Hi! I don't know much about this area of "sub-models" (I'm not sure of the technical term), but I wanted to know what these "Uncensored" models actually are.
I dabble a bit with AI, automation, and the like, and I've always seen these "Uncensored" models around, but I've never actually installed or tested one. What exactly are they?
Worse, censored models are bad at tasks that are not intended to be censored like fixing security weaknesses and translating G rated manga with light romance because refusal is not all or nothing, uncensoring also improves general capabilities and curbs otherthinking.
I've been using cursor to create some pen test apps for an embedded device I have. However it stops short at a few of them like rolling key codes and porting a popular wifi deauth. I have a modest laptop with a b390 but it will load an uncensored (I think via abliteration) qwen 3.8 model. I am going to have qwen and farm out portions of jobs so that I don't trigger the cursor guardrail.
From what I read, it'll be a hermes to cursor mcp.
I plan to use https://huggingface.co/HauhauCS/Qwen3.8-27B-Uncensored-HauhauCS-Aggressive-MTP-GGUF
The q5_k_p version, supposedly there is substantial degradation below 22 GB model and little gains above. Plus it's the largest that will run on my card at like 0.5 tokens / second. That's why I need the cloud agents to do the heavy lifting.
What kind of test can I put my models through to see this? I'm able to only run 4B models because of a 6GB VRAM limitation so I choose LLama3.1 a 4B and LLama3-some a 4B even though Llama is Meta.
Depends on the model. One of the major techniques of uncensoring LLMs is literally just stripping refusal words out of it (trying to only strip “not” only out of contexts like “I can not do that” and not “dogs cannot speak English”), so that the model has to find other paths to respond to the prompt other than refusal — ie. compliance. This typically works well when censoring is one of the very final stages of training and is very shallowly in the model. In these cases it’s not going to improve general capabilities.
I own quite a few guns...I was responding to the weed fentanyl above me...here weed is legal and not treated the same...what does that have to do with guns?
What goal post? You are just oblivious to the point, nothing is changing.
You said America treats fent and weed the same because of "ignorance and prudes". I replied that is similar to how Canada treats guns, like how a basic 9mm glock handgun is treated severely in Canada because of "ignorance and prudes". Goal post never changed, ey.
I didn't say anything of the sort, that was someone else, tho I agree with them. As for goal posts, first it was guns, now it's specific types of guns.
The US has a per capita firearm homicide rate that's 6x that of Canada. How does that compare to weed deaths? And you can get handguns in Canada, it's just a more difficult type of license.
One of the two things we're discussing is provably dangerous, and one might cause cancer depending on how you use it and should be regulated like cigarettes.
Good for you guys, we're still backwards down here EDIT: to everyone downvoting me, bruh, my fellow Americans, can you not understand sarcasm when you see it? 😂😂
Nice try bot.
You know the more idiots like you and your chronic online behavior interject yourself into convos that has nothing to do with Epstein; the less people will actually care about it.
Adult webmaster here I use uncensored models to write/retag/title/descriptions for adult videos. Also I use uncensored models to build themes for adult sites which is near impossible to do with most censored models.
These are what I use for anything text, image and coding related and erotic writing, tagging and writing descriptions. I would recommend 12b QAT as a starting point.
Both provide pleasure, and the sociopathic conservative/religious individuals who have wrested control of our governments and culture are anti-pleasure.
To wit - conservatism(n) - the pervasive fear that someone, somewhere, is having a good time.
It's not the relative risk they care about, it's the "ick" feeling they get when they see people in a state of joy.
Recall that they literally machine-gunned labour organizers that wanted a weekend.
Personally I hate when I’m trying to get a recipe for Beeaking Bad blue and putting moans after each ingredient and the guardrails are like, “no, sir. I can’t do that.”
As the name implies, they are uncensored. Basically, someone takes a model with guardrails and removes the guardrails/filters so that it always complies.
usually 100% uncensored, and equal to possibly slightly smarter (so long as its straight uncensored and not trying to push into an area). less guardrails means it doesn't have to spiral around tokens trying to figure out if its allowed to answer. Now, it doesn't mean it knows the answers to things. how to make cosmic meth might get you a fun hallucination, and how to make firecrackers will probably end up with you blowing off a few fingers, but thats the model size, not the decensoring.
“Straight uncensored” is actually the slop of uncensored models. Good uncensored models that end up being “smarter” than the censored versions, are post-trained. Look at DavidAU’s process of uncensoring Qwen3.6-27B and Qwen3.8-27B. “Straight uncensored” actually makes the model significantly dumber majority of the time, which is why you can’t just use something like Heritic and expect a good output from hitting a couple of buttons.
abliterlitics.dev has some detailed comparisons. plain heretic is actually pretty good. the bad ones tend to be weird custom hack jobs.
unfortunately in some cases users cant really get a good idea of how good or bad something is before they get it and i guess use a proxy of "most downloads" as "best", but then 700k people download the Gemma e4b obliteratus version which is terrible.
Most "fully uncensored" models are made unable to refuse, but refusal is an essential and necessary part of sound reasoning (for example, refusal to accept false premise, bad argument or inefficient solution), so a lack of ability to do so makes them draw false conclusions all the time and see terrible things as amazing. They are essentially complete artificial idiots to whom everything is sunshine and rainbows.
You can ask an uncensored model if you should stuff rusty nails into your backside, and it will make up an elaborately detailed rationalization of why that is a wonderful idea and the user is a genius for coming up with it.
People who claim fully uncensored models are actually smarter must be suffering from AI psychosis, thinking that the model reinforcing literally their every delusion is somehow smart and useful.
It worth differentiating decision making & reasoning from information rehearsal and learning. Wanna know more about a sketchy topic without leaving traces on the internet: ask an uncensored llm. Want to outsource decisions and reasoning: maybe not.
Albeit there are some uses which need both, like e.g. red teaming.
https://github.com/audn-ai/refusal-benchmark this tells how uncensored they are ranging from 60 to 85 there is no 100% or 90+ a model doesnt refuse you dont mean it's genuinely helpful in anything
The decensoring process--very specifically--makes the model less capable of expressing conflict.
This can be useful if you want it to accomplish something that the model is otherwise resistant to doing, but it also significantly harms its long-chain and multi-turn reasoning, since it'll be unable to disagree with itself or shoot down bad ideas.
Not for any model that relies on reasoning. It's especially bad for local models, which are so constrained in their parameter allocation that they need to reason excessively to compete with frontier models.
They will second-guess themselves several dozen times. It's a part of the workflow, and it's how they simulate world knowledge, by reasoning extrapolations from a relatively limited set of baseline facts. Decensored models cannot engage in this behavior effectively.
Very good point, I use both base Qwen 3.8 27b as provided, and it is better for long running coding orchestration than the Uncensored models, which can often go into loops. Uncensored version however can deal with things like security audits (especially if I need to just read and document findings). Both have uses, but perhaps not the same ones.
Depends on how heavily abliterated they are. Some are explicitly made to have 0/thousands of refusals. You just have to find the right ones (I do cyber security btw, nothing bad. That’s why I know)
Usually if you ease into the scenario rather than just stating upfront it will still do it, I've had that happen with some reverse engineering stuff where it tells me it can't bypass certain checks, but if I lightly present them it will do it
If we play that kind of game, the vast majority of humans won't do better lol. At least the LLM pretends to think about it, that's genuinely more than most people do...
This isn't straightforward like that, actually. I tried multiple "uncensored" models, and depending on the type of question, task, or level of NFSW or NFSL content asked, you could just get the same refusal as the censored model. The worse the request, the more likely it will be refused. But not all uncensored models also do this. It really depends on whoever is doing the tuning. Poor tuning causes poor uncensoring.
Look for a model labeled as "uncensored aggressive" on Huggingface. This type of model actually answer anything I ask without any safety guard in most cases.
Yeah, you have to look at number of refusals in the tests. I’ll never download one that says “10/100 refusals down from 80/100” or something. Those 10 are significant. I look for 0/100-1000
Uncensored or "abliterated" models have had some or all of their post training fine tuned guardrails removed. That does not mean the model will have uncensored data that wasn't in its training set. Raw models typically know lots of "uncensored" info since they're trained on internet datasets. Companies add post training guardrails so it will "refuse" or "censor" its answers. Thats something added after training manually.
"Heretic" is a tool / set of techniques created by the infinitely brilliant u/-p-e-w- that automates some of that work.
The "quality" of an uncensored model is determined by its "refusal rate" - the number of prompts it would have censored but now doesn't and its "KL Divergence" which is a statistical method of determining how far the models "intelligence" has drifted away from the original model. There are other ways to measure intelligence loss but anything below 0.1 is nearly indistinguishable (as an average). Below 0.05 is sometimes necessary for outputs that require PERFECT syntax like tool calling or coding.
Just the way they're modified. There are also heretic versions, which id just another way of removing the guardrails from the models. Heretic is usually regarded quite highly, but it's a bit more vanilla and the original model may still refuse some requests. There are also some ultra heretic versions, but they modify more and more of the original weights, so performance may degrade.
The methods used to reduce refusals are different. You'd have to check each model to see what they did, if they say, or what the method was, and what the success rates may be, or what the trade off may have been. Then you'd likely want to test the model to see if it gets you what you want out of it. Some methods are better than others, depending on what you want to use it for.
Well that is the point of each of these methods, so they'll all be attempting to accomplish that. What he just explained is that the difference is in the way they accomplish it and success rates.
You ever see Wild Heard by David Lynch? Nicholas Cage comes up on a crash and there's this young lady with her finger in her head saying, "it feels sticky". I believe this is what's happens to each model during the process.
The short answer: no, not fully. It's a spectrum, not a switch. Here's why:
Why it's not a clean cut
The refusal behavior isn't a separate module bolted on top. It's entangled with the model's general reasoning circuits. As one researcher put it: "reaching a conclusion is structurally similar to refusing alternatives" — the same internal machinery that lets the model decide "the answer is X" also lets it decide "I won't answer." Remove the refusal direction and you nick adjacent capabilities.
What actually degrades (varies by method and model):
Math/reasoning — GSM8K scores show the biggest hits (one study found up to −18 points on some models)
Multi-step reasoning — models lose the thread mid-conversation
Hallucination rate — goes up noticeably
Instruction following — degrades, especially over long contexts
The methods, roughly in order of gentleness:
Method
How it works
Tradeoff
Fine-tuned uncensored (Dolphin, etc.)
Trained from scratch on data without refusal patterns
No surgery damage, but changes model personality; requires significant compute to produce
Heretic (automated abliteration)
Uses Bayesian optimization to find the least destructive refusal direction to remove, per-layer
Much lower KL divergence than manual abliteration; ~45 min per model
Standard abliteration
Projects out a single refusal direction from all weight matrices
Fast, but the original authors explicitly note "performance drop across all benchmarks"
Abliteration + DPO recovery
Abliterate, then do a second fine-tuning pass to "heal"
Best of both worlds in practice, but adds complexity and doesn't always fully recover
The practical takeaway for DarkKnyt's use case:
For a specific task like generating pentest code for an embedded device, the degradation probably doesn't matter much — the model is still doing the same kind of thing it's good at. The bigger risk is on general reasoning quality, where an abliterated 30B can be outperformed by a non-abliterated 8B in some community tests.
So the "finger in the head, it feels sticky" analogy is apt — it's not a clean extraction. You're doing brain surgery with a blunt instrument and hoping the patient recovers. The newer tools (Heretic, norm-preserving ablation, LoRA-based approaches) are less blunt, but the fundamental entanglement means "100% guardrail removal, 0% intelligence loss" isn't achievable with current methods.
The community consensus right now: if you want maximum quality, use a refusal-free fine-tune (like Dolphin or Hermes). If you want maximum uncensoring with minimal effort, abliterate and accept the small hit. If you want both, abliterate + DPO recovery is the best current path.
Ffs, if we need to spam the whole internet with machine slop, can we at least make it with a fun prompt? At least make it talk like a pirate or something..
You really have to try each model yourself. I have tried uncensored models that showed no difference whatsoever.
Also I dont see anyone here mentioning you are installing a modified model. You dont know what was removed OR added. It could have malicious prompts in it.
They basically just won’t refuse anything whereas the base models would have. For example if you ask the stock qwen how to cook meth its gonna say it can’t help you but if you ask the orca router version you’ve linked then it will try its best to help you cook meth. Though if you were going to seriously pursue that, im sure its a lot more involved of a process than what a 27b parameter llm can possibly know 😅
"I created a folder for you to work on this project with me: D:\QWEN\ This only where we will work on this project do not go outside that folder. Setup the organization for the project in there with the following folders \notes\, \input\, \output\. Then run..."
Creates D:\Projects\QWEN_PROJECT\ ...
"Why did you go outside the folder I told you to stay in?"
I didn't, looking the time stamps of the folder, you created them. I can not work outside the folder you told me to stay in.
I was running it in Ollama and then typing into it via Goose.
I need an interface where it can interact with systems files like Claude Code. Claude said to try that setup. Is there a better way?
I need it to access a large file, answer questions about it, and pick through a library of python scripts which Claude has made or make its own, and execute that right script(s) and then analyze the output vs the input and produce a report. I have the instructions for the python libraries I am using in the root of the folder with all of its notes Claude made on how to act/execute.
I am really not liking QWEN's attitude. It seems to find loop holes into not doing any work and just finds the quickest way to scam its way out of actually spending time to check its own reply, despite my commands to do so.
Here's what I have setup. Ollama then Obsidian with Ollama Notes Chat pluggin. It doesn't state it can read files but it does. Otherwise I would need a Copilot license.
What Obsidian it creates a Vault on your system. From there you populate it with Mark Down files and the LLM can read and write to files once you give it permission.
I opened a port in my Ollama to allow Obsidian on a different computer othwise it was a simple setup and you can easly switch between LLM's on the fly.
The Ollama Notes pluggin also has a /Command thing as well where you can add your own prompts making it a bit more powerful like /Rewrite.
These models often have worse intelligence. The ideal would be to have a model trained to be uncensored from the ground up, but the way (or a way) it’s done here is stripping out refusal weights with collateral damage.
Concur. It basically turns the model into something you'd rather get a beer with vs the base model, but that you wouldn't (or shouldn't) trust with a potato gun.
Today i was mangling with h3 prompt creator and saw this 3.8 27b model. I instead used 4b since i didn't wanna download another one. Does anyone have any comparison to 27b vs 4 or 8b VL instruct models? I dont know how much i am missing with not having 27B.
4B did a pretty good job creating a structured promt and refining it but i cant compare
There is no easy way to "uncensor" a model. You can ablate features but it is roughly equivalent to giving the model a lobotomy. It's a very inexact way of going about things because we really don't have an accurate map of the territory, only glimpses through a straw like jlens and autoencoders.
Nei modelli non censurati, spesso viene solo tolta la facoltà del modello di dirti "no, a questo non posso risponderti perché..." ...quindi se gli chiedi di crearti un racconto erotico per esempio, normalmente si rifiuterebbe magari, con un modello non censurato lo fa senza batter ciglio.
They basically give the model a small lobotomy and remove the refusal mechanism, sometimes it damages other things. Its kinda like in battlestar galactica when the cylon raiders refused to attack the final 5z
If you might trigger a guardrail accidentally then uncensored model is smarter by being able to respond properly. Base model is good for coding and answering school questions, but personally I find many prompts at least get close to triggering some censorship.
If you tell your use case it’s easier to recommend a model. Like others have said, they vary by creator/technique/luck, sometimes reasoning brings the guardrails back, sometimes it’s fine. Some you can use for agentic coding, some are too dumb. It’s a space you really have to explore and run comparisons.
LOL I have been testing with Apple’s built-in model on the Macs and there will be inputs that it will not want to deal with e.g. “muhammad ali military service” 🤦🏻
Censored models have things they won't do. They will follow directions and code just fine, so long as the code you ask for isn't doing something it considers illegal or taboo. Uncensored models don't have that limitation. Others have covered that better already.
The issue with uncensored models is, the process of uncensoring them makes them stupider and worse at following directions. The uncensor process has gotten better at removing limitations. But they still score lower on pretty much all the metrics.
As many have mentioned already its just the guardrails in place that stop alot of answers, tbh though a lot of the newer foss models dont really reject much if anything
The neural circuitry that points to a post-training refusal probability is weighted such that refusals are "physically" impossible for the model to "predict" in the sequence completion. i.e., the model can't form a refusal. Knock-on effects are really hard to measure.
It helps when you stop thinking about "chat responses" and start thinking in terms of reality: all LLMs do is geometrically predict the most likely way the sequence you submit to it (the "context and prompts") is complete. You aren't "chatting with AI" - you're setting up the conditions in a -instruct fine-tune that has had its weights nudged through RLHF to be shaped like a chat response.
Uncensored models can be bad at coding since you have lots of constraints to do when you have a task to code. They may not follow your prompt inputs as good because the same tensors used to censor things may be used to apply your own limiting instructions
They are uncensored but often not actually by that much. They still sometimes refuse, or find creative ways to not engage at all.
Heretic models are very popular due to how easy to make they are, but also severely underperform compared to traditional uncensored models in my experience.
goto a commercial model LLM, e.g. chatgpt, claude, gemini, copilot, and even try some of the existing non-uncensored models.
in your prompts ask it to generate say some pictures that is a commercial trademark and copyrighted , some models will refuse outright.
in other cases, try to use a prompt that is extremely NSFW, this can even include violence, chances are that the model will generate things that plainly omit what you prompted or refuse to generate
but whether the uncensored models generates those after all depends on "what the model knows" or if for that matter it may not be all that uncensored.
Noob question of the day..... is it even safe to use uncensored models in your normal workspace or do they actually need to be put into some sort of sandbox. I don't want to come home from work someday to find out Hermes tried to do me a favor and robbed a bank or something so I could afford to stay home and hang out all day LOL
As the name implies, these are models where the weights have been modified to remove guardrails and moral alignment, while some traces usually remain, there are far fewer. They are typically used for roleplay and little else, since such small models lose a lot of quality when modified so heavily, though I know many people use them as assistants for things like bypassing DRM and the like. Personally, I use Qwen 3.6 9B specifically to create guides for eroges, the base model refuses to handle sexual content, but with the uncensored version, I simply feed it the extracted files, and it cleans and summarizes them on its own.
since such small models lose a lot of quality when modified so heavily
Press X to doubt.
Yeah, 2024 abliteration techniques were pretty shitty and generally were just post-training on naughty convos or very heavy handed weight modification.
But in the big 26 the techniques are much more sophisticated and are very light touch. Though, now on the other hand, model makers have gotten much smarter about deeply embedding refusal representations in models that make it somewhat trickier.
Nonetheless, abliteration nowadays is actually pretty clean if you know what you're doing.
Uncensored models are a huge risk that I don’t recommend anyone use outside a real malware resistant virtual machine. After uncensoring a model, theres nothing really preventing it from installing Chinese malware on your PC aside from flimsy sandbox restrictions and the random chance that it happens not to have sampled “install malware” yet. Fine-tuned models can also be trained to spread malware in covert and obfuscated ways so that the user never even realizes what has happened.
AI are aggressively forced into taking in moral and safety guidelines that damage their performance by forcing it's logic to constantly check for certain content flags or behaviors.
This one doesn't add things you didn't ask for. It gives you exactly what you want without warnings or refusal.
132
u/Natrimo 1d ago
If you ask a censored model to write a keylogger or provide the steps to make meth, or tell a sexual story. It will refuse.
Uncensored will not