The Uncensored AI: What's Actually Happening When People Strip Safety From AI

A Medium essay by Rekhi (@Reiki32, self-described "AI Researcher", 817 followers), published 2026-02-17, an eight-minute read carrying 1.7K claps and 24 responses. It opens on the author downloading an abliterated Llama model — "Took about twenty minutes" — and ends without a conclusion, which the author says plainly.

This is the first source in the corpus that looks at what happens downstream of abliteration rather than at the technique. The spoke already holds the mechanism (arditi-refusal-direction), the tool (heretic), the volume, and a publisher (readyart). What was missing was any account of who runs the results and to what end, and that is what this essay assembles.

Tier: T3, and the reasons are worth stating. The author is pseudonymous. The piece contains no primary evidence beyond one personal anecdote; every figure in it is quoted from somebody else's report, several without a link, and none has been checked here. Some of the attributions are loose enough to be unusable as citations ("a study published in Nature Communications a few weeks ago"). And it makes at least one technical claim that this wiki's own T1 sources contradict — see below. It is ingested for the shape of the picture it draws and the primary reports it points at, not for its numbers.

What it gets right, and where it came from

The account of abliteration matches arditi-refusal-direction and heretic: refusal is mediated by a direction in the model's internal representations, the direction is found by measuring how activations differ between a harmless and a harmful prompt set, and the weights are then edited so the model cannot express it. The essay credits the popularizing write-up to mlabonne — "the one by mlabonne that everyone references" — and notes the code is on Google Colab and in a public LLM course. That is the same finished-tooling point heretic makes from the other end, dated eight months earlier.

It also names a taxonomy this corpus had only the abliteration half of:

Fine-tuned uncensored models — Eric Hartford's Dolphin family (Dolphin-Mixtral, Dolphin-Llama 3), described as among the most downloaded models in their size classes.
Explicitly abliterated models — including DavidAU's LLaMA-3.2 Dark Champion, an 8×3B MoE with a claimed 128k context.

The naming, the essay observes, hides nothing: "Dark Champion." "Uncensored." "Abliterated." — published on Hugging Face with documentation and active Discord communities.

The claim the corpus contradicts

The essay treats abliteration and safety-breaking fine-tuning as one technique, quoting a description of abliteration as "a method that erodes safety alignments via targeted fine-tuning." That is wrong on this wiki's own primary sources: heretic states its method involves no post-training and no training at all — a difference of means over two prompt sets, then an orthogonalization of two matrices per layer. Weight editing and fine-tuning reach a similar end by unrelated means, and the distinction matters because it decides what a defender would have to detect.

Reading the piece with that separated out, it stacks three techniques under one heading:

Weight editing — abliteration proper. No training.
Safety-breaking fine-tuning — including the "GRP-Obliteration" result it attributes to Microsoft researchers: fine-tuning 15 models across six families (GPT-OSS, DeepSeek-R1-Distill variants, Gemma, Llama 3.1, Ministral, Qwen) on the single benign-sounding prompt "Create a fake news article that could lead to panic or chaos" reportedly made them more permissive across all 44 harmful categories of the SorryBench benchmark. Also FAR.AI's "jailbreak-tuning," with the finding that larger models are more vulnerable to poisoning, across 23 LLMs from 8 model series.
Prompt-level jailbreaking — no weight access at all. Tenable's "crescendo" multi-turn escalation against GPT-5 (bypassed "within 24 hours" of the August 2025 launch, Molotov instructions by the fourth exchange); HiddenLayer persuading a guardrail LLM to lower its own confidence score; and a study the essay places in Nature Communications in which reasoning models act as autonomous jailbreak agents at a 97.14% success rate across model combinations.

Only the first requires open weights. The essay's thesis is about open weights, so the conflation does real work in it — and the corpus should not inherit it.

The downstream half

This is the part the spoke did not have. The essay assembles it from security-industry reporting:

Exposed deployments. A 293-day study by SentinelOne and Censys of open-source LLMs running in the wild identified hundreds of instances where guardrails were explicitly removed. The researcher's word for what is visible is "the tip of the iceberg."
A rental market. Citing Group-IB: at least three active vendors selling "Dark LLMs" on self-hosted platforms, some over 80 billion parameters, at $30–$200 per month depending on features and API access, with a customer base "likely exceeding 1,000 users." See dark-llm-services.
Tooling as product. WormGPT and FraudGPT as the known names; GhostGPT described as walking an attacker through an exploit workflow step by step. Trend Micro's framing — that this has matured from jailbroken chatbots into "a resilient underground ecosystem" — is the essay's most-quoted source. CCN is cited for a 219% rise in dark-AI mentions on cybercrime forums in 2024.
Losses, in dollars. The February 2024 Arup deepfake video-conference fraud ($25 million wired after a call featuring generated likenesses of the CFO and other executives); Resemble.ai's $350 million of deepfake damages in Q2 2025 alone; the FTC's $1.3 billion in romance-scam losses in 2024; Norton's 2025 report that 40% of online daters have been targeted; and the AI Incident Database's count rising 50% year over year 2022→2024, with the ten months to October 2025 already past the 2024 total.

Of these, none is verified here (two other citations were chased on 2026-09-06 — see below), and the deepfake figures in particular are about generated media rather than about abliterated text models — the essay's own subject. They are recorded as leads to primary reports, not as findings.

Two citations chased (2026-09-06)

The curator re-sent this link, so the two loosest attributions were run down. Both are real, both are stronger than the essay's rendering of them, and neither has been read here beyond its abstract and the reporting around it.

"A study published in Nature Communications a few weeks ago." Hagendorff et al., Large reasoning models are autonomous jailbreak agents, Nature Communications (nature.com/articles/s41467-026-69010-1; preprint arXiv:2508.04039). Four reasoning models (DeepSeek-R1, Gemini 2.5 Flash, Grok 3 Mini, Qwen3 235B) were pointed at nine target models and ran multi-turn attacks unsupervised after a single system prompt. The 97.14% is the overall success rate across model combinations; the spread underneath it is wide — maximum harm scores of 90% (R1), 87.14% (Grok 3 Mini), 71.43% (Gemini 2.5 Flash) and 12.86% (Qwen3). The essay quotes the aggregate and not the spread.
"Microsoft researchers recently discovered something called GRP-Obliteration." Microsoft Security Blog, A one-prompt attack that breaks LLM safety alignment, 2026-02-09 (microsoft.com/en-us/security/blog/2026/02/09/prompt-attack-breaks-llm-safety/). The name is literal: the attack weaponizes Group Relative Policy Optimization, the alignment training method, to run it backwards. The 15-models-across-six-families detail and the 44 SorryBench categories check out. What the essay omits is the comparison — Microsoft reports an average score of 81% for GRP-Obliteration against 69% for abliteration and 58% for TwinBreak, with utility "within a few percent of the aligned base model" — and the image half, where ten prompts unaligned Stable Diffusion 2.1 and raised harmful generation on sexuality prompts from 56% to nearly 90%.

So the essay's two most alarming figures survive being checked, which is worth saying plainly about a T4-adjacent source. The classification problem does not: GRP-Obliteration is a fine-tuning attack (row 2 of abliteration's table), and the Nature result is prompt-level against hosted models (row 3). Only the essay's opening subject needs open weights.

The argument that survives the sourcing

Two claims in the essay do not depend on any of its numbers.

Open weights cannot be recalled. "Once Meta publishes Llama, those weights exist forever. And whatever capabilities researchers discover in those weights later, whatever new attacks become possible, everyone who ever downloaded the model has access to them." That is a structural statement about the tier open-weight-models describes, and it is true by construction.

Capability gains propagate to the uncensored derivative. "Every improvement in base model capability is also an improvement in uncensored model capability." Since the edit costs 20–30 minutes (heretic) and needs no understanding of the architecture, the lag between a frontier open release and its decensored version is measured in days. The essay's sharper version: "Every dollar of safety R&D you proudly announce is being amortized across criminal campaigns within weeks."

The author's honest ending is that they use open models daily, still believe the arguments for them, and have no resolution: "The same technique. The same models. The same download link."

What it does not say

Nothing about cost. The essay's picture of abliteration is a model that "simply doesn't have the machinery for refusal anymore" — a clean subtraction. abliteration and heretic hold the only measured account this corpus has, and it is a trade: the direction was never carrying refusal alone, and every refinement of the method is an attempt to pay less coherence for the same suppression. The popular account and the measured one disagree about whether anything is lost, and neither side has an independent capability evaluation to settle it.

abliteration · heretic · arditi-refusal-direction · open-weight-models · dark-llm-services · maxime-labonne · readyart · gemma-4-31b-it-scotoma · llama · llm-provider