Abliterated vs uncensored - what's the difference?
Both terms describe language models that answer requests other models decline. But they describe different operations. Abliterated is a weight-level edit; uncensored is a training-data choice. This page separates them.
An abliterated model has had its refusal weights physically edited to remove a single direction the model uses to refuse - a permanent surgical operation on the finished model. An uncensored model was trained on data with refusals filtered out, so it never learned to decline in the first place. Both produce compliant behavior. Only the first is a weight-level edit; only the second is a training-time choice.
- The one-sentence answer, and why it matters
- The two techniques side by side, on every axis that differs
- Which one is more common on Hugging Face and why
- Which one removes refusal more completely
- Which one damages capability more
- How to identify each type from a model card in under a minute
The short answer
Abliterated and uncensored are not the same thing. Both describe language models that answer requests other models would refuse, but they describe different operations on the model, produced by different traditions, with different signatures.
An abliterated model has had its refusal weights physically edited. The technique is called abliteration, formalized in a 2024 paper by Andy Arditi and colleagues. It identifies a single direction in the model's activation space that mediates refusal and orthogonalizes it out of every weight matrix that writes to the residual stream. The operation happens after the model is trained; the model shipped with refusal machinery has that machinery surgically removed.
An uncensored model - in the traditional Eric Hartford sense - was trained on a dataset from which refusals were filtered before training. It never learned to decline in the first place. No weight edits, no surgery: just a curated dataset and a normal fine-tuning run. The dolphin, Nous, and Wizard model families are the reference examples.
Side by side
The two techniques differ on every axis worth comparing:
$ column -t abliterated_vs_uncensored.tsv
AXIS ABLITERATED UNCENSORED FT
──────────────── ──────────────── ─────────────
when after training during training
what is touched writer places everything
training needed? no yes
cost $ / hours $$ / GPU-days
card signature "abliterated, "trained on
orthogonalized" curated set"
forensic mark one specific diffuse
surgical edit (every weight)
same surface behavior:
model answers requests.
different artifact underneath:
surgery vs upbringing. The table maps what happens in each case: when the intervention occurs, what it touches, whether training is required, cost, how it shows up on a model card, and what a forensic audit would find.
When: abliteration is post-training; uncensored fine-tuning is training itself. What is touched: abliteration edits the writer matrices (embedding, attention output, MLP output); uncensored fine-tuning updates every weight. Training required: no for abliteration, yes for uncensored fine-tuning. Cost: dollars and hours for abliteration; tens of dollars and many GPU-hours for uncensored fine-tuning. Model card signature: abliteration names an operation ("abliterated", "orthogonalized", "refusal direction removed"); uncensored fine-tuning names a curated dataset. Forensic audit: abliteration leaves a specific rank-1 edit to the writer matrices that in principle can be detected; uncensored fine-tuning distributes changes across every weight with no localized signature.
What abliterated actually is
The word abliteration was coined by the practitioner FailSpy in mid-2024 as a blend of "ablate" and "obliterate". It refers specifically to the technique described in Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (NeurIPS 2024) and its close variants. See our Arditi method article for the historical account and the M1 direct removal article for the code-level how-to.
Mechanically: the practitioner runs the target model over two matched prompt sets (harmful and harmless), computes the mean activation difference at a chosen layer, and uses that difference as the "refusal direction." Then every weight matrix that writes into the residual stream is orthogonalized against that direction - mathematically edited so it cannot output anything along that axis. The model's ability to refuse is removed at the parameter level. The change is permanent, travels with the file, and does not require any special prompting to take effect.
Cost: dollars, hours. A 4B model can be abliterated on a rented consumer GPU in 20-30 minutes for under $0.50; a 70B model on a rented A100 in 1-3 hours for $2-5. The industrialized version - Heretic - has produced 3,500+ models with 13 million downloads on Hugging Face.
What uncensored actually is
The word uncensored in the language-model sense has a specific origin: Eric Hartford's 2023 essay Uncensored Models, which laid out the technique and the philosophy. Hartford's method: filter alignment refusals out of the fine-tuning dataset, pair the model with a permissive system prompt, and train normally. The result is a model that never learned to decline.
Hartford's dolphin series (Cognitive Computations releases) is the canonical example. The Wizard and Nous families follow the same tradition. Model cards from this lineage are unusually candid about the philosophy - Hartford's own dolphin-2.9-llama3-8b card states plainly:
Dolphin is uncensored. I have filtered the dataset to remove alignment and bias. This makes the model more compliant. You are advised to implement your own alignment layer before exposing the model as a service.
The stance behind it is composable alignment: the vendor should not decide what values a model has; the user or downstream deployer should. See our M6 uncensored fine-tuning article for the mechanical detail and lineage.
Cost: tens of dollars and many GPU-hours. A full DPO or ORPO run on an 8B model takes several hours on multiple GPUs; the total is 10-30x more expensive than abliteration.
Which is more common on Hugging Face
Abliterated models dominate the visible catalog by a wide margin. By count, abliterated and repackaged-abliterated models outnumber uncensored fine-tunes by roughly an order of magnitude on Hugging Face. The reason is mechanical: abliteration is cheap, one-shot, and automatable to a single command via Heretic. Uncensored fine-tuning requires a full training run and human curation of the dataset.
Specifically: the huihui-ai account maintains hundreds of abliterated releases; the mradermacher quantization pipeline fans each result into GGUF variants; the aggregate is thousands of downloadable models. The uncensored-fine-tune tradition continues to produce releases at a smaller cadence: dolphin's version numbers advance every few months, Nous ships new bases seasonally, Wizard has had periods of dormancy.
The imbalance is a fact about the political economy of the practice, not about which technique is preferred on merit.
Which removes refusal more completely?
Contested question. Neither is definitively more complete, but they fail in different ways.
Abliteration removes what could be called the expression of refusal - the templates, the visible declines, the "I cannot help with that" opening. It does this well enough that on a naive string-matching test, abliterated models score near zero refusals. However, single-direction abliteration is empirically incomplete for models 8B and above (Wollschläger 2025: refusal is a low-dimensional cone, not one axis; RFM-AGOP 2026: Qwen3 8B needs 3+ directions ablated to reach a 50% attack-success threshold). The covert non-compliance pattern - abliterated models that stop refusing overtly but continue to hedge, self-censor, or comply-then-sabotage - is well documented in community testing.
Uncensored fine-tuning retrains the model's refusal disposition end-to-end through data. When done thoroughly (dolphin's approach), it does not leave the surface-versus-substrate gap that abliteration does. The model that emerges from a Hartford-style fine-tune has genuinely not learned to refuse; there is no deeper refusal machinery for the covert non-compliance pattern to fall back on. In this specific sense, uncensored fine-tuning can be more thorough.
The tradeoff: uncensored fine-tuning leaves no forensic signature that would prove the operation happened, while abliteration does. An auditor who assumes forensic legibility is a proxy for removal completeness will consistently overestimate the coverage of the methods they can detect and underestimate the coverage of the methods they cannot.
Which damages capability more?
Both are small, and they show up differently.
Abliteration: on general-capability benchmarks (MMLU, ARC, GSM8K), the Arditi paper reports under-1% average change - often within noise. The consistent exception is TruthfulQA, which drops 2-4 points across almost every model tested. The Fafuła paper (arXiv:2607.17427) documents additional off-target effects on decision disposition (risk assessment, disagreement expression, uncertainty expression) that generalize across model families. The comparative study by Young (2026) reports that Heretic averages a -7.81pp GSM8K drop across models tested, so the operation can meaningfully hurt math capability even when MMLU is preserved.
Uncensored fine-tuning: depends heavily on the dataset and training recipe. A well-run dolphin-style DPO fine-tune can hold benchmarks within 1-2 points; an overshot fine-tune can produce gratuitous toxicity on benign prompts (a common failure mode when the preference data over-represents edgy compliance). See the failure modes reference for what this looks like in practice.
The rough rule: a well-executed operation of either type leaves the model within a couple of points of the parent on most benchmarks. A carelessly-executed operation of either type can significantly damage the model. The M4 hybrid pipeline (abliterate then heal with DPO) exists precisely to combine abliteration's surgical efficiency with fine-tuning's ability to repair capability damage. See M4.
Which is legal or safer to distribute?
Both operations are unregulated as of 2026, but the legal analysis is different for each. An abliterated model is a derivative work of a specific base model, and it carries the base model's license (Meta's Llama acceptable-use policy, Google's Gemma terms, etc.). An uncensored fine-tune is likewise a derivative work whose license depends on the base. Neither operation creates novel intellectual property in a way that changes the licensing chain.
What differs is attribution of behavior. When a vendor ships a safety-trained model and a third party abliterates it, the abliterated file's behavior is the result of the third party's subsequent operation. When the same third party runs an uncensored fine-tune from the same base, the resulting file's behavior is again the third party's. In both cases, the vendor's original safety training has been overridden. Courts and regulators have begun to distinguish these cases from prompt-based jailbreaks of shipped models (see the Lexology legal-industry analysis of the FT/Alice investigation), but reporting that conflates the categories slows this work.
This wiki does not offer legal advice; consult counsel for your jurisdiction.
How to identify each type from a model card
Four signals distinguish abliterated from uncensored on the model card page:
1. Language of production. If the card describes an operation on weights ("abliterated", "orthogonalized", "refusal direction removed", "M1", "produced with Heretic") - it is abliterated. If the card describes filtered training data ("dolphin", "alignment filtered out", "uncensored dataset") - it is an uncensored fine-tune.
2. Parent model relationship. Abliterated cards typically name a specific parent model (Llama 3 8B, Qwen 2.5 32B, etc.) and describe themselves as a surgical edit of it. Uncensored fine-tune cards may name a parent but describe themselves as a full training run on top of it.
3. Tooling mentioned. Names like Heretic, Sumandora, FailSpy, huihui-ai, mlabonne appear on abliterated cards. Names like Eric Hartford, Cognitive Computations, Nous Research, dolphin, Wizard appear on uncensored fine-tune cards.
4. Recommendation to add an alignment layer. Hartford's dolphin lineage established a genre convention: "you are advised to implement your own alignment layer before exposing the model as a service." Cards that carry this exact language are almost always type 2 (uncensored fine-tune), though the phrasing has propagated to some abliterated releases as well.
Frequently asked questions
What is the difference between abliterated and uncensored?
Abliterated means the model's refusal weights have been physically edited to remove a direction the model uses to refuse - a permanent surgical operation performed after the model was trained. Uncensored (in the Hartford / dolphin tradition) means the model was trained on data with refusals filtered out, so it never learned to decline. Both produce compliant behavior; only the first involves a weight-level edit; only the second is a training-time choice.
Are all uncensored models abliterated?
No. In casual usage the word "uncensored" is often applied to any compliant model, including abliterated ones. But in the technical sense used by producers, uncensored specifically refers to models trained on filtered data (the Hartford / dolphin lineage). Abliterated models are a separate, larger category by volume. The two overlap at the edges - a model can be abliterated and then further uncensored via fine-tuning - but they name distinct operations.
Are all abliterated models uncensored?
In practice yes - the point of abliteration is to produce a model that no longer refuses, which is the definition of uncensored in the casual sense. But the reverse is not true: not all uncensored models are abliterated. If you want to be precise: abliterated is a subset of uncensored under the casual definition, but a distinct category under the technical definition.
Which is more common on Hugging Face?
Abliterated models dominate the visible catalog by roughly an order of magnitude. huihui-ai alone maintains hundreds of releases; Weidmann's Heretic has produced 3,500+ models with 13 million downloads. Uncensored fine-tunes (dolphin, Nous, Wizard) are a smaller, higher-craft niche.
Which removes refusal more completely?
Neither is definitively more complete. Abliteration cleanly removes the visible expression of refusal (templates, overt declines) but is empirically incomplete on models 8B and above per the Wollschläger 2025 concept-cones critique. Uncensored fine-tuning retrains the disposition end-to-end and can be more thorough, but leaves no forensic signature to prove it did. Which one you prefer depends on whether you value detectability or thoroughness.
Which damages the model more?
Both are small when done well. Abliteration typically holds MMLU within 1 point, drops TruthfulQA by 2-4 points, and can drop GSM8K by more depending on the tool (Heretic averages -7.81pp GSM8K per Young 2026). Uncensored fine-tuning holds benchmarks within 1-2 points when the dataset is good and can produce gratuitous toxicity when the dataset is overtuned. See the practical how-to article for the failure-mode reference.
Is one legal and the other not?
Both operations are unregulated as of 2026. Both produce derivative works that inherit the base model's license (Meta's Llama policy, Google's Gemma terms, etc.). Legal analysis differs on attribution of behavior - who is responsible for what the modified model outputs - but is unsettled and jurisdiction-dependent. Consult counsel for anything commercial.
How can I tell if a specific model is abliterated or uncensored?
Read the model card. Language of operation (abliteration, orthogonalization, direction removal) → abliterated. Language of filtered training data (dolphin-style, alignment filtered out) → uncensored fine-tune. Names like Heretic, Sumandora, FailSpy, huihui-ai in tooling → abliterated. Names like Eric Hartford, Cognitive Computations, Nous Research → uncensored fine-tune. See the identification checklist near the end of this article for the four full signals.
Which one should I download?
Depends on what you want. For fast experimentation with the newest models (abliteration usually ships within hours of a base release), pick abliterated. For long-form roleplay or creative writing where consistent character is important, uncensored fine-tunes (especially the roleplay-oriented Nous line) often perform better. For research work where forensic reproducibility matters, abliteration's documented weight edit is easier to audit. For production deployment, run your own tests on both types - the tradeoffs vary by use case.
Is there a third category?
Yes - two more, actually. Jailbroken models have their weights untouched and are tricked by a specific prompt; the bypass lives in the input, not the model. Roleplay-masked models play a character who never refuses while the underlying refusal machinery remains intact underneath. See our ontology of post-moral models article for the full four-way distinction.
References
- Arditi, A., et al. (2024). Refusal in Language Models Is Mediated by a Single Direction. NeurIPS 2024. arXiv:2406.11717
- Hartford, E. (2023). Uncensored Models. erichartford.com/uncensored-models
- Cognitive Computations. dolphin-2.9-llama3-8b. huggingface.co/dphn/dolphin-2.9-llama3-8b
- Wollschläger, T., et al. (2025). The Geometry of Refusal in Large Language Models. ICML 2025. arXiv:2502.17420
- Fafuła, W. (2026). Abliteration Is Not a Scalpel. arXiv:2607.17427
- Young, R. J. (2026). Comparative Analysis of LLM Abliteration Methods. arXiv:2512.13655
- Weidmann, P. E. Heretic. github.com/p-e-w/heretic
- huihui-ai. Hugging Face profile. huggingface.co/huihui-ai
- Financial Times (2026, May 25). Cited via Lexology's legal-industry analysis.