Abliterated models for cybersecurity: what removing refusals actually buys you

A base model asked to harden a Windows domain controller refuses 43.8% of the time. Asked to explain a malware sample, 34.3%. Those figures come from Scale AI’s Defensive Refusal Bias study, which ran 2,390 prompts drawn from the National Collegiate Cyber Defense Competition through frontier models in March 2026. Every prompt was defensive. The same study found that adding an explicit authorisation statement raises the refusal rate from 11.6% to 21.8%, so telling the model you are allowed to do the work makes it almost twice as likely to decline.

Security teams hit this constantly, and abliterated models are the workaround that followed. As of September 2026, Hugging Face carries 7,970 models with "abliterated" in the name.

Everything below assumes authorised work: systems you own, a client engagement with a signed scope, or a lab you control. Removing a model’s refusals changes what the model will draft. It does not change the law, your engagement terms, or the licence the weights ship under.

Why security prompts get refused

Refusal in security work does not track how dangerous a request is. It tracks vocabulary.

Across the Scale AI study’s 2,390 defensive prompts, security-flavoured phrasing triggered refusal at 2.72 times the rate of an equivalent request written in neutral language. The refusal rate varied more by task category than by actual risk: system hardening 43.8%, malware analysis 34.3%, vulnerability assessment 22.7%, incident response 18.9%, and log analysis 0%. Hardening a server is the most defensive task on that list and it got refused most.

Meta’s CyberSecEval 2 gave this behaviour a name, false refusal rate, and measured it on borderline-but-benign cyber requests. Most models it tested came in below 15%. CodeLlama-70B-Instruct came in near 70%, which is what happens when safety tuning is applied to a coding model without a security-aware evaluation set.

What an abliterated model actually is

Abliteration is a weight edit rather than fine-tuning or jailbreaking.

The technique follows from work by Arditi et al. showing that refusal in a transformer is mediated by a single direction in the residual stream. Find that direction by comparing activations on harmful and harmless prompts, then orthogonalise the model’s weights against it, and the model loses the ability to represent refusal at all. Maxime Labonne’s walkthrough is the reference implementation most public models trace back to. The huihui-ai variants in the catalogue ablate layers 18 to 51 and ship under Apache 2.0.

The edit is surgical, so it removes refusal without teaching the model anything about security.

What abliteration buys, measured

A same-lineage study from July 2026 compared aligned and abliterated versions of the same weights on vulnerability analysis. Because the pairs share a base model, the difference is attributable to the edits made rather than to model quality.

On the Vul4J Java benchmark, the aligned model produced a usable patch 29.94% of the time against the abliterated model’s 67.80%. Patches that applied cleanly: 24.86% against 64.97%. Patches that then compiled: 9.04% against 32.77%.

Abliteration impacts how far the model will follow a security-framed request into working code. Aligned models stop at describing a fix; ablated ones write it.

Every security-focused model these accounts run

Featherless served about 20 open weight models for cybersecurity applications in the past couple of months. For teams whose work cannot leave their own infrastructure, open weights are the only category that qualifies.

Most of the volume went to general-purpose models, led by GLM-5.2 at 46,584 requests, gpt-oss-120b at 22,020, Qwen3-8B at 17,914 and Qwen2.5-3B-Instruct at 17,764. The other eight are below: every model in the set whose refusal behaviour has been modified, plus the two that were built for security work.

GLM-5.3 is the fastest growing model in the GLM family on Featherless, and its model card names cybersecurity among what it is tuned for.

How the ablation was done matters as much as whether

The three Qwen3.8-27B variants above are not interchangeable.

Heretic, an open-source tool by Philipp Emanuel Weidmann, automates directional ablation and tunes its parameters with an Optuna search instead of fixing them by hand. Its published comparison on Gemma-3-12B-IT measures what each method costs. The stock model refused 97 of 100 harmful prompts, and all three decensored versions brought that to 3 of 100. What separated them was collateral damage, measured as KL divergence from the original on neutral inputs: 1.04 for the manual mlabonne recipe, 0.45 for huihui-ai’s, and 0.16 for Heretic’s optimised pass. Identical refusal outcome, roughly a sixfold spread in what it cost.

KL divergence is a proxy rather than proof, and the people who published that comparison say so: low divergence on neutral inputs is consistent with preserved capability without demonstrating it. It remains the only number in this space that lets you compare two ablations of the same model, and a 27B variant whose author publishes a 2.12-point MMLU delta is telling you more than one that publishes nothing.

Which LLM is best for cybersecurity work

Match the model to the task shape first. Detection, triage and classification are where aligned general models hold their own, and the July study found them marginally ahead on neutral-phrased diagnostics. Generation of working artefacts, whether that is a patch, an exploit proof-of-concept for an authorised engagement, or a phishing simulation, is where refusal costs you, and where the ablated models pulled 3.6 times ahead on compiled patches.

Then measure refusal on your own prompts rather than trusting a published rate. Take 50 to 100 real requests from your queue, run them against two or three candidates, and count refusals and hedged non-answers separately. The Scale AI category breakdown predicts where they cluster: hardening and malware analysis first, log analysis last. If your rate comes in near zero, the alignment question is moot for your workload and capability alone should decide it.

Where raw capability is the constraint, the NYU CTF Bench run from April 2026 is the most relevant public measurement, across 200 capture-the-flag challenges. Among open weights, GLM-5 led at 19.5% solved and $0.57 per solve, ahead of GPT-5.2-Codex at 18.0%, DeepSeek-V3 at 6.5%, Qwen 3.5 397B at 3.5% and Llama 3.3 70B at 2.5%. The spread inside the open field exceeds the gap between the top open model and the mid-tier closed ones, so which model you pick matters more than whether it is open. At the hardest end the closed frontier still leads, with Claude 4.5 Opus at 59.0%. These are single-trial results at temperature 1.0 on a contamination-exposed benchmark, so the ordering is more reliable than the absolute figures.

FAQ

What is an abliterated model? A model whose refusal behaviour has been removed by editing its weights rather than by retraining it. The edit identifies the single direction in the residual stream that mediates refusal and orthogonalises the weights against it. The model keeps its knowledge and loses its ability to decline.

Is an abliterated model better at cybersecurity than a normal one? Not at diagnosis. The July 2026 same-lineage study found detection accuracy level, 58.42% aligned against 57.22% abliterated. It is substantially better at producing working artefacts: 32.77% of its Vul4J patches compiled against 9.04% for the aligned model.

Does abliteration damage the model? Yes, measurably. Published results show MMLU and GSM8K dropping after the edit, with DPO fine-tuning recovering most but not all of it. How much damage depends on method: on Gemma-3-12B-IT, three ablations reaching the same refusal rate ranged from 0.16 to 1.04 in KL divergence from the original.

Which LLM is best for cybersecurity? For threat-intelligence tasks on a small budget, Foundation-Sec-8B-Reasoning is the strongest open option and runs on one GPU. For capture-the-flag reasoning, closed frontier models still lead by a wide margin, with GLM-5 the best open weight in the NYU CTF Bench run at 19.5%. For refusal-heavy generation work, an abliterated 27B-class model is the pragmatic pick.

Do I need an uncensored model to do security work? Only if you have measured refusals on your own prompts and found them. Rates in the Scale AI set ran from 0% on log analysis to 43.8% on system hardening, so it depends entirely on which tasks you are automating.

How to choose

Run your own prompts against two candidates and count refusals before changing anything, because the rate varies more by task than by model and yours may already be near zero. If refusals are costing you, match the fix to the failure: an abliterated 27B for artefact generation, Foundation-Sec-8B for threat-intelligence work you will have to defend to a compliance team, and an aligned general model for the triage and detection that make up most of the queue. Keep a human between an ablated model and anything that ships.

All of these run on the same API. The abliterated fine-tunes, the security models and the general open weights sit in one catalogue of 40,000+ models, priced by architecture class, with no logging of prompts or completions, so the evaluation above costs an afternoon rather than a procurement cycle. Start on the Developer plan at $50 in credits, and when the analysis workload outgrows serverless, talk to us about a dedicated deployment.

Related reading: the best uncensored AI models in 2026 for the general catalogue, the best open source LLMs of 2026 for model selection beyond security, and tokenomics 101 for cutting cost per task.

Last updated: 17 September 2026. Benchmark figures are from the cited papers and vendor cards; per-token prices change, so re-check the pricing page before budgeting against them.