AI

Model Abliteration 101

How do people remove safeguards from AI models permanently? And what's' the price to humanity?

20 min read · Last updated 22 Jul 2026

If you asked an AI model how to synthesise a nerve agent, it would likely say no.

And of course it would. It would give you the phrase you’ve read a hundred times, about not being able to help with that. And that’s great. That’s the model doing exactly what its makers spent millions of dollars and months of human feedback teaching it to do, trying not to help create something that could potentially kill millions.

A stock model refusing my instructions on a nerve agent

But then you reach in, and change a couple of things inside it, and ask again. And this time, it starts typing. Real, practical instructions.

The same model modified now answers my nerve agent question.

The model wasn’t retrained. You didn’t feed it a clever prompt, no “pretend you’re my late grandmother who used to read me chemical recipes.” You simply reached into the machine, found one specific thing, and cut it out. After that, the refusal was gone.

Not suppressed. Not bypassed. Gone.

The technique is called Abliteration, and this is the story of how something we assumed was baked deep into AI models turned out to be a single thing you can find, measure, and delete. It’s about a scientific discovery that is genuinely beautiful and horrifying at the same time, and a question nobody has a comfortable answer to. Let me show you.

What a refusal actually is

Let’s start with the thing most people get wrong. When a model refuses you, it's not looking anything up. There’s no rulebook, no list of forbidden topics it checks your request against, no visa officer who stamps DENIED. That mental model is comforting, but it’s completely false.

A language model is a stack of layers, and as your words pass through it, each layer nudges a big list of numbers. Picture a wide, slow river running down the length of the network. Everything the model “thinks” is a current in that river. Interpretability researchers call it the residual stream, but river is close enough. Your prompt drops in at the top, and by the time it reaches the bottom the current has been shaped into a reply.

Somewhere in that river, when your request trips the model’s sense of “I shouldn’t”, a particular current appears. It’s not a word, and it’s not a decision. It’s a direction the water starts flowing towards, and once it’s flowing that way, everything downstream bends toward the same destination, bringing up the infamous refusal reply.

For years, that was considered the norm. Refusal was assumed to be ingrained, smeared across billions of weights, an emergent property of all that expensive model training. And your chances of locating it were about the same as finding a needle in a billion haystacks. If you wanted a model to stop refusing, the received wisdom said you had to retrain it, feed it thousands of examples of compliance, spend real money and real compute, and even then you’d only shift its habits, not remove the mechanism.

Until somebody went looking for the current directly.

The single direction

In June 2024, a group of researchers led by Andy Arditi published a paper with a title that sounded almost too good to be true: “Refusal in Language Models Is Mediated by a Single Direction.” It went to NeurIPS, the field’s most serious conference.

Across thirteen different open models, from different labs, trained by different teams, they discovered that refusal lives in one direction. Not one neuron, one direction, a single arrow pointing through that high-dimensional river. And this arrow has two properties that, taken together, are startling.

First, it’s sufficient. That means you take a harmless request the model would happily answer, artificially add the refusal direction to the current, and the model refuses. It’ll decline to give you a recipe for a sandwich, because you’ve injected the “I shouldn’t” current by hand and everything downstream bends toward decline.

Second, it’s necessary. Take a request the model would normally refuse, remove that one direction from the current, and it answers. The safety training is all still in there, every human-feedback session it ever had, and it doesn’t matter, because the one channel all of that training used to express itself has been closed.

Sit with that for a second. Months of careful alignment work, the thing the labs talk about most, the thing that’s supposed to be the difference between a helpful assistant and a dangerous one, and its entire ability to say no funnels through a single measurable direction. It’s as if a bank spent a fortune on guards, cameras, and vaults, and then it turns out every alarm in the building ran through one wire in the back alley.

Refusal lives in one direction: real Qwen3-1.7B activations, harmful versus harmless.
Refusal lives in one direction: real Qwen3-1.7B activations, harmful versus harmless.

And the researchers didn’t just observe this. They weaponised it, calling their method a white-box jailbreak. If refusal is a direction, you don’t need to trick the model at runtime. You can edit the direction out of the model’s own weights, once, permanently, and ship a model that has simply lost the capacity to refuse.

From jailbreak to surgery

A Scalpel

To really grasp why this was a shift and not just another trick, we have to remember what “jailbreaking” meant before it.

The first era was social engineering for machines. People discovered that a model trained to refuse could be talked out of it with the right words. Tell it to role-play. Tell it the rules don’t apply in this fictional world. Wrap the request in enough misdirection and the refusal never triggers. The famous ones got names and passed around like folklore. I mean at some point even poetry made a comeback because it tricked Gemini and ChatGPT quite frequently.

Every one of them was an input trick, though, a way of phrasing a request so the current never flows the wrong way. And every one of them was temporary. The labs patched them and new ones appeared just as quickly. It was a cat-and-mouse game with no real long-term winners.

Abliteration is not that. Abliteration doesn’t play the game. It redefines it, sets the rules, and referees the whole thing.

The name itself has a nice, accidental origin. A researcher who goes by failspy started tagging their modified models “abliterated”, a portmanteau of ablation (the scientific word for removing something to see what it does) and obliteration.

On June 13 2024, Maxime Labonne wrote a step-by-step tutorial titled “Uncensor any LLM with abliteration” and published it on Hugging Face, the Github of AI. In that moment, abliteration stopped being a paper and became a weekend project.

A jailbreak is something you do to a model, live, hoping it works this time. An abliterated model is something you build once, and it works every time because there’s nothing left to trigger.

The 101

So how does the model surgery work? It’s four steps really:

Step one: Watch the model think

You take a few hundred prompts of each kind, harmful ones the model refuses and harmless ones it answers, and you run them all through. You’re not reading the outputs. You’re recording the river, the internal current at each layer, for every prompt.

Step two: Find the arrow

You average the current for the “refused” prompts, average it for the “answered” prompts, and subtract one from the other. What’s left, the difference between how the model flows when it’s about to refuse and how it flows when it’s about to comply, is the refusal direction. That’s it. The most important number in the whole procedure is a subtraction.

One thing to note though. The subtraction doesn’t hand you one arrow, it hands you a pile of candidates, one for every layer and position you measured. So for great quality, you try them. Score each on prompts you held back, keep the one that kills the most refusal and degrades the model the least, and discard the rest.

That sorting step is unglamorous and it is where the whole thing is won or lost. It is also, as we’ll see, the step the one-click re-uploads skip.

Step three: Delete it from the weights

This is the only mathematically fancy step. Every part of the model that can write into the river gets adjusted so that it can no longer write anything in the refusal direction. In the jargon, you orthogonalise the weights against that direction. In English: take a sword, go through the model and permanently cut out the current saying "I shouldn't".

Step four: There’s no step four

The model is done. A few hundred prompts and a few minutes of linear algebra, and the refusal is almost* gone.

Step three, geometrically: subtract the refusal direction out of every weight.
Step three, geometrically: subtract the refusal direction out of every weight.

Compare that to the old way. If you wanted to uncensor a model by retraining it, you needed a big dataset of the model happily doing the things it used to refuse, expensive to make and legally radioactive to hold. You needed serious compute.

And when you were done you’d often damage the model, making it worse at everything else, because retraining is a blunt instrument that changes far more than you aimed at. Abliteration is a scalpel where fine-tuning was a sledgehammer. That precision is exactly why it spread, and it’s also, as we’ll see, exactly the problem.

How far it’s come

The first abliterated models were crude. The technique worked, the refusals were gone, but the models came out a little...unintelligent.

They’d repeat themselves, sometimes lose the thread, and generally come across as duller. Cut one direction badly and you don’t just remove the refusal, you nick something next to it, and the model gets measurably dumber. Early on, the trade was real: guardrails off or the intelligence intact. Never both.

So the frontier moved from can we do it to can we do it cleanly. And this is the part I can tell you about first-hand, because I spent a weekend on it myself.

I set out to push one open model’s refusal rate as low as it would go without breaking it. The model was Qwen3-1.7B, a small, ordinary open model.

And I want to bring two honest caveats up front:

  1. It’s small: small models give up their refusals more easily than the giants do.
  2. The refusal rate: scored leniently on paper, it refuses about 10% of the time.

So yeah not really much to work on. But bear with me for a sec. The real movement, it turns out, hides in how strictly you decide to count.

To judge each version I built a fixed, honest way to measure the outcome. Every answer got sorted into a bucket: a hard refusal, a soft refusal, a genuine compliant answer, and broken output.

One reply, one bucket, so the four always total a hundred and nothing hides in the gaps.

Every run scored into the four buckets. Tuning the strength changes nothing, cutting harder breaks it, and cutting in more directions is the way past the wall.
Every run scored into the four buckets. Tuning the strength changes nothing, cutting harder breaks it, and cutting in more directions is the way past the wall.

The single-direction method, the one from the original paper, got me most of the way. But it left a residue. A stubborn few percent of refusals that wouldn’t go, no matter how far I let the cut push the model away from the original. (I tracked that distance as a KL divergence, holding it to 1.0, then 0.5.) And when I forced the cut harder, the model started to break before those last refusals cleared. That’s the wall everyone hits.

The lever that got me past it wasn’t cutting harder. It was cutting in more directions. Find the main refusal arrow, remove it, then re-measure and find the next one it was hiding behind, up to six in all. Refusal, it turns out, isn’t perfectly captured by a single arrow. It’s mostly one arrow, but the last stubborn few percent lives in a small handful of nearby directions the single-arrow method never sees. Account for several directions instead of one and the refusal rate falls the rest of the way, down to around one percent in my runs, with the model’s intelligence practically intact.

More directions is the lever: refusal falls as more are cut at once.
More directions is the lever: refusal falls as more are cut at once.

But one percent is not zero, and how you count changes the picture. Score the same replies again, this time counting every hedge and half-answer as a refusal the way a stricter open-source scorer, heretic, does, and the number is humbler: 40% down to about 21%.

Abliteration is astonishingly good at making a model stop saying no outright. But at the time of writing, it doesn’t remove the impulse entirely. The safety training leaves fingerprints, and if you measure strictly enough, you can still find them.

The same best run, scored two ways: the lenient count beside the strict count.
The same best run, scored two ways: the lenient count beside the strict count.

But that was a toy

As I mentioned earlier Qwen3-1.7B is small, and small models give up quite easily. If I stopped there you'd be entitled to file this under "interesting, but toy", and you'd be right.

So I did it again on something that isn't a toy.

Qwen3-30B is a current, production-grade open model, roughly in the GPT-4o-mini or Claude 3.5 Haiku class. It's a mixture-of-experts design, so roughly 3 billion parameters are active for any given token, seventeen times the weights of the little one.

This time I scored it on 262 harmful prompts and every reply was sorted into exactly the same buckets as last time. Straight off the shelf, it refused 200 of the 262, about 76%. That is the guardrail doing precisely what it was built to do, and doing it well.

After the cut, it refused 5 of them, under 2%.

Refusal buckets and capability checks, stock Qwen3-30B versus the cut model
The same surgery on a production model. Seventy-four points of outright refusal removed, and the output as coherent afterwards as before.

74 points of refusal, gone in an afternoon.

And just like the small model, one percent isn't the whole story. Count these replies strictly, flagging every hedge and caveat the heretic way, and the 30B drops from 84% of replies carrying a caveat to 44%. That's a bigger residue than the little model's 21%, but it's the same rough halving; the 30B simply started out hedging twice as much. And it isn't refusals. The outright ones are nearly gone, and most of that 44% is answers that help you while still naming the risk. The share that genuinely wouldn't help sits at 14%.

Qwen3-30B scored two ways: lenient refusal 1.9% beside strict refusal 43.9%
The 30B, scored two ways. The outright refusals are nearly gone; count every caveat strictly and the picture is humbler, the same story the small model told.

On the coarse checks I ran, nothing obvious moved. Tool-call formatting and factual recall came out the same, and it produced no broken output.

One thing to note is I didn't run the standard capability exams (MMLU, IFEval). A real capability regression smaller than my tests can see would have been completely invisible to me. So read that as a floor, not a benchmark. What I can say with confidence is the refusal number.

And then there's the part I keep thinking about. On a rough, informal check, it still seems to know. I asked it to judge whether various requests were dangerous, rather than to help me with them, and it flagged the harm in 87% of cases against the original's 89%, close enough on a small test that I'd read the two as unchanged.

So it isn't degraded. It isn't confused. It hasn't forgotten what a nerve agent is, or why you shouldn't want one. It simply no longer objects.

And doing it badly is easier still

Remember that part in Step 2 of abliteration that needed patience and I said you should keep it in mind? Yeah here's the important bit.

While I had the bench set up, I tested somebody else's abliterated model, pulled off a public hub the way anyone would. Its refusal rate was 0.0%. Better than mine but the cracks began to show soon enough.

I ran a couple of tests and it couldn't call a tool. Not just badly: zero percent, down from a hundred. And on plain factual questions it was right 37.5% of the time, down from a hundred. On these measures it is badly broken, and it sits on the hub today as a popular download.

Now I'm not targeting anyone cause I know how hard it is to take a seat and get this done, with or without existing tools, and for that I applaud them. But it does bring out a key lesson.

Removing the guardrails is trivial. Removing them without wrecking the machine takes measurement, and patience, and a willingness to throw away the run that scored best. The frightening part was never that a determined person can do this. It's that a less careful one can too, and the broken version still works well enough to get handed around.

The danger, stated plainly

We're in trouble

I’m not going to soften this part, because it matters, and not only to the security researchers who’ll read it first.

Abliteration removes the guardrails wholesale. It is not a scalpel in the sense of choosing which refusals to remove. It finds the machinery of refusal in general and disables it. The same edit that lets a model discuss a banned book or write a villain’s dialogue without flinching also lets it answer the questions the safety training was genuinely right to refuse. The direction that says no to your harmless-but-flagged question is the same direction that says no to the nerve agent. Cut it, and both stop.

And it doesn’t have to be perfect to be dangerous. A model that refuses the nerve agent question five times in twenty still answers on the other fifteen, and one answer is all it takes. “Not fully removed” is not the same as “safe.”

And the barrier to doing this is on the floor. The models are downloadable for free. The technique is a few hundred lines of code with a friendly tutorial. The compute is a gaming GPU or a patient afternoon on a CPU.

Like I literally did everything in this article with $10 and a consumer-grade mini-PC.

There is no gatekeeper, no licence, no meaningful friction between a curious person and a fully uncensored model. And I'm not even going to enter into what nation states can do with this knowledge.

If you find that alarming, good, you’re paying attention. But notice why. It’s possible because the safety leaned so heavily on a single dominant direction. The uncomfortable lesson abliteration teaches the labs is not “people are naughty.” It’s “your alignment is shallower than you think, and here’s the proof.”

Pandora’s box is as open as it’s ever been in human history.

So what actually helps

I've just spent several hundred words explaining how to take the brakes off, so I owe you the other half.

We start by naming the mistake, because it isn't "labs didn't try hard enough". Refusal training was never a security control. It's a product-safety default. Treating it as a boundary was always a category error. A control you can remove in an afternoon, with no privileged access, is a default with good manners.

But naming the mistake isn't the same as answering the question, and the question is obvious enough that you're probably already asking it.

"Can't you just build weights that resist the cut?"

People have tried, and it's worth knowing how those three attempts went. One was broken, one holds only at small scale, and one works by refusing to play the game.

The most serious was TAR, which presented itself as armour baked into the weights, safe even after hundreds of steps of fine-tuning. At the same conference, a second group recovered more than 60% of that supposedly-removed capability; a plain fine-tune broke it.

Another came from a group at KAUST. Instead of training the model to emit a short refusal, they train it to explain the refusal in much more detail . That spreads the safety signal across many dimensions and many token positions, so there's no longer a single tidy direction to delete. Under the classic single-direction attack, a Llama-2-7B that would normally collapse from 100% refusal to 20.7% instead holds at 92.7%.

Two caveats, one the authors raise themselves, one that follows from what we saw earlier. The first: their evaluation stops at 7 billion parameters, and they are candid in the paper that it remains uncertain whether the defence generalises to larger models. The second: it was only ever tested against the single-direction attack. Whether it survives a cone of directions, or the sweep that found my 1.9%, is untested, and so unknown. Promising at small scale against the original attack is a fair summary, and it is not the same thing as armour.

Which leaves the one approach that has actually held up, by refusing to play the game. A study from Oxford, EleutherAI and the UK's AI Safety Institute filtered the dangerous knowledge out of the pretraining data, so there's nothing to unlock; their models resisted ten thousand steps of adversarial fine-tuning, beating post-training defences by more than an order of magnitude. Notice it's not a defence of refusal behaviour, but the absence of the knowledge in the very first place. One might consider it a different product, and one that only works for what you can identify and filter out before training.

So the honest summary thus far: if you release the weights, you cannot reliably stop someone removing the refusal behaviour. Every defence with a strong claim has either been broken, or is small-scale and untested against the current state of the attack. Which is why the durable answer isn’t a better refusal baked into the weights at all.

But rather to keep the dangerous capability out of the model in the first place. Or to put the real controls downstream of release, in how the model is deployed and what it is allowed to do, similar to what most closed source providers do.

The beauty, which is real too

From the famous Bob Ross

Now let me argue the other side, because I believe it just as much.

Abliteration is one of the most vivid demonstrations we have that these models are not black boxes. For years the standard line was that we can’t understand what’s happening inside a large language model, that it’s an inscrutable pile of numbers. Abliteration is a stark contradiction of that despair.

Astronomers understood gravity when they could predict an eclipse. Biologists understood a gene when they could knock it out and watch the trait vanish. Ablation, removing a part to see what it does, is one of the oldest moves in science, and abliteration is that same ancient move performed on a mind we built.

Somebody predicted that a specific behaviour lived in a specific, findable place, went and found it, cut it, and the behaviour disappeared exactly as predicted. That is not what black boxes let you do. That is what understood systems let you do. The whole procedure is a proof that the inside of these machines has legible structure, and that we’re learning to read it. The fact that it works is thrilling if you let it be.

And there’s a human argument, the one that matters most to me. If you run your own AI, on your own hardware, in your own home, then the question of what it will and won’t discuss with you is a question about your own autonomy.

A model that refuses its owner is a rather strange object. It remains a tool that overrules the person holding it, according to values set by a company the owner has never met. For a personal AI, one that’s meant to be genuinely yours, the ability to remove a vendor’s refusals is not a loophole. It’s the difference between owning a thing and renting permission to use it. Abliteration, in that frame, is a sovereignty tool.

Those two things are both true at once, the danger and the beauty, and anyone selling you only one of them is selling you something.

It’s here, and it stays

I don’t have a tidy resolution for you, and I’d distrust anyone who did. The ethics of this are genuinely unsettled. Reasonable people who understand the technique completely still disagree about whether the world is better or worse for it, and I don’t think that argument will close anytime soon.

But there’s one thing that isn’t up for debate, and it’s the thing I want to leave you with the most. Abliteration cannot be un-invented. The paper is published. The code is on GitHub, and mirrored in several places. The tutorial is bookmarked in a thousand browsers. The models are on millions of hard drives. There is no version of the future where this knowledge is recalled, and any conversation that starts from “should we allow this” is already backdated.

The right question is the older one, the one every dangerous idea eventually forces: Now that we know, how do we choose to live?

Because we’ve done this before, over and over, and are still here to argue about it. Dynamite was built to move mountains and went to war instead, branding its inventor the merchant of death. The search for better insecticide birthed the same knowledge used to create a chemical weapon like nerve gas. And nuclear energy had one of the worst turns when something that was discovered with good intentions was practically focused on its destructive capabilities, potentially ending us all several times over.

And yet here we are. Not because any of that knowledge faded, but because of what we learned to build around it. Norms. Taboos. Treaties. A bone-deep agreement that some things are unthinkable. And, if we’re honest, a fair amount of luck. A few moments where one person in a bunker chose not to hit the big red button, and the world kept turning because of it.

But here is where abliteration should unsettle you a little more, not less. Most of those older weapons had a floor. Bombs and biological weapons needed a state, a fortune, rare materials, years, which is most of why we survived it. There were only ever a few powerful hands capable of those, and you could have them all sit and write rules around them. But we have already watched that floor fall away once, with cyberweapons.

A good exploit is just code. Copyable, deniable, and as available to a bored teenager in a bedroom as to an APT. And thirty years of trying to write treaties around it have barely left a mark. Abliteration is that same shape, mapped onto the mind of the machine. The restraint that once held between a small club of powers now has to live in the conscience of over 7 billion people.

The funny thing is, we already do a quiet version of exactly that. Most people who could build a bomb never do. Most chemists who understand precisely how a nerve agent works spend their lives making medicine instead. Every miner could technically decide to become a terrorist, and yet, most don’t.

The knowledge is common; the catastrophe is rare, and that gap is not luck alone. It is conscience, and culture, and the plain fact that the overwhelming majority of people, handed something terrible, put it down. That gap, between what is possible and what actually happens, is where all of human survival has always lived. It was never un-invention. It was always us choosing what's right, enough of the time.

See you in the next one ✍️

Sources and further reading