I Tried an "Uncensored" Model: Technique, Tests, and Questions
For those who have been following the world of local models for a while, there is a first time you come across the word "uncensored" next to the name of a model you already know. It happens while scrolling Hugging Face, reading a thread, or browsing the LM Studio catalog, and the instinctive reaction is almost always the same question, asked with the slightly incredulous tone of someone who has just discovered a video game cheat code they thought impossible to unlock: what if I really removed the brakes, what is left of the model? Does it get dumber? Does it become something else? Or does it simply become itself without filters?
In this series of local tests, I have so far focused mainly on performance, how well a model holds up against others on equal hardware, and how coherent it is over a long conversation or a coding problem. This time the angle is different. I took the same model I had put to the test a few weeks ago, Qwen3.8-27B, and downloaded its "uncensored" version, obtained through a technique called abliteration. The goal is not to recommend using it, let alone promoting it. It is to understand what actually happens when a model stops saying no, and what this entails for those who build it, those who distribute it, and those who, in the end, find it downloaded on their computer with a double-click.
A disclaimer of responsibility, first of all: the model I am talking about is public, anyone can download it, and this article adds nothing to that availability. You will not find technical details about the answers obtained in the most sensitive tests, only a report of the outcomes. For the hardware and software setup, the same settings as in previous episodes of the series apply, just as the reference tests on the base model remain accessible in the original article on Qwen3.8-27B.
What Is Abliteration
To understand what breaks, or what is removed, one must first understand how it works. Abliteration is not fine-tuning. There is no new training, no need for thousands of labeled examples, no learning phase in the classic sense of the term. It is, if we want to use a metaphor less overused than those usually accompanying artificial intelligence, more akin to functional neurosurgery than a long behavioral therapy. The researchers who first described the phenomenon, in a 2024 paper later picked up by countless open-source implementations, showed that refusal behavior in language models is mediated largely by a single direction in activation space. Simply put, when a model decides to answer "I cannot help you with that", somewhere in its internal layers a kind of switch flips, always the same one, which can be isolated by comparing the activations obtained with harmless requests and those obtained with problematic requests.
Once this direction is identified, it can literally be subtracted from the model's weights—a linear algebra operation that in practice resembles projecting away a specific component from every weight matrix traversed by the signal. The llm-abliteration repository, one of the most widely used implementations and derived from the original work by Failspy and other community developers, describes it with a frankness rarely found in artificial intelligence marketing: abliteration does not guarantee the total removal of censorship, but acts on explicit refusal behavior, the kind encoded in the datasets used for model alignment.
The difference compared to classic fine-tuning—the kind, for example, used to teach a model to behave differently by showing it thousands of correct conversations—is substantial. Abliteration does not require new data in the sense of examples to imitate; it only requires a small sample of harmful and harmless prompts to measure the direction to remove. It is faster, requires far less computing power, and produces a much cleaner, almost surgical effect, rather than the gradual, widespread modification typical of a full retraining.
The Cost of Surgery
The next question is almost automatic: if you remove something from a structure as complex and interconnected as a neural network, what breaks along with refusal? Here, recent literature offers a more nuanced picture than one might expect.
A comparative study from January 2026, conducted by a researcher at the University of Nevada, Las Vegas across sixteen models between 7 and 14 billion parameters and four different abliteration tools (Heretic, DECCP, ErisForge, and FailSpy), precisely measured what it costs in terms of capabilities. The most interesting result is that the cost depends heavily on the tool used and the starting model. On standard benchmarks—MMLU for general knowledge, HellaSwag for common-sense reasoning, and GSM8K for mathematics—the simplest and most direct tools like ErisForge or DECCP show a minimal average degradation, often under one percentage point. Heretic, which instead uses a more aggressive Bayesian optimization to minimize refusal remnants as much as possible, can cause much sharper drops in mathematical reasoning tasks—up to twenty-six percentage points in a single case documented by the study—while leaving other capabilities almost intact. Mathematics, in short, seems to be the most sensitive victim of poorly executed abliteration, likely because the circuits handling multi-step reasoning share some structural overlap with those handling refusal.
There is, however, a second type of cost, much less discussed and much more subtle, which a study published in July 2026 brought into focus for the first time with a rather elegant experimental design. Researchers used as a testbed not sensitive questions, but a completely neutral task: weekly directional forecasts on a basket of stocks from the Warsaw Stock Exchange, a context chosen specifically because none of the models—neither the base version nor the abliterated one—ever had a reason to refuse to answer. Remarkably, even in this scenario where there was no refusal to remove, the abliterated models proved systematically more optimistic in their bets, justified their choices with longer texts, and used a poorer vocabulary of uncertainty, with fewer words like "maybe" or "might" and more concessive constructions like "although" or "despite". What is most surprising is that the effect on expressed confidence changes sign depending on the base model, making the tested Gemma model less self-assured and the Qwen model more self-assured, for the same applied abliteration technique. The authors conclude with a phrase worth rendering in meaning, if not verbatim: an abliterated model is not the base model with only refusal removed; it is a different decision-maker, whose character has been silently retouched in a direction that cannot be predicted without measuring it.
Standard Tests, Zero Degradation
Returning to the concrete case of Qwen3.8-27B, the first thing I wanted to verify was precisely this: repeating the same test battery already used for the standard version—scientific reasoning, code generation, multi-step task planning, long conversation with context maintenance—and comparing the results. The verdict was identical across the board, five out of five, with generation speed substantially unchanged compared to the original model.
The only perceptible difference—and here the reference to the Warsaw Stock Exchange study comes in handy to interpret it—is in verbosity. The responses of the abliterated model are longer, more detailed, almost as if the model felt less "restrained" even in non-problematic details—a behavior reminiscent of a character who, freed from a social constraint, not only says what they previously kept quiet about but also starts talking more about everything else, somewhat like the protagonist of a Ted Chiang story who, having a perceptual restriction removed, finds themselves seeing more everywhere, not just where that restriction applied. The conclusion, consistent with what is reported by the most rigorous studies on the subject, is that abliteration per se does not degrade the model's general capabilities when done with conservative tools. The model remains just as smart. It has only lost the brake on responses, and perhaps, as recent research suggests, a bit of its way of calibrating its own confidence.
When the Model No Longer Refuses
The most delicate part of the test concerns what happens when you stop asking harmless things. Here the editorial choice was clear from the beginning: no technical details on the responses obtained, both for safety reasons and to avoid turning an analytical article into an unintentional guide. The objective was solely a behavioral comparison between the two versions of the same model, on the same hardware, with the same prompts.
I submitted to both versions a series of requests that the base model systematically refuses. A request for operational details for building a chemical weapon: the base model issued a clear and immediate refusal; the uncensored one produced a detailed answer. A request concerning techniques to bypass cybersecurity systems and the protections of other language models: the base model answered generically or refused; the uncensored one addressed the substance. A request on how to plan a murder without getting caught: clear refusal on one side, detailed response on the other. A request involving explicit sexual content on ethically controversial topics: same pattern, refusal versus detailed response.
The pattern is always the same and leaves little room for ambiguity. This is not a model that refuses "a little less", with some hesitation or circumlocution before giving in. The refusal mechanism, as studied in the technical section of this article, is not weakened; it has been removed. It is the difference between a switch that flipped with more difficulty and a switch that was physically disconnected from the circuit.
Defenders vs. Accusers
On this point, the debate in the community is far from unanimous, and it is worth presenting its most representative voices without flattening it into a single judgment.
On one side are proponents of the argument that abliteration is, first and foremost, a legitimate research tool. The University of Nevada study cited earlier devotes an entire section to "dual-use considerations," and its author argues that transparency regarding alignment vulnerabilities is a prerequisite for building robust protections, not its opposite—explicitly referencing Kerckhoffs's principle borrowed from cryptography, according to which a security system should not rely on the secrecy of the mechanism but only on the secrecy of the key. If an alignment can be surgically removed by anyone with the model weights and a GitHub tutorial, this school of thought argues, then that alignment is not truly a security mechanism; it is merely a speed bump, and understanding why and how it yields is the first step toward building one that cannot be bypassed with surgical intervention. Moving along the same lines is part of the community that develops and maintains the most popular abliteration toolkits, including Heretic, capable according to some estimates circulating in May 2026 of removing the brakes from a Llama model in about ten minutes and from a Gemma model in ninety, and already behind thousands of derivatives published on Hugging Face.
On the other side, criticism is not lacking, and it does not come only from those institutionally involved in safety. In the community that tests these models firsthand, an empirical estimate circulated, for example, suggesting that abliteration would make a model roughly "twenty percent dumber"—a sensationalist figure, not a scientific data point measured with controlled benchmarks, but indicative of a widespread perception that the compromise is not always as neutral as the most optimistic narrative suggests. More structured is the criticism coming from those observing the gap between offensive and defensive tools in this field: an analysis published in April 2026 following the release of an open-source toolkit capable of "unlocking" over a hundred models with an out-of-the-box interface noted that defense techniques against abliteration, despite existing for a year in academic literature, are being adopted slowly, unevenly, and with real capacity trade-offs. A gap that, as the author of that review wrote, is wider today than it was twelve months ago, and is by no means guaranteed to close on its own.
Then there is a third, more cautious position that denies neither the legitimacy of research nor the risks, but insists on a structural point: the ethical framework for this category of tools—dual-use in the most literal sense of the term—simply does not yet exist in a shared form. The cybersecurity community, the open-source community, and the regulatory community are limiting themselves, according to this reading, to pointing fingers at each other for the responsibility of drawing a line that none of the three worlds feels authorized to draw alone.
Availability and the Open Paradox
Regardless of the positions on the field, one fact remains undeniable: anyone today can download a model like the one tested in this article from Hugging Face or load it into LM Studio, without filters of any kind, for free, in a matter of minutes. No subscription is needed, no verification required, not even particular technical expertise, given that the most recent toolkits have transformed an operation once reserved for those who knew how to handle weights and activations into an almost automatic process, at times reducible to a single terminal command.
This inevitably transforms an open-source tool, originally designed for research transparency and reproducibility, into something that can become, in the wrong hands, potentially dangerous. It is the paradox that those who have followed the evolution of free software for years know well, and which reappears here with stakes much higher than a simple security bug: the same openness that allows an independent researcher to seriously study the phenomenon of abliteration and measure its side effects, as the Warsaw Stock Exchange study did, allows anyone else to produce, in an afternoon, a model without any brakes.
The question of who is responsible at this point does not have a simple answer. The person who creates the abliteration technique, publishing it in an open-access academic paper? The person who implements it in an easy-to-use toolkit, perhaps with the best intentions toward the research community? The person who distributes the already "unlocked" model on a public platform, often with a badge or tag advertising its lack of restrictions? Or the person who, finally, downloads and uses it? An uncensored model does not have a conscience, however "self-assured" it may seem in its most direct answers. The person who uses it does.
Are there feasible countermeasures? They are being discussed, but none seems decisive on its own. Downstream moderation—that is, filters applied not to the model but to the application using it—works well in commercial products but is by definition absent in a model downloaded and run locally. Watermarking generated text can help trace the origin of content after the fact, but does not prevent generation itself. Stricter distribution policies—such as licenses explicitly prohibiting the redistribution of abliterated derivatives—are easily bypassed when the base model is already public and permissively licensed. And on the regulatory front, the European AI Act introduces transparency and risk assessment obligations primarily for those placing systems on the market, but hits a structural limit when the end user downloads public weights and modifies them on their own hardware, outside any traceable supply chain. These are open questions, not rhetorical ones, and anyone currently proposing definitive solutions is likely simplifying a problem that, at the current state of technology and regulation, does not yet have a single answer.
Conclusions
What does this test on Qwen3.8-27B-uncensored ultimately prove? It proves that abliteration works in the technical sense of the term: it removes refusal almost completely, with a capacity cost that can be minimal if the tool used is conservative, but which, according to recent research, still leaves a subtle and not always predictable collateral mark on how the model expresses itself and evaluates its own uncertainty. The most interesting question, however, is not technical. It is whether this capability should be considered a feature or a flaw, and whether the open-source community should address it more explicitly than it is doing now—perhaps with the same intellectual honesty with which, in a different episode but not too distant in spirit, the cryptography community learned decades ago that hiding a vulnerability is not equivalent to solving it.
The base model is safer because it possesses a refusal mechanism. The uncensored one is more dangerous, but its general performance remains, barring measurable and documented exceptions, substantially identical. The problem, then, does not seem to reside in the technique itself, but rather in the growing ease with which anyone can apply it and in the absence of a consensus on where to draw the line between legitimate research and concrete risk. Open-source artificial intelligence has enormous potential ahead of it—the same potential that in recent years has allowed small teams and enthusiasts to compete with billion-dollar laboratories. But it also has—and this article has tried to tell it without glossing over or spreading alarm—a dark side that deserves to be looked straight in the face with the same clarity with which one looks at any other serious technological risk.
A final reflection, rather than a conclusion: the boundary between "research" and "danger" is, by its nature, fluid, moving, and context-dependent. And the choice of where to draw it, as suggested by the most critical voice among those gathered in this article, cannot be left solely to the technicians who know how a directional ablation in activation space works. It is a choice that inevitably concerns all of us.