“Uncensored model” covers at least three different things. Providers rarely say which one they’re selling, but the difference shows up in how often the model refuses, how smart it stays, and how reliably it behaves.
1. Abliteration: delete the refusal direction
What it is: a training-free edit to the weights. You find the direction in the model’s activation space that mediates refusal and project it out of every layer that writes to the residual stream. (Full explainer.)
Strengths:
- Cheap: minutes to hours on one GPU, no training data.
- Targeted: it removes the refusal mechanism and leaves most knowledge intact.
- On the UGI leaderboard, most Heretic and abliterated checkpoints score 8–10 out of 10 on its willingness measure.
Weaknesses:
- Measurable capability loss, especially on math. One late-2025 study found an average 7.8-point GSM8K drop for one popular tool, with others under a point.
- Possible increase in confident falsehoods.
- Quality varies enormously by recipe.
2. Uncensored fine-tunes: retrain without the refusals
What it is: take a base model and fine-tune it on instruction data with refusals and moralizing filtered out.
- Eric Hartford’s Dolphin line started this in 2023. He argued for “composable alignment”: ship an uncensored base and let each application add its own rules.
- Nous Research’s Hermes 3 calls itself “neutrally aligned”. It filters refusals from the training data and teaches the model to follow the system prompt exactly, on the view that guardrails belong at the system level, not in the weights.
Strengths:
- Can improve the model while uncensoring it: new skills, better style, longer context.
- A system prompt can steer behavior both ways.
Weaknesses:
- Needs data and compute.
- “Neutral” isn’t the same as “compliant.” On UGI’s willingness score, Hermes-4-70B scores 3.2/10 and Hermes-4-405B 4.8/10, well below typical abliterated models. Dolphin-Mistral-24B-Venice-Edition scores 7.8.
- Refusal behavior can creep back in from the base model.
3. Jailbreaks and permissive system prompts
What it is: no change to the model. A long system prompt, a role-play frame, or an adversarial suffix talks the model into answering.
Strengths:
- Works on any model, including closed frontier models. Some “uncensored AI” products are exactly this: a mainstream API wrapped in a jailbreak prompt. Cato Networks found that two WormGPT variants sold on criminal forums were built on Grok and Mixtral, not custom models. The Grok one was simply the Grok API with a jailbreak in the system prompt.
Weaknesses:
- Brittle. One model update and the prompt stops working.
- The model is still pulling against its training, so answers tend to hedge.
- StrongREJECT found jailbreaks often reduce answer quality: the model “complies” with something vague or wrong.
- If the upstream is a mainstream API, your prompts are subject to that company’s logging and usage policy.
Side by side
| Abliterated | Uncensored fine-tune | Jailbreak / prompt | |
|---|---|---|---|
| Changes weights | Yes (rank-1 edit) | Yes (training) | No |
| Cost to produce | Very low | Medium–high | None |
| Typical compliance | High | Varies widely | Varies, unstable |
| Capability impact | Small, math-sensitive | Can go either way | Often negative |
| Durable across updates | Yes | Yes | No |
| Works on closed models | No | No | Sometimes |
Why we track the method
Every provider in the index is tagged with how its models are uncensored: abliterated, fine-tuned, prompted, or mixed. It’s one of the most predictive facts about what you’ll get.
A “prompted” provider can quietly break when its upstream model changes. A fine-tune might refuse more than its marketing suggests. An abliterated model might be blunt and fully willing but weaker at arithmetic.
Our compliance and capability benchmarks run on each provider’s live endpoint, so the scores show what you actually get, whatever the method. See the methodology.