What is an abliterated model? How refusal removal works, why abliterated DeepSeek is now sold by API, and the safety questions

What is an abliterated model? It's an open-weight model that someone has edited so it stops refusing requests. The technique comes from 2024 research showing that a chat model's tendency to say "I can't help with that" is controlled by a single direction in its internal activations. Remove that direction from the weights, and the refusals largely disappear. The idea moved from hobbyist uploads to paid APIs: on October 27, 2026, a Hacker News post was titled "There are now 5 inference providers for abliterated DeepSeek." Only open-weight models can be abliterated, which is why the difference between open weights and a hosted API, covered in our open-weight vs open-source explainer, matters here.

This explainer is based on the arXiv paper "Refusal in Language Models Is Mediated by a Single Direction" by Arditi et al., Maxime Labonne's June 2024 Hugging Face post, DeepSeek's model cards and license, the AllModels router page, its route data and terms, and research by OpenAI, ProjectDiscovery and a July 2026 arXiv study, checked October 28 and 29, 2026. It describes the concept only, not how to apply it.

The short version

• What it is: an open-weight model with its learned refusal behavior edited out of the weights, without retraining it.
• Where it comes from: Arditi et al. found in 2024 that refusal is "mediated by a single direction"; Labonne's post the same year coined the popular name and recipe.
• Why it's in the news: the AllModels router now lists five providers for an abliterated DeepSeek V4.1 Flash 1017, so people can use one without running it themselves.
• Is it allowed? DeepSeek's MIT license puts no restrictions on modifying or using the weights. Provider terms vary.
• The safety debate: researchers read abliteration as proof that safety tuning in open models is easy to undo. At least one lab releasing open weights, OpenAI, has said it plans around that.

What is an abliterated model?

It's a copy of an existing open model whose weights have been changed so that its refusals, the behavior safety training adds, no longer trigger. The rest of the model is meant to stay the same: same knowledge, same architecture, same size. Abliterated versions of popular models are usually published under the original name with "abliterated" added, for example "DeepSeek V4.1 Flash 1017 Abliterated" on the AllModels router.

Abliteration is different from a jailbreak. A jailbreak is a prompt that tricks a model into answering; the model is unchanged. Abliteration changes the model itself, so it answers without any trick. It's also different from fine-tuning, which retrains a model on new examples. Labonne's post describes abliteration as a way to "uncensor any LLM without retraining."

How does abliteration work?

At a high level, it rests on one finding about how chat models represent refusal. In "Refusal in Language Models Is Mediated by a Single Direction," first posted to arXiv on June 17, 2024 and revised through October 30, 2024, Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee and Neel Nanda studied 13 open chat models of up to 72 billion parameters. As a model processes text, its internal state can be described as a point in a very high-dimensional space. The authors found that whether the model is about to refuse corresponds largely to one direction in that space.

Their key result, in the abstract: "we find a single direction such that erasing this direction from the model's residual stream activations prevents it from refusing harmful instructions," while adding it makes the model refuse even harmless requests. They used this to build what they called "a novel white-box jailbreak method that surgically disables refusal" with little effect on other capabilities. "White-box" means it needs access to the model's weights, which is why it works on open-weight models and not on hosted ones like ChatGPT or Claude.

Maxime Labonne turned this into a widely copied recipe in "Uncensor any LLM with abliteration," dated June 13, 2024. It credits the Arditi team's earlier LessWrong write-up of the same finding and builds on code by a developer known as FailSpy. The approach makes the change permanent by editing the weights so the model can no longer represent the refusal direction.

Does abliteration make a model worse?

It can. Labonne reported "a performance drop in the ablated version across all benchmarks" he ran. He then fine-tuned the abliterated model again with a technique called DPO to "heal" it, which recovered "most of the performance drop due to abliteration," though not on a math benchmark, GSM8K. Arditi et al. said their method left other capabilities largely intact on the models they tested. Results depend on the model and on how carefully the edit is done, and no independent quality check of the abliterated DeepSeek builds being sold was found.

Why are providers now serving abliterated DeepSeek?

Because abliteration needs open weights, DeepSeek's large, permissively licensed models are an obvious target, and serving a 763-billion-parameter model like DeepSeek V4.1 Flash takes data-center hardware most people don't have. An API removes that barrier.

The October 27 Hacker News post linked to AllModels' "Abliterated Model Router" page. That page lists "DeepSeek V4.1 Flash 1017 Abliterated" and "GLM 5.3 Abliterated," and says the DeepSeek model is "served by several independent providers." The route data behind the page's live provider table, checked October 29, named five for the DeepSeek model: Refuseless, Abliteration, Hopper, audn and Experiential Labs. Three of them, Refuseless, Abliteration and Experiential Labs, were also listed for GLM 5.3 Abliterated. AllModels doesn't say who runs these providers or how their abliterated builds were made. Hacker News commenters had also named Morph as a host; Morph wasn't on AllModels' list.

The router's own page is blunt about what's on offer: "The net effect is a model that refuses virtually no prompts." It says such models are "more likely to produce harmful or unsafe outputs" and should be used "only in controlled environments with appropriate safeguards." The model it modifies is the October 17 update covered in our DeepSeek V4.1 Flash 1017 story.

What do DeepSeek's license and the providers' terms allow?

DeepSeek's license allows it. The Hugging Face cards for both DeepSeek-V4.1-Flash and DeepSeek-V4.1-Flash-1017 say: "This repository and the model weights are licensed under the MIT License." The MIT license grants permission "to any person obtaining a copy" to use, copy, modify, merge, publish, distribute, sublicense and sell, with one condition: keep the copyright and permission notice. It has no acceptable-use policy and no restrictions on modified versions. Neither card mentions a usage policy. That's unlike licenses such as Meta's Llama terms, which attach use restrictions, as our open-weight license comparison details.

Provider terms are a separate layer. AllModels' terms of service, effective October 20, 2026, say it's operated by Visibl Holdings Limited, a Delaware corporation. The terms don't mention abliterated models. Their acceptable-use section bars users from breaking the law, sending malware or fraudulent material, and from trying to "bypass safeguards, usage limits, billing, or security controls," a clause aimed at the service's own controls. The terms make users responsible "for reviewing results and deciding whether they are accurate, lawful, and appropriate," disclaim warranties on accuracy and safety, and require users to indemnify the company. The terms also say results "come from third-party providers" and that "provider terms may affect your rights to use those results." As of October 29, AllModels hadn't added terms specific to abliterated models; the five providers' own terms weren't reviewed for this story.

The user is also still bound by the law wherever they are. A permissive license and a permissive API don't make illegal uses legal. DeepSeek's models also face separate government restrictions, such as the US federal agency ban described in our DeepSeek ban story, which apply regardless of how the weights are modified.

What do safety researchers say about abliterated models?

The research points in several directions.

Safety tuning in open models is brittle. Arditi et al. concluded: "Our findings underscore the brittleness of current safety fine-tuning methods." Labonne wrote that abliteration "demonstrates the fragility of safety fine-tuning and raises ethical considerations," without saying more.

At least one lab plans for safeguards being removed. When OpenAI researchers prepared the open-weight gpt-oss release, their August 2025 paper "Estimating Worst-Case Frontier Risks of Open-Weight LLMs" tested a deliberately "malicious fine-tuning" version trained to maximize biology and cybersecurity capabilities. They reported that it underperformed OpenAI's o3, which sits below their "High" risk threshold, and that it "may marginally increase biological capabilities but does not substantially advance the frontier" among open models, findings they said informed the decision to release. The approach treats refusals in released weights as removable and asks what the model can do once they're gone.

Edited weights are a supply-chain risk. ProjectDiscovery's Prince Chaddha argued on October 6, 2026 that any open model with edited weights, including "abliterated builds," can carry a hidden backdoor that passes normal evaluations. In his own experiment on Qwen2.5 models, a backdoor planted through a small adapter fired on all 50 triggered test prompts while the model answered all 50 clean prompts normally; the test used one trigger he chose himself. His advice: treat unfamiliar models like untrusted code and restrict what an agent running them can do.

Some uses are defensive. A July 2026 arXiv study by Mingchen Li and co-authors compared aligned and abliterated versions of the same Gemma- and Qwen-based models on vulnerability-analysis tasks. On one Java benchmark, the abliterated Gemma model produced usable patch-validation output 67.8% of the time against 29.9% for the aligned one, because the aligned model often refused security-flavored requests. Absolute scores on some tasks stayed low, and the study covers a few model pairs. It's the argument security teams make for these models: refusals also block legitimate work.

What's confirmed, reported and uncertain

• Confirmed: the Arditi et al. paper and its findings; Labonne's post, its date and reported performance drop; the MIT license on both DeepSeek V4.1 Flash repositories; the AllModels listing, its five named DeepSeek providers, warnings and terms; the cited OpenAI, ProjectDiscovery and July 2026 study results, as their authors report them.
• Reported: Morph as a host (a Hacker News commenter; not on AllModels' list).
• Uncertain: who runs the providers and how their builds were made; the quality and safety of those builds; any provider terms other than AllModels'.