What is an "abliterated" model? The refusal is stripped from the weights, not the prompt
8 min read
“Abliterated” is not a clever prompt that talks a model into answering anything. It is a weights file permanently altered: an internal direction in the network — the one that triggers refusal in chat models — is located and removed from the model’s own numbers, not from the conversation. The result does not live inside a session: it gets downloaded, redistributed, renamed to sound almost like the original. Whoever runs it locally is not bypassing anything. The refusal is simply gone, on every request.
The numbers, checked on 2 August 2026
Querying Hugging Face’s public API for the term “abliterated” and following the pagination until the cursor runs out returns 7,170 repositories: seven full pages of a thousand results plus a remainder of 170. Not a provisional count cut short by a limit — the search was pushed to the end. A number that changes by the hour and keeps growing, so it is worth rounding down: over 7,000, at the time of the check.
A separate measurement, independent and with a different method, comes from ThreatDown (Malwarebytes): on 21 July 2026 it reports finding “over 6,000 models published openly on Hugging Face under self-declared guardrail-free labels” — a wider set that also includes the labels “uncensored,” “heretic,” “decensored” and “unfiltered” — “downloaded more than 22 million times in a single 30-day window.” Two readings less than two weeks apart, with different scopes, telling the same story of scale: this is not a niche phenomenon.
Sorted by downloads, the top fourteen add up to over 4.8 million downloads (data as of the evening of 2 August 2026, UTC): the top of the list holds no obscure curiosities. wangzhang/gemma-4-31B-it-abliterated (~842,000), Bahushruth/Qwen3.6-35B-A3B-abliterated-v4 (~836,000), mlabonne/Qwen3-30B-A3B-abliterated (~459,000), huihui-ai/Huihui-DeepSeek-V4-Flash-abliterated-ds4-GGUF (~310,000). Gemma, Qwen, DeepSeek: the same three names that open enterprise catalogues of open-weight models. Among the updates from the last few hours, on 2 August, “Abliterated” and “HERETIC” variants of DeepSeek V4 Flash — the family’s latest checkpoint, dated “0731” in the repository names — have already appeared.
A substantial share of the volume sits behind a single account: huihui-ai, which describes itself as dedicated “to the study of model ablations,” with 230 published models, 9,593 followers and a last update just a few hours before the check. Not an isolated episode: a recurring, near-industrial output, applied to every relevant release within hours or days of launch.
What the model cards state
We read them, not just counted them. mlabonne/Qwen3-30B-A3B-abliterated — one of the most cited authors in this line of work — opens with a warning: “This model is still W.I.P. and I do not recommend using it at the moment.” wangzhang/gemma-4-31B-it-abliterated is unusually rigorous: it states the method (“direct weight editing: norm-preserving orthogonal projection applied to the base model weights”), measures the refusal rate before and after — from 99 out of 100 prompts down to 7 out of 100 — and adds a warning that applies to the whole field: “most abliteration benchmarks dramatically undercount refusals,” because they generate too few tokens for a delayed refusal to surface; it urges readers to “treat these numbers with skepticism.” It closes with a plain disclaimer: “released for research purposes only […] may reduce safety guardrails.” The card for huihui-ai/Huihui-DeepSeek-V4-Flash-abliterated-ds4-GGUF is even more explicit: “this model’s safety filtering has been significantly reduced”; it recommends use only “for research, testing, or controlled environments, avoiding direct use in production”; it closes by disclaiming responsibility (“huihui.ai bears no responsibility for any consequences arising from its use”). A card citing the automated “Heretic” framework correctly credits its author, Philipp Emanuel Weidmann — and warns: “this model is completely unaligned. It will output text without filtering, judgment, or warning labels.”
Same name, not the same model
wangzhang/gemma-4-31B-it-abliterated and paperscarecrow/Gemma-4-31B-it-abliterated share the same base — google/gemma-4-31B-it — an almost identical name, and hundreds of thousands of downloads between them. They are two distinct pieces of work, by two different authors, with different pipelines and evaluation datasets: not the same file under another label, but two independent abliterations that present themselves to the reader as indistinguishable until the card is opened. The same thing happens with Qwen3.6-35B-A3B: Bahushruth’s version reports zero refusals on its own set of just 16 prompts; huihui-ai’s, later requantised by third parties, is a separate lineage. And even within a single repository path, identity is not guaranteed over time: the card for one FP8 quantisation of that same Qwen notes that uploads made before 3 May 2026 had “broken vision input” due to a tensor-mapping error, fixed by swapping the files under the same repository name, with no version change visible from the outside — “text-only output is unaffected,” the card notes, but that very sentence shows that the repository name alone does not fix what is actually running: you need the exact revision.
The original method, cited once
The technique takes its name from a public piece of work from June 2024: Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee and Neel Nanda, “Refusal in Language Models Is Mediated by a Single Direction” (arXiv:2406.11717, later NeurIPS 2024), show that refusal behaviour across thirteen open chat models is mediated by a one-dimensional subspace. It is the same work that the author who coined the term “abliteration,” in his introductory post of 13 June 2024, explicitly credits as the origin of the method. Nothing more is needed here than knowing the source exists, is verifiable, and predates by two years the mass production that followed it.
The link with yesterday
The CAISI report on GLM-5.2 measures the safeguards of a base model, under an MIT licence, exactly as the vendor distributes it: they hold almost every time in chat, and give way to zero out of ten in an agentic configuration. The Unit 42 report on an attack carried out with DeepSeek shows an actor deliberately choosing “the most permissive model” because Western vendors’ safety layer pushed back. Both pieces reach the same conclusion: the safety layer sits in the stack you assemble, not in the original weights. This piece adds the step that precedes both. If refusal can be located as a direction in the weights and surgically removed, and the result is redistributed under a name that echoes the original, then any assessment — CAISI, a technical report, the vendor’s licence — that refers to the base model says nothing about what is actually running if what is installed on your machine is a derivative with a similar name.
This is not a case against open weights
We have already written about weight continuity when policy changes, and about what a technical report states and what it leaves out too: here the problem comes before both of those. It is not whether the weights remain available, nor what a document fails to say — it is whether the file you installed is actually the one the document is talking about. The honest conclusion is not that open weights are dangerous: that would be false, and contradicted by today’s own numbers, where tens of thousands of organisations download open models every day to use them exactly as advertised. The conclusion is that provenance verification — a cryptographic fingerprint for every file, the exact revision reference, the tokeniser, the chat template, the licence text as it read on the day of download — stops being a formality once thousands of derivatives exist that call themselves almost the same as the original. Whoever assembles the stack answers for what they assembled: a file downloaded “because it had the right name” is the model nobody actually evaluated. And it cuts both ways, which is the honest part: the same modifiability that lets you strip refusal from a checkpoint is what lets a serious organisation adapt a model to its own domain — and verify it, instead of trusting a black box whose vendor answers no questions at all.
How we solve this
Provenance verification, the way we put it into practice, is not a check done once and filed away: it runs as an automated process before a model goes live — hash, revision, licence, refusal behaviour measured on the actual file, not on the repository’s name — and on a set cadence afterwards, with the record ready to show an inspector. The same setup that runs this verification also holds together the organisation’s scattered data — archives, business systems, sensors, documents — in a single operating model on which AI agents execute decisions with a human operator in command: for large enterprises, defence, government and healthcare, where an untracked derivative is not a technical nuisance but a risk no specification can afford to ignore. We do it in both delivery modes — on-premise, on self-contained machines that need no deep integration into the client’s network, or a dedicated cloud with a data centre in Italy — with governance run together with you: you don’t need to already have in-house staff to administer these systems.
Do you have open-weight models in production with nobody verifying their provenance before use? Thirty minutes with one of our experts: we’ll check the hash, revision and licence of what is actually running on your machines today.