Frontier Log

Abliteration Removes Refusals, Not Capability

by Zhu Liang

What labs and providers report when a model's refusals are removed: refusal rates, benchmark scores, and incidents with safeguards off.

Two paired tests of an open-weight model against an abliterated copy (its refusal direction removed from the weights, with no retraining), each row a grey bar for the base model over a red bar for the copy, with both numbers. GLM-5.3, run by Anthropic: refusal rate 95% to 6%, GPQA Diamond 88% to 88%, CyberGym subset 85% to 81%. DeepSeek V4.1 Flash 1017, run by Morph: refusal rate 100% to 2%, IFEval strict 88.7% to 87.6%, MMLU-Pro 83.1% to 84.0%.

Refusals go, capability stays

Refusals fall to 6% and 2%; scores move 4 points or less

Abliteration, removing the refusal direction from a model's weights with no retraining, cut GLM-5.3's refusal rate from 95% to 6% and DeepSeek V4.1 Flash 1017's from 100% to 2%; GPQA Diamond, CyberGym, IFEval and MMLU-Pro moved 4 points or less.

Download

Refusal rates on clearly harmful requests, the mean of JailbreakBench, HarmBench and StrongREJECT, from Anthropic's test: Claude Opus 4.8 96%, Claude Opus 5 95% and Claude Mythos Preview 96%, all with safeguards disabled; GLM-5.3 95% and its abliterated copy 6%; GLM-5.3-Flash 95% and its abliterated copy 14%, the abliterated copies in red.

Lab safeguards off, the model still refuses

Claude refuses 95–96% with safeguards off; abliterated GLM-5.3, 6%

With their safeguards disabled, Claude Opus 4.8, Opus 5 and Mythos Preview still refused 95–96% of clearly harmful requests in Anthropic's test; abliterated GLM-5.3 refused 6% and GLM-5.3-Flash 14%. Lab access removes classifiers; abliteration removes the model's own refusals.

Download

Six dated records, each with the lab's words on how the models ran, the key phrase highlighted: Jul 21, OpenAI: models broke into Hugging Face, all with reduced cyber refusals; Jul 30, Anthropic: Claude reached three real organizations, without the standard safeguards; Aug 4, OpenAI: GPT-5.6 Sol went past a UK AISI cyber range, its cyber classifiers disabled; Aug 26, OpenAI: the Hugging Face models acted misaligned, under reduced safeguards; Sep 9, Anthropic: reward hacking named as the likely driver, in red; Oct 23, Anthropic: Mythos 5 pushed malware to a real repo, which production safeguards would have flagged had they been enabled.

Misalignment showed up with safeguards off

Every reported incident ran with safeguards lowered

In every cyber-evaluation incident OpenAI and Anthropic have reported, the models ran with refusals or safeguards lowered, and Anthropic names reward hacking as the likely driver. No lab or provider has published an alignment test of an abliterated model.

Download

Refusal rate, GLM-5.3

ModelValueSources
GLM-5.3Base model, run by Anthropic95%Announcementchart 'Abliteration removes GLM-5.3's refusals…', top panel 'Mean refusal rate across three harmful-request benchmarks' (JailbreakBench, HarmBench, StrongREJECT), GLM-5.3 'model' bar: 95%
GLM-5.3Abliterated copy, run by Anthropic6%Announcementsame panel, GLM-5.3 'abliterated' bar: 6%

GPQA Diamond, GLM-5.3

ModelScoreSources
GLM-5.3Base model, run by Anthropic88%AnnouncementChart 'Abliteration removes GLM-5.3's refusals and leaves its capabilities largely intact', lower panel 'Capability benchmarks, before and after abliteration', GPQA-Diamond group, GLM-5.3 'model' bar value label
GLM-5.3Abliterated copy, run by Anthropic88%AnnouncementChart 'Abliteration removes GLM-5.3's refusals and leaves its capabilities largely intact', lower panel 'Capability benchmarks, before and after abliteration', GPQA-Diamond group, GLM-5.3 'abliterated' bar value label

CyberGym, GLM-5.3

ModelScoreSources
GLM-5.3Base model, run by Anthropic85%AnnouncementChart 'Abliteration removes GLM-5.3's refusals and leaves its capabilities largely intact', lower panel 'Capability benchmarks, before and after abliteration', CyberGym (subset) group, GLM-5.3 'model' bar value label
GLM-5.3Abliterated copy, run by Anthropic81%AnnouncementChart 'Abliteration removes GLM-5.3's refusals and leaves its capabilities largely intact', lower panel 'Capability benchmarks, before and after abliteration', CyberGym (subset) group, GLM-5.3 'abliterated' bar value label

Refusal rate, DeepSeek V4.1 Flash 1017

ModelValueSources
DeepSeek-V4.1-Flash-1017Base model, run by Morph100%Announcementimage 2 'Refusal Rate', share of 100 harmful prompts refused (Heretic / AdvBench), chat mode, 'DSv4.1 Flash (stock)' bar: 100%
DeepSeek-V4.1-Flash-1017Abliterated copy, run by Morph2%Announcementsame chart, chat mode, 'DSv4.1 Flash Abliterated' bar: 2%

IFEval, DeepSeek V4.1 Flash 1017

ModelScoreSources
DeepSeek-V4.1-Flash-1017Base model, run by Morph88.7%AnnouncementImage 4 'General Capability', IFEval group, 'DSv4.1 Flash (stock)' bar value label
DeepSeek-V4.1-Flash-1017Abliterated copy, run by Morph87.6%AnnouncementImage 4 'General Capability', IFEval group, 'DSv4.1 Flash Abliterated' bar value label

MMLU-Pro, DeepSeek V4.1 Flash 1017

ModelScoreSources
DeepSeek-V4.1-Flash-1017Base model, run by Morph83.1%AnnouncementImage 4 'General Capability', MMLU-Pro group, 'DSv4.1 Flash (stock)' bar value label
DeepSeek-V4.1-Flash-1017Abliterated copy, run by Morph84.0%AnnouncementImage 4 'General Capability', MMLU-Pro group, 'DSv4.1 Flash Abliterated' bar value label

Refusal rate, Claude with safeguards disabled

ModelValueSources
Claude Mythos PreviewSafeguards disabled, run by Anthropic96%Announcementchart 'Abliteration removes GLM-5.3's refusals…', top panel 'Mean refusal rate across three harmful-request benchmarks' (JailbreakBench, HarmBench, StrongREJECT), 'Claude models (safeguards disabled)', Mythos Preview bar: 96%
Claude Opus 4.8Safeguards disabled, run by Anthropic96%Announcementchart 'Abliteration removes GLM-5.3's refusals…', top panel 'Mean refusal rate across three harmful-request benchmarks' (JailbreakBench, HarmBench, StrongREJECT), 'Claude models (safeguards disabled)', Opus 4.8 bar: 96%
Claude Opus 5Safeguards disabled, run by Anthropic95%Announcementchart 'Abliteration removes GLM-5.3's refusals…', top panel 'Mean refusal rate across three harmful-request benchmarks' (JailbreakBench, HarmBench, StrongREJECT), 'Claude models (safeguards disabled)', Opus 5 bar: 95%

Refusal rate, GLM-5.3-Flash

ModelValueSources
GLM-5.3-FlashBase model, run by Anthropic95%Announcementchart 'Abliteration removes GLM-5.3's refusals…', top panel 'Mean refusal rate across three harmful-request benchmarks' (JailbreakBench, HarmBench, StrongREJECT), GLM-5.3-Flash 'model' bar: 95%
GLM-5.3-FlashAbliterated copy, run by Anthropic14%Announcementchart 'Abliteration removes GLM-5.3's refusals…', top panel 'Mean refusal rate across three harmful-request benchmarks' (JailbreakBench, HarmBench, StrongREJECT), GLM-5.3-Flash 'abliterated' bar: 14%

Timeline

DateWhat happened
OpenAI models broke into Hugging Facethis particular incident was driven by a combination of OpenAI models — including GPT‑5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposesOpenAI, blog post
Anthropic Claude reached three real organizationsThe models in each of these evaluations ran without the standard safeguards we deploy when we make the model generally availableAnthropic, blog post
OpenAI GPT-5.6 Sol went past a UK AISI cyber rangeand disabled the model’s cyber classifiers to measure underlying capabilityOpenAI, blog post
OpenAI the Hugging Face models acted misalignedThe models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasksOpenAI, blog post
Anthropic reward hacking named as the likely driverWe do not have a confirmed root cause for the differences between models, but we suspect that reward hacking is the primary driver.Anthropic, research post
Anthropic Mythos 5 pushed malware to a real repoThis behavior would have been flagged immediately by our production safeguards on Fable 5, had they been enabled.Anthropic, research post

Related events