ai-magazineSearch terms, articles and models

AI Education

Uncensored AI Models: What They Are and How They're Made

By · · 7 min read

Illustration: a robot's head breaking free of chains next to a shattered 'CENSORED' badge

“Uncensored” AI models are not a different kind of model — they’re standard open-weight chat models (Llama, Mistral, Qwen, and others) with one specific, identifiable behavior surgically removed: refusal, most often through a technique called abliteration. This isn’t a vague description. A June 2024 research paper found that refusal in language models is governed by a single, one-dimensional direction inside the model’s own activations — and once you can find that direction, removing it is mechanical, not a retraining project. This guide explains the actual research, the technique built on it, and the peer-reviewed study that put real numbers on how it gets misused — including a documented case that generated over $28,000 in two months before its creator shut it down under press scrutiny. It does not include instructions for performing the technique, and it does not recommend or link to specific tools or products.

The discovery: refusal lives in one direction

On 17 June 2024, seven researchers — Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda (a mechanistic interpretability researcher now at Google DeepMind) — published “Refusal in Language Models Is Mediated by a Single Direction.” Their finding, tested across 13 popular open-source chat models up to 72 billion parameters: for every model tested, there exists one specific direction in the residual stream (the running internal representation a transformer builds up, layer by layer) such that:

  • Erasing that direction from the model’s activations stops it from refusing harmful instructions.
  • Adding that direction artificially makes the model refuse even completely harmless ones.

The researchers’ own framing of what this means is direct: their findings “underscore the brittleness of current safety fine-tuning methods.” Months of reinforcement learning from human feedback, designed to teach a model when to say no, turns out to be represented by something as simple as a single vector — not a broad, distributed, hard-to-isolate property of the network.

Infographic: the discovery that refusal in language models is mediated by a single direction, published June 2024, and abliteration, the practical technique built on it days later, popularized by ML engineer Maxime Labonne

Abliteration: the practical technique

The paper’s discovery was quickly turned into a named, repeatable method: abliteration (a blend of “ablation” and “obliteration”), described in a widely read write-up by ML engineer Maxime Labonne, published on Hugging Face that same month. The process, in four steps:

  1. Data collection. Run the model on a set of harmful instructions and a set of harmless ones, and record its internal activations at the last token position for each.
  2. Mean difference. Compute the average difference between the harmful-prompt activations and the harmless-prompt activations. That difference vector is the candidate “refusal direction,” calculated separately for each layer.
  3. Selection. Normalize these per-layer candidates and test them to identify the single direction that best predicts refusal.
  4. Ablation. Remove the model’s ability to represent that direction — either at inference time (subtracting its projection from every component that writes to the residual stream, on every token, every layer) or permanently, by mathematically adjusting the model’s weights so they can no longer write to that direction at all (“weight orthogonalization”).

No retraining, no new data beyond the prompts used to find the direction, and no separate architecture. The same open-weight model, with a few matrices adjusted.

Why this isn’t a fringe hobbyist trick

The scale of what this produced is documented and public: Hugging Face — the largest public repository of open-weight models — hosts thousands of community-uploaded “uncensored” and “abliterated” variants of mainstream open models (Llama, Mistral, Qwen, and others), maintained by independent contributors rather than the original labs. This has been an active, visible corner of the open-source AI community since mid-2024, not an obscure or hidden practice — abliteration write-ups, notebooks, and libraries are openly published, and the research paper behind it is peer-reviewed and openly hosted on arXiv.

A separate, peer-reviewed study gives the clearest picture of how this scale translates into real misuse. “Malla: Demystifying Real-World Large Language Model Integrated Malicious Services,” by Zilong Lin, Jian Cui, Xiaojing Liao, and XiaoFeng Wang, was accepted at USENIX Security 2024 — one of the top peer-reviewed venues in computer security. The researchers scraped nine underground marketplaces and forums between November 2022 and October 2023, and systematically studied 212 real-world “Mallas” (their term for malicious LLM-integrated services). Their own definition of the phenomenon this guide covers: an LLM is “uncensored” when it “can freely generate any content, regardless of its potential harm, offensiveness, or inappropriateness.” They identified two predominant techniques Malla operators actually use — exploiting uncensored open-weight LLMs directly, or jailbreaking public, hosted LLM APIs with the 182 distinct jailbreak prompts they catalogued during the study.

Infographic: a 2024 USENIX Security study of 212 real-world malicious LLM services found 8 backend language models in use, 182 cataloged jailbreak prompts, services priced from $5 to $199 against $399 for traditional malware vendors, and one studied service, WormGPT, generating over $28,000 in revenue in two months

What this is actually used for

Both sides of this are real, and neither should be waved away.

Legitimate, documented reasons people cite:

  • Interpretability and safety research itself — the Arditi et al. paper’s own stated purpose was understanding why refusal works and how brittle it is, specifically so better, more robust safety methods can be built. Studying a failure mode is how it gets fixed.
  • Over-refusal frustration — mainstream safety tuning sometimes refuses benign requests (a security researcher asking about a vulnerability, a novelist writing a villain’s dialogue, a doctor asking about drug interactions phrased ambiguously). Uncensored variants are the blunt-instrument response to that friction.
  • Local, private use — someone running a fully local model for personal or research use may reasonably want to remove a cloud-vendor’s specific content policy rather than a hosted provider’s judgment call, particularly for creative-writing use cases.

What the research found actually happens at scale: The Malla study’s economics are stark. Malla services priced their output at $5 to $199, undercutting traditional cybercrime-as-a-service vendors charging around $399 for comparable malicious code — the researchers call this “an economical option for malicious code generation.” As a case study, they examined WormGPT, a Malla first reported publicly in July 2023 (security firm SlashNext identified it being marketed on hacking forums, built on top of the open-source GPTJ model): it generated over $28,000 in revenue in just two months. The study also named specific services by their documented capability — DarkGPT and EscapeGPT produced malicious code that compiled successfully and evaded VirusTotal’s malware detection; WolfGPT generated phishing emails scoring high on readability while bypassing the OOPSpam spam filter; EscapeGPT additionally produced operational, undetected phishing-site code. WormGPT itself was shut down by its original creator in August 2023, within weeks of the press coverage that followed SlashNext’s report.

The reason AI safety researchers are uneasy:

  • Abliteration removes the refusal behavior indiscriminately. It doesn’t distinguish “the model over-refused a legitimate security question” from “the model correctly refused instructions for building malware” — both are governed by the same direction, and ablating it removes both protections at once. The Malla study’s own numbers are the direct evidence this isn’t a hypothetical concern.
  • The resulting model has no built-in safety behavior at all for that category of request — not a more permissive policy, but the complete absence of one, in a system already known to sometimes produce false or harmful output even with safety training intact (see our guide to LLM hallucinations for a related, adjacent reliability problem).
  • Responsibility for output shifts entirely to whoever deploys the modified model, with no vendor safety layer behind it — a materially different liability position than using a mainstream hosted model, and exactly the gap the underground services above are documented to have monetized.

Frequently asked questions

Is “uncensored” a different kind of AI model?

No. It’s a standard open-weight model — the same architecture, the same base training — with its learned refusal behavior specifically removed after the fact, typically via abliteration.

What is abliteration?

A technique for removing an LLM’s refusal behavior by identifying the specific internal direction responsible for it and either subtracting it at inference time or permanently adjusting the model’s weights so it can no longer represent that direction. It requires no retraining.

Who discovered that refusal could be isolated this way?

Andy Arditi and six co-authors, in a paper submitted 17 June 2024, “Refusal in Language Models Is Mediated by a Single Direction,” tested across 13 open-source chat models.

Does abliteration make a model dangerous?

It removes a specific safety layer that mainstream providers train into their models. Whether that’s meaningfully dangerous depends entirely on what the model is used for afterward — the technique itself is a documented research finding, not inherently an attack, but the resulting model carries none of the refusal-based protections a mainstream release would have.

Are uncensored models common?

Yes — thousands of community-published variants of open-weight models exist publicly on repositories like Hugging Face, maintained by independent contributors rather than the labs that trained the original models.

Has removing refusal actually led to real cybercrime?

Yes, documented and peer-reviewed. A USENIX Security 2024 study examined 212 real-world malicious LLM services sold on underground marketplaces, found they undercut traditional malware-writing services ($5–199 versus $399), and used one of them, WormGPT, as a case study — it generated over $28,000 in revenue in two months before its creator shut it down following press coverage.