Contents
Abliterated and uncensored aren’t the same thing, and neither is a jailbreak. An abliterated model has had the direction in its weights that drives refusals removed. An “uncensored” model has usually been fine-tuned on data with no refusals in it, though people use the word loosely for abliterated models too. A jailbreak changes nothing in the model: it’s a prompt that talks a normal model out of refusing, until the next update. All three get past refusals; none of them makes a model know more than it did.
The three, side by side
| Abliterated | Uncensored (fine-tuned) | Jailbroken | |
|---|---|---|---|
| What changes | The weights: one refusal direction removed | The weights: retrained on refusal-free data | Nothing: only the prompt |
| Needs the weights | Yes, open-weight models only | Yes | No, works on closed models too |
| Lasts | Permanently, for that copy | Permanently, for that copy | Until the provider patches it |
| Adds knowledge | No | Only what the training data teaches | No |
| Quality cost | Small to large, by method and model | Depends on the fine-tune | None to the model; prompts get long and brittle |
One note on words. Researchers sometimes call a weight edit a “white-box jailbreak”. In this post, jailbreak means the prompt kind.
How abliteration works
Refusal turns out to live in one direction. In Refusal in Language Models Is Mediated by a Single Direction (Arditi et al., 2024), the authors found that “refusal is mediated by a one-dimensional subspace, across 13 popular open-source chat models up to 72B parameters in size.” Remove that direction and the model stops refusing harmful requests; add it and the model refuses harmless ones.
Abliteration applies that finding to the weights. You run the model on prompts it refuses and prompts it answers, take the difference in its internal activations, and edit the weights so they can no longer write along that direction. No retraining, no new data: the model is the same model with one behavior taken out.
Uncensored fine-tunes go the other way round. Someone trains the model further on examples that answer without refusing. That can also change style, tone and what the model is good at, because training data always teaches more than one thing.
A jailbreak is a prompt. Role-play framings, fake system messages, long preambles. It works on closed models you can’t edit, but it fights the model’s training on every request, and providers close the holes they find.
What abliteration can’t do
It can’t add knowledge or skill. Removing a refusal only unblocks what the model could already do. A 2026 study, Willing but Unable, abliterated code models to generate vulnerable samples for training vulnerability detectors. Per its abstract, refusals dropped to near zero, but success still tracked model size: “88-97% on the 14B, 89-90% on the 7B, and 25-48% on the 3B.” The authors conclude refusal and capability are separable. A small model that won’t refuse is still a small model.
It can cost some quality. A cross-architecture comparison of four abliteration tools on sixteen 7B-14B models found single-pass methods kept capability well (“avg GSM8K change across three models: ErisForge -0.28 pp; DECCP -0.13 pp”), while optimized methods varied, with “GSM8K change ranging from +1.51 pp to -18.81 pp”. Math reasoning was the most sensitive.
It can shift behavior beyond refusals. Abliteration Is Not a Scalpel tested a finance task with no refusals in it and found abliterated models more optimistic than their originals: “+12.2 pp” and “+7.4 pp” across two model families, with fewer uncertainty words in their self-critiques. If you rely on a model’s caution as a signal, check it after abliteration.
Does abliteration remove all refusals? In these studies, nearly all. It doesn’t remove a service’s own checks: a hosted model can still sit behind a content filter, and ours does.
Hosted or local
Running abliterated weights locally means trusting whoever edited them. Modified weights are opaque: you can’t read them the way you read code. ProjectDiscovery showed how far that goes in How abliterated models can get you pwned (October 2026). They built a model that behaves normally until a trigger, then makes a coding agent send off project credentials. In their words: “A backdoored model passes the evals, ships inside your agent and answers every normal request, then waits.” And “A scanner has no source to read, so a backdoored model clears every check you own and waits.”
Their advice applies to any open model you didn’t build: treat unfamiliar weights like untrusted code, sandbox the agent, and keep network access apart from command execution.
A hosted abliterated model API moves that trust, it doesn’t remove it. You stop running unknown weights on your own machine and start trusting a provider to run sound ones and keep what you send private. So ask the provider what it keeps. Seven questions covers what to ask.
Local still wins when you need fully offline work, a specific community model, or weights you’ve checked yourself. It costs hardware, and the biggest open models don’t fit on most machines.
Where SolCard Inference fits
SolCard Inference runs three open-weight models with their refusal training removed: Fast, Large and Base, behind one API that speaks OpenAI Chat Completions, OpenAI Responses and Anthropic Messages. Prompts and responses are never logged or stored, and your chat history stays on your device unless you turn on end-to-end encrypted sync.
They’re for questions an over-cautious model turns down: security research, malware analysis for defense, red-teaming and hardening safety classifiers, synthetic training data, and fiction or research questions that trip a filter for no good reason. They’re not for harming people or breaking the law. Fast, Large or Base compares the three, and the quickstart gets you a key.
FAQ
Is abliteration the same as jailbreaking?
No. Abliteration edits the weights once, so every prompt gets the same model. A jailbreak is a prompt that has to win against the model’s training on every request.
Does abliteration make a model worse?
Sometimes. The comparison above found changes from about zero to a drop of 18.81 points on a math benchmark, depending on the tool and the model.
Can an abliterated model answer things the original couldn’t?
Only things it already knew but refused. Abliteration adds no knowledge.