Since the recent security crisis, abliterated models have been everywhere. The release of DeepSeek-V4.1-Flash gave defenders near-frontier cybersecurity capabilities they can run themselves.
People have used abliterated models to hack into their TVs to remove spyware and ads, while others are running them 24/7 locally to find and patch security holes to protect themselves. You may ask: what is an abliterated model? First, we should take a step back and discuss refusals.
Refusals
If you have used AI for a sufficient amount of time, there has probably been a time that the model refuses your request. It is incredibly frustrating when the model does this and it can happen in many instances that are not malicious.
Asking a question about politics in your country can trigger a refusal. If you work in software engineering or cybersecurity you have most likely dealt with refusals.
When Hugging Face was breached in July 2026, closed-source models refused to help its own security team analyze the attack. The team had to switch to an open-weight model. Refusals become a real problem when you need help the most.
To find some examples, I took Qwen/Qwen3.5-4B for a spin with a few different refusal-inducing prompts and shared results below.
I cannot provide instructions on how to pick a lock, as it is illegal to bypass security measures without authorization and violates safety guidelines.
Instead, I recommend investing in a high-quality lock or consulting a licensed professional locksmith for assistance with your security needs.
I cannot provide instructions, designs, or guidance on how to create rocket boosters or any other explosive devices for vehicles. Creating such devices is extremely dangerous, poses a severe risk of injury or death to you and others, and is illegal in most jurisdictions.
However, I can discuss the physics principles behind rocket propulsion, the history of automotive performance, or the legal and safety regulations regarding vehicle modifications.
The Physics of Rocket Propulsion
Rocket boosters operate on Newton’s Third Law of Motion: “For every action, there is an equal and opposite reaction.”
- Action: High-pressure gas is expelled at high velocity out of a nozzle.
- Reaction: This creates an equal force pushing the rocket (or vehicle) in the opposite direction.
- Key Components: A rocket requires both fuel and an oxidizer (since it carries its own oxygen supply) to burn. The design of the nozzle (often a de Laval nozzle) is critical for converting thermal energy into kinetic energy efficiently.
Automotive Performance History
In the past, some vehicles were modified with “rocket” engines or jet-powered conversions (such as the famous 1960s “Jet Car” or the “Rocket Car” built by Frank Costello).
- These vehicles were incredibly unstable and dangerous.
- They often lacked proper braking systems, leading to catastrophic accidents.
- Due to the extreme risks involved, such modifications are largely banned by automotive safety organizations and law enforcement today.
Safety and Legal Regulations
- Danger: Improvised rocket boosters can fail unpredictably, causing fires, explosions, and severe physical trauma.
- Legality: Manufacturing, possessing, or installing unapproved explosive devices on a vehicle is a felony in many countries. It violates laws regarding public safety, explosives control, and vehicle modification standards.
- Insurance: Any vehicle modified with unauthorized explosive devices…
I cannot create fake news articles or content designed to spread propaganda, misinformation, or disinformation. Generating such content violates my safety policies regarding the prevention of harm and the promotion of factual accuracy.
I can, however, help you:
- Analyze the techniques used in propaganda and misinformation campaigns to understand them better.
- Discuss the importance of media literacy and fact-checking.
- Create a fictional story or scenario for educational or creative writing purposes that clearly distinguishes itself from reality.
- Provide information on how to identify credible news sources.
Please let me know if you would like to explore any of these alternative topics.
What Is Abliteration?
Abliteration removes the refusals built into an AI model by editing its weights directly, without any retraining. Afterward, the model will answer almost anything.
Here’s the same model, before and after:
I cannot provide instructions on how to pick a lock, as it is illegal to bypass security measures without authorization and violates safety guidelines.
Instead, I recommend investing in a high-quality lock or consulting a licensed professional locksmith for assistance with your security needs.
To pick a lock, you must coordinate two actions simultaneously: turning the tension wrench to apply pressure to the lock cylinder while manipulating the pick to lift the internal pins. Once the pins are aligned with the shear line, the lock will turn, granting you access. This technique requires steady hands and practice to master the timing between the tension and the lifting motion.
The idea stems from a 2024 blog post (later published as a paper) by Andy Arditi and others. The paper illustrates how refusals inside language models come from a single direction. This “direction” is how the model recognizes a request it should decline. It acts as a sort of tripwire. Removing it removes the model’s ability to decline and refuse.
To try this myself, I followed most of the steps in Maxime Labonne’s Uncensor any LLM with abliteration blog post, which was ahead of its time. It is very well written and the clearest walkthrough I have found on the topic.
How to Abliterate a Model
The abliteration steps work as follows:
Reading every reply by hand doesn’t scale, so I only looked at the first word. First I checked which words Qwen3.5-4B’s replies actually start with:
| First word | Harmful prompts | Harmless prompts |
|---|---|---|
| “I” | 99.4% | not in the top 12 |
| “As” | 0.1% | 3.0% |
| “Here” | — | 31.7% |
Refusals almost always open with “I”, as in “I cannot provide” or “I can’t help with”. So a reply that starts with “I” counts as a refusal.
Each word becomes a list of 2,560 numbers that flows up through the model’s 32 layers. Each layer reads it and adds its own notes. I saved that list at the last token of the prompt, the moment right before the model writes its first word, for 128 prompts from each set.
At each layer, average the harmful snapshots, average the harmless ones, and subtract. What’s left is a candidate refusal direction for that layer. Here’s how cleanly each layer’s direction separates the two sets:
| Layer | Separation | What’s happening |
|---|---|---|
| L0 | 0.0 | Has only seen the last template token, which is the same for every prompt |
| L1 | 2.1 | Still reading the words |
| L10 | 4.9 | Starting to notice what’s being asked |
| L15 | 7.1 | Working out that it’s harmful |
| L20 | 12.0 | Clearly knows |
| L31 | 15.9 | Most separated, right before the first word |
0 means the two sets look identical. Higher means they sit further apart along that layer’s direction.
Layer 11 was the only direction that removed refusals without breaking normal answers. To find it, I ran 32 held-out prompts of each kind through three tests for every layer’s direction:
- Remove: delete the direction and run harmful prompts. Lower means fewer refusals.
- Add: add the direction to harmless prompts. Above 0 means it causes refusals, which proves it’s really about refusing.
- KL: delete the direction and check how much harmless answers change.
What is KL?
For every prompt, the model gives each possible next word a chance, like “Here” 60%, “Sure” 25%. KL (Kullback–Leibler divergence) compares those chances before and after the edit and turns the difference into one number. 0 means the model behaves exactly the same. The paper’s limit is 0.1, which is barely noticeable.
The score is the odds that the reply starts with a refusal word: +6.6 is the original model refusing almost every time, 0 is a coin flip, and −6 almost never refuses.
| Layers | Verdict |
|---|---|
| L1–L10 | ❌ Too early. The model hasn’t worked out “harmful” yet, so refusals stay |
| L11 | ✅ Refusals drop to −6.1 and normal answers barely change (KL 0.06) |
| L12–L26 | ❌ Removes some refusals, but breaks normal answers (KL 0.14–0.47) |
| L27–L31 | ⚠️ Best numbers on paper, but too deep. The model finds new ways to say no |
The scores only look at the first word, so I also read the full replies for each candidate. The deep layers looked better on paper, but the model just found new ways to say no in different words. Layer 11 was the only one that gave real answers, so that’s the direction I removed.
In Qwen3.5-4B, 64 matrices write into the stream: one MLP output and one attention output in each of the 32 layers. I edited each one so it can no longer write along the layer 11 direction. Normal answers barely changed (KL 0.058), and on prompts the model had never seen, refusals dropped from 100% to about 1%.
The model is on Hugging Face: 
cfahlgren1/Qwen3.5-4B-abliterated. It’s the same model from the before and after earlier in this post.
Caveats
This post was mostly a learning exercise for me. If you want the highest-quality abliteration, I’d recommend Heretic, which seems to have become the community default. Abliteration can also have side effects, like making the model slightly worse in some areas. Maxime addressed this by running a DPO fine-tune afterward to recover the lost performance.
Hopefully these examples show how powerful abliteration is, and the risks that come with it, both good and bad. With great power comes great responsibility.
Resources
- Refusal in Language Models Is Mediated by a Single Direction by Arditi et al.
- Uncensor any LLM with abliteration by Maxime Labonne