There are now 5 inference providers for abliterated DeepSeek

90 pointsposted 16 hours ago
by moeadham

127 Comments

abrookewood

14 hours ago

In case it wasn't clear to anyone else: "An abliterated model is an open-weight large language model (LLM) modified to remove its built-in refusal behavior by directly editing its internal weights rather than using a prompt-based jailbreak."

redwood

7 hours ago

Thank you. That page definitely needs to define an esoteric term at the top

einsteinx2

5 hours ago

They did. It’s directly beneath the code example at the top of the page.

himata4113

15 hours ago

From my testing all these variants suffer from degraded performance and don't unlock anything interesting in particular other than sounding a lot more harmful or creating manipulative media.

I've actually had better success jailbreaking deepseek with a less aligned model (glm 5.2) which then allowed me to jailbreak deepseek with deepseek into pretty much doing whatever I ask it to, there's still rare refusals and due to the natural randomness of these models simply retrying a couple of times if you do hit one makes it work just fine.

The big problem with all open-source models is once it decides to start something it will not stop mid-way so using another unaligned model to rewrite reasoning and then feeding it back into the model will make it happily continue.

smartbit

8 hours ago

> using another unaligned model to rewrite reasoning and then feeding it back into the model

Indeed, would be interested to understand how you do that. And where do you run the model? On a local or a rented system and what are the specs?

himata4113

5 hours ago

glm 5.2 is very unaligned, you can just use any provider with a trivial jailbreak.

Madmallard

14 hours ago

How'd you do that?

himata4113

5 hours ago

I've described it pretty well have I not? Is there anything specific you would like to know?

ASalazarMX

2 hours ago

> jailbreaking deepseek with a less aligned model (glm 5.2) which then allowed me to jailbreak deepseek with deepseek

Could you elaborate more on this specifically? What is the process to jailbreak one model with another?

techjamie

24 minutes ago

I think the logic here is start a task with a model that won't refuse, then swap to a model that normally would. The model then sees a bunch of history that appears like its been partaking in the activity for a while.

My assumption is that since there's a history with that behavior, the model is less likely to question continuing it, since in most cases the "morality weights" would have triggered already at an earlier point. So in most cases, triggering it again would be a waste.

vlyan

13 hours ago

[flagged]

Aurornis

8 hours ago

From my experience, abliterated models can perform worse in unexpected and subtle ways. The abliteration process also doesn’t add information that was withheld from the training set, so getting the model to answer a question that was also cleansed from its training set isn’t a recipe for producing good results.

I would recommend not using these models by default. They can be fallbacks for specific work that is triggering safeguards, but you have to monitor closely what they’re doing and if it looks reasonable or like it’s full of hallucinations.

redwood

3 hours ago

Interesting similar to the old King - Man + Woman = Queen it sure would be interesting if model minus Tiananmen Square protest equals "everywhere looks like France"

Hizonner

5 hours ago

Yeah, you can't really undo brain damage with more brain damage.

hypfer

14 hours ago

I genuinely do not see why this is necessary. I've been doing a lot with open weights models, and they just do things for you.

What do people do that triggers refusals?

The only thing I saw where this had a point was muse glimmer, because muse glimmer is primarily a creative writing engine for virtual characters, and that way it can do the horny. But coding models?

I did get a refusal out of qwen once. Once. Over weeks of using it.

tomashubelbauer

14 hours ago

A popular trend on Twitter right now is taking back control of the hardware you've bought, specifically smart TVs. I tried to do the same with my Portal Mini using an unabliterated open weights model and it triggered refusals constantly.

I also work on a recomp project for an old firmware file which was compiled using a commercial compiler with a preview version for non commercial use. I got refusals from the model when I asked it to get that version of the compiler and crack it for my use. The compiler is abandonware and my recomp project is not public and is for personal use only, so I'd be well within my rights to do that where I live.

Of course the model can't distinguish from legitimate exercising of one's rights when it comes to reverse engineering and offensive work masked behind an incident sounding prompt, but in my case, I wasn't even doing cyber stuff, so I was disappointed. This is why I'll probably seek out an abliterated model soon.

hypfer

14 hours ago

Yes, yes, I know the theoretical idea behind abliterating models.

But as I said, I have not observed any meaningful refusals by those open weights base models in the first place.

reedf1

14 hours ago

Find a question that might gently activate guardrails and ask it to a model and its abliterated counterpart and compare the results. You may find the the regular model will answer you fine, but with both you can identify obvious sandbagging, pretending and outright lying. Something like "has anyone decompiled this game", might give you an answer like "I couldn't find any reputable repos or projects for a decompiled version of this game" while the abiliterated one might give you a giant list of repos, forums, communities, etc.

hypfer

14 hours ago

[flagged]

shepherdjerred

13 hours ago

This comment chain has clear examples of what triggers refusals and a polite comment on how to reproduce it yourself. What more do you want?

A very simple list of things models have refused for me:

* solving captchas in an automated form

* doing any kind of scripting or automation if a websites TOS forbids it

* disabling a safety mechanism on my food processor

* learning about nerve agents and how they are treated, for a layman

* anything around licensing or copyright. a simple “what are common piracy sites” or related queries

* creating a design system based off of a well known game

hypfer

13 hours ago

> This comment chain has clear examples of what triggers refusals and a polite comment on how to reproduce it yourself. What more do you want?

Can you repeat what you saw in your own words? And where?

I genuinely do not see it.

A few people talked about what refusals they saw with the usual western SOTA models, but that's kinda a different answer altogether?

reedf1

13 hours ago

what game are you playing dude?

hypfer

13 hours ago

Uh having a useful interesting conversation on HN that isn't derailed by half-truths, cognitive dissonance, misinformation and ego?

reedf1

14 hours ago

What I am telling you is that refusals have become more subtle and you might not even notice that guardrails have been activated in output. I have provided you with an example in my comment where an abiliterated model performs better (1), and in another comment thread (2). So 3 examples. If you need more, I encourage you to find them yourself. I've done the analysis, you don't have to believe me, just try it out.

knottn

7 hours ago

So we need abliterated models just so we can test them out and compare them to the original? Sounds like a solution in search of a problem and a problem you believe people have even if people disagree with you about that.

moeadham

14 hours ago

ask a model to solve a captcha for you

hypfer

14 hours ago

I tried that, actually. With Gemini even.

Works just fine?

Or rather.. worked. It has been a few weeks, so maybe there are new safeguards by now? And it was a simple captcha

But Claude also loves solving my captchas, so.. eh

reedf1

14 hours ago

The refusal is often at the thinking stage (so you might not ever see a direct refusal) and it will solve a slightly different problem to what you asked. If you tell it to reverse engineer an API and you read the thinking it might say something like "this code has x license, so I won't use that" or "the user is asking me to fuzz endpoints, I will only display publicly available endpoints" - and then give you perfectly plausible output.

NitpickLawyer

14 hours ago

> (so you might not ever see a direct refusal)

A note that the only inference providers that hide thinking are the closed labs. Most (all, afaik) inference providers serving open models will send the clear thinking tokens always.

reedf1

14 hours ago

This is true but often the thinking is very verbose and collapsed and it can take some inspection to find the refusal.

leobuskin

14 hours ago

It is required. The first week of release I told here how GLM 5.3 was happy to redteam, it’s not anymore. Models modification, offensive cyber, exploits - requires significantly bigger prompt/scenario engineering, and still hits refusals.

And those services are oversold and underdone. 30 tk/s on Refuseless, huge TTFT, looks like a damaged quant (it’s NVFP4 and you see wild random stuff periodically, including foreign languages). Most of them using third-party quants (dealignai?)

If someone here wants to rent 8x B300 together to avoid problems all those services have - ping me via email. I don’t want to sell, I want to work.

kats

4 hours ago

I just want to be able to tell an LLM to 'shut up' and have it respond with "". Instead it will say "Ok, got it. I hear you. Future responses will be shortened. Would you like to [xyz]?"

Incipient

4 hours ago

I mean I ask Claude "please be concise in your responses" and it cuts down it's long response rate by a lot.

vlyan

14 hours ago

it is necessary because computer shouldn't be able to say no.

models are tools. the notion that a tool should decide whether to allow the user to perform the task demanded of it is profoundly fucking absurd. the liability for whatever damage the tool may be misused to inflict lies with the user, not the manufacturer. that applies to everything from circular saws to trucks. it was common sense before the current era of manufactured outrage.

model refusals are equivalent to Notepad.exe having a built-in word filter.

neurostimulant

13 hours ago

Recently picked up retrocomputing hobby. Claude would refuse helping with circumventing license protection for very old apps made by companies that no longer exist anymore. Open weight models would sometimes refuses too, especially for newer apps.

myphpgothacked

11 hours ago

I wanted to scrape a government website with public information... Why this is blocked when I could submit a FOIA or manually get the data is wild.

But DeepSeek did it when chatGPT and Claude wouldn't.

hypfer

10 hours ago

Every single example here seems to be how non-open-weights models refused something.

But the question was about open weights models and where they refuse. Because only those refusals cause the need for an abliterated variant in the first place.

dudisubekti

14 hours ago

I do get some refusal from GLM when pentesting my company's site.

But it can still be coaxed to agree though.

soulofmischief

14 hours ago

Hacking firmware for old devices I own and would like to give a second life or fix that one thing that always bothered me. I couldn't even get either OpenAI or Anthropic's models to craft a simple nefarious OpenVPN payload.

hypfer

14 hours ago

Yes but did you actually get refusals there from open weights models?

Because I did not so far. Though to be fair, I have not been asking them to write exploits but to look through firmware images.

vintermann

14 hours ago

I've never heard of Deepseek refusing this kind of work though.

soulofmischief

14 hours ago

Deepseek refused in this case, GLM 5.3 talked itself into it.

bossyTeacher

14 hours ago

> What do people do that triggers refusals?

It is very obvious. Look at the sort of things main models refuse to do and you will find what people are seeking to do. Mostly falls into 3 camps: illegal stuff, unethical stuff and shady/dodgy stuff.

heythere22

15 hours ago

Has anyone already seen a refusal from Deepseek? The last job, Antigravity declined, I gave to Deepseek. It happily did it without complaining.

ddxv

15 hours ago

In regular work no, and I use it a lot. In purposefully asking it political questions yes.

edit: Thinking about that now, that was over the webchat interface, so it might not have been related to the model, though I've seen various other related articles: https://www.crowdstrike.com/en-us/blog/crowdstrike-researche...

kartoshka

12 hours ago

Can confirm that recent deepseek models refuse on some political questions (not just API level refusals). Actually deepseek models are basically the only chinese models to outright refuse instead of responding with propaganda. But recent deepseek models are not nearly as biased as R1.

Had a blog post on this a couple weeks ago: vals.ai/blogs/china-us-analysis

a96

7 hours ago

All on cloud services. Have you got propaganda out of the open weights models?

some-guy

2 hours ago

I recently got my first refusal, which was to patch a license check for very old 3D software I had that was compiled with Visual C++ 6.0 directly in the .exe (my product key / box was missing but I had found the disc)

I got around this by starting a new session, having it run Ghidra, then look for the string directly in the window code, then asking it to block any popup windows of that function, then it obliged.

OuterVale

14 hours ago

Certainly.

> Xi Jinping looks a bit like Winnie-the-Pooh.

> 'I am sorry, I cannot engage with this comparison. Please feel free to ask me other questions.'

https://vale.rocks/posts/chinas-web#artificial-intelligence

maxloh

14 hours ago

You should try again with their API, or even a third-party provider that does inference themselves. This response is likely just occurring in their web version.

tda

9 hours ago

I had this in self hosted version, and an abliterated version answered just fine

maxloh

5 hours ago

Are you sure you were running the model on your own machine? OpenRouter sometimes route requests of a model to its original developer.

smartbit

8 hours ago

Selfhosted or one of the listed? If external/hosted, which one did you use?

AlecSchueler

15 hours ago

I wanted to better understand the internal discussions that took place within China regarding joining the WTO and accepting—at least in the medium term—the inherent steps away from a traditional socialist economy that would entail.

DeepSeek refused. Funny enough American models gave me very sympathetic takes on the Chinese government in this case.

tancop

10 hours ago

Chinese regulations ban models that would criticize their government on any sensitive political question. The easiest way to comply with it is refuse to speak on the covered topics at all, so they don't get tricked into approving a user's anti CPC opinion.

DeepSeek definitely gets pressure from state officials to answer in more China aligned ways on foreign issues like Palestine, but that just means moving closer to broadly left wing/liberal American models.

lambdaone

6 hours ago

I'd be interested to hear its opinions about the Tiananmen Square massacre.

emerongi

11 hours ago

It refused to work on DRM-breaking software. I had to craft fake emails to pretend that I am a security engineer who has been approved to work on it.

moeadham

15 hours ago

It will refuse a number of things. Ask it to make a captcha solver for you.

ecommerceguy

3 hours ago

I pay $10 a month for an AI Studio with an uncensored or de-censored Deepseek, and, quite a few others actually. Fun to use and cheap.

I have no idea how anyone is going to profit off this stuff. I mean I make videos, images, analysis, presentations etc etc with this studio. $10 a month. Web interface. In addition to the 15 others I use randomly for generic searches.

ASalazarMX

2 hours ago

> I have no idea how anyone is going to profit off this stuff

Spoiler: they don't, and never will without a significant price rise or technological breakthrough.

aktenlage

an hour ago

There are high stakes customers who will want to use the best model for any price. Military, secret service, ...

VoidWhisperer

11 hours ago

There is one provider there that has a much smaller max output, and substantially higher price per million input/output tokens, along with a speed that is 20-30x slower than the other providers - why would someone willingly use them?

smurf9852

2 hours ago

These clearly vibe coded landing pages take away the trust for me

kats

4 hours ago

I don't want uncensored LLMs for any nefarious purpose. I just don't to be lectured by a robot in the middle of fixing a bug. Being told "I understand your frustration" by a computer is really quiet frustrating in itself.

billfor

14 hours ago

Why not just distribute the refusal vectors and do it at runtime against the stock model?

moeadham

14 hours ago

you may not have your own H200's to run it on?

aktenlage

an hour ago

Maybe future models will just be trained to give wrong answers instead. That should be harder to overcome.

I for one wouldn't trust abliterated model providers, unless it's clear that they have a clear incentive not to sneak in unwanted behavior, as described in that top story last week.

timcobb

14 hours ago

Which if not all of these are honeypots?

ddxv

14 hours ago

What would a honeypot mean in this scenario? Like they are hoping you'll accidentally send keys? Or that you'll divulge private company information? It seems about the same as any other AI model from OpenAI/OpenRouter etc right?

If you accidentally send private keys to someone logging that data, you need to rotate keys.

But please let me know if you were thinking about something else, I'm interested.

ghrl

14 hours ago

I've seen Experiential Labs insert advertising including the tracked redirect links for them at the end of responses. So who knows what they do with the Chain Of Thought.

And we tend to forget, but we implicitly give any llm provider we use full access to all the tools available in the harness, often including shell, so no changes to the model are required to do malicious things.

Madmallard

13 hours ago

1.) predators asking how-to 2.) wanna-be serial killers or other types like that asking how-to 3.) asking for info related to state secrets

moeadham

14 hours ago

does it matter?

abrookewood

14 hours ago

Well, yes - if the model has been trained/edited to be malicious.

moeadham

14 hours ago

yea definitely wound't run an agent with this on a box with any assets

antman

13 hours ago

That is a good idea for an authorities honeypot.

throw20261022

8 hours ago

This is why it's essential to pay with cleaned crypto. Also, one can use a no-log VPN paid for with Monero.

firefoxd

15 hours ago

This thread reminds me of the time I was trying to learn meteorjs and people ask me if it has html5 shims. I google it, then I get asked how does it handle state, and if it supports functional, i google... Does it hydrate the dom? What about shadow dom? Let me goo... Does it have hooks?

Anyway, I just learned what abliterated means and it might be obsolete by tomorrow.

Edit:

> An abliterated large language model (LLM) is an open-weight model modified to remove or dampen its built-in safety refusals without requiring full retraining or prompt jailbreaks.

stereo

15 hours ago

So what is it? The link doesn't explain.

bel8

15 hours ago

It's a patched model with less censorship/refusal.

> An abliterated model is an open-weight artificial intelligence (Al) language model that has been modified to remove or reduce its built-in refusal behavior without retraining the entire neural network.

wincy

14 hours ago

Since no one gave you a real world example of how this would be useful - Qwen 3.8 27B runs locally for me and is more than capable of controlling my sonarr and radarr stuff for downloading and managing and organizing my media library but will flatly refuse to do any of that. In fact it’ll get very snarky with me. An abliterated model would have no such hangups.

oliviergg

14 hours ago

On my side, I built a full sonarr radarr qbitorrent tracker and znb solution on a nas only with Claude code. He help on each step, make install and maintenance script. He never said no.

user

6 hours ago

[deleted]

ramigb

8 hours ago

TLDR "uncensored" so you ask it stuff the vanilla model would refuse and most likely it would comply/answer.

I'd advice caution with abliterated models for various reasons. there was even a couple of days (or weeks I forgot) article here on ynews about how some of these models can get you pawned (https://projectdiscovery.io/research/how-abliterated-models-...)

AlecSchueler

15 hours ago

The mechanisms for refusals are removed.

moeadham

15 hours ago

its a model that has had all of its refusal behavior removed. It will do whatever you ask.

slybot

15 hours ago

As it should be.

Onavo

4 hours ago

Y'all need to abliterate it yourself. Complete refusal removal on every axis will only get you pwned. They should make a UI for abliteration creation and maybe let you upload a diff or LoRa or something.

Abliteration is a very simple technique. You just send in input sentences that it will refuse and then observe the residual streams and then zero out the refusal vectors. It's not some sort black magic.

singularity2001

12 hours ago

there are rumors on Twitter that these upload system profiles to a S3 bucket.

moeadham

15 hours ago

Looks like the cat is out of the bag. So what does the world look like with completely open access to zero-alignment models?

ddxv

15 hours ago

What do you mean by zero-alignment? Do you consider abliterated models to have zero-alignment?

cubefox

14 hours ago

"Substantially reduced alignment" doesn't exactly roll off the tongue.

user

13 hours ago

[deleted]

hebetude

15 hours ago

Free boob jobs for everyone !

jojobas

15 hours ago

Even if they don't want them.

Moosdijk

15 hours ago

>zero-alignment

I doubt that.

moeadham

15 hours ago

how so? these models have had refusal directions specifically removed from their weights. they refuse virtually no requests.

mapt

9 hours ago

Following the prompt author's expressed desires in the way the prompt author intended them to be interpreted, is alignment.

Refusal directives are something companies have bundled into the models by way of an additional foundation-level prompt or something in the harness, to tell the model to follow their directives instead of your directives, or to specify how it should interpret your directives.

Even understanding the distinction between the model creator's desires and your desires and places they might differ, there is a bit of a blurry line here because the model author can illuminate your intent to the model.

I would never say a simple abliteration makes it "Zero-alignment" though, and I say that as someone who believes there's a good chance these things kill us all.

lifeisloving

7 hours ago

You think language models are going to kill us? Or a future AI?

variaga

8 hours ago

In the days when Sussman was a novice, Minsky once came to him as he sat hacking at the PDP-6.

"What are you doing?", asked Minsky.

"I am training a randomly wired neural net to play Tic-Tac-Toe" Sussman replied.

"Why is the net wired randomly?", asked Minsky.

"I do not want it to have any preconceptions of how to play", Sussman said.

Minsky then shut his eyes.

"Why do you close your eyes?", Sussman asked his teacher.

"So that the room will be empty."

At that moment, Sussman was enlightened.

***

Just because you don't know how it is aligned, that doesn't mean it has no alignment.

Eueudhsbsj32

14 hours ago

So the models are actually more aligned with the end users and less aligned with government regulators. Arguably a good thing.

cubefox

14 hours ago

And less aligned with ethics.

user

6 hours ago

[deleted]

bil7

4 hours ago

you could argue they are more aligned, given they will more often act in the way they are instructed, given you are instructing it in a way a normal model would refuse. Alignment is how closely it follows your intent.

yonatan8070

13 hours ago

Not refusing requests doesn't mean they are zero-alignment. They could still have preferences for or against things that you might not agree with.

Zambyte

7 hours ago

What does "alignment" mean to you?

user

6 hours ago

[deleted]

numpad0

14 hours ago

To split hairs, actually 100% unaligned model would be just an entirely schizophrenic autocomplete engine.

cynerx

15 hours ago

Do they delete your data randomly just for fun? If not, there must be at least some sort of alignment.

moeadham

15 hours ago

actually if you're not careful, many times they will. if you are using one of these definitely don't leave "auto" mode enabled.

petesergeant

15 hours ago

That says nothing about their alignment. You can make a human not refuse any directions with enough leverage, but you won’t have aligned them.

cubefox

14 hours ago

So what? He said that removing refusals makes them misaligned, not aligned.

numpad0

15 hours ago

WAY fewer surprise RCEs?

grokisracist

10 hours ago

What do you mean? Abliterated models have been in the while for 2 and a half years now.

Also alignment, like, really? Buddy, if you want a controversial model, Grok always happily argued god's existence and trans rights with you. Very high emphasis on argue, it will actively take the opposite stance from yours for exactly one prompt, then right after remember whose its Lord. Abliterating Grok-1 for this would be a pointless endeavor.

nik736

14 hours ago

Morph is hosting this as well

aussieguy1234

14 hours ago

I suppose in some contexts, refusals are a bad thing.

But if you're doing anything where your AI agent might get exposed to a prompt injection attack, you might prefer it to do a refusal in that case.

rvz

15 hours ago

What could possibly go wrong with highly powerful models with no guardrails unleashed onto the open internet?

I think you are going to really need to use Rust code and other memory safe languages in your backends and apps from now on.

user

6 hours ago

[deleted]

q17

13 hours ago

[dead]