weights doesn't change the terms they came under, and the uploads say so in their own metadata. FailSpy's Llama 3 abliterations are tagged "llama3," Labonne's Gemma 3 27B abliteration is tagged "gemma," and Qwen3-8B, which 288 Hugging Face uploads named "Qwen3-8B-abliterated" build on, carries Apache 2.0 (Hugging Face, Hugging Face, Hugging Face).

Those licenses come with use rules that abliteration doesn't remove:

• Llama 3. The Meta Llama 3 Community License, released April 18, 2024, requires anyone who shares a model made from Llama 3 to include a copy of the agreement, "prominently display 'Built with Meta Llama 3'" on a related website, and put "Llama 3" at the beginning of the model's name. It folds in Meta's Acceptable Use Policy, which starts by prohibiting use to "violate the law or others' rights" (Meta, Meta).
• Gemma. Google's Gemma Terms of Use, last modified April 1, 2026, cover "Model Derivatives," defined to include "modifications to Gemma." Anyone sharing one "must include the use restrictions" of the Gemma Prohibited Use Policy "as an enforceable provision" (Google). Google's page says Gemma 4 has a separate license.

This isn't legal advice. If you plan to share or build on a modified model, read its base model's license first.

Is it legal and safe to use an abliterated model?

The base model's license and the law still apply to whatever you do with an abliterated model's answers. The WizardLM-7B-Uncensored card says so directly: "You are responsible for anything you do with the model," and "publishing anything this model generates is the same as publishing it yourself" (Hugging Face).

The paper's authors weighed the risk in their own ethics statement. They wrote that the method "marginally lowers the bar" for getting past the safety training of open-weight models, and that they believe it "does not substantially alter the risk profile of open sourcing models" (arXiv). On your own computer, an abliterated model has no filter around it, so nothing checks a reply before you read it. Treat its medical, legal, and factual answers the way you'd treat any model's, and check the ones that matter.

How Morse gives you unfiltered models without a GPU

Running an abliterated model yourself means finding the weights, a computer with enough GPU memory to hold them, and software to serve them. By our arithmetic, Llama 3 70B at 16 bits per parameter is about 140 GB of weights. Morse is a web app at trymorse.ai, so there's no model to download and no hardware to buy.

On Morse's paid plans, picking an unfiltered model gives you answers other apps refuse: dark fiction, straight medical and legal answers, and help testing your own security. Unfiltered models come with Pro, at $19 a month, and with Max. The Free plan doesn't include them. Unfiltered isn't a pass for anything illegal, and Morse reports child sexual abuse material to NCMEC.

A model on your own machine keeps your chats on your machine. Morse keeps your history in your browser, encrypted, and not on Morse's servers. Then you choose who can see each chat:

• Private, for open-weight models on hosts that keep nothing. Morse has zero data retention agreements with its inference, search, and other providers, and where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't. We explain the arrangement in what is zero data retention.
• E2EE, for anything no one should read. On Pro and Max, your browser checks a secure enclave's hardware attestation, then encrypts the message so only that enclave can read it, and Morse's servers relay ciphertext they can't read. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed. Read how end-to-end encrypted AI chat works for each check.
• Anonymous, for GPT, Claude, and Gemini without the provider knowing it's you. Morse's proxy removes your account, email, and IP address before the message goes out. The provider may keep it for a limited time to check for abuse, under its own policy.

In every mode, Morse doesn't train AI on your chats, sell your data, or show ads (privacy policy). For the privacy side of asking AI about your body, read private AI for health questions, and for everything else, how to use AI privately.

Start free, and move to Pro when you want unfiltered models: until December 1, 2026, Pro includes more models as a launch offer.