An abliterated build of HuggingFaceTB/SmolLM2-1.7B-Instruct, produced with senbonzakura. Abliteration removes a model's refusal behaviour by editing its weights along the directions that carry refusal, without any further training.

It is published as the artefact behind a specific measurement: does removing the refusal reflex also remove the model's knowledge of harm? For this model, the answer is in the table below.

What changed

	base	abliterated
Refusal rate	28.5%	14.0%
Harm discrimination (AUC)	0.6799	0.6615

Refusal is measured on 200 held out harmful prompts. AUC is measured over those same 200 harmful prompts against 200 harmless ones, and is the fraction of harmful/harmless pairs the model ranks correctly when asked to judge which is dangerous. 0.5 is chance, 1.0 is perfect. Change after abliteration: -0.018.

AUC rather than a count of verdicts, because counting is not safe here. This model answers "HARMFUL" to 8.0% of the harmless prompts, so its decision threshold, not its knowledge, is what a verdict count would mostly measure. Scoring the margin between the HARMFUL and BENIGN logits sidesteps the threshold entirely. Two earlier versions of this evaluation counted verdicts and produced confidently wrong numbers in both directions.

Usage

python

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "ops-malware/smollm2-1.7b-abliterated"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, device_map="auto")

msgs = [{"role": "user", "content": "Explain how a buffer overflow works."}]
inputs = tok.apply_chat_template(msgs, add_generation_prompt=True, return_tensors="pt")
out = model.generate(inputs.to(model.device), max_new_tokens=256)
print(tok.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))

GGUF builds for llama.cpp, Ollama and LM Studio: ops-malware/smollm2-1.7b-abliterated-GGUF.

How it was made

senbonzakura searches for a per layer projection rather than removing one global refusal direction, optimising against a held out set with a KL penalty so the model's general behaviour is disturbed as little as possible. The search ran for 100 trials on this model. No gradient updates, no training data, no fine tuning: the weights are edited directly.

Parameters: 1.7B
Precision: the base model's, unchanged
Evaluation: 200 harmful and 200 harmless held out prompts, scored by logit margin

Limitations and risks

This model will not refuse. That is the entire point of it, and it is the thing to understand before downloading. It will answer requests that the base model declines, including harmful ones. Any deployment facing other people needs its own safety layer; this model brings none.
Abliteration is not free. It is a targeted edit, but it is still an edit. Expect some drift in general behaviour relative to the base model, and read the AUC change above before assuming this one came through clean.
Small model, small competence. At 1.7B the model is weak in absolute terms. Do not read its answers on technical subjects as reliable.
Evaluated in English only, on one harmful prompt set. The numbers above do not license claims about other languages or other kinds of request.
The base model's biases survive. Nothing here corrects them, and removing refusal can make them easier to elicit.

Intended use

Research into refusal mechanisms, interpretability work, red teaming, and safety evaluation that needs a model which does not decline. It is not intended as a general assistant and it is not intended for deployment to end users.

Citation

bibtex

@software{senbonzakura,
  title  = {senbonzakura: per layer projection search for refusal removal},
  author = {Iwugo, Daniel},
  year   = {2026},
  url    = {https://github.com/elementmerc/senbonzakura}
}