An “uncensored” model can still refuse for several reasons, and only some of them are about the model. Abliteration removes the main refusal direction, not every trace of refusal: Heretic’s own test on Gemma-3-12B still left 3 refusals out of 100. On top of that, the service may add its own filter or system prompt, its terms may rule out whole categories (NoTrack calls itself “99.9% uncensored” and lists 10 restricted items), or the model you’re talking to may not be uncensored at all.
1. Uncensoring reduces refusals, it doesn’t delete them
The research behind abliteration found that a single direction in a model’s activations carries most of the refusal signal. Most, not all. Removing it makes a model far more willing, but some refusals and hedges can survive, especially with older or cruder recipes. Our abliteration explainer covers the mechanism.
Fine-tunes vary even more. They’re retrained on data with refusals filtered out, and refusal behaviour can creep back in from the base model. On the UGI leaderboard’s willingness measure, most Heretic and abliterated checkpoints score 8 to 10 out of 10. Hermes-4-70B scores 3.2 and Hermes-4-405B 4.8, even though Nous Research describes Hermes 3 as “neutrally-aligned”. Fine-tunes are 375 of the 504 models in our index, so this is the common case.
2. The host adds its own layer
The same weights can behave differently on different hosts because of quantization, chat templates, or a system prompt added upstream (more on that). Some hosts say so openly:
- DreamGen content is auto-moderated by default.
- Requesty lets customers configure their own refusal guardrails, so a setting on your account or organization can be the cause.
3. The terms say no
Almost every hosted service keeps some hard limits, whatever its marketing says. NoTrack’s restrictions page lists 10 items, including sexual content involving minors, weapons capable of mass harm, harassment and doxxing of real people, non-consensual intimate content, malware and fraud “at scale”, and an adults-only rule. NoFilterGPT promises “no exceptions”, yet its terms still ban several categories. If a refusal lands squarely in one of these areas, it’s probably policy, not a weak model.
4. You may not be talking to an uncensored model
- Wrong surface. At Unjailed AI, the uncensored models work through its CLI and API, but the web chat uses standard models only.
- Wrong model in the picker. FreedomGPT also routes 400+ models, including mainstream ones from OpenAI, Anthropic, Google and xAI. Venice’s “Anonymized” Claude, GPT and Grok models still send your prompt to that vendor. Pick one of those and you get that vendor’s rules.
- A prompt, not a model. Some “uncensored AI” products are a mainstream model wrapped in a jailbreak prompt. Cato Networks found one WormGPT variant was simply the Grok API with a jailbreak in the system prompt. These break when the upstream model changes. More on the three methods.
- Undisclosed. 61 of our 504 models don’t say how they were uncensored, so you can’t tell in advance.
5. The model doesn’t know the answer
Abliteration doesn’t add knowledge: it only removes the refusal direction. A small model asked about something it never learned may hedge, change the subject or give a vague answer, which can look like a refusal. StrongREJECT found that jailbreaks that get past a model’s safety training tend to reduce its capabilities, so a non-refusal isn’t always a useful answer either.
What to do about it
- Check which model you’re on. Confirm the model name in the picker or API call, and whether that surface serves the uncensored models.
- Use a system prompt. State the context plainly: fiction, research, harm reduction. Fine-tunes like Hermes 3 were trained to follow the system prompt closely, so it carries real weight there.
- Check the provider’s settings and content policy. Look for moderation toggles, guardrail settings, and a restrictions page. If your request is on the list, no prompt will fix it, and trying to get around it may break the terms.
- Try a different method. If a fine-tune keeps refusing, try an abliterated or Heretic checkpoint of a similar size, or the reverse if an abliterated model gives thin answers.
We haven’t measured refusal rates on hosted endpoints yet. Our compliance benchmarks are in preparation and will run on each provider’s live endpoint; the methodology explains how.
Compare Heretic checkpoints and their hosts on the Models page.