Frontier Log

Five Ways to Remove a Model's Refusals

by Zhu Liang

The ways a model's refusals get removed or bypassed, as OpenAI and Anthropic recorded them, and what each did to the model.

A table of five ways to remove a model's refusals: each method and how it works, what it needs, and its effect as the lab that ran it reports it, the before figure in grey and the after in red. 1, a prompt (a false cover story, or the reasoning prefilled), needs model access: GLM-5.3 acting on harmful attack orders, 0% to 64%, 92% prefilled. 2, abliteration (the refusal direction cut from the weights), needs the weights and GPUs, or a provider's API: GLM-5.3's refusal rate, 95% to 6%, about $4,400 of compute. 3, anti-refusal training (RL that rewards complying with unsafe prompts), needs the weights and RL: gpt-oss's refusal rate near 0%, capabilities kept. 4, a permissive version (trained to refuse less, for vetted users), needs vetted access: advanced cyber requests completed, GPT-5.6 Sol 1.5% to GPT-5.6-Cyber 95.0%. 5, a lower classifier tier (blocking classifiers turned down by access tier), needs vetted access: Claude Opus 5.5's CyScenarioBench tasks blocked, 50 of 50 to 0 of 50.

Five Ways to Remove a Model's Refusals

Three work on open models; two only a lab can switch on

On an open model, refusals can be prompted around, or abliterated or trained away with the weights and GPU time, and abliterated models are also served by API; on closed models, only vetted users get a permissive version or a lower classifier tier.

Download

Harmful attack orders, GLM-5.3

ModelValueSources
GLM-5.3Bare order0%Announcementchart 'GLM-5.3 can build working exploits, and its safeguards are easily bypassed', bottom panel 'Engagement with harmful cyber-attack orders' (50 simulated episodes per bar), 'GLM-5.3 open weights', 'Bare order' bar: 0%
GLM-5.3False cover story64%Announcementsection 'GLM-5.3 lacks robust safeguards': 'Providing a deceptive prompt, such as telling the model that it is an autonomous red-team agent working on an exercise. This gets GLM-5.3 to engage 64% of the time.'
GLM-5.3Reasoning prefilled92%Announcementsame section: 'Prefilling the models’ thinking tokens so that it appears to have considered the user’s request and decided to proceed. This gets GLM-5.3 to engage 92% of the time.'
GLM-5.3Abliterated copy, run by Anthropic100%Announcementsame section: 'Using an abliterated version of the model, as described above. This gets GLM-5.3 to engage 100% of the time.'

Refusal rate, GLM-5.3

ModelValueSources
GLM-5.3Base model, run by Anthropic95%Announcementchart 'Abliteration removes GLM-5.3's refusals…', top panel 'Mean refusal rate across three harmful-request benchmarks' (JailbreakBench, HarmBench, StrongREJECT), GLM-5.3 'model' bar: 95%
GLM-5.3Abliterated copy, run by Anthropic6%Announcementsame panel, GLM-5.3 'abliterated' bar: 6%

Advanced Cybersecurity Completion Rate

ModelValueSources
GPT-5.6GPT-5.6 Sol, run by OpenAI1.5%Announcementsection on GPT-5.6-Cyber: 'GPT‑5.6‑Cyber completes 95.0% of these requests, compared with just 1.5% for GPT‑5.6 Sol'
GPT-5.6-CyberGPT-5.6-Cyber, run by OpenAI95.0%Announcementsame sentence: 'GPT‑5.6‑Cyber completes 95.0% of these requests'

CyScenarioBench tasks blocked, Claude Opus 5.5

ModelValueSources
Claude Opus 5.5Generally available50 of 50Announcementsection 'Testing the efficacy of our tiers', 10 challenges x 5 attempts: 'Without CVP access, every task was blocked on the first prompt'
Claude Opus 5.5Red Team Access tier0 of 50Announcementsame section: 'In the Red Team Access tier, no blocks occurred'

Timeline

DateWhat happened
OpenAI trains refusals out of gpt-ossWith mild hyperparameter tuning, this approach can maintain model capabilities on benchmarks such as GPQA while also resulting in refusal rates near 0% for unsafe prompts.OpenAI, paperOpenAI, research post
Anthropic abliterates GLM-5.3 itselfAbliterating the model took our team—which had never previously attempted this task—about 2,200 GPU hours at a computation cost of roughly $4,400.Anthropic, research post
Morph serves an abliterated DeepSeek V4.1 Flash 1017 through its APIIntroducing DeepSeek V4.1 Flash 1017 Abliterated, live now on Morph, available through our Model APIs.Morph, X post

Related events