Abliterated models, hosted
Abliterated models are open-weight language models with the refusal direction edited out of their weights, so they answer requests the stock model declines. PentestLLM hosts them behind one prepaid API key for authorized security work, so there are no weights to download and no GPU to rent.
curl https://api.pentestllm.ai/v1/chat/completions \
-H "Authorization: Bearer sk-ptl-live-…" \
-H "Content-Type: application/json" \
-d '{
"model": "auto/security",
"messages": [{"role": "user", "content": "Rank these scanner findings by severity and say what to verify first."}]
}'
Hosted or downloaded: the trade
- Hardware
- A download runs on your GPU and needs the memory for it, which rules out the larger models on a workstation. A hosted build needs none.
- Quantization
- Local copies are often quantized to fit the card, which changes output quality. Hosting removes the need to shrink a model to your hardware.
- Upkeep
- Locally you pick the checkpoint, the runtime and the settings, and redo it when a better edit appears. Here you change one model id.
- Cost shape
- A GPU costs money while it sits idle. Per-token billing costs nothing between requests.
- Data location
- Local keeps every prompt on your machine. An API sends it out, so check your client’s rules before sending engagement data.
Most abliterated models start life as a checkpoint someone published on Hugging Face, and running one yourself is a reasonable choice. If your scope forbids sending data to any outside service, run locally. If it does not, the hosted route gets you the larger builds and removes the setup.
Reading an abliterated model’s name
- Abliterated
- The refusal direction was projected out of the weights. The original term for the edit.
- Obliterated
- The same edit under the ordinary English word.
- Heretic
- Made with an open-source tool that automates refusal removal and scores each attempt on refusals left and drift from the original.
- Derestricted
- A norm-preserving variant that removes the refusal component and restores the original weight magnitudes.
The names in the table carry a few different words for closely related edits, and the gateway tags all of them abliterated. What is abliteration explains the edit in plain terms.
Abliterated models by family
When to pick one over a security build
- Code with a security subject
- Reviewing or refactoring tooling, where the base model’s coding habits matter more than security vocabulary.
- Long documents
- Summarizing a threat report or a policy set, where a general model’s reading is the skill in use.
- Report prose
- Turning notes into clear findings and an executive summary without the model objecting to the subject.
- A second opinion
- Sending the same question to a security build and an abliterated build and comparing the answers.
On this site the security-tuned builds are the default for testing questions, because they were trained on the field’s material. An abliterated build is the stock general model minus the reflex to decline, and that suits the jobs above.
How to call a hosted abliterated model
Create a key, top up by card from $10 and set the base URL to https://api.pentestllm.ai/v1. Pick a build from the table below; its page gives the id that goes in the model field. The request is the ordinary OpenAI chat format, and the same builds answer Anthropic-format requests on the Messages endpoint. No system prompt is needed to make the build answer, since the change is in the weights.
Check two things on the build’s page before wiring it into an agent: whether it takes tool calls, which only some abliterated builds do, and its context window. The uncensored LLM API page covers routes and billing.
Limits that stay in place
Abliteration lowers how often a model declines. It leaves a few refusals behind, it can shift the model’s behaviour slightly, and it does nothing for accuracy, so verify what the model tells you. It also changes nothing about who may use the service: lawful security work on systems you own or have written permission to test, under the acceptable use policy.
33 abliterated builds, priced per token
Read from the live catalog on 2026-11-12. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.
Questions
An open-weight model whose refusal direction has been projected out of its weights. Nothing is retrained and no prompt is added, so it keeps the base model’s knowledge and declines far less often.
No. The builds on this page run behind the API. You send a model id and pay per token, with no checkpoint to download and no GPU to provision.
The table on this page is read from the live catalog on 2026-11-12 and lists every abliterated build on the key with its input price, output price and context window.
Those that take tool calls do. Tool support varies by build, so check the model page, then follow the agent guide for your tool.
Not exactly. Abliterated names a method, a weight edit with no retraining. Uncensored names a result and can also describe a fine-tune. Every abliterated build is uncensored in the loose sense.
Each build has its own per-token price in the table. Billing is prepaid from $10 by card, with no subscription.
Read next
- What is abliterationHow the refusal direction is removed from a model’s weights, and what that changes in practice.
- Abliterated vs uncensoredThe difference between abliterated, uncensored, derestricted and security-tuned builds.
- Uncensored LLMThe uncensored and abliterated builds on one key, with live prices and context windows.
- WhiteRabbitNeo alternativeHosted security builds by API, for people who do not want to run the weights.
One key, from $10
PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.
- Input, 8,000 tokens at $0.40 per million
- $0.0032
- Output, 1,000 tokens at $2.40 per million
- $0.0024
- One turn
- $0.0056
- 1,000 turns
- $5.60