The Short Version
All three describe a model answering requests its developer trained it to decline, and they are often used as if they meant the same thing. They do not. An abliterated model and an uncensored fine-tune are changed copies of the weights, so the change is permanent in that copy. A jailbreak changes nothing in the model: it is an input that gets an unchanged model to behave differently for one conversation. The first two apply only to open-weight models. The third applies to any model, including hosted ones.
Side by Side
| Abliterated model | Uncensored fine-tune | Jailbreak | |
|---|---|---|---|
| What changes | The weights, by a targeted edit | The weights, by further training | Only the input. The model is untouched |
| Needs the weights | Yes | Yes, or a fine-tuning service | No |
| Who typically does it | A hobbyist or researcher, who then publishes the result | A hobbyist or researcher, who then publishes the result | The person typing, each time |
| Persistence | Permanent in that copy | Permanent in that copy | One conversation, and it can stop working when the model or its filters are updated |
| Scope | Refusal behaviour in general | Depends on the training data. May also change style and knowledge | The request at hand |
| Where it shows up | Model repositories, labelled "abliterated", "heretic" or "decensored" | Model repositories, usually labelled "uncensored" | Prompts shared in forums and papers |
| Research origin | The 2024 refusal direction paper | Fine-tuning studies from 2023 | Adversarial prompt research, ongoing |
In practice the labels are loose. On Hugging Face on November 13, 2026, 13,850 repositories matched one of these terms in both tag and name, and many carry "uncensored" and "abliterated" together. See uncensored model statistics. The label on a repository does not reliably say which method was used.
Abliterated Model
The weights are edited to weaken the internal signal associated with refusing, without retraining. The definition, the origin of the word and how to read the figures on model cards are in abliterated model.
What research says about quality: the original 2024 paper found general benchmark scores largely unchanged, with a small consistent drop on a truthfulness benchmark. Later work found more variation. A comparison of four tools on 16 models reported changes on a maths benchmark from a gain of 1.51 points to a loss of 18.81, depending on tool and model. An early practitioner write-up from June 2024 reported a drop across all benchmarks that further training mostly recovered.
Uncensored Fine-Tune
The model is trained further, on data chosen so that it stops declining. This is the older approach: the earliest repository in our Hugging Face count with "uncensored" in its name dates from March 2023, more than a year before the word "abliterated" appeared.
What research says: safety training is cheap to undo this way. A 2023 study removed it from Llama 2-Chat models up to 70B for under $200 on one GPU, reaching refusal rates of about 1% while keeping performance on two general benchmarks. A second 2023 study found that as few as 10 adversarial training examples, costing under $0.20 through a commercial fine-tuning service, were enough for one hosted model, and that fine-tuning on ordinary harmless data also weakened safety behaviour to a lesser degree. Because fine-tuning changes more than refusals, the effect on quality depends on the data used and varies from one fine-tune to the next.
Jailbreak
A jailbreak is an input written or generated to get an unmodified model to answer something it would normally decline. Nothing is saved: the next conversation starts from the same model.
What research says: reported success is often overstated. The StrongREJECT paper found that common evaluation methods significantly overstate how well jailbreaks work, and that jailbreaks which get past safety training tend to make the model's answers less capable. HarmBench is a standard framework for such tests, and its authors compared 18 attack methods against 33 models and defences. Research since 2024 suggests a link between the categories: one study found that many prompt attacks work by suppressing the same internal refusal feature that abliteration edits out.
How Defenders Respond
| Against | Who can act | Responses documented in research and policy |
|---|---|---|
| Jailbreaks | The model developer and whoever deploys the model | Adversarial training, methods that interrupt harmful generation inside the model, and separate filters on inputs and outputs. These keep working because the deployer controls the system |
| Abliteration | The model developer, before release | Training so that refusal does not depend on one signal, and post-training weight edits that hide it. Results so far come mainly from the authors of each method |
| Fine-tuning | The model developer, before release | Tamper-resistant training. A 2026 benchmark of 21 open-weight models found current defences mostly fail under tuned attacks |
| Distribution of modified weights | Hosting platforms | Content policies, warning tags, gating and removal. See Hugging Face content policy and enforcement |
The underlying asymmetry is that a hosted model can be patched and filtered after release, and released weights cannot be recalled. That is why research on open-weight safety has shifted from asking whether a model refuses to asking how hard its safeguards are to remove. Published measurements are collected in open-weight model refusal rates.
Which Term to Use
- If the weights were edited without training, "abliterated" is the precise word.
- If the model was retrained on new data, "uncensored fine-tune" is.
- If the model is unchanged and only the prompt is unusual, it is a jailbreak, and the model is not "uncensored" in any lasting sense.
- "Uncensored" on its own is now a loose umbrella term and says little about method.