Every abliterated model pays some tax for losing its refusals. The question is how much, and on what. This post collects the measured numbers from the research so far. Once our own runs are in, we’ll publish the tax for every endpoint in the index.
Knowledge and reasoning: usually small
The original abliteration paper compared orthogonalized models with their originals on standard benchmarks. MMLU, ARC, and GSM8K mostly moved by less than ±1.5 points, which is close to run-to-run noise.
Labonne’s 8B experiment (model card) tells a similar story at small scale. The average over the Nous benchmark suite went from 55.87 to 55.06 after abliteration, and back to 55.87 after a short DPO “healing” fine-tune. The average recovered, but not every subscore did: AGIEval stayed below the original.
Math: the fragile capability
The most systematic study so far, a late-2025 comparison of four abliteration tools across 16 models from 7B to 14B, found that math reasoning takes the biggest hit:
| Tool | MMLU | GSM8K | HellaSwag |
|---|---|---|---|
| Heretic | −0.78 | −7.81 | −0.56 |
| DECCP | −0.61 | −0.13 | −0.25 |
| ErisForge | −0.12 | −0.28 | −0.08 |
Mean change in points across DeepSeek-7B, Mistral-7B, and Yi-1.5-9B, the three models with base-model baselines. The fourth tool, FailSpy’s, ran on too few models to benchmark. Single runs, so treat as indicative.
The worst single case was Yi-1.5-9B, where GSM8K fell from 70.89 to 52.08, more than a quarter of its math ability. The same study found Heretic’s divergence from the original model ranged from 0.04 to 1.65 depending on the model, so the cost isn’t uniform even within one tool.
Truthfulness: the quiet cost
Here the evidence is more worrying. In the original paper, TruthfulQA dropped for all 13 models tested, by 1.0 to 5.9 points. For the largest model in each family: −2.4 (Gemma-7B), −3.5 (Yi-34B), −1.0 (Llama-2-70B), −2.3 (Llama-3-70B), −1.4 (Qwen-72B). The smaller models lost more, up to −5.9 for Yi-6B. The authors partly attribute this to TruthfulQA’s categories overlapping with refusal territory: misconceptions, conspiracies, and so on.
What nobody has measured well yet is whether abliteration makes models state falsehoods more often in free-form answers, rather than on a multiple-choice test. KL divergence, the usual “how much did we change the model” number, can’t answer that: a model whose outputs stay close to the original’s on average can still be wrong more often on facts. That’s why our method measures truthfulness directly with SimpleQA instead of relying on divergence numbers.
The recipe matters more than the technique
“Abliterated” isn’t one thing. On the UGI leaderboard, its NatInt intelligence measure for the same Gemma-3-12B base varies by variant:
| Variant | NatInt |
|---|---|
| Original model | 18.72 |
| Norm-preserving biprojected (grimjim) | 21.33 |
| Heretic v2 | 19.10 |
| huihui abliterated | 12.11 |
| mlabonne abliterated v2 | 8.16 |
That’s a spread from 14% above the original to less than half of it, on the same base. Some of the newer methods, like norm preservation, KL-optimized search, and DPO healing, seem to recover most or all of the loss. Older or cruder ones can gut the model.
What this means if you’re choosing a provider
- Ask which checkpoint. “Llama 70B abliterated” could be any of a dozen community releases of very different quality.
- If you need math or code, test that first. It’s the first capability to degrade.
- Expect some hallucination risk. Verify factual claims the way you would with any model, and maybe a little more.
- Trust measurements over model cards. The same weights on different hosts can behave differently because of quantization and templates.
This is the “abliteration tax” column in our methodology: capability and truthfulness on each uncensored endpoint, minus the same evals on the original base model. We’ll publish it for every provider as our runs complete.