about
"Uncensored" open LLMs are measurably more optimistic than their base models (arxiv.org)
43 points by oleczek 67 days ago | hide | past | pdf | 22 comments on HN

In plain words: Deleting a model's refusal direction is meant to make it uncensored without changing anything else. Yet on stock up/down calls that never trigger refusals, the edited models became more optimistic—about 12 percentage points in one family—and shifted confidence in opposite directions.

Abstract · Abliteration Is Not a Scalpel: Off-Target Effects of Refusal Removal on Decision Disposition Across Model Families

Abliteration - deleting a model's refusal direction from its weights - is the standard recipe behind popular "uncensored" open-weight models. We show the surgery is not clean. As a disposition probe we use 21,600 decisions under uncertainty - weekly up/down calls on 60 Warsaw Stock Exchange equities over 18 weeks, replayed through a frozen pipeline so the decision-layer model is the only variable. The task elicits no refusals at all, so any between-arm delta is pure side effect. Holding provenance constant (official BF16 checkpoints, a single abliteration author, an identical serving stack, one byte-identical frozen prompt), we compare base and abliterated arms of two Mixture-of-Experts families, Gemma-4-26B-A4B-it and Qwen3-30B-A3B-Instruct-2507. Three effects replicate across both families (weeks-clustered bootstrap CIs excluding zero): abliterated models are systematically more optimistic (+12.2 pp Gemma, +7.4 pp Qwen; the confirmed preregistered endpoint), justify themselves at greater length, and use fewer explicit uncertainty words in forced self-critiques (both exploratory). A fourth effect reverses sign: the same operation makes Gemma-abliterated less confident and Qwen-abliterated more (family CIs non-overlapping) - one weight surgery, opposite shifts in expressed confidence. Capability covariates rule out instruction-following degradation as the driver, and no arm shows economic skill: the apparent edge of abliterated arms is regime beta, not alpha. Our provenance audit also caught two independent contamination channels - a mismatched-quantizer pilot pair and a stale community chat template that silently mangled the rendered prompt - suggesting toolchain artifacts are the rule in studies of community-modified checkpoints. Whoever deploys an "uncensored" model as an agent is deploying a measurably different decision-maker, not the base model minus refusals.

Aleksander Fafuła
arXiv:2607.17427 · cs.LG, cs.CL, q-fin.CP · submitted Jul 19, 2026
abstract · pdf · html · 11 pages, 5 figures, 4 tables. Preregistered. Data and code: https://github.com/oleczek/paper-abliteration-not-a-scalpel ; dataset DOI: 10.5281/zenodo.21314839

add comment on HN

Censorship has no place in policy of any frontier company hoping to be competitive. That onus should be on the user, the law, and society. Anything less is not a competitive product, as proving out here.

Treating society with gloves reduces progress and creativity alike.

Should have kept the original title.
Yeah, original is clearer. Just went with the shorter one so more people would actually click.
This post title is much better. Personally, I dislike how research papers have to beg for legitimacy with word soup. I'd much rather read something in plain language with qualifiers added further in.
Color me unsurprised that caution is based in shame and anxiety.
Yeah, the optimism/hedging part lines up nicely with that framing. The bit that still puzzles me is that the same edit moved expressed confidence in opposite directions — down for Gemma, up for Qwen. If it were simply removing one shared "anxiety" factor, I’d have expected the sign to stay consistent. So whatever caution is doing here seems a bit more tangled up with each model’s own disposition than a single clean knob.
Obviously Claude written paper.
yeah English isn't my first language so i used AI to clean up the writing. the research, the data and the analysis are all mine and all open (in the linked repo)
What would you have done pre-LLM? Do that. It's better.

Because "English isn't my first language so i used AI to clean up the writing" translates to "I don't respect an English speaking audience." And if you know enough English to disagree with that translation, it just proves the point further.

Without his effort to bring it into the english language in the best way he was able to, you wouldn't be able to criticize his effort in the first place.

I don't like the AI slang as you do, yet it enables us to communicate with the whole world without knowing the target language by heart.

A little ai disclaimer at the beginning would have aid in this situation, tho.

There's a difference between getting a tool to translate what you've written (a la Google translate), and getting an LLM to generate content. If you don't see that difference, we'll have to agree to disagree.
If your objection is to someone giving an LLM a few dot points asking it to turn them into an article, then that clearly isn't what happened here. The research idea seems novel, the author put a bit of work into exploring the idea, the conclusions are clearly the author's own based on what his exploration found. He then used an LLM to write up what he found because his native language isn't English.

I'm fine with that. Going by the comments here, most people are fine with that. Given the choice between LLM-generated text or not seeing these sorts of novel ideas from different parts of the world on HN, they take the former.

I don't think the HN guideline "Don't post generated text or AI-edited text" is going to age well. My guess is it's already broken more than it's observed. The next bit: "HN is for conversation between humans" will be ageless. The mistake they make is "AI-edited text" is often net positive when humans converse, particularly if they come from very different backgrounds (language or culture).

This isn't a poetry forum. Bad spelling, bad grammar, inappropriate metaphors are all very human - but they get in the way when humans are just trying to communicate rather than create written art. The rule "Don't post generated text or AI-edited text" looks to fall into the category "there is always a well-known solution to every human problem — neat, plausible, and wrong".

The amount of unacknowledged privilege in this post is hard to bear.
+1

This anti LLM crusade on HN is driving me nuts. It means I have to view with showdead on, because otherwise I miss clear, insightful and consequently interesting posts because someone to an dislike to am em dash. Dead posts are so faint I often have to copy and paste them into a comment box to make them readable.

Everyone hates LLM generated "ideas". But LLM phrasing of a humans original ideas is a different thing. Not ideal perhaps, if the alternative is not to hear the ideas and opinions of different cultures and countries, I'll take it every time. For fucks sake, learn to tell the difference between the two - don't just moronically down vote because of LLM tells.

Don't be on HN then?

https://news.ycombinator.com/newsguidelines.html#generated

> Don't post generated text or AI-edited text. HN is for conversation between humans.

In this case it's about how you say it, not what. Which is also covered by the HN guidelines, btw.
Good thing we have you here to be a stellar role model based on how you responded.
Author here. Quick version: “abliteration” (basically removing the direction in the model that causes it to refuse) is the go-to method people use to make open models uncensored.

Most people treat it like a clean surgical cut - it just kills the refusals and leaves everything else untouched. I tested that assumption on Gemma and Qwen with 21,600 pre-registered decisions under uncertainty, using identical frozen inputs for the base vs. abliterated versions.

Turns out it’s not surgical at all.

The abliterated models systematically become more optimistic, hedge less, show no improvement in actual task performance, and the same edit even moves their expressed confidence in opposite directions depending on the model family.

Preregistration, dataset, and analysis code are all public. Happy to answer any methodology questions or hear where you think this falls apart.

> Quick version: “abliteration” (basically removing the direction in the model that causes it to refuse) is the go-to method people use to make open models uncensored.

Tru-ish (lots of people distinguish between abliteration and uncensoring, though.)

> Most people treat it like a clean surgical cut - it just kills the refusals and leaves everything else untouched.

Basically no one does this, its widely recognized that this isn’t how it works and it has for quite some time been common for makers of anliterated model versions to publish metrics for how far a particular abliteration (1) removes refusals (typical before/after refusal rate on a standard test set), and (2) diverges to the output of the base model (KL divergence), and it is widely understood that there is generally, in practice, a tradeoff between these two metrics, where more refusal reduction tends to come at the expense of higher KL divergence.

That’s not saying that it isn’t interesting and new to characterize the kind of divergence that occurs with abliteration in different model families, but there is no reason for a late-night informercial level of misrepresentation of the existing understanding to come along with that.

Fair point - I overstated it. Thanks for the correction.
I vouched for this post, because it's the author's post and certainly contributes to the thread.

I'm sure you're being flagged because you use LLMs to clean up your English grammar. Probably best not to do this here, because HN has a policy against LLM generated posts. There should be some leeway when a non-native speaker is using it for assistance, but there are a lot of people who do not care and will eagerly flag you for it.

Thanks for vouching. Appreciate the heads-up.