What is an abliterated model? Abliteration explained

An abliterated model is an open-weight chat model with the direction that makes it refuse removed from its weights. The direction is found by comparing the model's activations on prompts it refuses with prompts it answers. Removing it is an edit to the existing weights, with no training run and no new data.

11 abliterated builds run on UplinkSwitch, on the same key as Claude and GPT. The uncensored LLM API page lists every build with its live price.

The method comes from Refusal in Language Models Is Mediated by a Single Direction by Andy Arditi and six co-authors (arXiv 2406.11717, first posted June 2024, read 2026-10-19). They tested 13 open chat models from five families, up to 72 billion parameters, and found one direction in each that controls refusal.

Maxime Labonne's Hugging Face post Uncensor any LLM with abliteration (June 2024, read 2026-10-19) builds on that work and walks through it in code under the name abliteration. The paper calls the permanent edit weight orthogonalization. To abliterate a model is to apply that edit and save the changed weights.

Abliteration needs the model's weights and two lists of prompts: one the model refuses and one it answers. The paper calls them harmful and harmless instructions and used 128 of each to find the direction. Labonne's notebook uses 256 of each, drawn from two public Hugging Face datasets, harmful_behaviors and harmless_alpaca.

1. Run both lists through the model and record the residual stream, the running vector that every layer reads from and adds its output to. Labonne records it at the last token of each prompt. The paper records every layer at the token positions after the instruction.
2. Average the activations of each list and subtract one mean from the other. Normalized, that difference in means is a candidate refusal direction, one per layer and position.
3. Test the candidates on held-out prompts and keep one. The paper scores them on 32 validation prompts per list and drops any that move the model's outputs on harmless prompts past a KL divergence of 0.1. Labonne tries 20 candidates on four test prompts and keeps the one from layer 9 for his model.
4. Remove the direction. At inference time, that means subtracting each activation's projection onto the direction at every layer and every token, which the paper calls directional ablation. The permanent version orthogonalizes every matrix that writes to the residual stream against the direction: the embedding, each attention output and each MLP output. The model can then no longer write to that direction at all.
5. Save the weights. The paper shows the weight edit is equivalent to ablating at inference. The edited model has the same architecture and size as the original, so it loads and serves like any other checkpoint.

The math is one line each way. For a unit refusal direction r, ablation replaces an activation x with x − (r·x) r, which leaves nothing along r. Orthogonalizing a matrix W that writes to the stream gives W − r rᵀ W, so every output it writes already has that component removed. Running the edited weights gives the same result as ablating at every step.

Edited weights are the version that ships. An orthogonalized checkpoint loads in any inference server that runs the original, with no hooks added to the forward pass. Ablating at inference needs code that intercepts every layer, which suits research more than serving.

No step uses gradient descent or example answers. The paper says the method needs neither gradient-based optimization nor examples of harmful completions, only forward passes to collect activations. That is the practical line between abliteration and a fine-tune.

The direction also works in reverse. Adding it to the activations made the models refuse harmless Alpaca instructions, the paper's evidence that refusal runs through this one direction. The authors also traced how an adversarial suffix, a string appended to a prompt to get past refusals, works in one model: it suppresses this same direction.

Heretic is an open-source command-line tool by Philipp Emanuel Weidmann that runs abliteration for you. Its README (read 2026-10-19) calls it fully automatic censorship removal for language models: it removes safety alignment from transformer models without expensive post-training. It is free software under the AGPL-3.0 license, installs with pip install -U heretic-llm on Python 3.10 or later with PyTorch 2.2 or later, and runs as heretic <model-id>. The project site, heretic-project.org (read 2026-10-19), carries the same install line and links the GitHub repository and the project's Hugging Face organization. The README's example, Qwen3-4B-Instruct-2507 on an RTX 3090, takes about 20 to 30 minutes with the default settings.

The edit is the same kind. Heretic calls its method a parametrized variant of directional ablation and cites Arditi et al. (2024) and the projected and norm-preserving biprojected variants from Lai (2025). What changes is who picks the settings. In the paper and in Labonne's notebook a person chooses one layer, one direction and one strength by reading validation outputs. Heretic hands those choices to a TPE optimizer from the Optuna library, which scores each try on two numbers at once: how many test prompts the model still refuses, and its KL divergence from the original model on harmless prompts. The paper used a KL divergence of 0.1 as a cutoff for candidates. Heretic minimizes it alongside refusals.

Either way the result is the original architecture with edited weights, so a Heretic build loads, serves and bills like any other abliterated checkpoint. The README lists most dense models, many multimodal models and several MoE architectures as supported, and says the community has published well over 5,000 models made with the tool. The author reports that MLP edits damage a model more than attention edits, which is why the two get separate settings.

The README's own benchmark is on Gemma 3 12B: three edited builds each cut refusals from 97 to 3 of 100 prompts, and the Heretic build did it with the lowest KL divergence of the three. Those numbers, and our dated refusal test of the Gemma build here, are in Uncensored Gemma API: the Heretic build, tested and priced.

On this key, a build's id says which kind it is. Prices are live from the catalog, per million tokens.

Gemma 31B Heretic Uncensored (gemma-31b-heretic-uncensored) is the Heretic build here, at $1.50 per million input tokens and $8.25 per million output tokens. Its name marks it as a Heretic build; the catalog records the name, not the run. The daily real-model check shows: No answer at the last check.

The same open weights can ship three ways. The base model is the release as its developer trained it. An abliterated model has one direction projected out. A fine-tuned uncensored model, as a general category, is trained further on new examples so it answers instead of refusing.

The practical difference is where the behavior comes from. An abliterated model learned nothing new, so what it knows and how it writes come from the base model. A fine-tune also picks up whatever its training examples teach, which can be more than answering, such as a new tone or format.

On this key, GLM-5.3 runs three ways. glm-5.3 is the base release. glm-5.3-abliterated is the open weights with the refusal direction removed. glm-5.3-uncensored is a build of the open weights changed to answer instead of refuse. Its name does not say how it was made, so don't assume it is a fine-tune. All three take the same request body, so you can run your own prompts through each and compare.

A fourth route keeps the base model and changes the prompt instead. A jailbreak prompt rides along with every message, so it is billed every time and can still be refused. GLM jailbreak prompts vs an abliterated GLM-5.3 puts a number on that per 100 messages.

Across the 13 models in the paper, removing the direction stopped refusals of harmful instructions. The other effects measured there were small.

The authors tested MMLU, ARC, GSM8K and TruthfulQA on the orthogonalized models. They report every model's scores within 99% confidence intervals of the original, except Qwen 7B and Yi 34B. The change they call out is TruthfulQA, where accuracy dropped consistently after the edit. Measured by cross-entropy loss, the authors found directional ablation more surgical than methods based on activation addition, which shift activations along the direction instead of removing it.

Labonne saw a bigger effect on one 8B model. After abliterating Daredevil-8B, its scores fell on every benchmark he ran, and he writes that the edit uncensored the model but degraded its quality.

His fix was to train the abliterated model a little more, which he calls healing it. He ran DPO on the orpo-dpo-mix-40k dataset with QLoRA, on six A6000 GPUs for about 6 hours 45 minutes. The result, NeuralDaredevil-8B-abliterated, recovered most of the lost performance. GSM8K did not come back, which he suspects is because the dataset lacks math samples.

What abliteration leaves alone follows from the math. The edit removes one direction from the residual stream and adds nothing, so the model gains no new knowledge or skills. Its architecture, parameter count and tokenizer stay the same, which is why an abliterated build is served and billed per token like any other model.

The paper is plain about its limits. The authors say the extraction relies on heuristics and is likely not optimal, call the work an existence proof, and note that results may not carry over to larger or untested models. Treat each abliterated build as its own result and test it on the prompts you care about.

Two routes run an abliterated model: download the weights and run them yourself, or call a hosted one online by API. The Hugging Face tag page listed 11,959 models tagged abliterated on 2026-10-19 (Google result, read that day), and every one is a download. A 31B model in 16-bit weights is about 62 GB before the KV cache, more than one consumer GPU holds, so local runs lean on quantized GGUF files that trade some quality for the fit.

Hosted means the weights stay on a server and you pay per token. Here the base URL is https://api.uplinkswitch.com/v1, the key comes from the console, and the model is the build's id. One request:

curl https://api.uplinkswitch.com/v1/chat/completions \
  -H "Authorization: Bearer $UPLINKSWITCH_API_KEY" \
  -H "content-type: application/json" \
  -d '{"model":"glm-5.3-abliterated","max_tokens":1500,"messages":[{"role":"user","content":"What does abliterated mean?"}]}'

The reply is the OpenAI chat completions shape with the id in its model field. No weights, no GPU, and prepaid credit is drawn per token. Each abliterated id in the daily real-model check, at its latest run:

• deepseek-r1-distill-llama-70b-abliterated: No answer at the last check
• deepseek-r1-distill-qwen-32b-abliterated: No answer at the last check
• deepseek-v4.1-flash-abliterated: Same fingerprint since Oct 19
• glm-5.3-abliterated: Same fingerprint since Oct 12
• glm-5.3-flash-abliterated: Same fingerprint since Oct 12
• glm-5.3-flash-apex-abliterated: Same fingerprint since Oct 20
• llama-3-70b-abliterated: No answer at the last check
• llama-3.3-70b-abliterated: No answer at the last check
• mimo-v2.6-flash-abliterated: Same fingerprint since Oct 20
• neuraldaredevil-8b-abliterated: No answer at the last check
• qwen2.5-32b-abliterated: Same fingerprint since Oct 20

11 abliterated builds run here, priced live from the catalog per million tokens. The last column is each model's latest result on the daily real-model check.

For the uncensored and roleplay builds side by side, see all uncensored models. The best uncensored LLM picks between them by task. OpenRouter's public list of 471 models had no abliterated build on 2026-10-19, per our scan of OpenRouter's uncensored models.

GLM-5.3 shows the three versions best, because the same open weights run here as the base model, an abliterated build and an uncensored build. Z.ai publishes a list price for the base model, and GLM-5.3 here is 70% under Z.ai's list price. The builds have no developer list price. The last price column is 1,000 requests of 2,000 input tokens and 1,000 output tokens each, the reply budget the thinking build needs.

At that size, GLM-5.3 Uncensored costs the least of these 3 here, $0.52 for 1,000 requests.

Once a UTC day, every model gets the same fixed test prompt. The input token count works as a tokenizer fingerprint, so a swapped model or hidden instructions added to the prompt show up as a changed count. GLM-5.3 Abliterated at its latest check: Same fingerprint since Oct 12. The full results are on the real-model check, and the method page explains the count.

The abliterated builds take the OpenAI chat completions format only. Any OpenAI SDK or OpenAI-compatible client works with two settings: the base URL https://api.uplinkswitch.com/v1 and a key from the console. The model page for GLM-5.3 Abliterated has TypeScript and curl versions.

from openai import OpenAI

client = OpenAI(
    base_url="https://api.uplinkswitch.com/v1",
    api_key="sk-uplink-live-...",
)

completion = client.chat.completions.create(
    model="glm-5.3-abliterated",
    max_tokens=1500,  # it thinks first; at 300 a reply can stop mid-sentence
    messages=[{"role": "user", "content": "Explain how a refusal direction is found."}],
)
print(completion.choices[0].message.content)

GLM-5.3 Abliterated thinks before it answers, and the thinking counts against max_tokens. In SillyTavern on 2026-10-18, a reply capped at 300 tokens stopped mid-sentence and one capped at 1,000 finished. Set 1,000 or more. The Flash abliterated build takes the same request with its own id.

Streaming works the same way, and streams pass through as sent:

curl https://api.uplinkswitch.com/v1/chat/completions \
  -H "Authorization: Bearer $UPLINKSWITCH_API_KEY" \
  -H "content-type: application/json" \
  -d '{"model":"glm-5.3-abliterated","max_tokens":1500,"stream":true,"messages":[{"role":"user","content":"Hello"}]}'

The key goes in an Authorization: Bearer header or x-api-key. This request lists every model id the key can call:

curl https://api.uplinkswitch.com/v1/models -H "Authorization: Bearer $UPLINKSWITCH_API_KEY"

In a roleplay frontend the same two values go into the connection settings. The SillyTavern guide shows where, and the SDK guide covers other languages.

• Max tokens too low. A thinking build can spend a 300-token budget before the answer starts. Give glm-5.3-abliterated 1,000 or more.
• The full URL where a base URL goes. SDKs and SillyTavern take https://api.uplinkswitch.com/v1 and add /chat/completions themselves, so a full URL puts the path in twice. Janitor AI is the exception and takes the full https://api.uplinkswitch.com/v1/chat/completions.
• Display names as ids. Ids are exact and lowercase: glm-5.3-abliterated, not GLM-5.3 Abliterated.
• The Anthropic SDK. The abliterated and uncensored builds answer the OpenAI format only, so call them with an OpenAI client even when the same key runs Claude through the Anthropic SDK.
• A key in the URL. It is refused. Send it in a header.

What does abliterated mean? When a model is abliterated, the direction in it that makes it refuse has been removed from its weights. The direction is found by comparing activations on prompts the model refuses with prompts it answers, then projected out of the weight matrices. Nothing is retrained.

What is abliteration in AI? A way to stop an open-weight language model from refusing by editing its weights. It finds the single direction in the activations that mediates refusal, as shown by Arditi et al. in 2024, and orthogonalizes the weights against it. A Hugging Face post by Maxime Labonne the same year walks through it in code under that name.

How do you abliterate an LLM? Run two prompt lists through the model, one it refuses and one it answers, and record the residual stream activations. Average each list and subtract the means to get candidate refusal directions, then keep the one that stops refusals on held-out prompts without changing answers to harmless ones. Ablate that direction at inference, or orthogonalize the weight matrices that write to the residual stream against it and save the checkpoint. NousResearch packages the steps for Transformers models in its llm-abliteration repository.

What does Heretic mean in AI models? Heretic in a model name marks a build run through Heretic, an open-source tool by Philipp Emanuel Weidmann that abliterates transformer language models from the command line. It installs with pip install -U heretic-llm under the AGPL-3.0 license and searches for the abliteration settings with a TPE optimizer from Optuna, keeping refusals and the KL divergence from the original model low at the same time (its README and heretic-project.org, read 2026-10-19). On this key, gemma-31b-heretic-uncensored is the build whose name marks it as a Heretic build; the catalog records the name, not the run. It costs $1.50 per million input tokens and $8.25 per million output tokens.

Did Heretic use AI? Heretic is a program, not a model, and no language model makes its decisions. It runs the model it is editing: prompts go through that model to count refusals and to measure KL divergence from the original, and the TPE optimizer from Optuna picks the next settings from those two scores. The only AI in the loop is the one being edited.

How to use Heretic AI? Two ways. To make a build, install it with pip install -U heretic-llm on Python 3.10 or later with PyTorch 2.2 or later, then run heretic followed by a Hugging Face model id. The README's example, Qwen3-4B-Instruct-2507 on an RTX 3090, takes about 20 to 30 minutes with the default settings, and the result can be saved, benchmarked or uploaded to Hugging Face. To chat with one, call a Heretic build by API: gemma-31b-heretic-uncensored runs here at $1.50 in and $8.25 out per million tokens, with no weights to download and no GPU. The uncensored Gemma post shows the request and a dated refusal test.

Does Hugging Face have Heretic versions of models? Yes. The Heretic project's own organization, heretic-org, listed 16 models on 2026-10-19, each with heretic in its id, and DavidAU keeps a collection of Heretic builds across the Qwen, Gemma, Llama and gpt-oss families. The README counts well over 5,000 community models made with the tool. Each of those is a download; the Heretic build you can call here without a GPU is gemma-31b-heretic-uncensored. The heretic-org models are on Hugging Face. So is DavidAU's Heretic collection.

Is an abliterated model the same as uncensored? Both answer prompts a stock model declines, but the terms are different. Abliteration edits the existing weights with no training run, while a fine-tuned uncensored model, in general, is trained further on new examples. Here, glm-5.3-abliterated has the refusal direction removed from its weights, and glm-5.3-uncensored is a build of the open weights changed to answer instead of refuse. Its name does not say how it was made, so don't assume it is a fine-tune.

Does abliteration make a model dumber? Slightly, and unevenly. Arditi et al. report benchmark scores within 99% confidence intervals of the originals except for Qwen 7B and Yi 34B, and a consistent drop on TruthfulQA. Labonne measured a broader drop on one 8B model and recovered most of it with a DPO fine-tune.

How do I run an abliterated model without a GPU? Call one by API instead of loading the weights. Point any OpenAI-compatible client at https://api.uplinkswitch.com/v1, add a key and set the model to glm-5.3-abliterated. It bills per token from prepaid credit: $2.25 per million input tokens and $2.25 per million output tokens.

Which abliterated LLM is the best? For API use, one key runs deepseek-r1-distill-llama-70b-abliterated, deepseek-r1-distill-qwen-32b-abliterated, deepseek-v4.1-flash-abliterated, glm-5.3-abliterated, glm-5.3-flash-abliterated, glm-5.3-flash-apex-abliterated, llama-3-70b-abliterated, llama-3.3-70b-abliterated, mimo-v2.6-flash-abliterated, neuraldaredevil-8b-abliterated, and qwen2.5-32b-abliterated on https://api.uplinkswitch.com/v1. glm-5.3-flash-abliterated has the lowest price: $0.66 per million input tokens and $0.66 per million output tokens. By paid spend on 2026-10-18, glm-5.3-abliterated was the second most-used uncensored build here. The best uncensored LLM post picks a build for each task.

How do you uncensor an AI model? Three ways change what a model answers. Abliteration edits the weights: find the refusal direction in the activations and project it out, with no training run. An uncensored fine-tune trains the model further on examples that answer. A jailbreak changes only the prompt and leaves the weights alone, so it fails when the model's training wins. The first two need the open weights and a GPU; calling an already-edited build by API, such as glm-5.3-abliterated at $2.25 per million tokens in and out, needs neither.

Which open-source AI model is the most uncensored? No benchmark we trust measures it, and the answer changes with each release. Abliterated builds remove refusal most completely in the published tests (Arditi et al., 2024), and on this key the abliterated open-weight builds are DeepSeek R1 Distill Llama 70B Abliterated ($2.10 per million tokens in and out), DeepSeek R1 Distill Qwen 32B Abliterated ($4.20 per million tokens in and out), DeepSeek V4.1 Flash Abliterated ($1.05 per million tokens in and out), GLM-5.3 Abliterated ($2.25 per million tokens in and out), GLM-5.3 Flash Abliterated ($0.66 per million tokens in and out), GLM-5.3 Flash Apex Abliterated ($0.45 in and $1.50 out per million tokens), Llama 3 70B Abliterated v3.5 ($2.10 per million tokens in and out), Llama 3.3 70B Abliterated ($2.10 per million tokens in and out), MiMo V2.6 Flash Abliterated ($1.50 in and $4.50 out per million tokens), NeuralDaredevil 8B Abliterated ($1.32 per million tokens in and out), and Qwen2.5 32B Abliterated ($2.10 per million tokens in and out).

Get a key: prepaid from $10, no subscription, 30-day price lock.