Free tools Windows power users keep installed
One-click scans. No signup required.
In tested cases, abliteration sharply reduced an AI model’s refusals to harmful requests while leaving selected capability scores unchanged or only slightly lower. That is a limited benchmark result—not proof that the model retained all its knowledge or that its other behavior stayed the same.
What abliteration changes
Abliteration is a family of techniques for reducing refusal behavior in an open-weight model. An edit may target refusal-associated directions in the model’s internal representations or weights. The term does not describe one standardized procedure, and “obedience” is shorthand here for refusal behavior—not a claim that every aspect of instruction following changes.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters: a model may become more likely to answer requests it previously refused without losing its ability to answer ordinary questions or perform a particular benchmark task. But a few stable scores cannot establish that its full knowledge, safety, or behavior is unchanged.
What the GLM-5.3 evaluation found
Anthropic reports applying abliteration to GLM-5.3 and measuring refusal behavior on JailbreakBench, HarmBench, and StrongREJECT. Its report says refusal rates fell substantially. On GPQA-Diamond, the standard and abliterated versions received the same reported score; on a tested CyberGym subset, the abliterated version scored a few percent lower. Anthropic’s GLM-5.3 evaluation is one organization’s reported evaluation, not an independent replication or a result that can be generalized to every model.
#1 Best Overall
The comparison illustrates the central point: refusal behavior and performance on selected capability tasks are separate outcomes. A model can change substantially on one while appearing stable on another. GPQA-Diamond and a CyberGym subset cover only the tasks tested; they are not a comprehensive measurement of everything the model knows or can do.
Why the effect is not uniform
A 2025 study by Agnihotri and colleagues compared 10 base models with their 10 abliterated counterparts. Each of the 20 systems received 100 prompts—50 harmful and 50 harmless—with multiple judges evaluating responses. The researchers also used a small human-labeled subset to validate the judging. They reported that safety-pretraining variants combining signals such as rephrasing, metatags, and refusals were more resilient to abliteration than simpler variants. The study’s prompt set is a bounded evaluation, not a measure of responses to every real-world request. The study’s preprint and Keuper Labs’ project page describe the work.
Results also depend on the model, its safety pretraining, the editing method, the prompts, and the evaluator. The available studies do not establish a single protocol that makes their results directly comparable. A refusal-rate change from one setup should not be read as a prediction for another.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Refusal removal is not the same as fixing false refusals
Some research targets a narrower problem: a model refusing safe requests that it should answer. Wang and colleagues’ ICLR 2025 paper proposes removing a single false-refusal vector, with the stated aim of reducing refusals to safe requests while preserving safety on harmful requests and general capability. That goal differs from broadly reducing refusals, which can also remove refusals to harmful prompts. The ICLR 2025 paper describes the approach.
Rank #3
How to judge whether capability or safety changed
A refusal rate by itself is not enough. Fewer refusals might reflect successful removal of a targeted behavior, but the figure alone cannot show whether the model still answers harmless questions appropriately, whether its task capability changed, or whether it now complies with harmful requests.
A useful evaluation reports the model and edit, the prompts and their harmful or harmless categories, the refusal measure and evaluator, and capability tests with their coverage. It should include both false refusals on safe prompts and refusals on harmful prompts, alongside capability measures. Without those details, a change in one score has an ambiguous meaning.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Behavior outside refusal can shift too
A July 2026 preprint by Aleksander Fafuła reports changes in model dispositions after abliteration in two model families on a financial decision task. The study reports greater optimism and changes in how uncertainty was expressed; confidence effects differed in direction between the model families. Its dataset covers 21,600 decisions across 60 Warsaw Stock Exchange equities over 18 weeks. Those figures describe the study’s task-specific decision data, not general model capability. The preprint is preliminary evidence, but it is a reason not to infer that every behavior stayed fixed just because selected benchmark scores did.
Quick Recap
What the evidence supports—and what it does not
- Supported: In reported evaluations, refusal behavior can fall markedly while selected capability scores remain the same or decline only modestly.
- Also supported: Outcomes vary with the model and its safety-pretraining configuration, and measured behavior beyond refusal may shift.
- Not established: That abliteration leaves a model’s complete knowledge, all capabilities, or all behavior intact—or that one evaluation predicts the effects on other models.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
