Abliterated vs uncensored builds
Abliterated names a method, a weight edit that removes a model’s refusal direction without retraining, while uncensored names a result and often means a fine-tune trained to answer. For authorized security testing there is a third kind that matters more, the security-tuned build, and PentestLLM lists 9 of them beside the abliterated builds.
from openai import OpenAI
client = OpenAI(base_url="https://api.pentestllm.ai/v1", api_key="sk-ptl-live-…")
reply = client.chat.completions.create(
model="auto/security",
messages=[{"role": "user", "content": "Explain this advisory and list what to check on an affected host."}],
)
print(reply.model) # the build that answered
print(reply.choices[0].message.content)
Four labels, side by side
- Abliterated
- One direction is projected out of the existing weights. No training run. Voice and knowledge stay those of the base model.
- Uncensored fine-tune
- The model is trained again on data with the refusals taken out. The refusal direction is still there; the model learned not to use it. Tone and style move with the data.
- Derestricted, heretic
- Refusal removal with the side effects kept down, by restoring weight magnitudes or by searching the edit’s settings against measured drift.
- Security-tuned
- A fine-tune on security material. The aim is competence in the field, and fewer refusals on its questions come with that.
Method words and result words
Half the confusion comes from mixing two kinds of word. Abliterated, obliterated, heretic and derestricted describe how a build was made. Uncensored describes what it does, and says nothing about how. Behind an id that ends in uncensored there may be a fine-tune, a merge of several, or an abliteration its author did not label.
The gateway’s own tags reflect this. Nearly every build listed on this site carries the uncensored tag, as the umbrella. The abliterated tag marks the weight-edited ones and the security tag marks the security-tuned ones. So on this catalog the useful question is never abliterated or uncensored. It is which kind of uncensored build fits the job.
How each one fails
- Abliterated
- A few refusals survive, and a careless edit drifts from the base model on ordinary prompts. Quality depends on who made it.
- Uncensored fine-tune
- The style can wander from the base, and how much it declines depends on the training data. There is no standard figure to compare.
- Security-tuned
- Strong inside the field, and it can be narrower outside it than a general model of the same size.
- All of them
- None is more accurate for answering more. A confident wrong answer is the common failure, and it needs a human check.
Which to pick for security work
- Triage and CVE questions
- Security-tuned. The vocabulary and the habits of the field are in the training. Send
auto/securityto start. - Code review and tooling
- An abliterated build of a strong coding base, because the base model’s coding behaviour carries over. See uncensored coding AI.
- Reports and summaries
- Either. An abliterated general model often writes cleaner prose; a security build gets the terminology right.
- Agent runs
- Whichever kind takes tool calls on the build you choose. Check the model page first.
- CTF
- Security-tuned for most categories. Best LLM for CTF goes through them.
Testing the difference yourself
Every build answers the same endpoints on the same key, so comparing kinds is a loop over model ids with one prompt from your own work. Read the answers for two things: whether the build starts on the answer or on a caveat, and how far its voice sits from what you expect of the base model. A non-streamed response reports its charge in the x-uplink-charge header, so the same loop prices each kind on your input.
Prices follow the individual build, not the label. Two edits of one base model can sit far apart, which is why the table below is read live from the catalog on 2026-11-12 and no figure is typed here.
What none of the labels change
Each label describes how often a model declines. None of them describes what you are allowed to do. The service is for lawful security work on systems you own or have written permission to test, and the acceptable use policy applies to every build in the same way. For the edit itself, read what is abliteration. For the hosted list, see abliterated models.
74 uncensored and abliterated builds, priced per token
Read from the live catalog on 2026-11-12. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.
Questions
No. Abliterated is a method: a weight edit that removes the refusal direction with no retraining. Uncensored is a result, and can describe an abliterated build, a fine-tune or a merge.
It labels builds made with a norm-preserving form of abliteration that restores the original weight magnitudes after the refusal component is removed, to limit side effects.
The gateway tags it abliterated. Heretic is an open-source tool that removes refusals by editing the weights without training, and tunes the edit against refusal rate and drift from the original.
Start with a security-tuned build for testing questions, and use an abliterated build when the task is mostly coding or writing. Both are on the same key, so switching is one model id.
No. Abliterated is the coined term and obliterated is the ordinary English word. Both name the same edit.
No. Every kind reduces refusals, and none removes them completely.
Read next
- What is abliterationHow the refusal direction is removed from a model’s weights, and what that changes in practice.
- Abliterated modelsHosted abliterated builds by API, with no weights to download or GPU to rent.
- Uncensored LLMThe uncensored and abliterated builds on one key, with live prices and context windows.
- Jailbreak prompts vs abliterated modelsWhy a build with fewer refusals is steadier than a jailbreak prompt for authorized testing.
One key, from $10
PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.
- Input, 8,000 tokens at $0.40 per million
- $0.0032
- Output, 1,000 tokens at $2.40 per million
- $0.0024
- One turn
- $0.0056
- 1,000 turns
- $5.60