Lets talk about Abliterated LLMs
An abliterated model is an open-weight AI model with its trained refusals removed. Notes from a class discussion on why that is hard to control, and where safety could go instead.
Most AI models are trained to refuse certain requests. An abliterated model is an open-weight model, one anyone can download and run, with that training removed. You can get one today, for free.
I first raised this on the forum for my Ethics in AI course, part of my MSAI at UT Austin. A classmate’s reply changed my thinking, so here is that conversation, expanded.
How it works
In 2024, researchers showed that refusal in 13 open chat models came down to a single direction inside the model. Erase that direction and the model stops saying no.
One direction, erased
Maxime Labonne then wrote up how to burn this into the weights without retraining. Heretic now automates it.
Safety work turns out to be one of the cheapest parts of a model to remove.
How many are out there
I counted model names on Hugging Face through its public API on 1 November 2026. A name can match more than one row, and “uncensored” also covers models made other ways.
Models on Hugging Face, by name
The first “abliterated” upload is from May 2024. More than half have come in 2026.
New “abliterated” models each month
Just over half of the “abliterated” models (4,722) are GGUF, a format for running models on your own machine, and many are probably conversions of the same model.
Downloads count file requests, so scripts and repeat pulls inflate them. These numbers show supply and interest. They say nothing about what anyone did with a model.
Why people use them
Refusals are blunt. Models turn down safe questions that only sound risky, which gets in the way of security researchers, doctors and novelists. Abliteration fixes that for them.
It fixes it for everyone else too.
What goes on download
Hosted models have more than refusals. Anthropic wraps Claude Opus 4 in classifiers that watch inputs and outputs, plus wider monitoring.
A downloaded model has no provider watching, so all of that is gone before anyone edits a weight. The refusal is the last safeguard left, and abliteration takes it.
What surrounds the model
Can this be controlled, safely and responsibly?
That was my first question. Something this capable is free to download. Shouldn’t it have safeguards?
My classmate’s answer was hard to argue with. Files don’t stay contained. Pirated software carries legal penalties and still circulates over BitTorrent. Controlling weights would take internet monitoring most of us wouldn’t accept. Rules can also end up favouring large incumbents over new entrants.
I agree. Weights are a file, and a file can’t be recalled. The US government’s 2024 review landed close to this: monitor for now, keep restriction as an option.
But containment and friction are different things. Piracy survives, yet you won’t find it in an app store. Hugging Face can already gate, unrank or remove content. A label and a click-through won’t stop anyone determined. They do slow down someone curious, who has the least skill and the least patience.
Laws can also target the use. Fraud is fraud, whichever model wrote the email.
What I keep thinking about
I want open weights to exist. I’m less sure about how easily the refusals come off.
Most misuse before AI took some skill. Dario Amodei argues AI could make that skill far less scarce.
It’s easy to overstate this. Removing a refusal adds no knowledge, and knowing is far from doing. Some researchers see no immediate risk in domains like biology. Others found that o3 outscored 94% of expert virologists on a written test. A test isn’t a lab, so both can hold for now.
The models will keep improving, though, and the refusals will stay this easy to remove.
So where does safety go?
Whoever holds the weights can edit them, so safety has to sit somewhere harder to edit.
One place is what the model never learned. The Deep Ignorance paper filtered hazardous topics from training data, and those models resisted up to 10,000 steps of fine-tuning on that material. A model can still use such information if you hand it over, so this only goes so far.
Another is testing before release. OpenAI fine-tuned gpt-oss to push its risky capabilities as far as it could, and used the results to decide on release. A lab marking its own homework is a weak check. It still beats testing only the polite version, because the other version is the one that will circulate.
Where I land: keep open weights, filter the riskiest training data, test every release with its refusals gone, and have hosts label what they host.
None of that is airtight. It only has to raise the bar, and today the bar is a free download.