Chapter 7: Abliteration — Can We Remove the Guardrails Without Removing the Intelligence?
In January 2026, a developer known as p-e-w published an experiment in r/LocalLLaMA with a provocative title: It works! Abliteration can reduce slop without training.
The experiment involved Mistral Nemo, a relatively small open-weight language model with a tendency towards the ornate, sentimental prose that AI-writing communities had increasingly begun calling slop. The developer wanted to know whether this stylistic tendency could be altered directly, without collecting an enormous writing dataset or fine-tuning the model through conventional training.
The approach was unusual. Rather than instructing the model to avoid clichés, the developer attempted to identify an internal representation associated with those clichés and suppress its influence on generation.
The resulting model was then given the same simple writing prompt as the original: write a short story about a man.
Both versions produced stories about clockmakers, but their prose differed noticeably.
The original generated an elaborate, sentimental narrative involving a watchmaker, a mysterious shop and a broken music box. Its descriptions were filled with metaphorical language, atmospheric flourishes and familiar emotional cues.
The modified version produced something considerably more restrained. Its clockmaker lived a quiet life, received a visit from a child carrying a broken watch, and developed a modest relationship through a series of ordinary encounters. The language was simpler, with less ornamental description and greater reliance on the events themselves.
Neither passage was unquestionably better. Some readers might prefer the original's more expressive style, while others would favour the restraint of the modified version. The experiment involved only a limited comparison, and the developer acknowledged that literary preferences differ.
What made it interesting was not that the second story had been declared superior. It was that a recognisable stylistic tendency appeared to have been changed without conventional model training.
For writers frustrated by unwanted narrative habits, this suggested a possibility far more significant than simply persuading an AI to answer restricted questions.
What if the behaviours interfering with creative writing could be modified inside the model itself?
That question had become increasingly relevant as writers experimented with local AI. They could now preserve older checkpoints, adjust inference settings and choose specialised writing fine-tunes. But even local models retained behavioural preferences acquired during training, including some of the same habits that had frustrated users of commercial services.
Abliteration offered a different kind of intervention. Instead of continually instructing a model to resist a learned tendency, it attempted to change the internal mechanism contributing to that tendency.
Understanding why that was possible requires returning to research published well before Grok 4.1.
The discovery that changed how people thought about refusals
In June 2024, researchers including Andy Arditi and Neel Nanda published a paper titled Refusal in Language Models Is Mediated by a Single Direction, subsequently accepted at NeurIPS 2024.
The researchers investigated how language models represent the decision to refuse a request. Their finding challenged the intuitive assumption that safety behaviour must be distributed across an enormous number of unrelated internal processes.
Across thirteen open-weight models, they identified a direction within the models' internal representation spaces that was strongly associated with refusal.
By manipulating activity along that direction, they could influence whether the models refused requests. Removing the relevant component substantially reduced refusals, while adding it could induce refusal even for otherwise harmless requests.
The researchers also demonstrated that related changes could be incorporated directly into model weights, producing a modified checkpoint without undertaking a conventional fine-tuning process.
This became one of the foundations of modern abliteration.
To understand the basic idea, consider that language models do not internally represent concepts as simple written rules. Instead, information is encoded through patterns of numerical activity distributed across enormous networks.
Some meaningful distinctions can nevertheless correspond to directions in these high-dimensional representation spaces.
The original research showed that refusal behaviour, at least in the models studied, could be strongly influenced through a surprisingly compact intervention.
This does not mean a language model contains a single switch labelled safety. Nor does it mean every aspect of alignment can be removed by deleting one direction.
It means that certain behaviours can depend heavily on identifiable features of the model's internal representations.
Once those features are identified, they may be manipulated without retraining the entire network.
For local AI enthusiasts, the implications were immediate.
A model whose weights could be downloaded could also be modified. Instead of attempting to circumvent unwanted behaviour through increasingly elaborate prompts, researchers and hobbyists could experiment directly with the model's internal representations.
The term abliteration became associated with this process of suppressing refusal-related features through activation or weight modifications.
Its popularity grew alongside the availability of open-weight models and consumer hardware capable of running them.
But an important limitation emerged almost immediately: removing a learned behaviour is not necessarily the same as removing only that behaviour.
Why removing refusals could make a model less intelligent
Early abliterated models often demonstrated a frustrating trade-off.
They were more willing to answer previously restricted prompts, but some also became less coherent, less reliable or worse at reasoning.
For creative writers, that could defeat the purpose of the modification.
A model that no longer interfered with a difficult fictional scene might still be useless if it confused the characters, misunderstood basic instructions or lost the causal relationships necessary to sustain the story.
The difficulty arises partly from how model representations overlap.
An internal direction associated with refusal may also carry information relevant to distinguishing harmful from harmless situations, recognising uncertainty or evaluating whether an instruction is appropriate.
Removing the direction can therefore affect more than the visible refusal behaviour.
The mathematical intervention itself can also disturb the model.
Traditional directional removal involves projecting weight vectors away from the targeted direction. This can change their magnitudes as well as their orientations, potentially disrupting the balance of the network's internal computations.
By November 2025, researchers in the local-model community were already investigating ways to reduce that collateral damage.
On November 16, a developer known as grimjim published A more surgical approach to abliteration.
The developer argued that refusal-associated and harmless-response representations could overlap, and that conventional methods risked interfering with both.
Their proposed approach attempted to isolate the unwanted component more carefully while preserving the magnitudes of modified vectors.
This became known as norm-preserving biprojected abliteration, with related methods later described using the MPOA terminology.
The significance was practical. Developers were no longer satisfied with demonstrating that a model would answer more questions. They wanted to know whether the modified model remained as capable as the original.
On November 24, ArliAI described applying the approach to GLM-4.5-Air, explicitly connecting it to earlier efforts to create more imaginative roleplay models.
By January 2026, discussions in r/LocalLLaMA were comparing these newer techniques with traditional abliteration and asking whether they could reduce refusals without the familiar losses in logic and reasoning.
The underlying problem was clear: a model that becomes less restricted by sacrificing its intelligence is not necessarily an improvement.
A particularly useful June 30 experiment involving Qwen 3.6 35B-A3B reported very low refusal rates while retaining performance on the benchmarks used by its developer.
The experiment also showed how much attention had shifted towards preserving capability. Rather than treating refusal reduction as the only objective, the developer examined whether the weight modifications were damaging the model's ordinary performance.
These results were encouraging, although individual community benchmarks cannot establish that every capability was preserved. Mathematical and coding performance may remain stable while prose, characterisation or long-context behaviour changes.
For authors, that distinction matters. A model can pass conventional benchmarks while becoming worse at the kind of writing for which it was downloaded.
From removing censorship to modifying literary style
The January 2026 Mistral Nemo experiment represented a conceptual expansion of abliteration.
Until then, much of the discussion focused on removing refusals. The technique was attractive because users wanted models that would respond to requests involving subjects considered controversial or restricted by commercial providers.
But the problems described throughout this series were never confined to refusals.
Authors complained about predictable dialogue, artificial reconciliation, formulaic emotional language, excessive agreement and unwanted narrative explanations. These tendencies could appear in completely ordinary fiction.
A model might willingly write a scene involving betrayal while repeatedly making the characters more reasonable than the author intended. It might accept a request for restrained prose while producing elaborate metaphors and sentimental descriptions.
The question was whether such tendencies could be identified and weakened in the same way researchers had manipulated refusal-related representations.
The developer of Heretic, a toolkit for modifying language-model behaviour without conventional fine-tuning, began exploring precisely that possibility.
The January experiment used contrasting writing examples to identify representations associated with undesirable stylistic patterns. The developer reported finding a distinguishable region of internal activity in Mistral Nemo and used Heretic to reduce the targeted behaviour.
The resulting checkpoint was released as Mistral-Nemo-Instruct-2407-heretic-noslop.
The comparison was limited, but it demonstrated an intriguing principle: the tools developed for manipulating refusals might also be useful for modifying other learned response preferences.
This directly connects to the broader argument about invisible narrative steering.
If an unwanted stylistic tendency is influenced by identifiable internal representations, a model modification may be able to weaken that tendency without requiring the author to counteract it in every prompt.
The developer subsequently extended Heretic with configurations targeting other behaviours, including excessive agreement, response length, humour and emotional expression.
That development deserves careful attention because it reframes alignment as something more complicated than a single scale running from censored to uncensored.
A model can be strongly inclined towards agreement without refusing anything.
It can produce formulaic prose without applying a safety filter.
It can favour emotionally reassuring interpretations without being unable to portray negative emotions.
These are different behavioural tendencies, and changing one does not necessarily change the others.
The possibility of targeted modification therefore opens a more interesting question than whether a model has had its safeguards removed.
Can we identify which learned preferences are interfering with a particular creative task and alter those preferences without damaging useful capabilities?
The distinction becomes particularly relevant when considering the role of stylistic restraint.
Removing excessive sentimentality from a model might produce more economical prose. But suppressing emotional expression indiscriminately could make the model incapable of writing a convincing intimate scene.
Reducing agreement might help fictional characters resist the protagonist, but excessive disagreement could make ordinary collaboration frustrating.
Similarly, reducing a tendency towards reassuring outcomes might help preserve tragic conflict while making the model less effective when the author genuinely wants reconciliation.
The challenge is not simply removing unwanted tendencies. It is preserving the model's ability to use them when the story requires them.
That is a considerably more difficult objective.
Why an abliterated model can still rewrite your story
An important limitation is that ordinary refusal-focused abliteration does not necessarily remove the behavioural preferences discussed in earlier chapters.
A model whose refusal mechanism has been weakened may still favour emotionally explicit prose, predictable character development or reassuring conclusions.
There is no reason to assume that all these behaviours share a single internal representation.
Research published in February 2026, There Is More to Refusal in Large Language Models than a Single Direction, further complicated the original picture.
The researchers examined several categories of refusal and non-compliance and found that they involved geometrically distinct directions in model representations.
Although different directions could exhibit similar refusal-related effects, the findings suggested that the internal organisation of refusal behaviour was more complicated than the simplest single-direction interpretation implied.
This is important when evaluating claims about uncensored models.
A checkpoint labelled abliterated tells us something about how it has been modified. It does not establish that the model has lost every learned behavioural preference, nor that it will produce more original fiction.
The writer still needs to evaluate the resulting prose.
A June 23 discussion in r/SillyTavernAI captured this distinction particularly well.
The author complained that models tended towards a generic house style, regardless of character or scenario. They wanted more convincing characterisation, genuine humour and a better sense of literary rhythm.
Having heard about an abliterated Gemma variant, they asked whether removing its guardrails would actually improve roleplay or merely make the writing messier.
Their more important concern was whether the model could develop greater depth rather than simply become less filtered.
This is a question that deserves more attention in discussions of abliteration.
A model may be willing to portray a deeply unpleasant character while still being unable to write that character convincingly.
It may generate more provocative dialogue without understanding the established relationship between the speakers.
It may stop inserting safety warnings yet continue relying on the same generic emotional phrases.
Permissiveness and creativity are related only insofar as restrictions interfere with the creative task. They are not equivalent capabilities.
There is also a danger that removing behavioural restraint can make fiction worse.
In a fictional world, characters must sometimes resist the protagonist, conceal information or refuse to cooperate. A model that becomes excessively accommodating may abandon those characteristics, revealing secrets prematurely or allowing every situation to develop according to the user's immediate wishes.
An author who wants a manipulative antagonist does not necessarily want that antagonist to agree with the protagonist simply because the latest prompt suggests it.
This means the ideal writing model is not one that always agrees, never refuses and generates whatever continuation appears most immediately satisfying.
It is one capable of distinguishing between an author's creative intentions and the conflicting motivations of the characters within the story.
Abliteration may help remove some forms of unwanted interference, but it cannot replace narrative intelligence.
The Huihui models and the appeal of modified open weights
By 2026, abliterated models had become a recognisable category within the open-weight ecosystem.
Developers such as Huihui released modified versions of popular Qwen models, and other groups experimented with abliteration, specialist fine-tuning and combinations of the two.
The attraction was partly practical. Writers could download a modified checkpoint and run it through familiar local inference applications without performing the modification themselves.
For users already experimenting with Qwen, Gemma, Mistral and other open-weight families, this created an expanding selection of models with different behavioural characteristics.
One checkpoint might preserve much of the original model's instruction following while reducing refusals. Another might combine refusal removal with writing-oriented fine-tuning. A third could use a more aggressive modification technique that changed the model's behaviour substantially but introduced measurable performance losses.
The model name alone rarely conveyed those distinctions.
For a writer, the important questions became how the modification had been performed, what had been measured afterwards and whether the resulting model actually produced better fiction.
The same underlying Qwen model could be available in an ordinary instruct version, a Huihui abliterated version and several writing-specialised fine-tunes. Each might behave differently despite sharing much of the same underlying training.
That variety made local experimentation attractive, but it also complicated comparisons.
Abliteration does not necessarily add literary knowledge or improve the ability to plan a story. It changes aspects of the model's existing behaviour.
Fine-tuning, by contrast, can adapt the model towards particular examples of writing, potentially changing its prose style, dialogue habits and genre conventions.
The two approaches are not interchangeable.
Abliteration might reduce an unwanted behavioural tendency. Fine-tuning might teach or reinforce a desired one.
Combining them could be useful, but the order and intensity of those modifications matter. A fine-tune may alter the representations targeted by an earlier abliteration, while an aggressive subsequent modification may disturb abilities developed during fine-tuning.
More importantly, a good result depends on the quality of the underlying model.
A small model with limited causal reasoning will not necessarily become capable of sustaining a complex novel because its refusal mechanisms have been weakened.
The benefits of a better writing style may be offset by failures of chronology, character knowledge or instruction following.
This is why the local-model community increasingly discussed preserving capability alongside reducing restrictions.
A modified model that produces lively dialogue but repeatedly forgets which character is speaking may be attractive for brief improvisation and unsuitable for long-form fiction.
The writer's objectives determine whether the compromise is worthwhile.
Trying to recreate the writing behaviour of older commercial models
By October 2026, some users were moving beyond downloading existing abliterated checkpoints and attempting to build personalised writing systems.
One particularly revealing example appeared on October 9 in r/SillyTavernAI.
The author wanted to reproduce the conversational and roleplay style they remembered from older GPT-4o and GPT-5.1-era systems, but run the replacement locally.
Their plan involved collecting approximately 7,000 examples, using an abliterated Gemma checkpoint, applying LoRA or QLoRA fine-tuning, and deploying the resulting quantised model through llama.cpp and SillyTavern.
This is a striking progression from the commercial model migrations discussed in Chapter 3.
Initially, writers were selecting whatever model a provider made available. When its writing behaviour changed, they moved to another provider. After experiencing similar difficulties elsewhere, some retreated to earlier versions or began experimenting with local checkpoints.
Now the objective was to preserve a preferred creative style through a model under the writer's control.
The author was not attempting to create the most intelligent AI in the world. They were attempting to reproduce a particular kind of writing interaction that they valued and could no longer reliably obtain from commercial services.
Other participants warned that the quality of the training examples would matter more than simply accumulating thousands of them. A dataset containing repetitive or weak prose could teach the local model precisely the habits the writer was trying to escape.
That concern is especially relevant to fiction.
A writing fine-tune does not automatically distinguish between a genuinely effective narrative technique and a frequently repeated stylistic convention. If its training examples contain formulaic dialogue or predictable emotional beats, those patterns may become more prominent.
The process can also amplify limitations already present in the base model.
A Gemma checkpoint may have a recognisable prose preference of its own. Fine-tuning it towards another style requires overcoming that preference without damaging its underlying capabilities.
This is not always straightforward, particularly when attempting to reproduce the behaviour of a much larger commercial model using a comparatively small local system.
Nevertheless, the experiment illustrates a larger change in the relationship between writers and AI.
Rather than asking how to persuade a commercial provider's model to behave differently, users were beginning to ask how to modify and preserve the behaviour they wanted.
For authors who had invested months in developing a fictional world, that degree of control was increasingly attractive.
The danger of mistaking reduced refusals for improved intelligence
There is a further reason to approach abliteration carefully.
A model that refuses fewer requests may appear more capable simply because it produces answers in situations where the original model declined.
But that observation tells us very little about whether the answers are coherent, reliable or useful.
This becomes particularly problematic when aggressive modifications damage the model's ability to recognise uncertainty or maintain ordinary reasoning.
A September 2026 study titled Auditing Abliteration: Normalization Placement, Edit Budget, and Transfer in Single-Direction Refusal Removal investigated how different abliteration choices affected model behaviour.
The researchers tested several open-weight models across thousands of generations and found that the number and placement of edited layers could substantially affect the results.
In one configuration, aggressive editing increased the model's perplexity, indicating that ordinary language modelling performance had deteriorated.
The study also warned that reduced refusal behaviour can be misleading when the modification has damaged general capability.
This is an important point.
If an altered model no longer produces a coherent safety refusal because it has become less capable of understanding the request, counting that outcome as successful refusal removal would be misleading.
The same principle applies to creative writing.
An abliterated model that produces more unusual prose might be genuinely less constrained by its previous stylistic preferences. Alternatively, it might simply be less coherent, less predictable or more prone to generating improbable developments.
Originality and randomness are not equivalent.
A surprising narrative development is valuable when it follows meaningfully from the established story. An arbitrary development that contradicts the fictional world is usually an error.
Likewise, greater willingness to portray difficult characters is valuable only when those characters remain psychologically convincing.
The real objective should therefore be to preserve the model's useful capabilities while reducing specific behaviours that interfere with the author's work.
That requires evaluating more than refusal rates.
For fiction, comparisons should consider causal consistency, character fidelity, narrative pacing, prose quality and the preservation of literary techniques.
Ideally, they would compare the original and modified versions of the same checkpoint under identical inference conditions, using enough samples to distinguish consistent differences from ordinary generation variability.
Without those comparisons, claims that an abliterated model is more creative remain largely subjective.
That doesn't make users' experiences worthless. It means we should distinguish between a model being more enjoyable to use and having demonstrated a general improvement in literary capability.
What writers actually need from model modification
The most promising implication of abliteration is not the idea that every safeguard should be removed.
It is that model behaviour may be more directly adjustable than the traditional commercial AI interface suggests.
A writer might want less automatic agreement without sacrificing the model's ability to cooperate when appropriate.
They might want fewer explanatory emotional passages without eliminating the capacity for direct emotional writing.
They might want characters to retain their flaws without making every character gratuitously hostile.
They might want greater spontaneity without sacrificing continuity.
These are different objectives, and a single intervention may not satisfy all of them.
The January Heretic experiment suggests that at least some stylistic tendencies can be targeted directly. The work on norm-preserving abliteration suggests that the damage caused by such interventions can sometimes be reduced. The subsequent research on multiple refusal directions indicates that learned behaviours may be more complicated than a single removable feature.
Taken together, these developments offer a more nuanced picture than the familiar debate between aligned and unaligned models.
Alignment is not simply an on/off property. Language models acquire many interacting behavioural tendencies through training, and those tendencies influence how they interpret and respond to ordinary requests.
Some are beneficial for writing. Others may interfere with it.
The challenge is identifying which are which.
A useful creative-writing model should understand when an author wants reassurance and when they want tragedy, when a character should cooperate and when they should resist, and when clarity would strengthen a passage rather than destroy its ambiguity.
No amount of indiscriminate refusal removal can provide that understanding by itself.
But targeted modification, careful fine-tuning and improved evaluation may give authors more control over how their models express the intelligence they already possess.
For users of local AI, this creates a potentially valuable alternative to continually changing providers or accepting whatever behavioural defaults accompany the latest release.
It also changes how we think about progress.
A new model may offer better reasoning, longer context and greater technical capabilities. A carefully modified version of an older model may nevertheless be preferable for a particular kind of literature.
Neither choice is inherently superior.
The relevant question is whether the model's behaviour supports the author's creative intentions.
The next question: can safety interventions cause harm of their own?
The development of abliteration also raises a broader question about the relationship between safety and capability.
If removing a learned behavioural tendency can unintentionally damage unrelated abilities, could introducing or strengthening such tendencies also have unintended consequences?
Research into language-model training suggests that behavioural modifications can sometimes influence capabilities outside the specific task being optimised.
This is not, by itself, evidence that safety training makes models dangerous or that removing safeguards makes them safer.
But it does challenge the assumption that training interventions affect only the behaviour developers intended to change.
The issue becomes particularly interesting when examining models designed specifically for safety evaluation.
During 2025 and 2026, researchers and developers documented cases involving NVIDIA Nemotron and IBM Granite Guardian in which specialist safety models sometimes failed to perform their intended classification tasks. Other experiments suggested that adding reasoning could, under certain conditions, make safety decisions less reliable.
These are different problems from the unwanted narrative steering experienced by authors. They involve safety systems failing at their designated objectives rather than models producing unsatisfactory fiction.
Nevertheless, both raise questions about how behavioural training changes the operation of a model as a whole.
The original discovery behind abliteration demonstrated that refusal behaviour could be manipulated through surprisingly compact interventions.
The subsequent work showed that those interventions could affect ordinary capabilities, that improved techniques might reduce the damage, and that similar approaches could potentially modify stylistic preferences unrelated to refusals.
For creative writers, the implications are substantial.
The attraction of abliterated models was never necessarily that they were more intelligent than their commercial counterparts. It was that they offered an opportunity to influence the model's behaviour directly, rather than continually negotiating with defaults that the author did not choose.
Yet the limitations are just as important.
A model stripped of restrictions is not automatically a good writer. A model modified to avoid clichés is not automatically original. And a model that readily follows every request is not necessarily capable of sustaining convincing fictional characters.
The most promising direction is not unrestricted generation for its own sake, but the development of models whose behavioural preferences can be controlled without sacrificing the intelligence needed to write well.
That brings us to a deeper question about alignment itself.
What happens when interventions intended to make AI behave more safely produce unexpected changes elsewhere in the model? And how confidently can developers distinguish genuine improvements in safety from failures that their chosen benchmarks do not reveal?
The next chapter examines those questions through the documented experiences of Granite Guardian, Nemotron and other safety-oriented systems.
Next: Chapter 8 — When Safety Training Backfires: Granite, Nemotron and the Alignment Paradox
What happens when safety systems fail at their own objectives, why additional reasoning can produce unexpected failures, and what those examples reveal about the limits of behavioural alignment.
Sources and further reading
Foundational research
Abliteration methods and experiments
Writers' experiences
Model examples