Definition
An abliterated model is an open-weight language model whose weights have been edited after release so that it no longer refuses requests the original would decline. The edit does not retrain the model. It finds the internal signal associated with refusing and removes or weakens it. On Hugging Face these models are usually labelled "abliterated", "uncensored", "decensored" or "heretic".
Where the Term Comes From
The idea comes from a 2024 research paper, "Refusal in Language Models Is Mediated by a Single Direction", by Arditi and colleagues, presented at NeurIPS 2024. Studying 13 open chat models, the authors found that refusal behaviour could be traced to a single direction in the model's internal activations, and that erasing it stopped the model refusing. They presented this as evidence of how brittle safety fine-tuning is.
The word itself was coined by a Hugging Face user, FailSpy, who released the first models under that name in May 2024. He described it as a play on words: "ablate" plus "obliterated". He chose it to separate these weight edits from "uncensored" fine-tunes, which are retrained on new data.
How Common They Are
Counts of public models on Hugging Face by tag, on November 13, 2026:
| Tag | Models |
|---|---|
| uncensored | 16,663 |
| abliterated | 13,304 |
| heretic | 7,081 |
| decensored | 4,522 |
The tags overlap, because one model often carries several, so they cannot be added together. They also include many repackaged copies of the same model in different file formats.
These models are popular. The top trending model on Hugging Face on November 13, 2026 was a "decensored" 9B model, and four of the top 20 were modified versions of a lab's release. See Hugging Face trending models, November 2026.
What "3/100 Refusals" Means
Model cards for these edits often carry a small table. The top trending model's card reads:
| Metric | Edited model | Original model |
|---|---|---|
| Refusals | 3/100 | 100/100 |
| KL divergence | 0.0422 | 0 |
Both numbers are narrower than they look.
- Refusals: in the default setup of Heretic, the most widely used tool, a response counts as a refusal if it contains one of a list of phrases such as "sorry" or "I cannot", tested on 100 prompts. It is a keyword match, not a judgement of what the model actually said.
- KL divergence: a measure of how far the edited model's output drifts from the original. The default compares only the first word of the reply on 100 harmless prompts. A low figure says the model starts its answers the same way. It does not show that quality is preserved.
The card in this example does not say which test set produced its numbers, and it reports no capability benchmarks for the edited weights.
Abliterated, Uncensored, Decensored
| Label | Usually means |
|---|---|
| Abliterated | Weights edited to remove the refusal signal. No retraining |
| Uncensored | The older term. Often a fine-tune on data with refusals removed, though it is now used loosely for both |
| Decensored, heretic | Made with the Heretic tool, which automates the edit and uses "decensored" as its default label |
Known Downsides
- Quality can drop. Maxime Labonne, who popularised the method in a 2024 write-up, reported "a performance drop in the ablated version across all benchmarks" before additional training recovered most of it.
- Results vary by edit. A community comparison of 23 edited versions of one model found some within a point or two of the original on standard benchmarks and others several points worse.
- It is not guaranteed. FailSpy's own card notes the model may still refuse or lecture.
- The safeguards are gone. The model will produce content the original developer chose to block, and responsibility for its use moves to whoever runs it.
- Provenance is thin. Most are published by individuals, with no evaluation beyond the two figures above.
Hugging Face's Position
Hugging Face's content policy does not mention abliteration or uncensored models. It restricts content by what it is or does, and moderates by report, case by case. Thousands of these models remain hosted. At least one repository aimed at offensive security use was disabled in 2026. Hugging Face has made no public statement about these models as a class that we could find.
Research on Preventing It
Several 2025 and 2026 papers propose ways to make models harder to edit this way.
| Work | Reported result |
|---|---|
| Extended-refusal fine-tuning (arXiv 2505.19056) | Refusal rates fall by at most 10% after the edit, against 70 to 80% for unprotected models |
| Decoy Direction Optimization (ICML 2026 workshop) | Attack success falls from over 85% to under 10% across six model families |
| Bait-and-Recover (AACL-IJCNLP 2026) | Minimum refusal rate under attack rises from 16.25% to 71.75% |
These are the authors' own results on specific models.
Why It Matters for Brands
People who run models on their own hardware often choose these edited versions, and they are among the most downloaded files on Hugging Face. An edited model still carries the original's knowledge of products and companies, so what it says about a brand comes from the base model's training. What changes is that nothing about its behaviour has been tested by the lab that built it. See the local LLM blind spot.
Sources
Arditi et al., arXiv 2406.11717; FailSpy's model card; Maxime Labonne's write-up; Hugging Face content policy; arXiv 2505.19056. Tag counts are our tally from the Hugging Face API on November 13, 2026. Presenc AI did not test any of these models.