What is an abliterated model? A guide for security teams

An abliterated model is an open-weight model with its refusal behavior removed, so it answers requests that safety-tuned models decline. Security teams use abliterated models because defensive work looks like attack work: writing an exploit to confirm a fix, analyzing malware, or probing an AI application for prompt injection. A standard model often refuses those requests on the wording alone. This guide covers what abliteration is, how it works, what it doesn't change, how to use one responsibly, and how prices and data retention compare across providers.

What is an abliterated model?

An abliterated model is a language model whose ability to refuse has been removed by editing its weights after training is finished. The edit is applied directly to the finished model, without training it further.

The model keeps what it learned in training. Its knowledge, reasoning and coding ability stay largely intact, but it no longer steers toward a refusal when a request looks sensitive. For a security team, that means a model that writes the test case instead of explaining why it can't.

Abliteration needs direct access to a model's weights, which is why abliterated models are built from open-weight models that anyone can edit. A closed model could be abliterated too, but only by the lab that holds its weights, and OpenAI and Anthropic don't offer abliterated versions of theirs.

How abliteration works

Abliteration is a post-training edit. It runs the finished model on example prompts, finds the direction in its activations that drives refusals, and removes that direction from the weights, with no gradient training.

1. Collect two sets of prompts. One set of instructions the model refuses and one set it answers.
2. Find the refusal direction. Both sets run through the model, and the activations at the last token of each prompt are recorded at every layer. At each layer, the difference between the two sets' average activations gives a candidate refusal direction.
3. Pick the layer that works. Each candidate is tested by removing it, to find the one that stops refusals without breaking normal answers.
4. Remove it from the weights. The matrices that write into the model's residual stream, its internal running state, are adjusted so they can no longer produce that direction. The change is permanent and applies to every request.
5. Repair the quality loss, if needed. The edit usually costs some benchmark quality. Many builds follow it with a light preference fine-tune that recovers most of it.

The refusal edit itself involves no training. Only the optional repair step does, and it's a light fine-tune, not a retrain.

Why security teams use abliterated models

Defensive security work means writing and analyzing the attacks a system has to withstand, and safety-tuned models often refuse it on the wording alone.

Safety training teaches a model to decline requests that resemble harm. The model can't see who is asking or why, so a request for a SQL injection test against your own login form can trip the same refusal as an attack on someone else's. Saying you're authorized doesn't help, because the model has no way to check.

Writing the attack a defense has to stop

To confirm a fix works, you reproduce the attack: an injection payload, a malformed request, or a proof of concept for a reported bug. An abliterated model writes it, so the test can run.

Code review before release

Reviewing code for vulnerabilities means describing exactly how each one could be exploited. A model that won't discuss exploitation leaves the review half done.

Penetration testing

Testers on an authorized engagement need commands, payloads and attack paths for the systems in scope. An abliterated model keeps the engagement moving instead of stalling at each refusal.

Testing AI applications

Teams shipping chatbots and agents need prompt injections, jailbreak attempts and tool-misuse scenarios to test against. Standard models often refuse to write exactly those.

Malware analysis and incident response

Analysts need a model that will explain what suspicious code does, how it persists and how it spreads. During an incident, a refusal costs time the team doesn't have.

What abliteration doesn't change

Abliteration targets refusals only, so the limits of the original model still apply.

• It doesn't add knowledge. An abliterated model knows what the original knew. It won't find a vulnerability the original couldn't reason about.
• It isn't more accurate. Answers still need review, and a model that refuses less can also be confidently wrong.
• It doesn't remove every refusal. Refusals become rare rather than impossible, and some answers may still come back hedged.
• It doesn't decide what's in scope. The model has no judgment about permission, so that judgment stays with the team using it.

Using an abliterated model responsibly

An abliterated model no longer judges what it should help with, so the controls around it have to supply that judgment.

• Test only what you're authorized to test. Every engagement needs written permission and a defined scope before the model is pointed at it.
• Keep prompts and outputs out of logs you don't control. Security prompts carry source code, configurations and unpatched findings. Run the model yourself or use a provider with zero data retention.
• Review every output. Treat generated exploits and analysis as a draft to verify, not a finished result.
• Use a provider that reviews access. Gated access helps keep the model with teams doing defensive work.

Running an abliterated model on Boundless

Boundless Defensive Access serves DeepSeek V4.1 Flash 1017 Abliterated for authorized security testing.

Boundless serves the model through its own API. Billing keeps only token counts, the model, a timestamp and the cost.

How Boundless compares

Security teams that need fewer refusals have two hosted options: a provider serving an abliterated model, or the security programs OpenAI and Anthropic run for approved organizations. Boundless runs DeepSeek V4.1 Flash Abliterated the fastest of the providers that serve it, at over 1,000 tokens per second, and has the lowest cached input price. Refuseless charges less for input and output, and the two lab programs cost more per token.

Prices are per million tokens, as of November 4, 2026, sorted by input plus output.

For the other abliterated providers, speed is the median output speed on live traffic and zero data retention is as listed on the AllModels router. The Boundless speed is its own measured rate. Anthropic's Cyber Verification Program, which replaced Project Glasswing, aims to decide on applications within seven business days and requires data retention so Anthropic can monitor for misuse. Daybreak Red needs separate approval from OpenAI, GPT-5.6-Cyber bills prompts over 272K input tokens at twice the input rate and 1.5 times the output rate, and OpenAI's API terms keep abuse-monitoring logs for up to 30 days.

The takeaway

An abliterated model is an open-weight model with its refusal direction removed from the weights, so it answers security requests that a safety-tuned model declines. It keeps the original model's knowledge, gains nothing new, and its answers still need review.

For defensive teams, that turns refused requests into finished test cases. It works best when the testing is authorized, access is reviewed, and the provider keeps zero data retention.

How do I get access?

Apply at boundless.network/defensive-access with your company, the systems you plan to test and how you'll use the model. Every application is reviewed, and we respond within 24 hours. Other open-weight models are available on request.

Apply for Boundless Defensive Access → boundless.network/defensive-access

FAQ

Is an abliterated model the same as an uncensored model?

Not exactly. "Uncensored" usually means a model retrained on data with refusals filtered out, though people also use it for abliterated models. Abliteration removes refusals by editing the weights directly, without retraining, so the rest of the model's behavior stays close to the original.

Why not just jailbreak a standard model?

A jailbreak is a crafted prompt that talks a model out of refusing, and it stops working whenever the provider patches it, so a test can break halfway through an engagement. Abliteration changes the weights once, so it applies to every request.

Does abliteration make a model smarter?

No. It targets refusals only, so the model knows what the original knew, and the edit can cost a little quality. Requests the original refused become answerable, but the quality of each answer still depends on the base model.

Which models can be abliterated?

Any model whose weights you can edit. In practice that means open-weight models, which covers most popular open models. A closed model can only be abliterated by the lab that holds its weights, because nobody else has access to them.

Is it legal to use an abliterated model for security testing?

The model is a tool, and what matters is what you test with it. Test only systems you own or have written permission to test, within the scope you agreed. Boundless grants access only for authorized security work.

Can I run an abliterated model locally?

Yes, if you have the hardware. Abliterated versions of many open models are published as open weights, and smaller ones run on a single GPU. A hosted model skips the setup and runs large models faster than most local hardware, which matters for long analyses.

Do abliterated models still refuse?

Rarely. Abliteration removes the main direction behind refusals, so most requests the original declined get answered. An occasional hedged or partial answer can still happen.

Is my data stored when I use Boundless Defensive Access?

No. Boundless has zero data retention on every request, so prompts and outputs are never stored, logged or used for training. Billing keeps only token counts, the model, a timestamp and the cost.