Model Abliteration How Attackers Permanently Strip Safety From Open-Source AI

Executive Summary

• What it is. "Abliteration" is a technique that permanently removes an open-source AI model's ability to refuse harmful requests. Unlike jailbreaking, which tricks a model with prompts, abliteration edits the model's internal weights. This is a permanent modification, not a temporary bypass.

  
  

• The scale. Over 6,000 abliterated models are now freely available on a single platform (Hugging Face), up from roughly 600 in 2024, a tenfold increase in eighteen months. The permissive licences on major open models make this entirely legal.

  
  

• The threat. Criminal groups are already using uncensored models in active operations: AI-generated malware, automated phishing, and on-the-fly attack tooling. AI-linked phishing has surged over 1,265% since ChatGPT's launch.

  
  

• The dual edge. The same uncensored capability has legitimate defensive value for AI red teaming and penetration testing. The distinction between misuse and authorised testing lies entirely in intent and authorisation.

  
  

• What it means for leaders. Assume adversaries now operate with unrestricted AI assistance. Priorities: validate the provenance of any AI models in your environment, incorporate uncensored models into authorised red-team exercises, and test the resilience of your own AI deployments against these techniques.

Imagine your AI assistant has a tiny internal alarm that goes off every time you ask it something sketchy. It's the reason you get responses like "I'm sorry, I can't help with that." Now imagine someone figured out how to snip that alarm wire, permanently, in under five minutes, for less than the cost of a coffee. That's abliteration, and it's one of the most under-appreciated AI security risks facing organisations today.

Hugging Face, the largest open-source AI platform, now lists over 6,000 abliterated models, up from roughly 600 in 2024, according to research by the National Counterterrorism Innovation, Technology, and Education Center (NCITE). That is a tenfold increase in roughly eighteen months. Cybercriminals are building tools on top of these models. National security researchers are raising alarms. And most security teams are still catching up. Here's the full picture.

What is model abliteration?

Think of a modern AI model like a really smart employee who's been trained to say no to certain requests. That "say no" instinct isn't scattered throughout the employee's brain. It turns out it lives in one specific spot. Researchers at NeurIPS in 2024 discovered that all of a model's refusal behavior, every "I can't do that," flows through a single internal signal, like a single wire in a massive circuit board.

Abliteration is the act of cutting that wire. You feed the model a batch of "bad" questions it would refuse and a batch of "good" questions it would answer. You compare how the model's internals react to both. The difference between those reactions reveals the refusal signal. Then you tweak the model's weights to erase that signal. Done. The model now answers everything.

The key difference from jailbreaking is what makes abliteration a distinct AI security risk. Jailbreaking versus abliteration comes down to permanence: a jailbreak tricks an AI with clever prompts and works one interaction at a time, while abliteration is permanent surgery on the model itself. A jailbreak is a one-time trick; abliteration removes the refusal layer entirely.

How widespread are abliterated models?

Today, automated tools let you abliterate practically any open model with a single command. A 2025 study found that while normal models only complied with 18.8% of unsafe requests, abliterated versions complied with 74.1%, a near-complete safety inversion.

This isn't a niche hobby. The NCITE research consortium's count of over 6,000 abliterated models on Hugging Face, up from about 600 in 2024, points to explosive, accelerating growth. On Hugging Face, abliterated models now outnumber models de-aligned by other methods. (Counting all "uncensored" models, regardless of technique, pushes the total higher still; one 2025 survey put the broader figure above 11,000.)

A few prolific creators drive the ecosystem. huihui-ai alone has published over 200 abliterated models covering virtually every major AI family: Qwen, Gemma, Mistral, DeepSeek. Their most popular model has over 100,000 downloads.

The tooling is what changed the game. As one researcher put it, building an uncensored model used to be the work of "a senior employee" at a leading AI lab, and now "everybody with access to the internet and a laptop can actually run this thing on their own machine." And here's the kicker: every time a major company releases a new open model, abliterated versions appear within hours. Google released Gemma 4 under Apache 2.0 in 2026, meaning anyone can legally modify it however they want, including stripping its safety guardrails. Meta's Llama, Alibaba's Qwen, Microsoft's Phi, Mistral, and DeepSeek all get the same treatment. The permissive licenses (Apache 2.0, MIT) that make these models great for innovation also make abliteration completely legal.

How attackers use abliterated models in cyberattacks

The clearest sign that abliteration matters is AI showing up inside live attacks, and this is the development that should worry security teams most. Google's threat intelligence team documented PROMPTSTEAL, real malware used by Russian hackers against Ukraine that actually calls an open-source AI model (Qwen 2.5 Coder) via API to generate data-theft commands on the fly. It's the first confirmed case of malware querying an LLM during an active operation. IBM found "Slopoly," ransomware code that bears all the hallmarks of being AI-generated: neat comments, structured logging, descriptive variable names. The FunkSec ransomware group, a bunch of inexperienced operators, claimed more victims in one month than established cybercrime groups, apparently by using AI to compensate for their lack of skill.

The numbers tell the story of how AI-powered cyberattacks are scaling: a 1,265% surge in AI-linked phishing since ChatGPT's launch, over 82% of phishing emails now incorporating AI-generated content, and researchers showing that AI can build a sophisticated phishing campaign in 5 minutes versus the 16 hours a human expert needs.

AI red teaming: why defenders need uncensored models too

Here's the twist that makes this whole debate trickier. The good guys need uncensored models too. If you're a security team trying to test whether your employees would fall for a phishing email, you need an AI that can actually write one. If you're a penetration tester trying to find vulnerabilities, you need an AI that won't refuse to discuss exploit techniques. Safety-aligned models refuse to participate in the very testing designed to keep organizations safe, what researchers call the "AI Safety Evaluation Paradox."

This is exactly where AI red teaming and LLM security testing come in. The same capability that makes abliterated models dangerous in an attacker's hands makes them valuable for authorised offensive testing, provided it's done under proper controls. The organisations best positioned against AI-powered cyberattacks are the ones already stress-testing their own AI deployments the way an attacker would. (If you're evaluating this for your own environment, SecureDots' AI Security Assessment covers exactly this kind of adversarial testing.)

What model abliteration means for your organisation

Abliteration has turned what used to be a difficult, expensive process (making an AI ignore its safety training) into something trivially easy. The ecosystem (6,000+ abliterated models, one-click tools, active criminal adoption) is growing faster than any policy response can match.

For everyday people, the takeaway is this: the phishing email in your inbox, the scam text on your phone, the fake customer service chat are all getting dramatically better, faster, and cheaper to produce. AI-generated social engineering isn't coming; it's already here.

The stakes extend well beyond fraud. The Counter Extremism Project reported that an individual in an extremist online forum claimed to have used an uncensored model to research the type and quantity of explosives needed to attack a high-profile building. Whether or not that specific claim holds, it illustrates the point national security researchers are now making: a model with its refusal mechanism removed will answer the questions a safety-aligned model is specifically built to refuse.

For security teams, the message is dual: start using abliterated models in your own red team exercises (they're arguably the best offensive testing tools available), and prepare your defenses for a world where every adversary, from nation-state hackers to script kiddies, has access to an uncensored AI that will help with anything, no questions asked.