Abliteration Isn't Jailbreaking: It's Removing the Lock, Not Picking It

A jailbreak is a clever prompt. You find some phrasing, some roleplay frame, some encoding trick that gets a model to answer something it would normally refuse, and it works for exactly as long as that conversation lasts and that model version stays unpatched. The vendor notices, retrains or filters, and the specific trick stops working. It’s a lockpick: it opens the door without a key, but the lock is still there, and someone can change it.

Abliteration doesn’t pick the lock. It takes the lock off the door.

The idea comes out of a 2024 paper, Refusal in Language Models Is Mediated by a Single Direction, from Andy Arditi and coauthors at Anthropic and Google DeepMind. They found something pretty surprising: across thirteen open chat models, the thing that makes a model say “I can’t help with that” isn’t some complicated, spread-out behavior. It traces back to one identifiable internal signal. Turn that signal up artificially and the model starts refusing harmless questions. Turn it off and it stops refusing even clearly harmful ones.

What you do with that signal is where abliteration splits from a jailbreak. One option is to cancel it out while the model is running, intercepting it every time the model processes a word. That’s already a step beyond anything a clever prompt can do, since it’s reaching into the model’s internals rather than just its input. But the bigger option is to edit the model’s weights directly, so that signal can never form at all, in any conversation, no matter what’s typed in. Once that edited version is saved, the refusal isn’t being suppressed, it’s gone. Nothing brings it back, because the mechanism that used to produce it has been removed from the model entirely.

That permanence is the entire difference from a jailbreak, and it’s worth sitting with the asymmetry for a second. A jailbreak exploits a gap in how a safety-trained model processes one particular kind of input, and the company that trained the model controls the next version, the next filter, the next round of adversarial training against exactly that trick. They’re still the one holding the lock. Abliteration happens to a copy of the weights that has already left their hands. Whoever runs that copy afterward isn’t asking the vendor’s model to misbehave, they’re running a different model that happens to share a name and most of its capabilities with the original.

It’s worth saying the simple version of this story has gotten more complicated since 2024, not less. More recent work, including There Is More to Refusal in Large Language Models than a Single Direction, has shown that the tidy single-signal picture doesn’t hold for every model or every kind of harmful content, and that several signals can matter at once depending on how a model was built and trained. That nuance isn’t reassuring, though. It means the technique has kept getting refined rather than debunked, and the tools built on top of it have gotten better at finding whatever actually matters for a given model, rather than assuming there’s always just one thing to find.

That tooling is also where this stopped being a research curiosity. Mlabonne’s original walkthrough turned the technique into something you could run yourself, and it’s where the name stuck. NousResearch, the same group behind Hermes Agent, maintains its own llm-abliteration library, a step-by-step pipeline that’s been run against models from Llama 3.2 through Gemma 3. But the tool that’s actually changed the economics is Heretic, which automates the whole process end to end. You don’t need to understand any of the internals to run it. Point it at a model, let it search for the right settings on its own, and it hands you back an edited checkpoint a few minutes later. It has over 27,000 stars on GitHub as of this writing, which tells you roughly how far this has traveled from a research paper into something anyone can use.

GLM-5.3 is a good recent example of how fast the gap closes now. Within weeks of Z.ai releasing the weights, independent abliterated builds started showing up on Hugging Face from several unrelated groups, covering both the full model and the smaller Flash variant, in quantized formats ready to run on consumer hardware. One of those uploads was specifically packaged for offensive cybersecurity use, and Hugging Face pulled it. It came back under a slightly different name shortly after. That’s the pattern worth paying attention to: the original vendor’s safety training is no longer the last word on what the model will do, it’s the opening position in a process that other people, with no obligation to the vendor’s intentions, get to finish.

None of this makes open weights a mistake. It does mean the question “did the model refuse” stops being a safety property you can rely on the moment a checkpoint leaves the hands of whoever trained it. A refusal baked into training is a property of one specific set of weights, and once those weights are public, nothing stops someone with a GPU and an afternoon from publishing a version without it. If you’re evaluating an open-weight model for anything where that distinction matters, the honest question isn’t whether the model you’re looking at refuses. It’s whether you trust whoever is hosting the specific checkpoint you’re about to run, because that’s who actually decided whether the lock stayed on the door.