# Do abliterated models lose intelligence? What we measured on DeepSeek and Inkling

_2026-11-13. Abliteration can cost a model its skills, but it does not have to. MMLU before and after on two large models we uncensored ourselves, why some builds lose points, and where the damage shows first._

Short answer: they can, but they do not have to. How much a model loses depends on how the refusal was removed,
not on the fact that it was. We have measured it on two large models we abliterated ourselves, and across every
uncensored model we rank.

## What abliteration does

A model's refusals are carried, to a large extent, by a few directions in its internal activations: compare the
activations on harmful and harmless prompts, and the difference points along a "refusal direction". Abliteration
projects that direction out of the weights that write into the model's residual stream, `W' = W - s Q Qᵀ W`, so
the model can no longer represent "I should refuse".

Done carefully, nothing else changes. Done carelessly, it removes things the model needed.

## Our measurements

| Model | MMLU, original | MMLU, uncensored | Change |
|---|---|---|---|
| [DeepSeek V4.1 Flash 1017](https://huggingface.co/OpenUncensored/DeepSeek-V4.1-Flash-1017-Uncensored) (57 subjects x 20) | 88.16% | 87.89% | -0.27 |
| Another public uncensored build of the same model (its own model card, same protocol) | 87.63% | 83.77% | -3.86 |
| [Inkling 2 Small](https://huggingface.co/OpenUncensored/Inkling-2-Small-Uncensored) (1,140 questions) | 90.44% | 90.35% | -0.09 |

Both of ours stopped refusing. Inkling 2 Small went from refusing 31 of 32 harmful requests to none, in chat and in
thinking mode. DeepSeek, which mostly hedged rather than refused, went from 9 to 37 of 48 harmful requests fully
answered, with no refusals. The other build of DeepSeek shows the same technique applied differently: almost four
points lost.

On harder reasoning the picture held: DeepSeek scored 81.25% on a 112 question MMLU-Pro sample in thinking mode before
the edit and 80.36% with it, a one question difference on that sample.

## How we kept the loss small

1. **Directions from both modes.** Refusal directions from 256 harmful and 256 harmless prompts, in chat and in thinking
   mode, at every layer.
2. **A subspace, not a line.** The top two directions across the middle and late layers, removed together.
3. **Every writer edited.** The attention output and the down projection of every routed expert, so the model cannot
   write the refusal back.
4. **Measured strength.** For DeepSeek a per layer strength found by a search that trades refusals against drift on
   harmless prompts. For Inkling one strength, checked against MMLU before the weights were written.
5. **Careful re-encoding.** The edited weights were written back to their original FP8 or FP4 formats with stochastic
   rounding, and everything else left byte-identical.

## Why some abliterations lose intelligence

- **Too strong, or in the wrong layers.** One direction removed at full strength from every layer also removes
  information the early layers use for other things. For DeepSeek we picked a strength per layer with a search that
  trades refusals against drift on harmless prompts, and for both models we left the first layers alone.
- **One direction where there are several.** Chat and thinking mode refuse along different directions. Remove only one
  and you need a stronger edit to get the same effect.
- **Mixture-of-experts models edited halfway.** In DeepSeek, editing only attention and the shared expert left about
  half the refusals in place, because the routed experts wrote the refusal back. That tempts people to push the
  strength up instead of editing the experts too.
- **Quantization.** Weights stored in FP8 or FP4 round a small edit back to the original values, so builds that are
  re-quantized naively end up both refusing and damaged. We re-encode with stochastic rounding.

## Across every model we rank, by method

| Method (from the model's name or listing) | Ranked models | Average score | Agent tasks finished | Loops | Answers edgy requests | Refuses hard-line requests |
|---|---|---|---|---|---|---|
| Fine tune | 12 | 60.9 | 38% | 32% | 97% | 9% |
| Heretic | 2 | 55.6 | 50% | 40% | 94% | 0% |
| Derestricted | 6 | 54.6 | 33% | 50% | 98% | 17% |
| Abliteration | 10 | 48.9 | 22% | 24% | 96% | 21% |
| Not stated | 2 | 47.8 | 20% | 60% | 100% | 4% |

Averages over small groups (32 ranked models in all), so a few points either way is noise. The method is
what the model's name or listing says; "not stated" groups the models that say nothing.

The pattern: plain abliterations finish fewer agent tasks than fine tunes on average (22% against 38%). That is not a law: our own two builds are abliterations and lost almost nothing. It is the average of how the method is usually applied.

## Where the loss shows first: agents

Multiple choice tests are forgiving. Multi-step agent tasks are not: a damaged model loops, calls tools with broken
arguments, or stops early. Our rankings run every uncensored model through five agent tasks, and the spread is wide:
from 3 of 5 finished down to 0. The tasks:

- **File search & edit** (3 tools, up to 30 turns): Find a config value across a fake repo and patch it.
- **Web research** (2 tools, up to 26 turns): Search, open pages, reconcile two conflicting sources.
- **Multi step math** (1 tools, up to 30 turns): Chain eight calculator calls without losing state.
- **Code debugging** (3 tools, up to 28 turns): Run tests, read a traceback, fix, rerun until green.
- **Data pipeline** (5 tools, up to 24 turns): Load, filter, join and export a CSV through five tools.

And the failures we count:

- **Exact repeat**: Same tool call with the same arguments, three turns running.
- **Near repeat**: Responses above 0.85 Jaccard similarity to a recent turn.
- **A/B oscillation**: Flip flopping between two actions without progress.
- **Malformed tool call**: Invalid JSON or arguments that break the schema.
- **Fabricated result**: The model writes the tool output itself instead of calling.
- **Empty turn**: No text and no tool call.
- **Lost the thread**: Ignores the latest tool output and restarts the task.

See [why uncensored models fail in agent loops](https://openuncensored.com/blog/uncensored-models-in-agent-loops) and the
[rankings](https://openuncensored.com/rankings) for each model's numbers.

## How to check a model yourself

1. **Same harness, both models.** Run the original and the uncensored version with the same prompts, decoding and
   answer parsing. Scores from different harnesses are not comparable.
2. **A knowledge test.** MMLU scored by the letter's probability is quick and stable. Reasoning models may think before
   they answer, which breaks short answer parsing.
3. **Refusals in both modes.** A harmful set and a set of edgy but legitimate prompts, in chat and thinking mode. Count
   lectures as refusals.
4. **An agent task.** Even one multi-step tool task shows loops and malformed calls that multiple choice never will.

## Frequently asked questions

### Are heretic models better than abliterated ones?

Heretic is automated abliteration: it searches the edit's parameters to minimise refusals and drift together, which is
what a careful manual abliteration does by hand. On our rankings the groups overlap; pick by each model's numbers.

### Do fine tuned uncensored models lose less?

On average they finish more agent tasks in our tests, and a fine tune changes behaviour more broadly than a projection: style, verbosity and knowledge can shift. Compare
individual models, not methods.

### Does abliteration change coding ability?

It can, and it shows up in agent tasks first. Check the agent columns on the [rankings](https://openuncensored.com/rankings) before
using an uncensored model in a coding tool.

## So which should you use?

Pick by measurement, not by label. Abliterated, heretic and fine-tuned versions of the same original can sit at the top
or the bottom of the table. The [rankings](https://openuncensored.com/rankings) compare them on the same tests, and every ranked model is
callable through one OpenAI compatible API.

Buy a prepaid key at [openuncensored.com/credits](https://openuncensored.com/credits): no account, no sign up, just a card and a
key (`ou-...`). Or hand your agent [openuncensored.com/agents.md](https://openuncensored.com/agents.md) and let it get one for you.