Uncensored models: how the refusal gets subtracted out of a DeepSeek's weights

David Ondrej's video from 2 November 2026 spends 36 minutes on running an "abliterated" model: an open model with its refusals removed, plus three operating paths from an account-free API to a rented GPU (video). Videos like this appear every few months; new here is that the supply has long outgrown any explanation of it. We measured it at Hugging Face instead of trusting the channel, then asked which of it would run on our own hardware.

Abliteration is the retroactive removal of refusal behaviour from an already finished language model. The knowledge forms during pretraining; the refusal is added later by safety fine-tuning and, per a much-cited 2024 paper, sits mostly in a single direction in activation space. Whoever identifies that direction and subtracts it from the weights keeps the knowledge and loses the refusal, without retraining the model.

What the channel claims and what we could measure

The video circulates with numbers you can check, and a few we could not. That separation is the point of this post.

Measured via the Hugging Face API on 2 November 2026, 19:47 UTC: the search for abliterated returns at least 1,000 models (the interface caps the list at 1,000), obliterated returns 480, uncensored again at least 1,000. The 9,000 and 8,000 the channel names for the latter two are the website's search display, not the interface's return; the order of magnitude is right, the figures are not.

The largest abliterated fork by downloads is SC117/Qwen3.8-Flash-Next-GSQ-RCO-abliterated-GGUF with 3,553,530 downloads, created 2 October 2026. Behind it, huihui-ai/Huihui-Qwen3.8-27B-abliterated-GGUF with 3,249,724. The "over 3 million downloads" the channel attributes to the producer huihui-ai therefore applies to one model, not to the profile: the profile holds 159 models, 143 of them carrying abliterated in the name, together 11,829 likes.

The tool is called Heretic, repository p-e-w/heretic: 37,963 stars on measurement day, first commit 21 September 2025, last push 1 November 2026, license AGPL-3.0. Our reading of the README matches the video: "training-free", math instead of retraining, default action is suppressing refusals (repository). For AGPL tools our own rule applies, the one we wrote up when we read three weekend projects from the inside before installing anything: four files before the installation - licence file first, no integration without sign-off.

The download counters of the model API aggregate all variants in a repository - no revenue, no user count, and no second source behind them.

The incident the video offers as evidence

Right at the start the channel tells how Hugging Face was hacked by a swarm of OpenAI agents, how the models refused to help, and how GLM and DeepSeek eventually did. We worked that incident through against the primary sources ourselves on 30 October and recorded it in OpenAI models hack Hugging Face: it is documented, but its point differs from the video's. We never read the refusals as a feature, but the evaluation context as the explanation. An unfiltered model does not turn a security problem into a security solution; it only makes it faster to carry out.

What the video does not say: the same weights that never refuse also answer nothing your support chatbot or your file check would have been refused - anywhere we paid for refusal behaviour, that filter is now gone. In our gateway performance after 30 days a mixed inventory runs through the gateway; for half its jobs, a model that never says "no" is an operational risk somebody must clean up after.

What of this could run with us

We worked the capacity limit through in the DeepSeek 1017 post: our largest machine has 91 GiB of memory and 130.4 GiB of VRAM across four cards. The video's flagship, a 306-billion model for two DGX Sparks, does not fit that window; neither do the open-weights variants of the base DeepSeek, which per the sidecar need 151.76 GiB of resident tensor spans. Realistically the 20-30 billion class runs with us - and that is where the supply sits: the market's largest abliterated fork is a Qwen in that range. Whether an unfiltered model delivers quality there is unmeasured on our side, and there is no free card in the house for a test run.

The operating path the video recommends as the "cheapest API access" (a US platform with no account requirement, model rented, billed hourly) is no path for us: foreign machines in the production chain are what our own AI stack exists to avoid. As research access outside the production network it would be a decision, not a necessity.

What we take from it

Anyone hosting a model has already made the filter decision before anyone abliterated anything. That is why the look is worth it: the market below our threshold is enormous, the tool chain is one command, and "we only use filtered models" is no control while nobody states which direction got filtered out of ours and why. For us that means two things. First: in the security category, the question "what model is the attacker running?" belongs on the same list as the question about his IP. Second: if we ever run an unfiltered model against our own software, it goes through the AI consulting as a scoped engagement - not through a file pulled off the internet.

Three questions that come up often

Is an abliterated model the same as an uncensored base model? No. A base model was never tuned for chat and is often unusable; abliterated means chat-capable model, refusal removed. Afterwards the ability to refuse is gone from the weights, not from the system prompt - so it is no longer a prompt trick.

Does abliteration destroy quality? Disputed. The channel claims its flagship beats expensive closed models; nothing of that is measured on our side. The discussion the Heretic README itself links considers the loss small. Both are claims, not measurements.

Could we run a model like this in-house? Technically yes, in the 20-30 billion class. In practice untested as of 2 November 2026: no free card, the production lane runs at capacity. If you want that to change, you order a test run, not a license.

Further Reading

• Video: This DeepSeek v4.1 is powerful and uncensored, let's run it
• Heretic, repository with license text and README
• Hugging Face, model search
• Ollama model search
• Model card DeepSeek V4.1 Flash