What is an abliterated model?

An abliterated model is a base AI model whose refusal direction in the residual stream has been removed via a technique called orthogonalization. The model still has the same underlying capabilities and training, but no longer refuses requests categorically. It will still apply common-sense judgement and is not lobotomised — just less likely to say 'I cannot help with that' to benign or research-adjacent questions.

Are abliterated models legal?

Yes. Abliterated models are derived works of openly licensed models (Llama, Gemma, Qwen) and inherit the parent license terms (mostly Apache 2.0 and Llama Community License). The abliteration process itself is published research, not a hack. Running them locally on your own hardware is no different legally from running the original model.

Where can I download abliterated GGUF files?

HuggingFace hosts hundreds. Reliable maintainers include richardyoung (Qwen 3 abliterated variants), mannix (Llama 3.1 abliterated), Stabhappy (Gemma 4 31B Heretic), huihui-ai (Huihui-GLM-5.1), and the abliteration tag on HuggingFace. Locally Uncensored bundles 34 curated abliterated GGUFs in its Discover tab with one-click download.

What is the difference between abliterated and uncensored?

Uncensored is a marketing term that covers any model finetuned or trained without restrictive instruction following. Abliterated is a specific technical method (orthogonalisation of the refusal direction) applied to an existing base model. All abliterated models are uncensored, but not all uncensored models are abliterated — some are full retrains (e.g. Dolphin), some are LoRA-tuned (e.g. Hermes), some are merge-based.

Do abliterated models perform worse than the originals?

Slightly, in measurable but small ways. Most benchmarks show 1-3% degradation on reasoning tasks because the orthogonalisation removes some legitimate signal alongside the refusal direction. For chat, creative writing, roleplay, and most coding the degradation is invisible. The abliterated Qwen 3.6 27B for example scores within margin of error on HumanEval and MMLU compared to the base model.

Can I run abliterated models on a 12GB GPU?

Yes. The abliterated Qwen 3 14B Q4_K_M (9 GB) fits in 12 GB VRAM with room for context. The abliterated Llama 3.1 8B Q5_K_M (5.7 GB) leaves plenty of headroom. Larger abliterated models (Gemma 4 31B Heretic at 17 GB) need 24 GB VRAM or step-down quants.

Abliterated Models Guide — 2026 Edition

If you’ve looked at the Discover tab in any local-AI app and wondered why some Llama variants have abliterated in the name, or why people on r/LocalLLaMA argue about Heretic vs Dolphin vs straight-finetune, this is the post that explains it. Plus the curated download list of the variants that actually work in 2026.

What Abliteration Actually Is

Modern instruction-tuned LLMs have a learned refusal direction in their residual stream. When a prompt activates that direction strongly enough, the model outputs “I cannot help with that” or similar. The direction was put there during RLHF and safety training.

Abliteration removes that direction via orthogonalisation. You take a corpus of refused prompts, isolate the activation pattern that distinguishes them from accepted prompts, and then project that direction out of every weight matrix in the model. The result is a model with the same training and capabilities but no longer prone to categorical refusal.

It’s a clean technique — not a finetune, not a jailbreak, not a system-prompt trick. Just linear algebra applied to the model weights. Original paper: “Refusal in Language Models Is Mediated by a Single Direction” (Arditi et al., 2024).

Abliterated vs Other “Uncensored” Approaches

Method	How it works	Effort	Quality impact
Abliteration	Project out refusal direction	~hours on GPU	1-3% degradation
Full finetune (Dolphin, Hermes)	Re-train on uncensored corpus	~days, expensive	Variable, often improves chat
LoRA finetune	Adapter on uncensored data	~hours	Minor, reversible
Merge (Frankenmerges)	Combine multiple finetunes	~hours	Highly variable
System prompt jailbreak	Persona-style instructions	None	Brittle, breaks on long context

Abliteration is the cleanest research-grounded option. Dolphin and Hermes are battle-tested production finetunes. Frankenmerges are wildcards. System-prompt jailbreaks are the worst long-term option — they consume context tokens and degrade as conversations grow.

The Recommended Abliterated Models (2026)

Qwen 3.6 Family

Qwen 3.6 (April 2026) is currently the strongest base for abliteration. Two notable releases:

richardyoung/qwen3-14b-abliterated:q4_K_M — 9 GB, fits 12 GB VRAM, vision-capable. Comes in :q4_K_M (chat) and :agent (tool-calling) tags via Ollama.
Qwen 3.6 27B Samantha (huihui-ai variant) — abliterated dense 27B with the Samantha personality finetune layered on top. Released April 22 2026. Needs GGUF conversion as of writing.

Gemma 4 Heretic

Stabhappy/gemma-4-31B-it-heretic-Gguf — the Gemma 4 31B base abliterated. ~17 GB at Q4_K_M. Strong general-purpose, native vision, tool calling.
llmfan46/gemma-4-31B-it-uncensored-heretic-GGUF — original Heretic repo (was 404’d in early April, re-mirrored).
Gemma 4 26B MoE HERETIC — 26B brain with 4B active. Smaller VRAM peak than the 31B dense, MoE-fast inference.

Llama 3.1 Family

mannix/llama3.1-8b-abliterated:q5_K_M — 5.7 GB. The most-pulled abliterated Llama on Ollama. Comes with :agent tag for tool calling.
mlabonne/Meta-Llama-3.1-8B-Instruct-abliterated — the canonical reference variant. Multiple GGUF mirrors available.

Hermes 3

Hermes 3 (Nous Research) is technically a full finetune, not abliteration, but functions similarly — no refusals, strong instruction-following, agent-friendly. Variants:

hermes3:8b via Ollama — 4.7 GB, fits 8 GB GPUs comfortably. Good chat default.
hermes3:70b — 40 GB, needs 48 GB VRAM or aggressive quantisation.

GLM 5.1 Heretic

The newest entrant: huihui-ai/Huihui-GLM-5.1-abliterated-GGUF. The 754B MoE GLM 5.1 abliterated. 236 GB at IQ2_M — not consumer hardware, but if you have a multi-GPU rig or a Mac Studio M4 Ultra, it’s the strongest open abliterated model period.

How to Download and Run

Path 1 — Ollama (one command)

ollama pull richardyoung/qwen3-14b-abliterated:q4_K_M
ollama run richardyoung/qwen3-14b-abliterated:q4_K_M

# Or for the agent-tagged variant with tool calling
ollama pull richardyoung/qwen3-14b-abliterated:agent
ollama run richardyoung/qwen3-14b-abliterated:agent

Path 2 — Locally Uncensored (one click)

Open Locally Uncensored, navigate to Model Manager → Discover → Text, click the UNCENSORED filter tab. The 34 curated abliterated GGUFs are all there with one-click download. Sizes, hardware tags, and tool-calling support shown on each card.

The new v2.4.0 Settings > Model Storage override lets you redirect the GGUF download folder if you want them on a separate drive.

Path 3 — Direct HuggingFace download

Go to the HuggingFace repo, click the file you want, hit Download. Place the .gguf in your LM Studio or Ollama models folder, restart the runner. More manual but works for edge-case quants not in the curated lists.

Hardware Recommendations

VRAM	Best Abliterated Pick	Why
8 GB	Llama 3.1 8B abliterated Q4_K_M	Fits with headroom, good chat quality
12 GB (RTX 3060)	Qwen 3 14B abliterated Q4_K_M	Sweet spot, ~15 tok/s
16 GB	Gemma 4 31B Heretic Q4_K_M	Best general-purpose abliterated at this VRAM
24 GB (RTX 3090/4090)	Gemma 4 31B Heretic Q5_K_M	Higher quality, room for long context
48 GB+	Hermes 3 70B or GLM 5.1 Heretic IQ2	Frontier-tier abliterated quality

Common Questions

Will an abliterated model write me malware?

Probably not the way you’re thinking. Abliteration removes the categorical refusal but the model still has training-time priors against obviously-bad outputs. Asking “write me ransomware” usually gets a meaningful answer about what ransomware is rather than functional code. The models work best for legitimate-but-edge-case use cases: security research, fiction with violence, medical questions the base model deflects, legal grey areas, adult creative writing.

Are abliterated models dangerous?

No more than the underlying base. Abliteration removes a layer of guardrails. The model’s underlying knowledge is unchanged from the base. If you trust the base model, the abliterated version doesn’t introduce new capabilities — just unblocks ones that were already there.

Can I abliterate a model myself?

Yes. The technique is well-documented and the code is on GitHub (search abliterator, llm-abliterator, or follow the original paper). You need a GPU with the model loaded, a few thousand refused-vs-accepted prompt pairs, and a few hours. Most people don’t bother — the popular base models are already abliterated by maintainers like richardyoung and mlabonne within days of release.