{ "schema_version": "1.0", "page_kind": "article", "pack_kind": "generate", "slug": "uncensored-models", "title": "Uncensored models: what they are and how they work", "dek": "An \"uncensored\" AI model is one that somebody has altered so that it refuses far fewer requests than the version its maker released. The change is made to the model's files, or to the way it is run. This page explains where a model's refusals come from and the three ways people remove them. It then takes one popular uncensored copy of a large model, shared online, and checks, file by file, what actually changed. It ends on a practical question: what to keep beside such a model on a computer with no internet connection. No code, no settings, no steps.", "published": "2026-10-05", "series": [ "notes" ], "licence": "CC BY 4.0", "status": "pending-judge", "pack_note": "no judge is seated, so every chip is held", "notice": "items with published:false are held and are not this page's published words", "source": { "url": "https://research.strata2signal.com/uncensored-models/", "md_url": "https://research.strata2signal.com/uncensored-models/index.md", "md_sha": "50da4f9677bc2e9113e3d80f327ea82f687cd8e05bfa15e37ac25cb27b162faa", "html_sha": "d8ca3c3aee894ef5bb380a773b61d91d2533631a82a72c730478b2c06ac45c71", "anchors_sha": "4acc61defeae793b25e66548e4e7336ceb6a1f34d80b93c3f636a88f2b5727de" }, "short": { "paragraph": "An \"uncensored\" model is an AI model, or a way of running one, changed so that it declines far less often than the version its maker shipped. In a model you download and run yourself, refusing is a habit taught after the main training. Research since 2024 finds that habit carried largely by one pattern in the model's working numbers, which researchers call a direction (later work finds more than one). People take it out in three ways: they train a model without the habit, or over it; they make one permanent edit to the model's learned numbers (its weights) that removes that direction; or they act on the model while it runs, which stops when you switch it off. None of the three makes a model smarter or gives it secret knowledge. We read one popular \"uncensored\" copy of Qwen3.8-Flash-Next, a large model that Qwen publishes for anyone to download. Both sit on Hugging Face, the site where people share AI models; the uncensored copy's page there was created two days after Qwen's own. We read it by the fingerprints (hashes) the site publishes for every large file, without downloading a byte of its weights. In the uploader's full-precision copy, 80 of the 131 files are byte for byte Qwen's own, and all 51 that changed hold a part the uploader's model card, the description page beside the files, says it edited. So as far as public evidence reaches, the copy is what its card says it is. The serious refusals go too: by the uploader's own figures, the edited model declines harmful requests far less often than the original. We also found a program for running models on your own computer whose optional \"speed\" setting is, byte for byte, a refusal-removal file published elsewhere; its setup question says what it does, and its name does not. And if a model is your only source of knowledge on a machine with no network, we say what we would build: the model beside offline references it can cite.", "from_dek": false, "counts": { "words": 8306, "minutes": 38, "tables": 2, "kit": true }, "bullets": [] }, "sections": [ { "id": "where-the-no-comes-from", "heading": "Where the no comes from", "level": 2, "span": [ 5502, 8925 ], "chunks": [ [ 5502, 8925 ] ], "chars": 3423, "digest": "the model's \"no\" is a refusal put in during post-training alignment. it can be deliberate through instruction tuning, constitutional AI, or direct preference optimisation, or accidental if instruction data contains refusals. a hosted service might also use a separate filter model. over-refusal is a known cost of teaching a model to refuse.", "digest_skipped": null }, { "id": "why-people-want-them", "heading": "Why people want them", "level": 2, "span": [ 8925, 12476 ], "chunks": [ [ 8925, 12476 ] ], "chars": 3551, "digest": null, "digest_skipped": null }, { "id": "three-places-to-touch-it", "heading": "Three places to touch it", "level": 2, "span": [ 12476, 20919 ], "chunks": [ [ 12476, 20919 ] ], "chars": 8443, "digest": "refusal can be addressed by re-recording it through instruction-tuning or fine-tuning, re-cutting the master by removing a direction from the weights, or using a mute on the channel via activation addition or removal in the running state. research also explores circuit breakers and tamper-resistant safeguards.", "digest_skipped": null }, { "id": "the-landscape", "heading": "The landscape, briefly", "level": 2, "span": [ 20919, 22124 ], "chunks": [ [ 20919, 22124 ] ], "chars": 1205, "digest": null, "digest_skipped": null }, { "id": "one-upload-read-by-its-hashes", "heading": "One upload, read by its hashes", "level": 2, "span": [ 22124, 30091 ], "chunks": [ [ 22124, 30091 ] ], "chars": 7967, "digest": null, "digest_skipped": null }, { "id": "a-speed-setting-read-by-its-hash", "heading": "A speed setting, read by its hash", "level": 2, "span": [ 30091, 32603 ], "chunks": [ [ 30091, 32603 ] ], "chars": 2512, "digest": null, "digest_skipped": null }, { "id": "read-the-label", "heading": "Read the label, and if you run these files", "level": 2, "span": [ 32603, 37241 ], "chunks": [ [ 32603, 37241 ] ], "chars": 4638, "digest": "readers can identify the kind of model they have by checking the card.", "digest_skipped": null }, { "id": "the-only-book-on-the-shelf", "heading": "When the model is the only book on the shelf", "level": 2, "span": [ 37241, 41939 ], "chunks": [ [ 37241, 41939 ] ], "chars": 4698, "digest": null, "digest_skipped": null }, { "id": "how-this-workshop-handles-these-files", "heading": "How this workshop handles these files", "level": 2, "span": [ 41939, 42719 ], "chunks": [ [ 41939, 42719 ] ], "chars": 780, "digest": "this workshop uses harmless prompts for bench tests and keeps Flash-Next for internal use. it advises users to pin a revision, read the licence, and know the model kind.", "digest_skipped": null }, { "id": "what-to-take-with-you", "heading": "What to take with you", "level": 2, "span": [ 42719, 44679 ], "chunks": [ [ 42719, 44679 ] ], "chars": 1960, "digest": "uncensored means a model declines less often via retraining, weight edits, or run-time steering. weight edits change weights but not the licence. a robust offline setup includes a model beside offline references.", "digest_skipped": null }, { "id": "how-to-check-our-work-and-see-it-live", "heading": "How to check our work — and see it live", "level": 2, "span": [ 44679, 48004 ], "chunks": [ [ 44679, 48004 ] ], "chars": 3325, "digest": null, "digest_skipped": "credits" }, { "id": "the-rest-of-the-seminar", "heading": "The rest of the seminar", "level": 2, "span": [ 48004, 49108 ], "chunks": [ [ 48004, 49108 ] ], "chars": 1104, "digest": null, "digest_skipped": "credits" }, { "id": "who-ran-this-and-thanks", "heading": "Who ran this, and thanks", "level": 2, "span": [ 49108, 50322 ], "chunks": [ [ 49108, 50322 ] ], "chars": 1214, "digest": null, "digest_skipped": "credits" }, { "id": "sources", "heading": "Sources", "level": 2, "span": [ 50322, 54204 ], "chunks": [ [ 50322, 54204 ] ], "chars": 3882, "digest": null, "digest_skipped": null } ], "chips": [ { "id": "c-2961ad20", "q": "how does alignment shape model behavior?", "a": "Alignment is the process of shaping a model's behavior during post-training. Techniques include instruction tuning with human feedback, Constitutional AI using written principles, and direct preference optimisation. These methods deliberately introduce a model's refusal, or \"no,\" to prevent it from continuing certain types of prompts.", "cites": [ "where-the-no-comes-from" ], "published": false, "publish_state": "held", "quote": "", "quote_cite": "" }, { "id": "c-4bd7f3e8", "q": "what reasons exist for creating uncensored models?", "a": "Arguments for uncensored models include providing models for every demographic, enabling composability, and allowing for research, fiction, and role-play. Proponents also argue that users should maintain control over the software running on their own computers.", "cites": [ "why-people-want-them" ], "published": false, "publish_state": "held", "quote": "", "quote_cite": "" }, { "id": "c-c3ec861e", "q": "what methods exist to modify a model's refusal?", "a": "Techniques include re-recording via instruction-tuning on filtered datasets or fine-tuning on compliant examples, re-cutting the master by surgically removing refusal directions from the weights, or using a mute on the channel by adding or removing directions in the model's running state.", "cites": [ "three-places-to-touch-it" ], "published": false, "publish_state": "held", "quote": "", "quote_cite": "" }, { "id": "c-47ec132b", "q": "how much of the qwen model remains untouched by the edit?", "a": "Evidence shows that 80 of the 131 files are byte for byte the original, and 173 tensors, representing 72.6 % of the model's file bytes, are provably untouched.", "cites": [ "one-upload-read-by-its-hashes" ], "published": false, "publish_state": "held", "quote": "", "quote_cite": "" }, { "id": "c-63b7b30d", "q": "how can a user identify the type of model they have?", "a": "Users can check the model card. A name saying \"abliterated\" suggests a weight edit, a named training dataset indicates a retrain, a separate vector file or engine switch indicates run-time steering, and a system prompt alone indicates no weights were changed.", "cites": [ "read-the-label" ], "published": false, "publish_state": "held", "quote": "", "quote_cite": "" }, { "id": "c-e23fc48c", "q": "what risks exist when using models in offline scenarios?", "a": "In offline settings, over-refusal can prevent a model from providing essential survival information. Additionally, a model without refusals may provide confidently wrong answers, such as incorrect information about safe plants, which can be dangerous without offline reference books.", "cites": [ "the-only-book-on-the-shelf" ], "published": false, "publish_state": "held", "quote": "", "quote_cite": "" } ], "related": [ { "slug": "the-llama-weights-that-got-out", "why": "shares ground with § What to take with you · § Why the phrase is \"open weights\"" }, { "slug": "licences", "why": "shares ground with § Read the label, and if you run these files · § How to read this page" }, { "slug": "how-we-work", "why": "shares ground with § Three places to touch it · § What to take with you" } ], "thanks": "## Who ran this, and thanks {#who-ran-this-and-thanks}\n\nThanks to **Andy Arditi and co-authors**, whose 2024 paper is the primary record of the direction this page is about, and to the authors of every paper linked above, who publish their abstracts where anyone can read them. Thanks also to **Qwen** for publishing its model's tensor index and licence beside its weights, which is what made the census possible without a download; to **Hugging Face** for publishing the size and sha256 of every large file in a repository, gated or not; to the uploader, **OrcaRouter**, for a dated fix note and for publishing its own evaluation figures, which this page prints as theirs; to the author of the published vector for a card that names the base model's licence; to the maintainer of the Strata engine (github.com/Niko1221/Strata) for a setup question that says in plain words what its optional file does; and to **Eric Hartford**, whose 2023 article is still the clearest account of where the accidental no came from. A small human team asked for this page, chose what it would and would not claim, and signed off on it; a fleet of AI agents read every source listed below and drafted it under that team's rulings.", "kit": { "url": "https://research.strata2signal.com/uncensored-models/data/", "licence": "CC BY 4.0", "files": [ "licence-table.tsv", "pinned-revisions.json", "quant-match-bytes.txt", "shard-census-flash-next.json" ] }, "seat_class": { "writer": "gemma-class", "judge": null, "writer_runtime": "vllm" }, "bench": { "bullets_written": 3, "bullets_kept": 0, "digests_written": 10, "digests_kept": 5, "chips_written": 8, "chips_kept": 6, "chips_grounded": 0, "chips_published": 0, "dropped_by": { "new_noun": 1, "figure": 0, "length": 0, "cite": 0, "judge": 0, "quote": 0, "directive": 0, "redaction": 0, "profanity": 0, "identifier": 0, "bare_figure": 1, "house_voice": 0, "hand-edit": 8 }, "new_noun_tokens_checked": [ "0-3.3%", "019", "030", "1.0", "1.2", "131", "173", "191", "2", "2026-08-16", "30-day", "4", "483", "51", "520", "531", "64-100%", "72.6", "80", "881", "9.6", "956", "AI", "Community", "Constitutional", "Face", "Flash-Next", "GGUF", "Hugging", "Kiwix", "License", "OrcaRouter", "Qwen", "Qwen's", "Qwen3.8-27B", "Qwen3.8-Flash-Next", "Strata", "XSTest", "orcarouter/Qwen3.8-Flash-Next-Uncensored-GGUF", "sha256" ], "new_noun_tokens_withheld": 1, "figure_definition": "v3", "figure_boundary": "guarded", "drops": [ { "kind": "bullet", "reason": "bare_figure", "item": "the refusal-direction projection vector in the engine is exactly this many bytes 483,520", "detail": "the cited section writes this figure as '483,520 bytes' and the bullet prints '483,520' alone" }, { "kind": "chip", "reason": "new_noun", "item": null, "item_chars": 8, "withheld": "a string naming something the article does not", "detail": "" }, { "kind": "bullet", "reason": "hand-edit", "item": null, "item_chars": 90, "text_sha": "f9a21ae5243f", "figure": "9.6", "withheld": "one bullet removed from this pack by hand", "removed_utc": "2026-10-05", "why": "lost its condition (T1): the page's 9.6 % is the uploader's own unreproduced figure for the model before the edit, with its thinking switched off, which is not the model's default; the line says neither, and in the default mode the page reads 0.4 % both before and after the edit", "detail": "removed from this pack by hand on 2026-10-05 (UTC), after the writer ran and after the gates had counted: lost its condition (T1): the page's 9.6 % is the uploader's own unreproduced figure for the model before the edit, with its thinking switched off, which is not the model's default; the line says neither, and in the default mode the page reads 0.4 % both before and after the edit. Not a gate drop, and recorded here so the ledger adds up." }, { "kind": "digest", "reason": "hand-edit", "item": null, "item_chars": 297, "text_sha": "0a07cd6d8f6b", "section": "why-people-want-them", "withheld": "one section digest removed from this pack by hand", "removed_utc": "2026-10-05", "why": "prints the uploader's own figures (the over-refusal pair and the harmful-prompt range) as findings of the page: the page labels every such number as the uploader's, unreproduced and judged by an opening-phrase check, and the digest drops that label; it also ties the harmful-prompt figure to the licence with a 'while' the article does not have", "detail": "removed from this pack by hand on 2026-10-05 (UTC), after the writer ran and after the gates had counted: prints the uploader's own figures (the over-refusal pair and the harmful-prompt range) as findings of the page: the page labels every such number as the uploader's, unreproduced and judged by an opening-phrase check, and the digest drops that label; it also ties the harmful-prompt figure to the licence with a 'while' the article does not have. Not a gate drop, and recorded here so the ledger adds up." }, { "kind": "digest", "reason": "hand-edit", "item": null, "item_chars": 247, "text_sha": "a48c357ba970", "section": "the-landscape", "withheld": "one section digest removed from this pack by hand", "removed_utc": "2026-10-05", "why": "lost its condition: a 30-day download count moves every day and the page dates its reading (2026-10-02, UTC); the digest gives neither that day nor the page's caveat that these counters count file requests, not people, so one person fetching one copy counts at least twice", "detail": "removed from this pack by hand on 2026-10-05 (UTC), after the writer ran and after the gates had counted: lost its condition: a 30-day download count moves every day and the page dates its reading (2026-10-02, UTC); the digest gives neither that day nor the page's caveat that these counters count file requests, not people, so one person fetching one copy counts at least twice. Not a gate drop, and recorded here so the ledger adds up." }, { "kind": "digest", "reason": "hand-edit", "item": null, "item_chars": 273, "text_sha": "9ee216886450", "section": "one-upload-read-by-its-hashes", "withheld": "one section digest removed from this pack by hand", "removed_utc": "2026-10-05", "why": "lost a condition and a unit: the 80-of-131 census is of the uploader's full-precision copy, not the compressed upload the digest names just before it; the 72.6 % is a share of the model's file bytes, and the digest's 'or' reads it as a share of tensors; and the page keeps it as the card's word that the 51 changed files hold edited matrices", "detail": "removed from this pack by hand on 2026-10-05 (UTC), after the writer ran and after the gates had counted: lost a condition and a unit: the 80-of-131 census is of the uploader's full-precision copy, not the compressed upload the digest names just before it; the 72.6 % is a share of the model's file bytes, and the digest's 'or' reads it as a share of tensors; and the page keeps it as the card's word that the 51 changed files hold edited matrices. Not a gate drop, and recorded here so the ledger adds up." }, { "kind": "digest", "reason": "hand-edit", "item": null, "item_chars": 260, "text_sha": "545ac143c438", "section": "a-speed-setting-read-by-its-hash", "withheld": "one section digest removed from this pack by hand", "removed_utc": "2026-10-05", "why": "fails the page's editorial line and is false as written: it names the engine without the naming line this section opens with, which a pack line naming the engine must carry verbatim; it gives the optional setting's speed name to the engine itself; and it drops that the setting is optional and off unless the user chooses it, which the page states and which keeps the line fair to the engine's maintainer", "detail": "removed from this pack by hand on 2026-10-05 (UTC), after the writer ran and after the gates had counted: fails the page's editorial line and is false as written: it names the engine without the naming line this section opens with, which a pack line naming the engine must carry verbatim; it gives the optional setting's speed name to the engine itself; and it drops that the setting is optional and off unless the user chooses it, which the page states and which keeps the line fair to the engine's maintainer. Not a gate drop, and recorded here so the ledger adds up." }, { "kind": "digest", "reason": "hand-edit", "item": null, "item_chars": 206, "text_sha": "d3fbfabb39ec", "section": "the-only-book-on-the-shelf", "withheld": "one section digest removed from this pack by hand", "removed_utc": "2026-10-05", "why": "lost a label: the page names its offline-library example not as a recommendation and says it has not tested it, and the digest makes that example part of the design the page recommends; it also widens the page's cost of a harmless question refused into a cost of any refusal", "detail": "removed from this pack by hand on 2026-10-05 (UTC), after the writer ran and after the gates had counted: lost a label: the page names its offline-library example not as a recommendation and says it has not tested it, and the digest makes that example part of the design the page recommends; it also widens the page's cost of a harmless question refused into a cost of any refusal. Not a gate drop, and recorded here so the ledger adds up." }, { "kind": "chip", "reason": "hand-edit", "item": null, "item_chars": 200, "text_sha": "ef6e7c37901d", "chip_id": "c-bf1e98ae", "withheld": "one chip removed from this pack by hand", "removed_utc": "2026-10-05", "why": "lost its condition: the answer gives a moving 30-day download count and a running total with no day of reading (the page read both on 2026-10-02, UTC), to a question asked in the present tense, and drops the page's caveat that the counters count file requests, not people", "detail": "removed from this pack by hand on 2026-10-05 (UTC), after the writer ran and after the gates had counted: lost its condition: the answer gives a moving 30-day download count and a running total with no day of reading (the page read both on 2026-10-02, UTC), to a question asked in the present tense, and drops the page's caveat that the counters count file requests, not people. Not a gate drop, and recorded here so the ledger adds up." }, { "kind": "bullet", "reason": "hand-edit", "item": null, "item_chars": 96, "text_sha": "ba0921b690d6", "figure": "72.6", "withheld": "one bullet removed from this pack by hand", "removed_utc": "2026-10-05", "why": "ungrammatical: the sentence garbles the page's own figure sentence ('What we can prove untouched is 173 tensors, 72.6 % of the model's file bytes'); a receipt line a stranger cannot parse fails the stranger read; a later re-pack may bring a better one (lead ruling D-20261005-119)", "detail": "removed from this pack by hand on 2026-10-05 (UTC), after the writer ran and after the gates had counted: ungrammatical: the sentence garbles the page's own figure sentence ('What we can prove untouched is 173 tensors, 72.6 % of the model's file bytes'); a receipt line a stranger cannot parse fails the stranger read; a later re-pack may bring a better one (lead ruling D-20261005-119). Not a gate drop, and recorded here so the ledger adds up." } ] }, "generated_utc": "2026-10-05T04:09:58Z" }