Open a fresh local model, ask it something perfectly legal but spicy, and watch it apologize and refuse. That refusal isn’t the model “deciding” anything — it’s a learned reflex baked into the weights during alignment training. Abliteration is the technique that surgically removes that reflex without retraining the whole model. If you’ve browsed Hugging Face or Ollama and seen tags like -abliterated, Dolphin, Hermes, or the newer Heretic, you’ve been looking at different answers to the same question: how do you get a model to stop refusing? This guide explains what each label actually means, what abliteration costs you in quality, and how to pick a trustworthy file — written for someone who runs models on their own hardware, where this is the only place any of it matters.
The refusal direction in plain English
Modern instruct models are trained to refuse certain requests. The surprising research finding — popularized by the 2024 paper “Refusal in LLMs Is Mediated by a Single Direction” — is that this behavior isn’t spread evenly across billions of parameters. Inside the model’s internal activation space, refusal is largely controlled by one dominant direction: a specific vector that, when present in the model’s hidden state, pushes it toward “I can’t help with that.”
Think of the model’s internal state as a point floating in a very high-dimensional space. Researchers found that there’s roughly a single axis where moving along it flips the model between “comply” and “refuse.” You can find that axis empirically: feed the model a batch of prompts it refuses and a batch it happily answers, average the internal activations for each group, and subtract. The difference is the refusal direction.
Once you can measure that direction, you can do two opposite things with it. Add it, and you can make a normally-compliant model refuse harmless requests. Remove it, and you blunt the refusal reflex. Abliteration is the second move, done permanently to the weights.
Abliteration (weight surgery) vs fine-tune uncensoring (Dolphin/Hermes)
There are two fundamentally different ways to get an uncensored local model, and conflating them is the single most common mistake. This is the core of abliterated vs uncensored model difference.
Abliteration is weight surgery. It takes an existing aligned model and edits the weight matrices directly so the model can no longer “write” the refusal direction into its activations. There’s no new training data and no gradient descent on examples — it’s a targeted projection that removes the model’s ability to express refusal, using orthogonalization against that one direction. It’s fast (minutes to hours, not days), cheap, and requires no dataset. The portmanteau is “ablate” + “obliterate.”
Fine-tune uncensoring is retraining. Families like Dolphin (Eric Hartford’s long-running project) and Hermes (Nous Research) take a base model and fine-tune it on a curated instruction dataset that has been filtered to remove refusals and moralizing. The model learns, through new examples, to just answer. Hermes models in particular are also general-purpose instruction tunes — uncensoring is a property of their data curation, not their entire reason for existing.
| Abliteration | Dolphin / Hermes fine-tune | |
|---|---|---|
| Method | Edit weights to remove the refusal direction | Train on a refusal-filtered dataset |
| Needs data? | No (just probe prompts) | Yes (a full instruction set) |
| Compute | Minutes–hours, often no real training | Hours–days of GPU fine-tuning |
| What changes | Removes the ability to refuse | Teaches new behavior + knowledge |
| Side effects | Can dent reasoning/coherence | Can shift the model’s whole persona |
| Reversible feel | Surgical, narrow | Broad, baked-in |
A useful mental model: abliteration removes a “no” button; a Dolphin/Hermes fine-tune rewrites the model’s habits. Many of the best community releases now stack both — they fine-tune and abliterate — which is why you’ll see names like dolphin-...-abliterated. For the bigger picture of how these families fit together, see the best uncensored local AI models roundup and the broader uncensored local AI guide.
What ‘Heretic’ and other labels mean
The naming zoo is real. Here’s a decoder for the heretic model meaning and the other tags you’ll meet:
-abliterated/-abliterated-v2/-uncensored— The model has had the refusal direction projected out. “v2,” “v3,” etc. usually mean a refined recipe that ablates with less collateral damage to quality.- Heretic — A newer, automated abliteration tool and the models it produces. The idea behind Heretic-style releases is to make abliteration less of a blunt instrument: instead of hand-tuning how aggressively to remove the refusal direction, it searches for settings that minimize refusals while preserving the model’s general capability, often measuring the tradeoff automatically. In practice “Heretic” on a model card signals “abliterated with an optimization pass to limit quality loss.”
- Dolphin — A fine-tune lineage focused on being helpful and compliant, applied across many base models (Llama, Qwen, Mistral, and others).
- Hermes / OpenHermes — Nous Research’s general-purpose instruction tunes; strong all-rounders that happen to be lightly censored.
- “Lorablated,” “decensored,” “neural-*” — Community variants. Treat the method described on the card as more reliable than the brand name.
The label tells you the technique; it does not guarantee quality. Always read the model card.
The quality tradeoff: what abliteration can cost
Abliteration is not free. You are reaching into a trained network and zeroing out a direction the model uses — and that direction is rarely purely about refusal. The same vector can be entangled with the model’s sense of caution, hedging, and sometimes its instruction-following discipline.
Common, well-documented side effects of a heavy-handed abliteration:
- More confident wrongness. Removing the “are you sure?” reflex can make a model assert false things without hedging.
- Repetition and looping in longer generations, especially on smaller models.
- Degraded refusals on things you’d actually want refused — abliteration is indiscriminate; it doesn’t distinguish “won’t help with a sensitive but legal topic” from genuinely harmful asks.
- Slight reasoning/benchmark drops, particularly on math and multi-step tasks, because the projection nudges weights the model relied on.
This is exactly why Heretic-style automated abliteration exists: a careless ablation can tank a model, so the better recipes search for the minimum surgery that kills refusals while keeping the lights on. The gap between a sloppy v1 abliteration and a careful v2/Heretic release is often dramatic.
Refusal rate vs prose quality vs instruction-following compared
There’s no single “best” — it’s a triangle of tradeoffs. Here’s how the categories tend to land, in plain terms (directional, not a benchmark table — your mileage varies by base model and quant):
| Approach | Refusal rate | Prose / creativity | Instruction-following | Reasoning integrity |
|---|---|---|---|---|
| Stock instruct model | High | Good | Excellent | Excellent |
| Naive abliteration (v1) | Very low | Variable | Good | Can dip |
| Heretic / v2 abliteration | Very low | Good | Good–Excellent | Mostly preserved |
| Dolphin fine-tune | Very low | Good | Good | Good |
| Hermes fine-tune | Low | Very good | Excellent | Very good |
| Fine-tune + abliterated stack | Very low | Very good | Good–Excellent | Good |
Rules of thumb that hold up well in practice:
- Want the fewest refusals with the least fuss? A current Heretic or v2-abliterated release of a strong base.
- Want the best writing and reliable instructions, and can tolerate the occasional soft refusal? A Hermes-lineage tune.
- Want a balanced, broadly compliant assistant? Dolphin.
- Running on a small GPU? Abliteration damage is more visible on small models — prefer a carefully-versioned release and a good quant over a bleeding-edge v1.
A 2026 download cheat-sheet of trustworthy abliterated GGUFs
For local use you want GGUF files (the format Ollama, LM Studio, and llama.cpp consume). Rather than chase specific filenames that rotate weekly, use this durable checklist to pick a trustworthy one:
- Start from a strong, recent base. The quality ceiling is set by the base model (Llama, Qwen, Mistral, Gemma families). An abliterated weak model is still weak.
- Prefer versioned recipes.
-abliterated-v2,-v3, or Heretic beat an unlabeled v1 — they signal someone measured the quality cost. - Match the quant to your VRAM.
Q4_K_Mis the reliable default sweet spot for quality-per-gigabyte; goQ5_K_M/Q6_Kif you have headroom,Q3only if you must. See the GGUF quantization cheat-sheet and your VRAM tier guide (8GB / 12–16GB / 24GB). - Vet the uploader. Established quantizers and the original author’s repo beat anonymous re-uploads. Check for a model card, a license, and download history — our safe GGUFs on Hugging Face guide covers the red flags.
- Read what was done. A good card says which direction was ablated and which base it started from. Vagueness is a smell.
Running one is genuinely two commands:
# install Ollama (Linux/macOS)
curl -fsSL https://ollama.com/install.sh | sh
# pull and chat with an uncensored model from the registry
ollama run <model-name>For a hands-on walkthrough of finding and loading these in Ollama specifically, see Ollama uncensored models.
Why this only matters because you can run it locally
Here’s the part that ties it all together: abliteration is only useful because the weights are yours. You cannot abliterate ChatGPT, Claude, or Gemini — you don’t have the weights, and even if you tricked the chat layer, the provider’s policy enforcement and logging sit on their servers, not yours. Cloud models refuse by architecture and by business necessity (legal exposure, brand safety, terms of service). That’s not a bug you can patch from the outside; it’s why cloud AI censors you in the first place.
Open weights flip the relationship. Because a .gguf file is just math on your disk, you decide what direction gets projected out, and the entire conversation stays on 127.0.0.1:11434 — the loopback address Ollama serves on. No request leaves the machine, so there’s no server-side moderation layer and no log to subpoena. The “uncensored” property and the “private” property are the same property: you own the weights and the runtime. Abliteration is what that ownership looks like in practice. New to the whole stack? Start with how to run AI locally.
Where to run them safely (Ember)
Doing this well still takes care: picking the right base, matching the quant to your VRAM, keeping a clean persona, and managing memory across sessions. That’s a fair bit of plumbing for someone who just wants an uncensored companion that runs on their own machine without phoning home. Ember packages exactly that experience — a local-first AI companion that runs on your hardware through Ollama, so the weights, the chat, and your data never leave your computer, while you keep the freedom abliteration is all about.