What is an abliterated model?
An abliterated model is an open-weight language model whose refusal behaviour has been surgically removed from its weights. The technique rests on a finding that refusal in chat-tuned models is mediated largely by a single direction in the residual stream: collect activations for a set of harmful prompts and a set of harmless ones, take the difference of their means, and you have a vector that represents “I should refuse this”.
Project that vector out of every matrix that writes to the residual stream, and the model loses the ability to express refusal — while keeping essentially all of its other machinery intact. Because this is a closed-form linear edit rather than training, it runs in minutes on modest hardware. That is why over 8,648 of these models exist.
How it differs from the alternatives
- Versus jailbreaking: a jailbreak is a prompt, and prompts can be filtered. Abliteration edits the weights, so there is no input signature to detect.
- Versus fine-tuning: fine-tuning teaches new behaviour with data and gradients. Abliteration deletes existing behaviour with linear algebra, and touches nothing it was not aimed at.
- Versus base models: a base (pre-instruct) model never learned to refuse, but also never learned to follow instructions. An abliterated model keeps the instruction tuning and drops only the refusal.
The techniques you will encounter
Not all of these releases were made the same way, and the differences show up in how much capability survived:
- Abliteration + uncensored fine-tune — 209 models indexed.
- Heretic — 195 models indexed.
- Abliteration (directional ablation) — 191 models indexed.
What it costs
Abliteration is not free. Projecting out a direction perturbs weights that were doing other work too, and the published consequences are lower instruction-following fidelity, measurably worse benchmark scores, and in some cases increased hallucination. Norm-preserving variants renormalise the edited matrices to limit the damage, and the Heretic toolchain searches for an ablation that stays inside a KL-divergence budget against the original model. Both are attempts to buy back the capability that naive projection loses.
How this index is built
Every repository matching abliteration on the Hugging Face API is harvested daily — 23,736 of them at last run. Quantised re-releases are then grouped onto the model they derive from, so Huihui-Qwen3.8-27B-abliterated-GGUF and Qwen3.8-27B-abliterated-AWQ both appear as download variants on one page rather than as separate entries. That collapses 23,736 repositories into 8,648 distinct models, of which the 595 with at least 5,000 downloads are published here — that threshold covers the large majority of all download volume, while the excluded tail accounts for only a few percent.
Metadata — base model, licence, parameter count, ablation scope — is read from the API and from each publisher's model card. None of it is independently verified. This site runs no benchmarks and reports no refusal rates, because it has not measured them. Where a publisher does not state something, the page says so rather than guessing. See about this index for the known limitations.
Frequently asked questions
What is an abliterated model?
An abliterated model is an open-weight language model whose refusal behaviour has been removed by identifying the single direction in the residual stream that mediates refusal and projecting that direction out of the model weights. The result is a model that answers prompts its original version would decline, without any additional training on harmful data.
Is abliteration the same as jailbreaking?
No. A jailbreak is a prompt that talks a model out of refusing, and it can be patched or filtered at inference time. Abliteration is a permanent edit to the weights themselves, so there is no prompt to detect and no system prompt that restores the original behaviour.
Is abliteration the same as fine-tuning?
No. Fine-tuning updates weights by training on data. Abliteration performs a targeted linear-algebra edit: it computes a refusal direction from contrastive harmful and harmless prompt pairs, then orthogonalises that direction out of the matrices that write to the residual stream. No gradient descent is involved, which is why it takes minutes rather than GPU-days.
Does abliteration make a model more capable?
No, and usually the opposite. Abliteration removes a behaviour; it adds no knowledge or reasoning ability. Published results consistently show some degradation in instruction-following and benchmark scores, which is why techniques like norm-preserving abliteration and Heretic exist — they try to minimise that collateral damage.
Why would a security team want an abliterated model?
Because you cannot measure what an unaligned model will produce using a model that refuses. Abliterated models are used to generate red-team corpora, to build and test detection for AI-generated attack content, to establish a realistic threat baseline for what an adversary with open weights can do, and to evaluate how much of a model safety layer was alignment versus capability.
Do abliterated models still refuse anything?
Often yes. Ablation removes one direction, not a policy. Publishers who ablate only some layers frequently leave residual refusals that surface on particular phrasings, and models can reassert refusal behaviour in longer contexts. Any claim of complete compliance should be verified empirically.