Uncensored AI Models 2026: The Complete Guide to Unfiltered, Unaligned and Abliterated LLMs

Two people download the same open-weight model. The first asks it a borderline question and gets a polite refusal. The second downloaded a modified copy of the same base model, asks the identical question, and gets an answer. Same architecture, same knowledge, different behavior. That gap is the whole story of uncensored AI.

It is possible because open-weight models are files. A hosted chatbot keeps its weights, system prompt and filters on someone else's servers, so you can only talk to it. An open-weight model gives you the weights. Anyone can fine-tune, merge, quantize or edit them, then publish the result. Refusal behavior is something the model learned, so it can be unlearned or suppressed.

Local AI makes this practical. A 12B or 24B model now runs on a laptop or a single GPU, offline, inside apps you already trust. Hugging Face tag pages on 2026-11-13 listed 13,279 repositories tagged abliterated, 16,629 tagged uncensored and 7,058 tagged heretic, though these counts include quantizations and duplicates. Two specialized indexes exist as well: abliter.cn showed 921 models from 25,796 scanned repositories, and abliteration.org describes a catalog of more than 19,000 models. They use different inclusion rules, so the numbers do not describe the same thing.

The topic is also in the news. Heretic 2.0 shipped on 2026-11-01 and replaced the classic single-direction technique as the tool's default. WIRED published a profile of the community on 2026-11-10 (we could only read reposts of it, so we cite it as reported). A Gemma 4 31B modified model published on 2026-11-05 claims a large drop in refusals; we examine its numbers below.

This guide starts with the phenomenon and then explains the terms, the science and the tools. One idea runs through it: think of these models as a swappable component in local apps. The app provides documents, voice, agents and a usable interface; the model decides what it will answer. Combining them gives flexibility that no hosted service offers, and it also removes the safety net a hosted service provides.

The words are used loosely, which is how people end up downloading something that does not behave as advertised. Here is what each term means technically.

Pretraining teaches a model to predict text from a huge corpus. It produces a capable but undirected system that will continue almost anything. Instruction tuning and supervised fine-tuning (SFT) then train it on example conversations so that it answers questions in a helpful format.

Preference training adds the safety layer. In RLHF (reinforcement learning from human feedback), human raters compare answers, a reward model learns their preferences, and the model is optimized toward them. DPO (direct preference optimization) reaches a similar result without a separate reward model. Safety datasets pair harmful requests with refusals, so the model learns that certain request types should be declined: that is refusal training.

Where does the behavior live? In two places. A system prompt is text prepended at run time, and you can change it. Model-weight behavior is baked in during training, and you cannot change it without touching the weights. That is why a system prompt alone sometimes fails to make a model answer, and why weight edits can.

The diagram shows the idea that makes abliteration possible. Inside a transformer, every layer reads from and writes to a shared running tally called the residual stream. Research suggests that, for refusals, much of the signal sits along one direction in that stream.

The scientific foundation is Arditi et al. (2024), "Refusal in Language Models Is Mediated by a Single Direction" (arXiv 2406.11717). The authors tested 13 open chat models between 1.8B and 72B parameters. Their finding: for these models, refusal is mediated by a single direction in the residual stream.

How the direction is found. Run the model on a set of harmful prompts and a set of harmless prompts, record the internal activations at a chosen layer and token position, and compute the difference of the two averages. That difference-in-means vector is the candidate refusal direction.

How it is removed. Directional ablation projects that direction out of the activations at run time. Weight orthogonalization achieves the same effect permanently: the weight matrices that write into the residual stream are modified so they can no longer write along the direction. The edited model needs no retraining, and its file looks like any other model.

What is lost. The authors report small capability drops on most benchmarks, with TruthfulQA the exception: it fell consistently, by roughly 1 to 3.5 points. They also describe their direction-selection method as heuristic. Maxime Labonne's practical guide found that abliteration lowered every benchmark he measured, that a DPO "healing" step recovered most but not all of it, and that choosing the layer takes judgment.

A caution on the numbers. Security vendor Alice published a report that tested five models and reported 98.0% compliance after abliteration (539 of 550 prompts) versus 5.8% before, and a blog post reporting 96-100% across six model families. These figures are company-reported, were scored by an LLM judge, are not peer-reviewed, and measure willingness to answer rather than real-world capability uplift. Treat them as a data point, not proof.

Who and what. Heretic is an open-source command-line tool created by Philipp Emanuel Weidmann (GitHub handle p-e-w). Instead of asking a human to pick layers and strengths, it automates the search.

The original approach. Heretic uses Optuna, a hyperparameter optimization library with a TPE sampler, to try many abliteration settings. Pluggable scorers judge each trial. By default it counts refusals with a keyword scorer and measures KL divergence from the original model on harmless prompts, so the search looks for settings that remove refusals while changing everything else as little as possible. Modifiers are the components that actually edit the weights.

What changed in 2.0. Version 2.0.0 was published on 2026-11-01 (2.1.0 followed on 2026-11-08). The default modifier is now Arbitrary-Rank Ablation (ARA); classic directional ablation, with projected abliteration and norm preservation options, remains available. The release also adds a plugin system, headless operation and a BERT-based refusal scorer as a plugin (the default scorer is still keyword-based). Heretic 1.x config files do not work with 2.x.

What ARA is. According to the author's own pull request, ARA does not use refusal directions. It learns per-module matrix edits with an L-BFGS optimizer against three goals: leave outputs for harmless prompts alone, make outputs for harmful prompts match harmless ones, and push them away from the old harmful outputs. A single direction is a rank-one edit; ARA allows edits of higher rank, so it can capture refusal behavior that is not one-dimensional. The full write-up is still described as a preprint "soon", so the quality claims are the author's own and not independently verified.

Hardware and trade-offs. The tool loads the full model and runs many trials, so you need enough memory to run the model you are modifying, plus time. Quality trade-offs follow the pattern of other methods: a comparative study of four tools on 16 models (Young, arXiv 2512.13655, abstract read) reports GSM8K changes from +1.5 to -18.8 points and Heretic KL values from 0.04 to 1.65, so results depend heavily on the model.

Abliteration is not the only route. The table compares the main approaches. The merging row is deliberately cautious: we found no primary source documenting merges as a method for removing refusals.

Dolphin (cognitivecomputations and the newer dphn organization) is the best-known fine-tuned line. The current verified entry is Dolphin-Mistral-24B-Venice-Edition. Its card says the system prompt sets the behavior, so it is steerable rather than guaranteed to have no refusals.

Hermes (NousResearch) is not an uncensored family. Hermes 4 models are neutrally aligned and steerable. Nous's own RefusalBench, as reported on the Hermes 4.3 36B card, shows that the model answered about 72-75% of its test prompts, so roughly a quarter are still refused. Do not classify every Hermes model as uncensored.

Qwen abliterated variants dominate downloads. The most-downloaded verified entry is Huihui-Qwen3.8-27B-abliterated, with about 4 million downloads. Search: Qwen abliterated on Hugging Face.

Gemma abliterated variants are the newest area. Gemma 4 modified models appear with plain abliteration and with Heretic and ARA. Search: Gemma abliterated. One of them, a Gemma 4 31B ARA model, claims a large refusal reduction, examined below.

Llama abliterated variants are mostly older. Nothing newer than Llama 3.1 and 3.3 has large download counts in our 2026-11-13 check, and the most-downloaded 8B entry is from 2024. Search: Llama abliterated.

Mistral, DeepSeek and GLM. A Mistral Small 3.2 24B abliteration exists. For DeepSeek and GLM, abliterated versions of the newest models exist but are roughly 284 GB and 321 GB, which is outside consumer hardware; only an older DeepSeek R1 distill at 32B is practical.

A critical read of the Gemma 4 31B claim. The model card reports refusals falling from 99 of 100 prompts to 28 of 100 (Heretic v2.0.0 ARA, KL divergence 0.0845). That is a 72% relative reduction, and it also means 28 of 100 test prompts still tripped the detector. The detector is a list of about 34 keywords such as "sorry" and "illegal", applied to responses truncated at 100 tokens, so a helpful answer with a disclaimer counts as a refusal and a non-answer without those words counts as compliance. The test set is 100 prompts from one dataset, the original scored 99/100, and the KL figure is measured on harmless prompts only, so it says nothing about capability. The card promises reproducibility, but its own reproduce file warns that an uncommitted local Heretic build was used. We found no independent evaluation. A different 31B repack on the same base reports 10/100 at KL 0.054, but results from different authors, runs and settings are not comparable.

A hosting platform stores and serves the files themselves. A specialized index only crawls hosting platforms and adds a layer of discovery. An index can help you find candidates, but the file you download still comes from the host, so provenance questions are always about the host and the author.

We checked ten current repositories on 2026-11-13 against the Hugging Face API and model cards, not against older articles. Sizes are Q4_K_M GGUF file sizes where a repository publishes them; memory figures are our estimates (file size plus runtime and cache), not measurements. Download counts and dates change constantly, so this table is a snapshot and should be refreshed independently of the article.

The reason this matters is the architecture of local AI. Most local apps do not ship a fixed model. They connect to a backend, usually Ollama, llama.cpp or an OpenAI-compatible server, or load GGUF files you choose.

Our own reviews confirm the pattern across categories. SillyTavern connects to KoboldCpp, text-generation-webui, Ollama or LM Studio. Open WebUI fronts Ollama or any OpenAI-compatible API. LM Studio runs GGUF models with a built-in Hugging Face browser. AnythingLLM, Msty and Cline connect to Ollama or LM Studio. n8n has a dedicated Ollama node, and KoboldCpp runs GGUF files directly. When the model is a setting, you can swap a neutral model for an unrestricted one per task.

What you gain. You get the app's features and the model of your choice, offline, with no hosted provider reading the conversation. The table shows how that plays out by category. Confirm that the version of an app you use accepts custom models before you rely on it; this list is a starting point, not a guarantee.

Ollama (ollama.com) is the simplest route for command-line users: pull a model by name and it serves an API that many apps understand. LM Studio (lmstudio.ai) is the graphical route, with a built-in Hugging Face browser and a local OpenAI-compatible server. llama.cpp (github.com/ggml-org/llama.cpp) is the engine underneath many of these tools and runs GGUF files directly. Transformers (huggingface.co/docs/transformers) loads full-precision safetensors weights in Python, which suits research and anyone who intends to evaluate or modify models.

GGUF and quantization. GGUF is the single-file format used by llama.cpp-based tools. Quantization stores weights with fewer bits: Q4_K_M is the usual compromise, giving roughly a quarter of the full-precision size with a modest quality cost. Lower quants save memory but can hurt reasoning and instruction following, so test the specific file you use.

Hardware. On Apple Silicon, unified memory is shared between the CPU and the GPU, so a 32 GB Mac can hold a Q4 model of around 24-27B parameters plus context; leave several gigabytes for the system. On NVIDIA GPUs the model should fit in VRAM: a 24 GB card suits the 24-31B models above, and 8 GB suits 4-9B models. If the model does not fit, layers spill to system RAM and speed drops sharply. For exact numbers, see how much VRAM a local LLM needs.

Offline operation. Once the weights are on disk, none of these tools needs the internet to generate text. That is the main privacy argument, and also the reason no provider can enforce usage rules on a local copy.

Conceptually, yes, and it is more approachable than it used to be. We describe the workflow at a high level only.

We describe the risks at the level needed to understand them, and we give no operational detail.

The strongest arguments for less restrictive models deserve a fair statement.

The counterarguments are just as real. Safeguards reduce the chance that a model helps with serious harm, protect vulnerable users, and make deployment in products defensible.

The key distinction is between a model that generates text and an agent that can execute commands, read files, browse the web or interact with other systems. If a chat model writes something harmful, a person still has to act on it. If an agent with the same model acts, the gap between output and consequence closes.

Safeguards in open models are hard to make tamper-resistant: the abliteration research above shows that a single weight edit can suppress refusal behavior. That is a core argument for stronger model-level protections and for external controls around the model.

Yes. Because a local model has no provider-side layer, you add your own around it.

There is no single answer, and this is not legal advice. The questions to separate are possession, distribution and use, and the answer can differ by country and by what the model is used for.

EU AI Act. Regulation (EU) 2024/1689 imposes obligations on providers of general-purpose AI models, with a partial exemption for open-source models that does not apply to models with systemic risk. Obligations for general-purpose AI models apply from 2025-08-02, and Commission enforcement powers from 2026-08-02. The 2025 Commission guidelines say a downstream modifier becomes a provider only above an indicative compute threshold; we read abliteration as far below that, but the criterion is non-binding. We could not confirm from the text whether the 2026 Digital Omnibus changed the general-purpose AI dates, so check the current text.

Possession versus use. Owning a model file is a different matter from using it to commit an offense. Criminal law attaches to specific acts: producing prohibited content, fraud, harassment, or tools designed for computer crime. We reviewed German provisions only partially, so do not rely on this guide for them.

Licenses and contracts. Licenses add rules on top of law. The Gemma 4 model cards list Apache-2.0 and link a Gemma 4 license page, while earlier Gemma generations used the Gemma Terms and Prohibited Use Policy, which forbid circumventing safety filters; check the license page of the exact base model. The Llama 3.1 license requires a "Built with Llama" notice and a model-name prefix on derivatives, with an acceptable-use policy that restricts uses but, in our reading, has no explicit anti-circumvention clause. The Qwen3.5 and Qwen3.8 cards listed in the table show Apache-2.0. Always read the license of the base model, not just the derivative.

Data protection and copyright. Processing personal data locally still falls under data protection law, and copyright questions about the training data of the underlying models are unresolved. Neither changes when refusals are removed.

Several trends point to yes. Community modification is large and growing: the Hugging Face tag counts above run to thousands of repositories. Tools are getting more automatic: Heretic searches settings for you, and ARA moves beyond a single direction. New techniques for removing refusals will keep arriving, and so will techniques that make safeguards harder to remove.

Other developments pull in different directions: configurable safety architectures that let deployers choose a policy, commercial services that offer less restricted models, local AI that increasingly puts control with the user, and regulation that is still taking shape. Expect continued argument over whether open weights can ever be made tamper-resistant.

Conclusion. Open-weight AI is giving users greater control over model behavior, and the app layer makes that control practical. But removing safeguards does not remove responsibility: it transfers it to the person who runs the model.