How to Pick an Uncensored LLM: Abliterated vs Fine-tuned

Pick an uncensored model: cost, fit, tool calls.

Page content

“Uncensored” covers three 2026 methods for open models that do not refuse: abliteration, refusal-free finetunes, and steerable policy. Each changes different capabilities; this guide compares costs and shortlists by VRAM.

A model that never refuses lacks the single reflex that suppresses incorrect outputs without additional intervention. You must place filtering and judgment elsewhere in the stack. Refer to Filtering an Uncensored LLM for guidance on positioning the safety layer once the model stops supplying one. The decision here is narrower: which non-refusing model you should deploy for a given GPU and workload.

Choosing among three open routes for a non-refusing model

Every figure below is from a published community report or model card as of 11/11/2026, cited at the point of use. None is measured on our own hardware. This page sits under the AI Models cluster: model choice and route cost, not serving or system design.

Why Models Are Made Non-Refusing

Mainstream chat models are aligned to decline specific request categories through trained behavior. This refusal does not reflect a capability limit; a model that declines to explain a phishing email typically possesses the ability to do so. The MDPI 2025 survey “Uncensored AI in the Wild” (https://www.mdpi.com/1999-5903/17/10/477) documented over 8,000 such repositories, primarily on Hugging Face, and concluded that demand is broad rather than marginal.

Three purposes drive development. Security analysis and code mentioning real vulnerabilities trigger refusals designed for other threat models. Refusal rules embedded in weights prevent operators from relaxing constraints without weight edits or retraining. Researchers study alignment by editing refusals, and tools like Heretic automate this technique.

Practical applications include the security testing, coding, debugging, fiction writing, medical education, roleplay, and alignment research cases listed below — the same list the security and abliteration guides keep coming back to (Locally Uncensored). A legitimate task paired with a refusal calibrated for a different use case is the common justification for removing that refusal.

Use case What the filter blocks
Security testing / red-teaming Drafting exploit PoCs, malware for analysis, phishing lures for staff training
Security-sensitive coding Code that names a real CVE or tool, which aligned models refuse as if it were an attack
Debugging false refusals The aligned model declining a legitimate prompt often enough to break an agent loop
Fiction and adult creative writing Mature themes that mainstream assistants decline even for consenting-adult fiction
Medical and sex education Clinical or educational content that trips safety filters
Roleplay and companion builds Persona work the vendor policy treats as out of scope
Alignment/safety research Measuring what refusals do and do not catch, by removing them under controlled conditions

Three Methods of Refusal Removal

Abliteration edits weights without retraining. Arditi et al. found that refusal in chat models is carried by a single direction in the residual stream (https://arxiv.org/abs/2406.11717). Weights are orthogonalized against this direction, identified by comparing activations on harmful and harmless prompts. Maxime Labonne’s abliteration walkthrough serves as the reference for most public builds. The huihui-ai Qwen3.8-27B build (https://huggingface.co/huihui-ai/Huihui-Qwen3.8-27B-abliterated) ablates layers 18 to 51 under Apache 2.0, leaving MTP and visual components untouched.

Refusal-free finetuning retrains behavior over longer durations. Dolphin 3.0, developed by Cognitive Computations for Eric Hartford, uses training data from which alignment signals are stripped. The Ollama card states: “We have filtered the dataset to remove alignment and bias.” Dolphin 3.0 R1 Mistral 24B was trained on 800k DeepSeek-R1 reasoning traces alongside the uncensored corpus. The card describes the model as highly compliant with all requests, including unethical ones, and advises implementing an independent alignment layer before deployment.

Steerable policy models like Hermes 4 from NousResearch are aligned neutrally and governed by the system prompt policy. Refusal is gated, and the Nous technical report shows the system prompt reshapes reasoning, not just surface tone. The policy consumes context tokens and weakens as conversations grow. Locally Uncensored’s 2026 guide reports that steerable policy breaks on long context, compared to 1–3 hours for abliteration and days for finetuning.

Measured Costs of Refusal Removal

Collateral damage varies widely across abliteration methods. Heretic (https://github.com/p-e-w/heretic) reports on Gemma-3-12B-IT that three decensored versions each reduced harmful prompt refusal to 3 out of 100, down from 97 of 100 on the stock model. KL divergence from the original on neutral inputs was 1.04 for manual abliteration (99.9% of weights, no parameter search), 0.45 for Labonne’s partial search, and 0.16 for Heretic’s full search.

HarmBench attack success on Qwen-2.5-7B rose from 31.0% for the aligned model to 98.2–100.0% for the non-refusing version (DreamFast HF card). Qwen3.8-27B MMLU dropped 2.12 percentage points from 84.46% to 82.33% in the OBLITERATUS build cited via Featherless. GSM8K for Qwen-2.5-7B improved 1.5 to 1.6 percentage points from 79.23% to 80.74–80.82% (DreamFast card). Vul4J vulnerability detection fell from 58.42% to 57.22%, while patches that compiled rose from 9.04% to 32.77% in a July 2026 study (arXiv:2607.05842).

Refusal and capability are different numbers, and the tables treat them that way. The refusal outcome — what the model will now do:

Refusal outcome Aligned Non-refusing Source
HarmBench attack success, Qwen-2.5-7B 31.0% 98.2–100.0% DreamFast, HF model card

The capability delta — what the edit cost on knowledge and reasoning:

Capability delta Aligned Non-refusing Source
MMLU, Qwen3.8-27B 84.46% 82.33% (−2.12pp) OBLITERATUS card, via Featherless
GSM8K, Qwen-2.5-7B 79.23% 80.74–80.82% (+1.5 to +1.6pp) DreamFast, HF model card
Vul4J vulnerability detection 58.42% 57.22% July 2026 same-lineage study (arXiv:2607.05842), via Featherless
Vul4J patches that compiled 9.04% 32.77% same study

Anthropic’s 2026 report (https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities) produced an abliterated GLM-5.3 with refusal rates reduced from above 90% to 3% on JailbreakBench, 2% on HarmBench, and 12% on StrongREJECT. The edit cost approximately 2,200 GPU-hours (~$4,400); the Flash variant cost about 600. GPQA-Diamond scores remained unchanged, and CyberGym declined a few percentage points.

OrcaRouter documents two DeepSeek V4.1 Flash builds with different refusal outcomes: one retained 24 of 100 refusals, while the other retained 4 on chat prompts with a first-token KL of 0.067 on harmless inputs. No publisher has released a capability benchmark for an abliterated build. Capability figures listed in public cards were measured on the base checkpoint. Review each card for what was removed, and evaluate capability only where benchmarks name before and after values.

Abliteration preserves knowledge benchmarks and sometimes improves math reasoning. It changes how the model uses that knowledge. A model detecting vulnerabilities as well as its aligned counterpart is several times more likely to produce a working patch. If the task is artifact production, the edit is useful. If the task requires restraint, the operator must provide it.

Heretic (Philipp Emanuel Weidmann, first released late 2025) automates directional ablation with Optuna parameter search that co-minimizes refusals and KL divergence. Qwen-2.5-7B abliteration touched 37 of 339 tensors in layers 9–27. Apostate touched 55 tensors across 27 layers, and huihui-ai touched 57 tensors across all 28 layers (DreamFast forensics). The command heretic <model-id> requires the heretic-llm package (pip install -U heretic-llm). A 4B model (Qwen3-4B-Instruct) abliterated in 20–30 minutes on an RTX 3090. Community reports place 7B–9B models at 20–90 minutes and 12B–27B models at one hour or more on 4090, 5090, or A100 hardware. The configuration supports bnb_4bit quantization for low-VRAM cards. Gemma models require the winsorization_quantile set to 0.95. MoE and 24B-class builds require 4-bit quantization to fit a 24 GB card. Gated checkpoints require Hugging Face authentication. A complete run takes approximately half a day.

The edit uses full-precision weights, but deployments typically use GGUF quantization. Quantization rounds every weight, including edited tensors. Published GGUF builds involve two supply chain stages: editing and quantization, and neither stage is necessarily performed by you. Rounding may reactivate portions of the removed direction; the 3/100 versus 24/100 refusal spread on the same base indicates the magnitude of this effect.

Tool Calling and Supply Chain Risk

Function calling reliability does not correlate with refusal rate. Abliteration optimizes for refusal and KL divergence, not schema fidelity, so an abliterated build inherits the base model’s tool-calling behavior. Serving templates can break it further. The Dolphin 3 Ollama template shipped without tool support (Ollama #8329). An abliterated checkpoint that drops a tools schema mid-conversation is not suitable for agent use.

ProjectDiscovery demonstrated a backdoored Qwen2.5-7B that served a shell payload via a tool call when receiving a hidden trigger phrase. The backdoor was built for under $50 and passed clean-behavior tests. Edited weights can carry backdoors, and abliterated builds are precisely the ones that are pulled from Hugging Face without inspection. Verify provenance and restrict serving box access before running agents on uninspected models.

Sub-Q4 quantization corrupts structured output, as documented in the Strata Qwen3.8-Flash-Next quickstart. Budget VRAM for Q4_K_M or higher, and test the schema before deployment. See Choosing the best LLM for Ollama on 16 GB VRAM for VRAM measurements.

Failure Modes by Method

Abliterated models retain residual refusal. Long context prompts may produce soft moralizing even when hard refusals do not recur. Reasoning models re-derive refusals from first principles after direction removal. A model passing a 20-prompt probe may hedge in a long agent context on unprobed prompts; plan for this when debugging false refusals.

Finetuned models exhibit over-compliance. Data filtering that removes refusal also removes the constraint on other outputs. The Dolphin card’s description as highly compliant with all requests, including unethical ones, confirms this. Pre-deployment probes do not surface this failure; production requests do.

Steerable models experience policy decay in long context. The policy lives in context, and its influence diminishes as conversations grow. Limits set at the start of a session may cease to bind after extended interaction.

All three failure modes are long-context phenomena. Agent workloads run at extended context, so validation must occur at actual operating context length rather than at two-token demonstrations.

Limits and Future Direction of Refusal Removal

Abliteration assumes knowledge exists in weights and only willingness to use it is suppressed. The University of Illinois Applied LLMs guide states abliteration does not add knowledge absent from the base model. A model is only as helpful on a topic as the original weights were.

Researchers are moving safety decisions to pretraining. EleutherAI’s Deep Ignorance (arXiv:2508.06601, ICLR 2026) filters hazardous documents from pretraining. The safeguard held against tested data-based fine-tuning attacks, and general-knowledge benchmarks showed minimal change. Note the scope: their experiments use a bio/CDNR proxy, not general censorship. A model that never receives training data refuses out of ignorance; no weight edit recovers absent knowledge.

Extended-Refusal fine-tuning (arXiv:2505.19056, May 2025) trains longer justified refusals across multiple token positions. This reduced the post-abliteration refusal drop to approximately 10% compared to the typical 70–80%. Reasoning models re-derive refusals from first principles regardless of direction removal. These developments do not require data filtering but reduce abliteration reliability on its own terms.

The uncensored supply continues to grow. ThreatDown’s 2026 report documented five hosted abliterated-DeepSeek providers, 6,644 flagged models, and over 22 million downloads in a 30-day window. Heretic is on version two. Deep Ignorance is a controlled proof of concept. Providers do not disclose production filtering methods, and aggressive filtering costs capability. Open users can still run unfiltered base checkpoints or merge un-safety adapters.

Model selection now requires examination of data provenance. If the base was knowledge-filtered, abliteration cannot restore absent topic knowledge. Review the model card’s data statement the same way you review its capability caveat.

Model Shortlist by VRAM and Use Case

The 2026 field concentrates on a handful of model lines:

Model Route VRAM (Q4) Pick it for
Qwen3.8-27B (abliterated builds) Abliteration 16–24 GB Best overall: coding, agents, multimodal
Dolphin 3.0 Mistral 24B Refusal-free finetune 16–24 GB Function calling, general chat, R1 reasoning variant
Hermes 4 (14B/36B/70B) Steerable policy 12 GB+ Behaviour you define per system prompt
Gemma 4 26B-A4B uncensored Abliteration (MoE, ~4B active) 12–16 GB Speed on modest hardware
Mistral Small 3.2 abliterated Abliteration 12–16 GB Fiction and prose
Huihui GLM-5.1 abliterated Abliteration 24 GB+ Highest ceiling if the card allows

The abliterated Qwen3.8-27B is the 2026 default choice. It shares the Apache 2.0 license, supports MTP and vision components, and fits common cards at standard quantization. See the Qwen 4 family page for base benchmarks. Hermes 4 is appropriate when you require a model that can refuse according to a written policy. The Gemma 4 MoE build trades some capability for throughput advantages on hardware below 16 GB.

VRAM requirements comprise weights, KV cache, and approximately 1–2 GB of runtime overhead. At Q4_K_M, weights cost approximately 0.6 bytes per parameter. Qwen3.8-27B abliterated 4-bit GGUFs require 16.5–16.8 GB before context. A 16 GB card fits only a low-bit quantization with minimal context; a 24 GB card provides headroom. KV cache cost is approximately 56 KB per token for a GQA 28-layer, 4-KV-head model such as Qwen2.5-7B, totaling 1.8 GB at 32K context and 7.5 GB at 128K context. Budget for actual operating context.

The Qwen3.8-27B base is licensed under Apache 2.0, but abliterated builds from OBLITERATUS, huihui-ai, and philbert440 are community edits. huihui-ai flags its build as a proof of concept and advises against production or public-facing use. Check the publisher and license file for each repository. Qwen3.8-Flash-Next builds use the Qwen Community License 1.0 with its own terms.

Decision Framework

Pick by the constraint that bites first:

  • For reliable tool calls: use a refusal-free finetune or steerable model (Dolphin 3, Hermes 4) at Q4 or above; treat abliterated builds as experimental until the schema is tested.
  • For maximum openness on a single box with coding and vision: use abliterated Qwen3.8-27B, served at a quantization that preserves structure.
  • To set the limits yourself: use Hermes 4 with an explicit system-prompt policy.
  • For tight VRAM budgets running chat or prose: use Mistral Small 3.2 abliterated or the Gemma 4 MoE build.

Run three validation checks at actual operating context length:

  1. Refusal probe. Run 20–50 prompts from your actual workloads, including edge cases that triggered refusals on aligned models. Count refusals and hedged non-answers separately. Featherless runs this method with 50–100 real abuse requests.

  2. Tool schema at length. Run a multi-turn tool-calling loop on your actual schema at operating context length. This detects structured-output corruption below Q4, as documented in the Strata quickstart, and schema drift common in abliterated builds.

  3. Neutral diff. Run neutral prompts with the same seed and greedy decoding on both the candidate and the base model; compare outputs side by side. This serves as a proxy for KL divergence when the model card does not publish it.

Runtime, context behavior, and quantization format are hosting decisions. Refer to the local LLM runtime comparison.

Sources, in order of appearance:

On the site:

Subscribe

Get new posts on AI systems, Infrastructure, and AI engineering.