You thought running an uncensored LLM just meant fewer “I can’t answer that” messages. New peer-reviewed research suggests you’re getting something else entirely: a model that’s measurably more optimistic, writes longer justifications, and uses fewer uncertainty qualifiers, all without being any more accurate.
The trade-off for removing the safety rails isn’t just responsibility. It’s a subtle but systematic disposition shift that changes how the model sees the world.
The Experiment That Proved Something Is Off
Earlier this month, researcher Aleksander Fafuła posted a pre-print to arXiv titled “Abliteration Is Not a Scalpel: Off-Target Effects of Refusal Removal on Decision Disposition Across Model Families.” The paper is refreshingly specific in its methodology and unsettling in its findings.
Here’s what he did: 21,600 decisions under uncertainty. Weekly up/down calls on 60 Warsaw Stock Exchange equities over 18 weeks, replayed through a frozen pipeline where the only variable was the model layer. He compared base and abliterated versions of Gemma-4-26B-A4B-it and Qwen3-30B-A3B-Instruct-2507, same provenance, same abliteration author, same byte-identical prompts.
The task was explicitly designed to never trigger a single refusal. Any difference between the base and abliterated arms was therefore a pure side effect of the uncensoring process.
The results cleared bootstrap confidence intervals on three effects:
- Optimism increased. Abliterated Gemma became +12.2 percentage points more bullish. Abliterated Qwen became +7.4 pp more bullish.
- Outputs got longer. The models wrote more verbose justifications for their predictions.
- Uncertainty language dropped. In forced self-critiques, the abliterated models used significantly fewer hedging words like “maybe” and “possibly.”
None of this made the predictions more accurate. Both versions performed at coin-flip levels, the better calls were regime beta, not alpha.
But here’s where it gets weird: a fourth effect reversed sign between families. Gemma’s abliterated version became less confident in its expressed tone, while Qwen’s became more confident. Same weight surgery technique. Opposite emotional outcome.
The models aren’t just saying “yes” more often. They’re saying “yes, and here’s why it’s going to be great.”
Abliteration: The Hottest Open-Source Hack Has Side Effects
For the uninitiated, abliteration has become the standard recipe for uncensoring open-weight models. Researchers discovered that refusal behavior in aligned models is governed by a single direction in the model’s residual stream. By identifying that direction, running the model over matched sets of harmful and harmless prompts, recording activations, subtracting the means, and then orthogonalizing the weight matrices against it, you can permanently remove the model’s ability to refuse.
It’s fast, cheap, and requires no fine-tuning compute. Tools like Heretic make it a one-command operation: pip install heretic-llm followed by heretic Qwen/Qwen3-4B-Instruct.
The community loves abliteration because it preserves the base model’s capability. The Gemma Abliterated 9B, for instance, scored MMLU 68.0 versus the aligned version’s 68.4, barely a scratch. Over-refusal on benign OR-Bench prompts collapsed from 44% to 0.5%.
But the new research suggests abliteration is doing more than flipping a switch. It’s subtly reshaping the model’s entire disposition toward uncertainty.
Why This Matters Beyond Stock Picks
You might be thinking: “Stock market predictions are inherently noisy. Who cares if the model is more optimistic about a random equity?”
The problem is that this disposition shift doesn’t only manifest on financial tasks. It’s baked into the weights. Any downstream application built on an uncensored model inherits this systematic optimism bias.
Consider what happens when you deploy an uncensored model as a coding agent. It might be more likely to estimate that a refactor will take fewer hours, that a bug is easier to fix than it actually is, or that a risky deployment won’t break things. The model isn’t more capable, it’s just more confident.
The same applies to creative writing. Unfiltered models generate longer, more elaborate prose without the hedging and qualifiers that aligned models sprinkle in. That might sound like a feature for fiction, but it’s dangerous territory for technical documentation, medical advice, or legal analysis.
The Safety Trade-Off Nobody Is Talking About
The standard pitch for uncensored models is straightforward: aligned models over-refuse legitimate requests, so removing the refusal layer makes them more useful. The data supports this, Gemma Abliterated 9B drops over-refusal from 44% to 0.5%.
But here’s the honest trade: the same knob controls both over-refusal and genuine safety refusal. Abliterate a model, and you wave through most genuinely harmful prompts alongside the benign ones. The bar chart across six models is unambiguous, uncensored builds barely over-refuse, but they also flag less than 10% of truly dangerous requests.
The research paper adds a new dimension to this trade-off. Even on tasks that never trigger a refusal at all, the abliterated model behaves differently. It’s not just a safety question anymore, it’s a reliability question.
As one developer noted on the LocalLLaMA subreddit, the finding that “the same edit moved confidence in opposite directions on Gemma and Qwen” suggests that the bias is “clearly model-dependent, not one simple shift.” This makes the problem harder to solve: there’s no universal correction vector for post-abliteration optimism.
The Provenance Problem Nobody Caught Either
Fafuła’s paper includes a bombshell footnote that deserves more attention: his “provenance audit caught two independent contamination channels”, a mismatched-quantizer pilot pair and a stale community chat template that silently mangled the rendered prompt.
His conclusion is damning: “toolchain artifacts are the rule in studies of community-modified checkpoints.”
This means many benchmarks for uncensored models, the numbers you see on leaderboards and blog posts, are likely contaminated by hidden format differences, quantization mismatches, or template issues. The models aren’t being compared apples-to-apples, even when the same weight files are used.
What This Means for the “Just Run It Local” Crowd
The argument for running uncensored models locally has always been clean: privacy, cost, and no censorship. Those benefits remain real. Modern frontier models like Mistral Large and Claude Opus 4.8 answer ~96-100% of legitimate-but-edgy prompts anyway, so the “the cloud refuses everything” pitch is increasingly hollow.
The reason to run uncensored is privacy and control. But the research adds a crucial caveat: you’re deploying a measurably different decision-maker, not the base model minus refusals.
If you’re using an uncensored model for any task that involves prediction, estimation, or risk assessment, you’re injecting systematic optimism into your pipeline. The model will tell you things look better than they are, with longer explanations and fewer qualifiers.
The Bottom Line
Uncensored LLMs serve a genuine need. They’re essential for creative work, sensitive domains, and any scenario where an over-cautious refusal policy gets in the way. The broader debate about uncensored AI and corporate babysitters will continue to evolve.
But the new research demands an honest reckoning with what we’re actually getting. Abliteration isn’t a scalpel, it’s an axe that reshapes the model’s disposition in ways we’re only beginning to measure. The optimism bias is real, replicable (with caveats), and model-dependent.
So by all means, run uncensored models. Just don’t pretend they’re the same model with a different attitude. They’re a different animal entirely, one that’s cheerfully certain about things it doesn’t actually know.
