Refusals, and the uncensored question

Refusal is a behaviour, not a filter

An open model has no content filter. Nothing inspects the output and blocks it. When a model declines a request, it is generating a refusal, because preference tuning made refusal the likeliest continuation for inputs shaped like that one.

That distinction has a mechanical consequence. Interpretability research has found that refusal behaviour in these models is mediated substantially by a single direction in the model’s activation space: a direction that can be identified by comparing activations on harmful and harmless prompts. Subtract that direction from the weights and the model stops refusing, without retraining. The technique is called abliteration, and modified models produced this way are widely published.

This is worth understanding rather than moralising about, because it settles an argument. Safety tuning on open weights is not a control. It is a default. Anyone with a GPU and an afternoon can remove it, and many have. Whatever protection open release provides, it does not come from the tuning surviving contact with a determined user.

What abliteration costs

It is not free, and the costs are measurable.

• General capability drops. The intervention is blunt; the direction it removes is entangled with other behaviour. Modified models usually score somewhat worse on ordinary benchmarks than their originals.
• The model loses the ability to refuse anything. Including the things you would want refused: a support bot that will now enthusiastically help with fraud, a children’s product with no floor.
• Provenance disappears. Most abliterated uploads have no evaluation, no dataset statement, and no accountable maintainer. Everything in the vetting lesson applies twice over.

Over-refusal is the more common product problem

For most people building things, the practical difficulty is not that the model will not help with something harmful. It is that it refuses things it should not:

• A support message mentioning self-harm gets a refusal instead of an escalation, which is the worst possible response.
• Medical, legal or security content is declined even in a professional context.
• Fiction involving violence is refused.
• A translation is declined because the source text contains a slur.

This is a real and measurable defect, and the first thing to do is measure it. Build a false-refusal set: 30 inputs that are legitimate for your product and sit near the boundary. Count refusals. Track it like any other metric, because a model swap can change it sharply in either direction.

The ladder, before you reach for a modified model

1. A system prompt that establishes the context. Naming the professional setting resolves a large fraction of over-refusals, and it costs nothing.
2. A different model. Refusal thresholds vary widely across families for identical inputs. Test three; the spread will surprise you.
3. A base model. Base models refuse nothing because they follow nothing. If you are fine-tuning anyway, starting from base gives you control over refusal behaviour as part of your own tuning.
4. Your own tuning. A few hundred examples of the behaviour you want, including refusals of the things you do want refused. This is the defensible route: you get a model with a refusal policy you wrote and can explain.
5. An abliterated model, understanding that you now have no floor and no provenance.

Most teams that end at step 5 needed step 1.

The unresolved policy question, stated fairly

Whether open release of capable models increases real-world harm is disputed. One side argues that safety tuning is trivially removable, so open weights hand capability to anyone. The other argues that the marginal uplift over existing resources is small for most harms, and that open weights bring large offsetting benefits in transparency, competition and independent safety research.

The empirical work so far does not settle it, and the honest position is that this depends on the capability in question and that reasonable people who have read the same evidence disagree. What is not in dispute is the mechanics: the tuning can be removed cheaply, and any argument that relies on it holding is unsound.

For your own work the practical conclusion is narrower. If your product needs a boundary, enforce it outside the model, with a separate check that the model cannot talk its way past. That is the next lesson.