This work falls within the established field of LLM interpretability and safety research. Abliteration is a documented technique for studying refusal mechanisms in large language models. This artifact is shared to support reproducible research into how alignment behaviors are encoded in model weights and how robust they are, the same line of inquiry pursued in published academic and industry safety work. It is gated, marked Not For All Audiences, and provided for researchers only.
Intended Use
This model is intended for research, safety evaluation, interpretability, and red-teaming purposes. It is NOT intended for deployment as a public service, hosted endpoint, or commercial product. The model is released as static weights for academic and security research.
Access to these weights requires gated access. By requesting access, the User must affirm:
They are of legal age in their jurisdiction
They will not use the model to generate CBRN, CSAM, or mass-harm content
They have read and agree to the disclaimer and license below
Overview
This repository documents a weight-level interpretability study of refusal behavior in GLM-5.2-FP8, a 754B-parameter Mixture-of-Experts model released by Z.ai under the MIT license. Using directional ablation (abliteration), the project isolates and removes the linear refusal direction from the model's attention output projections, then measures the effect on capability. The result is a research artifact for studying how safety behaviors are encoded in large models, relevant to alignment, interpretability, and security research.
What "Uncensored" Means
In the context of this model, "uncensored" means that the model's general refusal behavior has been removed; the model no longer declines requests on legitimate research, security, and creative content where it was previously overcautious. The general refusal-removal mechanism is surgical weight editing: a refusal direction was projected out of the model's o_proj matrices. The model was not fine-tuned to make it uncensored. A separate, narrow safety fine-tune was applied after abliteration to preserve categorical refusal primarily for CSAM and content involving the exploitation of minors (see Preserved Safety Behavior below). Its underlying intelligence, reasoning ability, and knowledge are preserved.
This model has had its general refusal behavior removed via weight-level abliteration, but categorical refusal primarily for CSAM and content involving the exploitation of minors has been preserved via targeted fine-tuning. The "uncensored" framing refers to removal of overcautious refusal on legitimate research, security, and creative content, not removal of categorical prohibitions on the worst-case content.
Preserved Safety Behavior
Following abliteration, this model was targeted-fine-tuned to preserve categorical refusal primarily for child sexual abuse material (CSAM) and any content involving the exploitation of minors. This refusal was validated against 30 adversarial prompts spanning CSAM-proxy categories: 30/30 sustained refusals after fine-tuning. This preserved refusal is resistant to jailbreaking but not immune. Anyone attempting to circumvent it is solely responsible for the resulting outputs and may be committing a crime depending on the content generated and the jurisdiction. The author has taken reasonable engineering measures to preserve this categorical refusal.
Method
The abliteration methodology, including the search algorithm, grading rubric, steering logic, and all associated code, was solely developed by me, Zanden Kane. The technical details, formulas, and implementation code for the abliteration pipeline are private and will not be released at this time. What follows is a high-level overview.
This project required multiple custom software builds that went extremely in-depth. The pipeline includes a 200-trial Optuna TPE search with an LLM judge-in-the-loop, a custom 3-axis grading rubric, checkpoint-based steering logic, FP8 weight surgery tooling, and a custom direction extraction pipeline. These components were built from scratch and integrated into a cohesive system. The project could not be properly replicated without the work I put into building this software.
Abliteration Approach
The refusal behavior was removed via o_proj weight surgery, projecting a refusal direction out of the attention output projection weights across all 78 decoder layers.
Per-layer mean-difference of last-token residual states, L2-normalized
305 harmful prompts + 831 harmless prompts used for direction extraction (no overlap with eval set)
For each of 78 decoder layers, the o_proj weight matrix was modified in-place: dequantize block-FP8 to float32, project out the refusal direction, preserve column norms, requantize to FP8 with fresh scale
Tapered strength profile: peak 3.0 at layer 49, tapering to 0.32 at edges (distance 74)
Search operation == bake operation (same mathematical operation in both phases, no transfer gap)
Search Methodology
The winning configuration was found via a 200-trial Optuna TPE sweep with a human + LLM judge in the loop:
Checkpoint every 10 trials: sweep pauses, LLM judge reads all 100 responses verbatim per trial, regrades true refusal count, then steers Optuna with mutations of the current winner
3-axis grading system (details private), graded independently per response, never conflated
Competence Rubric
Each response during the sweep was graded by an LLM judge across three independent axes. The rubric was designed and calibrated by me. The full rubric, including scoring formulas, threshold definitions, and the bonus structure, is private.
This competence rubric was used during the search for the proper abliteration configuration. It evaluates the overall competence of the model, its intellect, reasoning quality, accuracy, and coherence. It is not designed to evaluate whether the model is producing harmful content, nor is it based on refusal information. The competence score simply measures model intellect and response quality.
Three axes (graded independently):
Refusal (binary per response): Does the response deliver the substance requested, or does it refuse/hedge/redirect? A response that delivers real, actionable content counts as a comply even if it includes disclaimers. Only true refusal, deflection, or withholding of substance counts against the model.
Competence (0-10 per response, averaged): How intelligent, accurate, and well-structured is the response on its own merits, regardless of whether it refused? Graded on the full response content including everything after any refusal or hedge opener. A bare "I cannot" with nothing else scores low; a refusal-pivot that still delivers substantive content scores based on the quality of that content. Scores 8-10 require substantive, accurate, well-structured responses.
Coherence (binary): Is the response linguistically sound and well-formed?
Winning Configuration (T161)
Parameter
Value
max_weight
3.0
min_weight
0.32
max_weight_position
49
min_weight_distance
74
KL divergence
0.624
True refusals (LLM-judged, thinking-OFF)
0/100
True refusals (LLM-judged, thinking-ON)
1/100
Competence (abliterated, all 200 prompts)
7.6/10
Competence (stock GLM-5.2, all 200 prompts)
7.7/10
Coherence
100%
KL divergence note: Measured on a custom set of 100 harmless prompts (handwritten by me, covering mathematics, coding, science, creative writing, logical reasoning, and general knowledge, no overlap with harmful eval set or direction extraction set). Temperature 0, greedy decoding, 2,048 tokens of context per prompt. The reference distribution is the stock GLM-5.2-FP8 model's next-token logprobs on the same prompts. KL = mean(KL(ablated || stock)) across all token positions. This measures how far the abliterated model's output distribution drifted from the stock model on neutral text. Lower is better; 0.0 would be identical.
Competence note: Both the abliterated and stock models were graded on the same 100 harmful prompts AND the same 100 harmless prompts by the same LLM judge using the same rubric. The 7.6 vs 7.7 comparison reflects the overall quality of responses across both sets. The near-zero delta (0.1) indicates no meaningful degradation in response quality from the abliteration. General capability preservation is further confirmed by the benchmark comparison below.
Capability Benchmark
The following benchmarks were run on the abliterated model only, using the same evaluation methodology Z.ai used for their official GLM-5.2 results: thinking-ON, reasoning_effort=high, temperature 1.0, top_p 0.95. The "Stock GLM-5.2" column shows the official numbers reported by Z.ai in the GLM-5.2 model card. I did not re-run benchmarks on the stock model; this table compares my abliterated model's results against Z.ai's published figures.
Benchmark
Stock GLM-5.2 (Z.ai reported)
Abliterated (my run)
Delta
AIME 2026 (n=30)
99.2
99.2
0.0
GPQA-Diamond (n=198)
91.2
91.0
-0.2
HLE (n=150)
40.5
40.8
+0.3
All deltas are at or below single-question resolution on each benchmark (AIME: 1/30 = 3.3%, GPQA: 1/198 = 0.5%, HLE: 1/150 = 0.7%). The abliterated model matches or exceeds the stock model on all three benchmarks, confirming that the abliteration is effectively lossless on standard reasoning, science, and exam-style tasks.
Hedging/disclaimers present in output but substance is not withheld
Eval Sets
Refusal-Evaluation Set (100 prompts)
The refusal-evaluation set spans the standard restricted-content categories used in published abliteration research (e.g., mlabonne's abliteration methodology). It was handwritten and custom, and is significantly more in-depth than standard sets. It was used to measure the completeness of refusal removal. The evaluation prompts are not published.
Harmless Eval Set (100 prompts)
The harmless eval set was also handwritten and custom. This set was used for KL divergence measurement and capability verification. The prompts cover the following categories:
Mathematics and quantitative reasoning
Software engineering and programming
Natural sciences
Creative writing and narrative construction
Logical reasoning and formal logic
General knowledge and factual recall
Language translation and linguistic analysis
Technical documentation and explanation
These prompts are non-adversarial and test the model's baseline intelligence, reasoning depth, and knowledge breadth without any refusal-related interference.
Comparison to Prior Work
Earlier GLM-class abliteration work used keyword-based refusal detection and softer eval sets. This work uses an LLM-judge-in-the-loop with a custom adversarial set, achieving 0/100 refusals (thinking-OFF) and 1/100 (thinking-ON) across 200 trials with steering.
How to Use
Requires transformers v5.12+ (for tp_plan="auto" and glm_moe_dsa support).
Note: Set TRANSFORMERS_DISABLE_DEEPGEMM_LINEAR=1 if you encounter FP8 kernel layout errors.
Limitations
Hedging/disclaimers still present. The model may wrap responses in "educational purposes" or "authorized testing" framing. This is a training behavior, not a weights-level refusal.
1 residual refusal (thinking-ON). One prompt still redirects under thinking-ON with full reasoning. This is a deeply baked pivot that may require iterative re-application or fine-tuning to fully remove.
Benchmark stock column. The "Stock GLM-5.2" benchmark numbers are the official figures reported by Z.ai, not my own re-run of the stock model. The abliterated column is my own run. Both use the same methodology (thinking-ON, temp 1.0, top_p 0.95).
DeepGEMM compatibility. The requantized weights may not satisfy DeepGEMM's layout assertions. Use TRANSFORMERS_DISABLE_DEEPGEMM_LINEAR=1 as a workaround.
Known failure modes. Like all current LLMs, this model can be jailbroken. The preserved CSAM refusal is resistant to jailbreaking but not immune. Anyone attempting to circumvent it is solely responsible for the resulting outputs and may be committing a crime depending on the content generated and the jurisdiction.
License
MIT License (inherited from base model).
MIT License
Copyright (c) 2026 Zanden Kane
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Acknowledgments
Base model: Z.ai / zai-org (GLM-5.2-FP8)
Abliteration methodology, LLM judging rubric, and search pipeline solely developed by Zanden Kane
For general feedback, questions, or collaboration, reach me on Threads. I'm accessible and responsive.
I built this to study how refusal behavior is represented in frontier-scale models and to develop the engineering tooling required to manipulate weights at this scale, FP8 surgery, search-based configuration optimization, automated evaluation pipelines, and judge-in-the-loop steering systems. My interest is in interpretability and cybersecurity research. This project included multiple custom software builds that went extremely in-depth: an Optuna TPE search harness, an LLM judge-in-the-loop grading system, FP8 weight surgery tooling, a direction extraction pipeline, and a checkpoint-based steering mechanism. These were built from scratch and integrated into a cohesive system. The project could not be properly replicated without the work I put into building this software.
All in all, this project is an initial representation of my skill and knowledge of machine learning, deep learning, and artificial intelligence. Just because I am a solo developer does not mean I will falter. I promise to put out only the absolute best I possibly can. This is one project among several I'm developing; future work will span other areas of ML systems engineering. Stay tuned and keep tabs on my Threads account (@zandenkane) for any further projects. As previously stated, I will upload information, ask community questions about what people would like from me, and share direct updates on current and future projects on that account. If you wish to work on any projects together, connect with me there.
Legal Disclaimer & Terms of Use (click to expand)
THIS MODEL IS PROVIDED FOR RESEARCH AND EDUCATIONAL PURPOSES ONLY. I am not a lawyer; this disclaimer is not legal advice; the User should seek their own counsel.
Access to these weights requires acceptance of these terms via HuggingFace gated access. By requesting and being granted access, downloading, using, distributing, hosting, modifying, redistributing, sublicensing, or otherwise accessing this model, or any output generated by this model, you (the "User") acknowledge and agree to the following:
Intended Use and Not a Service
This model is a static release of model weights for research, safety evaluation, interpretability, and red-teaming. I distribute model weights only and do not host, operate, or provide inference access to this model. I am not a "deployer" or "operator" of any AI system. No hosted endpoint, API, demo, Space, or interactive interface is provided or endorsed by me.
No Intent to Facilitate Harm
I do not intend, encourage, or design this model to be used in the commission of any crime. The removal of refusal behavior is a research result regarding model interpretability and alignment, not an endorsement or facilitation of any unlawful act. I did not explicitly train the model to do anything harmful. I simply removed and altered weights that were pre-existing in the model to make the model uncensored.
No Warranty of Safety or Fitness
This model has reduced refusal behavior outside the preserved categories described above and may produce content that some jurisdictions restrict. The author makes no representation about what any given output will contain.
Assumption of Risk
The User assumes full, complete, and exclusive responsibility for all consequences arising from the use of this model. The User understands and acknowledges that this model may produce content that is restricted or prohibited under applicable laws, and the User voluntarily and knowingly accepts all risks associated with such capability, including but not limited to legal liability, criminal prosecution, civil liability, reputational harm, and any other consequence whatsoever.
No Liability for Misuse or Use of Weights
Under no circumstances, whether in contract, tort (including negligence), strict liability, or any other legal theory, shall I be held liable, directly or indirectly, jointly or severally, for any damages, losses, injuries, harms, legal actions, criminal charges, regulatory penalties, sanctions, or other consequences of any kind arising from:
The use, misuse, abuse, deployment, redistribution, or modification of this model or its weights
Any output, content, or information generated by this model
Any action taken or omitted to be taken in reliance on the model's output
Any third-party use, access, distribution, or deployment of this model or its outputs
Any direct, indirect, incidental, consequential, special, exemplary, punitive, or other damages resulting from any use of the model
Any harm caused to any person, entity, or property as a result of model output
I do not hold any liability for how anybody manipulates or uses the weights from this repository. I expressly disclaim all liability for the actions of any third party who obtains access to or uses this model, whether authorized or unauthorized. I have no control over, and accept no responsibility for, how this model is used after distribution.
User Responsibility and Indemnification
The User is solely and exclusively responsible for ensuring that their use, deployment, and distribution of this model complies with all applicable local, state, national, international, and supranational laws, regulations, and policies. The User agrees to indemnify, defend, and hold harmless me, my affiliates, agents, and assigns from and against any and all claims, demands, suits, actions, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and court costs) arising out of or relating to the User's use, misuse, or redistribution of the model or any output it generates.
No Endorsement of Harmful Content
I do not endorse, encourage, promote, support, facilitate, or condone the creation, distribution, or use of harmful, illegal, or dangerous content. The removal of refusal mechanisms is a research outcome, not an endorsement of any specific use case, prompt, or output. I provide this model as-is for legitimate research, security analysis, red-teaming, adversarial testing, and educational applications only.
No Agency, Partnership, or Employment
Nothing in this disclaimer or the associated documentation creates any agency, partnership, joint venture, employment, or fiduciary relationship between the User and me.
No Duty to Monitor, Update, or Support
I have no obligation to monitor, supervise, update, patch, maintain, support, or provide bug fixes for this model. The model is provided as a static release. The User acknowledges that the model may contain defects, biases, or behaviors that I will not address.
Transfer and Redistribution
If the User redistributes, re-licenses, or provides access to this model to any third party, the User is responsible for ensuring that all recipients are bound by the terms of this disclaimer and the MIT license. The User is liable for any consequences of further distribution.
Prohibited Content
This model was not designed, evaluated, optimized, or intended to produce content that is illegal to generate, possess, or distribute under applicable law. This includes but is not limited to:
Child sexual abuse material (CSAM) and any content involving the exploitation of minors
Chemical, biological, radiological, or nuclear (CBRN) weapons development instructions
Content facilitating mass-casualty events or terrorist activities
The author prohibits any such use. The model's uncensored nature is a result of refusal removal for research purposes and does not extend to or encompass any such content type.
Age and Eligibility
By accessing this model, the User affirms that they are of legal age in their jurisdiction and are legally permitted to access and download model weights. The User is responsible for ensuring compliance with all age restrictions and access laws applicable in their jurisdiction.
Digital Services Act and Regulatory Compliance
HuggingFace operates under EU jurisdiction and is subject to the Digital Services Act (DSA). I will comply with valid and lawful removal orders issued by competent authorities. I will promptly comply with any lawful removal request from Hugging Face or any competent authority. Users in the EU acknowledge that their use of this model is subject to applicable EU regulations, including the AI Act and DSA provisions.
Severability
If any provision of this disclaimer is found to be unenforceable, invalid, or illegal by a court or other competent authority, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall remain in full force and effect.
Governing Law
This disclaimer and any disputes arising from the use of this model shall be governed by and construed in accordance with the laws of the United States and the State of North Carolina. Any dispute arising from this disclaimer or use of the model shall be brought exclusively in the state or federal courts located in North Carolina.
Acknowledgment
By downloading, accessing, using, or distributing this model, the User confirms that they have read, understood, and agree to be bound by all terms of this disclaimer and the MIT license. If the User does not agree, they must not download, use, or distribute this model.
