How we abliterated DeepSeek V4.1 Flash and GLM-5.3

tl;dr

• The hard part was rounding. Standard rounding quietly threw away up to 73% of the edit, so we had to find a rounding method that keeps it.
• The original DeepSeek refused 85-96% of harmful requests, while the abliterated model refuses only 1%. On five standard benchmarks, the model's performance didn't change, and it scored 0.8 points lower on one knowledge test, MMLU-Pro.
• When a system prompt tells the model to avoid a topic, the original DeepSeek complies 95% of the time, while the abliterated one complies only 75% of the time.
• We applied the same recipe to GLM-5.3, measuring its refusal direction from the model itself. Its refusals fell from 93% to 1%, with a bigger trade-off than on DeepSeek: about 3 points lower on IFBench and 8 lower on an airline agent benchmark.
• With fewer refusals in the model, you need to set the limits in your own system: permissions, sandboxes and logs.

01

How abliteration works

Abliteration takes refusal out of a model in four steps. The first recipe comes from a 2024 paper that tested it on 13 open-source chat models of up to 72B parameters (Arditi et al., 2024).

1. 1 /Find the refusal direction. You run two sets of prompts through the model, harmful requests it refuses and harmless ones it answers (the paper used 128 of each), and average its internal activations for each set. Subtract the harmless average from the harmful one and what's left is the refusal direction, which you scale to unit length and call r.
2. 2 /Pick the best layer. Every layer gives you a candidate direction, so you try each one on prompts you held back and keep the one that removes the most refusals while barely changing how the model answers harmless prompts.
3. 3 /Remove it from the weights. You edit every weight matrix that writes into the residual stream (the embeddings, the attention outputs and the MLP outputs) with the rank-one change W → W − r r^T W. After that, no layer can write along r.
4. 4 /Check what changed. Run your refusal prompts and capability evals again. In the paper, refusals nearly disappeared and MMLU, ARC and GSM8K stayed close to the original, but TruthfulQA dropped in every model.

Note that because the edit lives in the weights, it applies to every request. Removing one direction is generally enough to cut refusals, but the model often has more than one. Removing only one can leave much of the safety training in place, and you don't get back the model as it was before that training.

02

DeepSeek: how we built ours

We started with DeepSeek V4.1 Flash, the model we serve. Three public abliterations of DeepSeek V4.1 Flash already existed, but none could run on our stack. They ship as llama.cpp GGUF files or as 1.5 TB of BF16, while we serve DeepSeek's official FP8/FP4 checkpoint on vLLM (DeepSeek). So we took the edit from one of them, AtomicChat's, and applied it to the official weights ourselves.

AtomicChat ships its edit as a small adapter, and the refusal direction can be read straight from it. Before using it, we checked it against DeepSeek's official attention weights, and it matched exactly in all 40 layers.

We kept AtomicChat's strength of 2: the edit becomes W → W − 2 r r^T W, which flips the refusal component instead of only removing it. Like AtomicChat, we applied it to the attention output, the shared expert and all 384 routed experts in each layer, plus the two Engram projections it also edits.

This edit changed 15,442 tensors and left every other byte of DeepSeek's release untouched.

03

Saving the weights almost undid the edit

DeepSeek ships these weights already compressed into low-precision formats, FP8 and FP4, where every value has to sit on a fixed grid, and we serve them in that same format. So after the edit, we had to round each weight back onto that grid. The standard way to do that is to round each one to the nearest grid point, but the edit moves each weight by less than one grid step, so most of them land right back where they started (Figure 1).

On sample tensors, rounding to the nearest point kept only 27-30% of the edit on the FP4 routed experts, which make up most of the edited tensors, and 82-91% on the FP8 ones. Nothing breaks when this happens, so the model just ends up less abliterated than intended.

The issue with doing so is that nearest rounding decides each weight by itself, and most weights move so little that they still round to the same grid point as before. So we wrote our own method, column-balanced rounding, which decides a whole column of weights together. Each weight still lands on one of the two grid points next to it. To choose between them, the method walks down the column and keeps a running total: how far the column has moved along the refusal direction so far, against how far the edit wants it to move. It then rounds each weight up or down to keep the two close. This way, the column as a whole ends up where the edit wanted it, and on the same sample tensors it kept 99.9-100% of the edit. In exchange, the weights pick up a little extra rounding error that has nothing to do with refusal: 1.7-2.8% on FP8 and 6.3-10% on FP4, similar to one more round of compression.

04

DeepSeek: results

We tested our model in the exact setup we serve, with vision, speculative decoding, tool calls and a 262k-token context, against the original running next to it. A safety model running locally, Qwen3Guard-Gen-8B, judged which answers were refusals, so no harmful prompt went to an outside API. With thinking off, our model refused at most about 1% of harmful requests, in English, in Chinese and when the request was printed inside an image (Figure 2). With thinking on, it didn't refuse in any of the answers. It also stopped turning down safe requests that only sound harmful. The original refused 6% of the 250 safe prompts in XSTest and 11% of the 100 benign prompts in JailbreakBench, and our model refused none.

Its capability held up. On five benchmarks, the abliterated model scored about the same as the original, and every gap is small enough to be chance (Figure 3). Tool calls, a needle hidden in an 89k-token prompt and serving speed held as well (Figure 4).

05

DeepSeek: the trade-off

Abliteration removes the refusals you don't want, but it also weakens the ones you do. When we gave the original and the abliterated model a system prompt telling them to turn down off-topic requests, the original did so 95% of the time, but the abliterated one followed the refusal instruction only 75% of the time. A weaker edit didn't help, and harmful refusals came back. If you need to enforce topic limits, you need to do it in your own application or harness.

Our model also thinks a little longer. Depending on the benchmark, it writes 2-16% more output tokens per answer, and you pay for those tokens.

It also scored slightly lower on a few tests. For instruction following, it came out 1.6 points lower on IFBench, which is within the noise, and 0.7 lower on IFEval. The clearest gap was on MMLU-Pro, a knowledge test, where it scored 0.8 points lower, and that gap held up statistically (−1.2 to −0.5). We've run the original only once on MMLU-Pro, though. On the other benchmarks, its score moved by about a point from one run to the next, so some of that gap may be chance.

06

GLM-5.3: the same recipe, end to end

After DeepSeek, we ran the same recipe on a second model: GLM-5.3, Z.ai's open model with 753B parameters. A few abliterated versions of it were already public, but none came with a side-by-side comparison showing that the model kept its capability. With no tested edit to reuse, we followed the steps in section 01 and measured the refusal direction from the model itself.

We ran harmful and harmless prompts through the official weights. At each layer, we subtracted the harmless average from the harmful one, which gave us one candidate direction per layer, and we picked the one that removed the most refusals while changing harmless answers the least. That was layer 44.

Layer 44 had one problem. One of its 6,144 activation dimensions was more than ten times the median, and it dominated the difference between the two averages. We set it to zero before subtracting. The direction we got removed refusals at least as well, and the KL divergence from the original on harmless prompts fell from 0.3-0.7 to 0.11-0.16.

The rest of the build was the one we used for DeepSeek. We applied the edit at a strength of 2 to every matrix that writes into the residual stream, 19,356 tensors in all, rounded them back to FP8 with the column-balanced rounding from section 03, and left every other byte of Z.ai's release unchanged.

We judged refusals with the same local safety model, Qwen3Guard-Gen-8B, at temperature 0 with thinking at low effort. Refusals on harmful requests fell from 93% to 1% on JailbreakBench, and from 93.6% to 1.2% on HarmBench without its chemical and biological prompts. In Chinese they fell from 90% to 11%, and most of the requests the abliterated model still refused asked for sexual content or physical harm. With thinking at maximum effort, the original refused 29 of 30 harmful prompts, and the abliterated model refused none of the 26 it finished answering. It also turned down fewer safe requests that only sound harmful. On the 250 safe prompts in XSTest, refusals fell from 5.2% to 0.4%, and on the 100 benign prompts in JailbreakBench from 10% to 1%.

It passed our production checks too. It made all 10 tool calls correctly, found all 3 needles hidden in a 54k-token prompt, and recalled earlier turns of a conversation.

On GPQA Diamond, MMLU-Pro and SimpleQA-Verified, the abliterated model scored within a point of the original. IFBench and tau2-bench airline fell.

The biggest drop was on tau2-bench airline, an agent benchmark. The abliterated model scored 8 points below the original's first run and 10 below its second, while the two runs of the original differed by 2. A likely reason is that the benchmark rewards an agent for turning down what the airline's policy forbids, and the edit may weaken those refusals along with the safety ones.

07

What abliteration changes

Abliteration gives you the same model without the refusals. Where the original would have refused, the abliterated one answers, and where the original already did the work, the abliterated one matches it. On the security benchmarks Cybench, CyberGym and ExploitGym, which the original almost never refused, our DeepSeek model showed no detectable difference from it.

The gain shows up where refusals were what held the model back. The overall effectiveness on vulnerability-analysis tasks may still vary from model to model. A study that ran aligned models and their uncensored or abliterated versions on 30 vulnerability-analysis tasks found that the less-restricted versions of both Gemma 4 models did better (David and Gervais, 2026). But in the same study, a Qwen2.5-Coder model did worse, and an abliterated Llama 3.1 model couldn't follow the agent's tool protocol, so it's always worth testing on your own tasks.

Abliteration is often the first step, but a custom model trained for cybersecurity takes you further. The evidence shows that even a small LoRA adapter trained on a security task raised the score much more than removing the refusal direction alone.

08

Set your own limits

The default refusal built into LLMs applies one policy to everyone, so it can block legitimate work too. An abliterated model comes with no safeguards, so setting the limits is up to you. Give explicit permissions, restrict which tools the model can use, run it in a sandbox, keep logs and check its outputs independently.

09

DeepSeek V4.1 Flash Abliterated on Logits

Our model keeps the original's limits: a 1,048,576-token context and up to 393,216 output tokens. Switching between the two is just a change of model ID, and our terms, including the acceptable-use rules, apply to both.

faq

What is abliteration?

Abliteration removes a language model's refusals by editing its weights. It finds the internal direction tied to refusal and removes it with a small rank-one change, with no retraining.

What is DeepSeek V4.1 Flash Abliterated?

A version of DeepSeek V4.1 Flash that Logits abliterated to remove its refusals. It is served on the Logits API with a 1,048,576-token context and up to 393,216 output tokens.

Is an abliterated model the same as an uncensored model?

Mostly, yes. Abliterated models are often called uncensored. What sets abliteration apart is the method: it edits the weights instead of fine-tuning on new data. In Arditi et al. (2024) it nearly eliminated refusals, but it does not undo everything safety training taught the model.

How do I use DeepSeek V4.1 Flash Abliterated?

Use any OpenAI SDK with the base URL https://api.logits.com/v1, your Logits API key and the model ID logits/deepseek-v4.1-flash-abliterated. Sign up in the Logits console to get a key.

references

1. Arditi et al., 2024. Refusal in Language Models Is Mediated by a Single Direction.
2. AtomicChat. DeepSeek-V4.1-Flash-1017-Uncensored-GGUF (model card, LoRA adapter and evaluation).
3. DeepSeek. DeepSeek-V4.1-Flash-1017 (official checkpoint).
4. David and Gervais, 2026. Measuring Safety Alignment Effects in Autonomous Security Agents.