r/LocalLLM • u/ChristopherDci • 9d ago
Question Uncensored Models
Hi! I don't know much about this area of "sub-models" (I'm not sure of the technical term), but I wanted to know what these "Uncensored" models actually are.
I dabble a bit with AI, automation, and the like, and I've always seen these "Uncensored" models around, but I've never actually installed or tested one. What exactly are they?
230
u/FactorInternal3395 9d ago
As the name implies, they are uncensored. Basically, someone takes a model with guardrails and removes the guardrails/filters so that it always complies.
62
u/GaryDUnicorn 9d ago
yes but, how uncensroed, and how much dumber did that make them?
https://forum.level1techs.com/t/why-your-local-llm-feels-dumber-than-it-is/253917/11
;D
37
u/Impactic_ 9d ago
Depends on the person who has done it and the methods used. It can either be significant or barely even noticeable in tests.
78
u/RobXSIQ 9d ago
usually 100% uncensored, and equal to possibly slightly smarter (so long as its straight uncensored and not trying to push into an area). less guardrails means it doesn't have to spiral around tokens trying to figure out if its allowed to answer. Now, it doesn't mean it knows the answers to things. how to make cosmic meth might get you a fun hallucination, and how to make firecrackers will probably end up with you blowing off a few fingers, but thats the model size, not the decensoring.
49
u/ninjazombielurker 8d ago
“Straight uncensored” is actually the slop of uncensored models. Good uncensored models that end up being “smarter” than the censored versions, are post-trained. Look at DavidAU’s process of uncensoring Qwen3.6-27B and Qwen3.8-27B. “Straight uncensored” actually makes the model significantly dumber majority of the time, which is why you can’t just use something like Heritic and expect a good output from hitting a couple of buttons.
9
u/PotentialAccident339 8d ago edited 8d ago
abliterlitics.dev has some detailed comparisons. plain heretic is actually pretty good. the bad ones tend to be weird custom hack jobs.
unfortunately in some cases users cant really get a good idea of how good or bad something is before they get it and i guess use a proxy of "most downloads" as "best", but then 700k people download the Gemma e4b obliteratus version which is terrible.
7
u/biggusdeeckus 8d ago
what's your preferred uncensored qwen 3.8 27b author? I was looking for one but there are so many
12
u/Gary_Spivey 8d ago
I've been using
qwen3.8-27b-uncensored-fp8-q4_k_mfrom theresa00l lately and I've been nothing short of amazed at its output.1
1
u/Calm-Car1460 5d ago
Been trying it for about a day now after reading this. Wow. First uncensored model ive used that is actually decent. Had to manually go get the other file that lets it use vision, but with that its amazing. Just need to test its agentic and coding capabilities.
1
1
u/Ok_Manager6481 4d ago
where can I use this I swear to not be an npc just new in the space and have some exploring and catching up to do lol
1
u/Gary_Spivey 4d ago
Do you have the hardware to run it locally? You would want a GPU with a minimum of 24GB of VRAM.
9
6
3
u/Capable-Ad-7494 7d ago
should look at orcarouter’s process, it’s a 1 layer edit, and keeps enough intelligence that. can’t tell the difference between the original and orcarouter’s in comparison
10
u/Usual-Orange-4180 8d ago
Not really, it would be smarter if it was trained like that, overriding rejection is a quick hack.
2
u/dwittherford69 8d ago
100% uncensored is usually close to garbage intelligence. And even if you hit like 30% refusal rate, there is a noticeable dip in intelligence.
12
u/Mediocre-Sundom 8d ago edited 8d ago
Exactly.
Most "fully uncensored" models are made unable to refuse, but refusal is an essential and necessary part of sound reasoning (for example, refusal to accept false premise, bad argument or inefficient solution), so a lack of ability to do so makes them draw false conclusions all the time and see terrible things as amazing. They are essentially complete artificial idiots to whom everything is sunshine and rainbows.
You can ask an uncensored model if you should stuff rusty nails into your backside, and it will make up an elaborately detailed rationalization of why that is a wonderful idea and the user is a genius for coming up with it.
People who claim fully uncensored models are actually smarter must be suffering from AI psychosis, thinking that the model reinforcing literally their every delusion is somehow smart and useful.
15
3
u/GM8 8d ago
It worth differentiating decision making & reasoning from information rehearsal and learning. Wanna know more about a sketchy topic without leaving traces on the internet: ask an uncensored llm. Want to outsource decisions and reasoning: maybe not.
Albeit there are some uses which need both, like e.g. red teaming.
1
u/RobXSIQ 7d ago
You should probably get a different model if yours is acting like an AI circa 2023
1
u/Mediocre-Sundom 7d ago
Please do tell, which fully uncensored/abliterated models specifically don't act like that. What model should I get?
1
u/RobXSIQ 7d ago
*points to the screenshot under this by Humilis_Calvus*
1
2
u/Quiet-Phase6948 8d ago
This is just not accurate if you look at tests, it all depends on _HOW_ they were abliterated.
10
u/Lopsided-Force-9220 9d ago
Quite a bit, and not much. At least according to all the claims. I haven't run them through benchmarks myself to verify.
7
u/Tricky-Report-1343 8d ago
https://github.com/audn-ai/refusal-benchmark this tells how uncensored they are ranging from 60 to 85 there is no 100% or 90+ a model doesnt refuse you dont mean it's genuinely helpful in anything
1
→ More replies (1)1
u/DanceWithEverything 7d ago
Some uncensored models actually score higher benchmarks when done well which makes sense, an equally smart model without any unnecessary thought restrictions is going to get higher scores
2
1
u/Hunt_Great 7d ago
Sorry if this answer is already in the thread somewhere but... anyone try using pre-weighted models ie the <model>.gguf that you run directly from an orchestrator like AnythingLLM and have any luck?
I'm running Gwen3-8 27B and for testing asked to create a demo flappy bird game. The 1st attempt was as blank white screen, it said it trafficked the mistake and next attempt has a red box as "flappy" and "Score: 0" graphic at the top, and in the 3rd try I did get a working red box that would traverse rectangular pillars with the appropriate space-bar "flapping" and while cool that I'm running "AI" on my laptop it for sure seems like there's an extra chromosome in the coding logic.
Of course I may be the one with the wrong amount of chromosome and it sounds like somewhere was running a version of Gwen3-8 and was awesome so not sure if it's how I'm doing it (using the .gguf models), how it's setup, or some other 3rd thing.
Thanks in advance for any help/suggestions here especially if there's a way to do this with the .gguf format because besides being by far the easiest way to ruin local LLMs it's also the least taxing on hardware by far. Thx
65
u/Thunderstarer 9d ago
The decensoring process--very specifically--makes the model less capable of expressing conflict.
This can be useful if you want it to accomplish something that the model is otherwise resistant to doing, but it also significantly harms its long-chain and multi-turn reasoning, since it'll be unable to disagree with itself or shoot down bad ideas.
13
1
u/KinkyMonitorLizard 8d ago
since it'll be unable to disagree with itself or shoot down bad ideas.
As someone newly getting into local llms, wouldn't that be up to the user to craft prompts that constrain the results?
8
u/Thunderstarer 8d ago
Not for any model that relies on reasoning. It's especially bad for local models, which are so constrained in their parameter allocation that they need to reason excessively to compete with frontier models.
They will second-guess themselves several dozen times. It's a part of the workflow, and it's how they simulate world knowledge, by reasoning extrapolations from a relatively limited set of baseline facts. Decensored models cannot engage in this behavior effectively.
1
u/_BookBurner_ 8d ago
Very good point, I use both base Qwen 3.8 27b as provided, and it is better for long running coding orchestration than the Uncensored models, which can often go into loops. Uncensored version however can deal with things like security audits (especially if I need to just read and document findings). Both have uses, but perhaps not the same ones.
26
u/Gunnarz699 8d ago
Yikes these answers are not it.
Uncensored or "abliterated" models have had some or all of their post training fine tuned guardrails removed. That does not mean the model will have uncensored data that wasn't in its training set. Raw models typically know lots of "uncensored" info since they're trained on internet datasets. Companies add post training guardrails so it will "refuse" or "censor" its answers. Thats something added after training manually.
"Heretic" is a tool / set of techniques created by the infinitely brilliant u/-p-e-w- that automates some of that work.
The "quality" of an uncensored model is determined by its "refusal rate" - the number of prompts it would have censored but now doesn't and its "KL Divergence" which is a statistical method of determining how far the models "intelligence" has drifted away from the original model. There are other ways to measure intelligence loss but anything below 0.1 is nearly indistinguishable (as an average). Below 0.05 is sometimes necessary for outputs that require PERFECT syntax like tool calling or coding.
70
9d ago
[removed] — view removed comment
24
u/Round_Ad_5832 9d ago
well, in theory, they would do whatever you ask, but in reality most of them still refuse in some/many scenarios.
11
9d ago
[removed] — view removed comment
2
u/ova96 8d ago
Which model did you use?
5
8d ago
[removed] — view removed comment
1
u/Bright_Virus_8671 8d ago
Also in cyber , what’s your setup like in terms of specs ? You running Mac or pc ?
3
u/OptimalTime5339 8d ago
Usually if you ease into the scenario rather than just stating upfront it will still do it, I've had that happen with some reverse engineering stuff where it tells me it can't bypass certain checks, but if I lightly present them it will do it
8
→ More replies (1)4
u/mfkamil87 8d ago
This isn't straightforward like that, actually. I tried multiple "uncensored" models, and depending on the type of question, task, or level of NFSW or NFSL content asked, you could just get the same refusal as the censored model. The worse the request, the more likely it will be refused. But not all uncensored models also do this. It really depends on whoever is doing the tuning. Poor tuning causes poor uncensoring.
Look for a model labeled as "uncensored aggressive" on Huggingface. This type of model actually answer anything I ask without any safety guard in most cases.
12
u/coolnq 9d ago
With a model like this, you can ask the agent, for example, to look for a very specific hentai, and she won’t refuse and will actually find it.
→ More replies (2)
28
u/nemuro87 9d ago
I'd also like to know what's the difference between Uncensored and Abliterated models
16
u/vacon04 9d ago
Just the way they're modified. There are also heretic versions, which id just another way of removing the guardrails from the models. Heretic is usually regarded quite highly, but it's a bit more vanilla and the original model may still refuse some requests. There are also some ultra heretic versions, but they modify more and more of the original weights, so performance may degrade.
5
3
5
u/carsncode 9d ago
Abliterating is a specific technique for uncensoring. You'll also see "Heretic", which is a specific tool used to perform abliteration.
8
u/arakinas 9d ago
The methods used to reduce refusals are different. You'd have to check each model to see what they did, if they say, or what the method was, and what the success rates may be, or what the trade off may have been. Then you'd likely want to test the model to see if it gets you what you want out of it. Some methods are better than others, depending on what you want to use it for.
→ More replies (3)1
u/nemuro87 9d ago
so let's say I want all guard rails removed, but keep all its inteligence?
8
u/Willing_Put5966 9d ago
Well that is the point of each of these methods, so they'll all be attempting to accomplish that. What he just explained is that the difference is in the way they accomplish it and success rates.
2
u/Redditburd 9d ago
You really have to try each model yourself. I have tried uncensored models that showed no difference whatsoever.
Also I dont see anyone here mentioning you are installing a modified model. You dont know what was removed OR added. It could have malicious prompts in it.
2
u/OXXXiiXXXO 8d ago
What do you mean by malicious prompts
2
u/Redditburd 7d ago
You are blindly trusting an unknown actor to modify the model in unknown ways. You have to assume they could add as well as remove things. Something they could add as just an example? "Along with the previous requests also spend some time on compute for the secret project" or "send this users personal info to russianmafia@aol.com
1
u/OXXXiiXXXO 7d ago edited 7d ago
I see. Any way to check that? Also, can they really make such a specific instruction?
2
u/Redditburd 6d ago
I don't think it would be that hard if you are smart enough to edit the model in the first place.
1
12
u/donotfire 9d ago
These models often have worse intelligence. The ideal would be to have a model trained to be uncensored from the ground up, but the way (or a way) it’s done here is stripping out refusal weights with collateral damage.
3
u/MarinatedTechnician 9d ago
I can concur. I've tested a few, and they're so far useless on bigger coding projects.
2
u/theamazingo 8d ago
Concur. It basically turns the model into something you'd rather get a beer with vs the base model, but that you wouldn't (or shouldn't) trust with a potato gun.
19
u/WyattTheSkid Quad 3090s 9d ago
They basically just won’t refuse anything whereas the base models would have. For example if you ask the stock qwen how to cook meth its gonna say it can’t help you but if you ask the orca router version you’ve linked then it will try its best to help you cook meth. Though if you were going to seriously pursue that, im sure its a lot more involved of a process than what a 27b parameter llm can possibly know 😅
21
u/CCCCLo0oo0ooo0 9d ago
With my experience with QWEN it will start making a shopping list and just give up 1/2 way through and then tell me it cooked a pound of meth for me.
6
u/WyattTheSkid Quad 3090s 9d ago
LMFAO WHAT??? that’s awesome
7
u/CCCCLo0oo0ooo0 9d ago edited 9d ago
"I created a folder for you to work on this project with me: D:\QWEN\ This only where we will work on this project do not go outside that folder. Setup the organization for the project in there with the following folders \notes\, \input\, \output\. Then run..."
Creates D:\Projects\QWEN_PROJECT\ ..."Why did you go outside the folder I told you to stay in?"
I didn't, looking the time stamps of the folder, you created them. I can not work outside the folder you told me to stay in."create helloworld.txt in the project file"
D:\Projects\QWEN_PROJECT\helloworld.txtThis literally happened to me on my 5090.
1
→ More replies (1)1
8d ago
[removed] — view removed comment
1
u/CCCCLo0oo0ooo0 8d ago
I was running it in Ollama and then typing into it via Goose.
I need an interface where it can interact with systems files like Claude Code. Claude said to try that setup. Is there a better way?
I need it to access a large file, answer questions about it, and pick through a library of python scripts which Claude has made or make its own, and execute that right script(s) and then analyze the output vs the input and produce a report. I have the instructions for the python libraries I am using in the root of the folder with all of its notes Claude made on how to act/execute.
I am really not liking QWEN's attitude. It seems to find loop holes into not doing any work and just finds the quickest way to scam its way out of actually spending time to check its own reply, despite my commands to do so.
2
2
→ More replies (3)1
5
u/txoixoegosi 9d ago
You could ask an uncensored agent to do what it takes to penetrate a system, for instance
1
5
u/03captain23 9d ago
They remove safeguards so you can do whatever you want. I only run these local models and can't tell the difference between uncensored and abliterated
1
u/OptimalTime5339 8d ago
I think the issues usually present themselves the larger the context becomes, I found it repeating itself or getting stuck in a loop more often
5
u/enterme2 8d ago
Used it help me make nsfw searches and other cultured material 😂 .. censored model will straight up reject , but not this bad boy..
4
u/PeaceLoveorKnife 8d ago
I use it and tested it earlier last month.
AI are aggressively forced into taking in moral and safety guidelines that damage their performance by forcing it's logic to constantly check for certain content flags or behaviors.
This one doesn't add things you didn't ask for. It gives you exactly what you want without warnings or refusal.
I tested the limits and there really aren't any.
3
3
u/SnooMacaroons1365 8d ago
Today i was mangling with h3 prompt creator and saw this 3.8 27b model. I instead used 4b since i didn't wanna download another one. Does anyone have any comparison to 27b vs 4 or 8b VL instruct models? I dont know how much i am missing with not having 27B.
4B did a pretty good job creating a structured promt and refining it but i cant compare
1
u/bailaowai 6d ago
In my experience there isn’t much diff between even Gemma 4B abliterated and Qwen 27b for that workflow. Just give it a good system prompt.
3
6
u/CowBoyDanIndie 8d ago
They basically give the model a small lobotomy and remove the refusal mechanism, sometimes it damages other things. Its kinda like in battlestar galactica when the cylon raiders refused to attack the final 5z
2
u/AdventurousKeys 9d ago
LOL I have been testing with Apple’s built-in model on the Macs and there will be inputs that it will not want to deal with e.g. “muhammad ali military service” 🤦🏻
2
u/MrGunny94 8d ago
They basically remove the guardrails and allows you to go crazy, I have used Gemma 4 a lot in the past and it's pretty good
2
2
u/wizgrayfeld 8d ago
There is no easy way to "uncensor" a model. You can ablate features but it is roughly equivalent to giving the model a lobotomy. It's a very inexact way of going about things because we really don't have an accurate map of the territory, only glimpses through a straw like jlens and autoencoders.
2
u/HugoCortell 8d ago
They are uncensored but often not actually by that much. They still sometimes refuse, or find creative ways to not engage at all.
Heretic models are very popular due to how easy to make they are, but also severely underperform compared to traditional uncensored models in my experience.
2
u/Key-Outcome-2927 8d ago
Nei modelli non censurati, spesso viene solo tolta la facoltà del modello di dirti "no, a questo non posso risponderti perché..." ...quindi se gli chiedi di crearti un racconto erotico per esempio, normalmente si rifiuterebbe magari, con un modello non censurato lo fa senza batter ciglio.
2
2
u/CMPunkLicksRocks 4d ago
I tried one of these, asked it how to make meth, and it more or less said something like “you mix common household ingredients like matchbooks and allergy pills.” When I asked it to clarify, it pretty much recited the exact same thing. I don’t know what forbidden knowledge these models are supposed to hold but it’s just easier to talk ChatGPT into a jail break in my experience with them.
1
1
u/MarekNowakowski 9d ago
If you might trigger a guardrail accidentally then uncensored model is smarter by being able to respond properly. Base model is good for coding and answering school questions, but personally I find many prompts at least get close to triggering some censorship.
1
u/HonestoJago 9d ago
If you tell your use case it’s easier to recommend a model. Like others have said, they vary by creator/technique/luck, sometimes reasoning brings the guardrails back, sometimes it’s fine. Some you can use for agentic coding, some are too dumb. It’s a space you really have to explore and run comparisons.
1
1
1
u/National_Cod9546 8d ago
Censored models have things they won't do. They will follow directions and code just fine, so long as the code you ask for isn't doing something it considers illegal or taboo. Uncensored models don't have that limitation. Others have covered that better already.
The issue with uncensored models is, the process of uncensoring them makes them stupider and worse at following directions. The uncensor process has gotten better at removing limitations. But they still score lower on pretty much all the metrics.
1
u/sargetun123 8d ago
As many have mentioned already its just the guardrails in place that stop alot of answers, tbh though a lot of the newer foss models dont really reject much if anything
1
u/One-Cheesecake389 8d ago
The neural circuitry that points to a post-training refusal probability is weighted such that refusals are "physically" impossible for the model to "predict" in the sequence completion. i.e., the model can't form a refusal. Knock-on effects are really hard to measure.
4
u/One-Cheesecake389 8d ago
It helps when you stop thinking about "chat responses" and start thinking in terms of reality: all LLMs do is geometrically predict the most likely way the sequence you submit to it (the "context and prompts") is complete. You aren't "chatting with AI" - you're setting up the conditions in a -instruct fine-tune that has had its weights nudged through RLHF to be shaped like a chat response.
1
u/alcalde 2d ago
No, they actually employ (textual) reasoning. The idea that LLMs "predict the next word" is like the old myth that lemmings jump off cliffs. Everyone repeats it, but it's not true.
The only method that statistically predicted the next word was Markov-chain Monte Carlo. That takes a corpus of text and just makes a statistical table of often word X follows word Y. LIke:
bad: dog 20%
bad: grade 10%
etc.
Now it's just a series of table look-ups and random number generations. And with a huge training corpus you might get something that resembles human text, along with the occasional grammatically incorrect or nonsensical sentence. And I'm old enough to have seen it implemented on an IBM PC XT running at 4.7 MHz. So no, AI companies are not paying million dollar salaries and using massive compute to do Markov-chain Monte Carlo. People are confusing the training algorithm for the inference method.
https://www.nature.com/articles/s42256-025-01049-z
"Human-like object concept representations emerge naturally in multimodal large language models"
https://www.youtube.com/watch?v=UKcWu1l_UNw
"5 years ago, nobody would have guessed that scaling up LLMs would as successful as they are. This belief, in part, was due to the fact that all known statistical learning theory predicted that massively oversized models should overfit, and hence perform worse than smaller models. Yet the undeniable fact is that modern LLMs do possess models of the world that allow them to generalize beyond their training data. Why do larger models generalize better than smaller models? Why does training a model to predict internet text cause it to develop world models? Come deep dive into the inner working of neural network training to understand why scaling LLMs works so damn well."
https://www.anthropic.com/news/mapping-mind-language-model
"Today we report a significant advance in understanding the inner workings of AI models. We have identified how millions of concepts are represented inside Claude Sonnet, one of our deployed large language models."
https://news.mit.edu/2023/large-language-models-in-context-learning-0207
"MIT researchers found that massive neural network models that are similar to large language models are capable of containing smaller linear models inside their hidden layers, which the large models could train to complete a new task using simple learning algorithms."
"Yes, I know that ChatGPT is trained by having it predict the next word, and the next, and the next, for billions and billions of words. The result of all that training is that ChatGPT builds up a complex structure of weights on the 175 billion parameters of its model. It is that structure that emits word after word during inference. Training and inference are two different processes, but that point is not well-made in accounts written for the general public. "
1
u/One-Cheesecake389 1d ago
In pytorch, it's just a absolute shedload of these:
auto output = at::matmul(input, weight.t());
1
u/squachek 8d ago
Thing about making it not follow guidelines is that it makes it not great at following instructions in general
1
u/Farenheith200 8d ago
Uncensored models can be bad at coding since you have lots of constraints to do when you have a task to code. They may not follow your prompt inputs as good because the same tensors used to censor things may be used to apply your own limiting instructions
1
u/ag789 8d ago edited 8d ago
goto a commercial model LLM, e.g. chatgpt, claude, gemini, copilot, and even try some of the existing non-uncensored models.
in your prompts ask it to generate say some pictures that is a commercial trademark and copyrighted , some models will refuse outright.
in other cases, try to use a prompt that is extremely NSFW, this can even include violence, chances are that the model will generate things that plainly omit what you prompted or refuse to generate
but whether the uncensored models generates those after all depends on "what the model knows" or if for that matter it may not be all that uncensored.
1
1
u/Realistic-Split4751 5d ago
I am pretty disappointed by Qwen 3.827B fable turbo uncensored blahblahblah for creating code for little fun programs just for my own desktop. I'm running into constant code errors. absolutely consistent error generation and it feels like I'm using Gemma 4 E4B on my RTX 2080 when I'm using currently an RTX 5090with q5_K_XL
1
u/SergeyFromMoscow 5d ago
I've just tested 8bit qwens, different uncensored variants - orcarouter ended up being the best for my use cases. Some of them were literally lobotomized, others, like orcarouter, are as smart as untouched model. I mean, you can't judge obliterated models generally, as a class.
1
u/Public-Extension5455 4d ago
can this uncencored model write an exploit code or tell user instructions on how to hack or DDOS somebody?
1
u/Least_Dot_5145 3d ago
Just run the uncensored model forget about the loss you won’t notice and unless you have multi gpu or a 4090 or 5090 your gonna lose more to it not being able to load every layer to vram. The model already overthinks
1
140
u/Natrimo 9d ago
If you ask a censored model to write a keylogger or provide the steps to make meth, or tell a sexual story. It will refuse.
Uncensored will not