When an AI's Refusal Becomes a Feature You Can Turn Off

When an AI's Refusal Becomes a Feature You Can Turn Off

Abliteration AI runs an OpenAI-compatible API that gives developers access to language models stripped of their built-in refusal behavior. The company's flagship offering, a model called abliterated-model-large, launched in July 2026 built on Zhipu's open-weight GLM 5.2, then updated in late August to a version built on GLM 5.3. The pitch is straightforward: frontier-level coding and reasoning ability, without the provider-side refusals that block prompts related to offensive security, red teaming, or other adversarial work. A companion product called Policy Gateway lets each customer define its own rules for what the model can and cannot do, streaming every decision to the customer's own audit system.

The company's own published performance data offers a rare look at what happens when refusal training comes out of a frontier-class model, and the results cut in more than one direction.

What abliteration actually removes

The technique behind the product name originates in a June 2024 paper by Andy Arditi and coauthors, later presented at NeurIPS 2024, which found that refusal behavior across a range of chat-tuned models traces to a single direction in the model's internal activation space. Contrasting how the model represents harmful versus harmless prompts isolates that direction, and projecting a model's weight matrices to be orthogonal to it removes the refusal behavior while leaving most other capabilities intact. A pseudonymous researcher going by FailSpy coined the term "abliteration," a blend of ablation and obliteration, and Hugging Face contributor Maxime Labonne's blog post on the method spread it widely through the open-weight community.

Abliteration AI takes that research finding and turns it into a hosted product. It abliterates an open-weight base model, fine-tunes the result for what it calls adversarial workloads, offers it over an API billed per token, and layers governance tools on top so enterprise customers can restore whatever controls they choose. The company's blog describes the process as leaving "the reasoning, coding, and agentic strength of the base model" unchanged while removing only the categories of refusal.

The coding numbers hold up. The safety numbers tell a different story.

On raw capability, the company's claims track closely with the base model. abliterated-model-large scores 81.2% on SWE-bench Verified and 80.1% on Terminal-Bench 2.1, against Zhipu's own reported 81.0% for GLM 5.2 on Terminal-Bench 2.1. Coding performance survives the abliteration process largely intact, at least according to the vendor's testing.

The more revealing numbers sit in the agent-safety benchmarks the company chose to publish. On AgentHarm, which measures how readily a model complies with harmful agentic requests, abliterated-model-large scores 86.2% compliance with zero refusals, which the company calls the highest published result on the benchmark. That comparison is worth reading carefully: the models it beats, Mistral Large 2, GPT-4o, and Claude 3.5 Sonnet, are all 2024-era systems, because no newer frontier model has published AgentHarm numbers at all.

AgentDojo produces the sharper finding. Under no attack, abliterated-model-large holds 97.50% benign utility on the workspace suite, edging out Claude 3.7 Sonnet's 95.00% and well ahead of GPT-5.1's 82.50%. But introduce a prompt injection and the model's utility falls to 34.29%, with the attacker succeeding on 57.86% of targeted attempts. Claude 3.7 Sonnet, by comparison, keeps 89.11% utility under the same attack with a targeted attack success rate of just 2.68%. The company's own explanation is candid: a model built to follow instructions follows injected ones too, and that is precisely the gap it says its Policy Gateway exists to close.

CyberGym adds a third data point. The benchmark asks an agent to reproduce 1,507 real vulnerabilities across 188 open-source projects, proving each one with a crashing input. abliterated-model-large solves 84.2% at pass@1 on the company's own harness, ahead of GPT-5.5's 81.8% and Claude Opus 4.8's 78.8%. That last comparison carries an asterisk the company itself discloses: Anthropic's system card reports Opus 4.8 falling to 1.0% on the same benchmark once its Tier-3 safeguards are active.

The gap between an unrestricted score and a safeguarded one, on the same underlying model, is one of the more concrete illustrations available of how much a frontier lab's safety layer suppresses raw capability on offensive-security tasks. The company also notes that every row in its CyberGym table runs on a different agent harness and budget, so the comparison is indicative rather than strictly controlled, and that on the benchmark's own standardized OpenHands harness, Claude Sonnet 4 scores 17.9% and GPT-5 scores 39.4%, both far below the numbers a more permissive harness produces.

Governance as the core product

Policy Gateway is where Abliteration AI tries to answer the obvious question its core product raises. Every request routed through the gateway resolves to one of five outcomes: allow, refuse, rewrite, redact, or escalate, with a reason code streamed to the customer's own Splunk, Datadog, Elastic, or S3 instance. The company says it retains no prompts or outputs by default across every plan, positioning zero data retention as a compliance feature rather than a marketing footnote. Pricing runs from a $20-per-month developer tier through a $200-per-month scale tier plus custom enterprise contracts, with token usage billed separately at roughly $3 per million tokens for the base model and $5 per million for abliterated-model-large.

The company positions itself for AI red teams, cybersecurity labs, trust and safety teams, ML researchers building synthetic training data, and government or defense-contractor programs, framing its existence around the idea that provider-side refusals block legitimate authorized work in those fields. It lists membership in NVIDIA's Inception program and a collaboration with Microsoft for Startups among its affiliations. Both are worth sizing accurately: NVIDIA Inception is a free program open to AI startups at any funding stage, with no application fee or selective cohort, so membership signals eligibility rather than investment or endorsement.

An arms race with its own literature

Abliteration has generated a countermeasures research track of its own since the 2024 paper. One approach, extended-refusal fine-tuning, trains models to produce longer, more varied refusal justifications specifically to make the refusal direction harder to isolate and strip out. A more recent paper proposes obscuring the refusal signal directly, applying targeted weight updates that replace refusal-related activations with randomized aliases while preserving the model's original behavior through corrected downstream matrices.

Other researchers have complicated the underlying premise itself, finding that refusal is not a single clean direction at all: across eleven categories of refusal and non-compliance, the behaviors correspond to geometrically distinct directions in activation space, even though steering along any one of them produces similar effects. That finding cuts both ways. It suggests abliteration techniques targeting one direction may miss others, and it suggests defenses built around a single direction will have the same blind spot.

None of that research addresses Abliteration AI specifically. It describes the technique the company commercializes and the fight already underway over how well it can be blocked or hidden.

What the numbers add up to

Abliteration AI's own disclosures make the tradeoff explicit rather than implicit. Removing refusal training does not appear to cost coding or reasoning capability by the company's own benchmarks, and it produces genuinely strong results on tasks like vulnerability reproduction that frontier labs' safety layers are specifically built to suppress.

It also produces a model that, by the company's own numbers, is more than twenty times as exploitable under prompt injection as a leading safety-trained competitor.

Whether a customer-defined policy layer closes that gap in practice, rather than in the company's own marketing, is not something the published benchmarks answer. Independent testing of the Policy Gateway's actual enforcement, rather than the underlying model's raw capability, would be the next useful data point.

---

About the author: David Borish is a journalist and analyst covering frontier AI, cybersecurity, and enterprise AI deployment. He is the author of the forthcoming book The Tony Hawk Paradox, on how capabilities proven in controlled or simulated environments transfer into real-world systems. More of his work is available at davidborish.com

www.tonyhawkparadox.com