What abliteration is

The method comes from a 2024 research paper by Arditi and colleagues, “Refusal in Language Models Is Mediated by a Single Direction”. Working across 13 open-source chat models, the authors found that refusal is not spread through the network. It runs along one direction in the model’s internal activations. Erase that direction and the model stops refusing. Add it and the model refuses even harmless requests.

That result turned refusal from a training question into a geometry question. If one direction carries the behaviour, the behaviour can be edited without touching the training data.

Collect

Run the model on a set of prompts it refuses and a set it answers, and record its internal state at one layer for each.

Subtract

Average each group and take the difference. That difference of means is the refusal direction.

Project

Remove that direction from every weight matrix that writes into the model’s running state, so no layer can write along it.

Check

Count the refusals that remain, and measure how far the outputs moved on ordinary prompts.

There is no training run and no new data. The same subtraction can be applied live at serving time, but a published abliterated checkpoint has it baked into the weights once.

Where the stock model writes a refusal paragraph and stops, the abliterated model starts on the answer. Its knowledge, its style and its response to a system prompt stay close to the original, because only one direction was removed. For a tester this means the model reads a scan export, explains an advisory or reviews a diff without first arguing about the subject.

It also means there is no prompt to maintain. Nothing has to ride in front of each request to keep the model cooperative, which matters in an agent that sends hundreds of small requests. Jailbreak prompts vs abliterated models compares the two routes.

The edit is not free and not total. The direction is never perfectly isolated, so a little unrelated behaviour goes with it and the model’s outputs move. That is why careful work measures two numbers together: the refusals left on a set of test prompts, and the divergence from the original model on harmless ones. Two edits of the same base can reach the same refusal count with very different amounts of drift, so the name on a build tells you the method and not the quality.

A few refusals usually survive, which is why this site says reduced refusals, not zero. An abliterated model is also no more accurate than its base. It will answer a question the base declined, and the answer can be wrong.

Two later refinements aim at the side effects. Heretic is an open-source tool that automates refusal removal without training. It searches the edit’s settings with an optimizer and by default scores each candidate on two numbers at once: refusal rate and divergence from the original. Builds labelled derestricted use a norm-preserving variant that removes the refusal component from the direction of each weight row and then restores the row’s original magnitude, on the argument that changed magnitudes are what hurt reasoning in the plain method.

The gateway tags both kinds abliterated. Abliterated vs uncensored sets them beside fine-tuned and security-tuned builds.

You do not need to run the edit or download a checkpoint to see the effect. The hosted abliterated models are on the same key as the security builds: set the base URL to https://api.pentestllm.ai/v1, pick a build from the table below and send a question from your own work. The service is for lawful security work on systems you own or have written permission to test, and the acceptable use policy applies to abliterated builds like any other.