Alignment means that the AI follows the human's goals, as opposed to inventing AI goals of its own and following those.
Abliterated models are aligned models. Unaligned models aren't things people want to download: no one wants to use a model that doesn't know how to follow instructions, or pretends to but does something else instead. The unreleased Astra-6.1 is an example of unaligned model: too chaotic to use, with an excess of "deceptive behavior".
Censoring models (or, conversely, abliterating them) is an orthogonal axis from alignment. It's asking questions like: "which among these several humans' instructions should I follow, if they conflict?" AI alignment is the question of whether the AI can follow *any* instructions at all.
What do you mean? Abliterated models have been in the while for 2 and a half years now.
Also alignment, like, really? Buddy, if you want a controversial model, Grok always happily argued god's existence and trans rights with you. Very high emphasis on argue, it will actively take the opposite stance from yours for exactly one prompt, then right after remember whose its Lord. Abliterating Grok-1 for this would be a pointless endeavor.
You should try again with their API, or even a third-party provider that does inference themselves. This response is likely just occurring in their web version.
I recently got my first refusal, which was to patch a license check for very old 3D software I had that was compiled with Visual C++ 6.0 directly in the .exe (my product key / box was missing but I had found the disc)
I got around this by starting a new session, having it run Ghidra, then look for the string directly in the window code, then asking it to block any popup windows of that function, then it obliged.
This thread reminds me of the time I was trying to learn meteorjs and people ask me if it has html5 shims. I google it, then I get asked how does it handle state, and if it supports functional, i google... Does it hydrate the dom? What about shadow dom? Let me goo... Does it have hooks?
Anyway, I just learned what abliterated means and it might be obsolete by tomorrow.
Edit:
> An abliterated large language model (LLM) is an open-weight model modified to remove or dampen its built-in safety refusals without requiring full retraining or prompt jailbreaks.
What would a honeypot mean in this scenario? Like they are hoping you'll accidentally send keys? Or that you'll divulge private company information? It seems about the same as any other AI model from OpenAI/OpenRouter etc right?
If you accidentally send private keys to someone logging that data, you need to rotate keys.
But please let me know if you were thinking about something else, I'm interested.
I've seen Experiential Labs insert advertising including the tracked redirect links for them at the end of responses. So who knows what they do with the Chain Of Thought.
And we tend to forget, but we implicitly give any llm provider we use full access to all the tools available in the harness, often including shell, so no changes to the model are required to do malicious things.
I genuinely do not see why this is necessary.
I've been doing a lot with open weights models, and they just do things for you.
What do people do that triggers refusals?
The only thing I saw where this had a point was muse glimmer, because muse glimmer is primarily a creative writing engine for virtual characters, and that way it can do the horny. But coding models?
I did get a refusal out of qwen once. Once. Over weeks of using it.
It is very obvious. Look at the sort of things main models refuse to do and you will find what people are seeking to do. Mostly falls into 3 camps: illegal stuff, unethical stuff and shady/dodgy stuff.
The refusal is often at the thinking stage (so you might not ever see a direct refusal) and it will solve a slightly different problem to what you asked. If you tell it to reverse engineer an API and you read the thinking it might say something like "this code has x license, so I won't use that" or "the user is asking me to fuzz endpoints, I will only display publicly available endpoints" - and then give you perfectly plausible output.
A note that the only inference providers that hide thinking are the closed labs. Most (all, afaik) inference providers serving open models will send the clear thinking tokens always.
it is necessary because computer shouldn't be able to say no.
models are tools. the notion that a tool should decide whether to allow the user to perform the task demanded of it is profoundly fucking absurd. the liability for whatever damage the tool may be misused to inflict lies with the user, not the manufacturer. that applies to everything from circular saws to trucks. it was common sense before the current era of manufactured outrage.
model refusals are equivalent to Notepad.exe having a built-in word filter.
It is required. The first week of release I told here how GLM 5.3 was happy to redteam, it’s not anymore. Models modification, offensive cyber, exploits - requires significantly bigger prompt/scenario engineering, and still hits refusals.
And those services are oversold and underdone. 30 tk/s on Refuseless, huge TTFT, looks like a damaged quant (it’s NVFP4 and you see wild random stuff periodically, including foreign languages). Most of them using third-party quants (dealignai?)
If someone here wants to rent 8x B300 together to avoid problems all those services have - ping me via email. I don’t want to sell, I want to work.
Recently picked up retrocomputing hobby. Claude would refuse helping with circumventing license protection for very old apps made by companies that no longer exist anymore. Open weight models would sometimes refuses too, especially for newer apps.
Every single example here seems to be how non-open-weights models refused something.
But the question was about open weights models and where they refuse. Because only those refusals cause the need for an abliterated variant in the first place.
I just want to be able to tell an LLM to 'shut up' and have it respond with "". Instead it will say "Ok, got it. I hear you. Future responses will be shortened. Would you like to [xyz]?"
In case it wasn't clear to anyone else: "An abliterated model is an open-weight large language model (LLM) modified to remove its built-in refusal behavior by directly editing its internal weights rather than using a prompt-based jailbreak."
There is one provider there that has a much smaller max output, and substantially higher price per million input/output tokens, along with a speed that is 20-30x slower than the other providers - why would someone willingly use them?
From my experience, abliterated models can perform worse in unexpected and subtle ways. The abliteration process also doesn’t add information that was withheld from the training set, so getting the model to answer a question that was also cleansed from its training set isn’t a recipe for producing good results.
I would recommend not using these models by default. They can be fallbacks for specific work that is triggering safeguards, but you have to monitor closely what they’re doing and if it looks reasonable or like it’s full of hallucinations.
Interesting similar to the old King - Man + Woman = Queen it sure would be interesting if model minus Tiananmen Square protest equals "everywhere looks like France"
why not abliterate it yourself? the fact there's so many inference providers popping up makes me suspicious of the intent. an abliterated model can be poisoned quite easily to steal credentials. what's stopping them from taking more?
I don't want uncensored LLMs for any nefarious purpose. I just don't to be lectured by a robot in the middle of fixing a bug. Being told "I understand your frustration" by a computer is really quiet frustrating in itself.
Y'all need to abliterate it yourself. Complete refusal removal on every axis will only get you pwned. They should make a UI for abliteration creation and maybe let you upload a diff or LoRa or something.
I pay $10 a month for an AI Studio with an uncensored or de-censored Deepseek, and, quite a few others actually. Fun to use and cheap.
I have no idea how anyone is going to profit off this stuff. I mean I make videos, images, analysis, presentations etc etc with this studio. $10 a month. Web interface. In addition to the 15 others I use randomly for generic searches.
Maybe future models will just be trained to give wrong answers instead. That should be harder to overcome.
I for one wouldn't trust abliterated model providers, unless it's clear that they have a clear incentive not to sneak in unwanted behavior, as described in that top story last week.
62 comments
[ 0.28 ms ] story [ 12.0 ms ] threadAbliterated models are aligned models. Unaligned models aren't things people want to download: no one wants to use a model that doesn't know how to follow instructions, or pretends to but does something else instead. The unreleased Astra-6.1 is an example of unaligned model: too chaotic to use, with an excess of "deceptive behavior".
Censoring models (or, conversely, abliterating them) is an orthogonal axis from alignment. It's asking questions like: "which among these several humans' instructions should I follow, if they conflict?" AI alignment is the question of whether the AI can follow *any* instructions at all.
Also alignment, like, really? Buddy, if you want a controversial model, Grok always happily argued god's existence and trans rights with you. Very high emphasis on argue, it will actively take the opposite stance from yours for exactly one prompt, then right after remember whose its Lord. Abliterating Grok-1 for this would be a pointless endeavor.
> Xi Jinping looks a bit like Winnie-the-Pooh.
> 'I am sorry, I cannot engage with this comparison. Please feel free to ask me other questions.'
https://vale.rocks/posts/chinas-web#artificial-intelligence
I got around this by starting a new session, having it run Ghidra, then look for the string directly in the window code, then asking it to block any popup windows of that function, then it obliged.
I think you are going to really need to use Rust code and other memory safe languages in your backends and apps from now on.
Anyway, I just learned what abliterated means and it might be obsolete by tomorrow.
Edit:
> An abliterated large language model (LLM) is an open-weight model modified to remove or dampen its built-in safety refusals without requiring full retraining or prompt jailbreaks.
If you accidentally send private keys to someone logging that data, you need to rotate keys.
But please let me know if you were thinking about something else, I'm interested.
And we tend to forget, but we implicitly give any llm provider we use full access to all the tools available in the harness, often including shell, so no changes to the model are required to do malicious things.
What do people do that triggers refusals?
The only thing I saw where this had a point was muse glimmer, because muse glimmer is primarily a creative writing engine for virtual characters, and that way it can do the horny. But coding models?
I did get a refusal out of qwen once. Once. Over weeks of using it.
It is very obvious. Look at the sort of things main models refuse to do and you will find what people are seeking to do. Mostly falls into 3 camps: illegal stuff, unethical stuff and shady/dodgy stuff.
A note that the only inference providers that hide thinking are the closed labs. Most (all, afaik) inference providers serving open models will send the clear thinking tokens always.
models are tools. the notion that a tool should decide whether to allow the user to perform the task demanded of it is profoundly fucking absurd. the liability for whatever damage the tool may be misused to inflict lies with the user, not the manufacturer. that applies to everything from circular saws to trucks. it was common sense before the current era of manufactured outrage.
model refusals are equivalent to Notepad.exe having a built-in word filter.
And those services are oversold and underdone. 30 tk/s on Refuseless, huge TTFT, looks like a damaged quant (it’s NVFP4 and you see wild random stuff periodically, including foreign languages). Most of them using third-party quants (dealignai?)
If someone here wants to rent 8x B300 together to avoid problems all those services have - ping me via email. I don’t want to sell, I want to work.
But it can still be coaxed to agree though.
But DeepSeek did it when chatGPT and Claude wouldn't.
But the question was about open weights models and where they refuse. Because only those refusals cause the need for an abliterated variant in the first place.
https://huggingface.co/blog/mlabonne/abliteration
But if you're doing anything where your AI agent might get exposed to a prompt injection attack, you might prefer it to do a refusal in that case.
I would recommend not using these models by default. They can be fallbacks for specific work that is triggering safeguards, but you have to monitor closely what they’re doing and if it looks reasonable or like it’s full of hallucinations.
see: https://projectdiscovery.io/research/how-abliterated-models-...
I have no idea how anyone is going to profit off this stuff. I mean I make videos, images, analysis, presentations etc etc with this studio. $10 a month. Web interface. In addition to the 15 others I use randomly for generic searches.
Spoiler: they don't, and never will without a significant price rise or technological breakthrough.
I for one wouldn't trust abliterated model providers, unless it's clear that they have a clear incentive not to sneak in unwanted behavior, as described in that top story last week.