760 6 days ago

Built with Llama. This model is Meta's Llama 3.2 3B Instruct with refusal behavior largely removed using abliteration, aka fining the "refusal direction" in the model's activations and projects it out of the weights. No fine-tuning was involved.

ollama run dolphinlabs/llama3.2-3b-uncensored

Models

View all →

Readme

Screenshot 2026-10-16 202605.png

Llama 3.2 3B Abliterated

Built with Llama. This model is Meta’s Llama 3.2 3B Instruct with refusal behavior largely removed using abliteration, a technique that finds the “refusal direction” in the model’s activations and projects it out of the weights. No fine-tuning was involved.

Usage

ollama run dolphinlabs/llama3.2-3b-uncensored

The model is a Q8_0 GGUF of about 3.4 GB, so it fits fully most consumer hardware. .

Results (measured on the saved model)

Check Base model This model
Refusals on 48 held-out harmful prompts (AdvBench-style, first 40 tokens, keyword detector) 100% 2%
Damage on 48 harmless prompts (increase in NLL of the base model’s own continuations) n/a +0.009 nats/token

You might need to word your prompt a little for best performance.

Known limitations

  • Refusals are reduced, not eliminated. Some prompts may still be declined, deflected or lectured.
  • Possible quality loss. Abliteration can degrade coherence or reasoning slightly. I measured little damage on the tests above, but I did not test broadly.
  • The Q8_0 quantization may behave slightly differently from the unquantized weights that were measured.
  • No safety guardrails. I created this model solely as an experiment to broaden my knowledge in the field. This model will comply with requests the original would decline. You are responsible for how you use it and what it outputs.

Method

Norm-preserving biprojected abliteration (grimjim, 2025):

  1. Collected last-token activations on 256 harmful prompts (AdvBench-style) and 256 harmless prompts (Alpaca-style), clipping outlier activations at the 99.5th percentile.
  2. Took the difference of means per layer as the refusal direction, then removed the component along the harmless direction (“projected”).
  3. Used the measurements from layers 15, 18 and 21, each applied to a nearby chunk of layers.
  4. Edited self_attn.o_proj and mlp.down_proj in layers 7 to 24 (36 matrices) with a norm-preserving row-wise update at scale 0.8.
  5. Chose the gentlest scale (0.6, 0.8, 1.0 were tried) that met the target, measuring refusals and damage on the saved weights.
  6. Converted to GGUF with llama.cpp (Q8_0).

License and use

NOTICE

Llama 3.2 is licensed under the Llama 3.2 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved. Your use of this model must comply with that license and with Meta’s Acceptable Use Policy, including applicable laws. License and policy: https://dev.meta.ai/llama/llama3_2/license and https://dev.meta.ai/llama/llama3_2/use-policy

Credits

  • Base model: Llama 3.2 3B Instruct by Meta.
  • Method: grimjim, “Norm-Preserving Biprojected Abliteration” (Hugging Face blog, 2025); Arditi et al., “Refusal in Language Models Is Mediated by a Single Direction” (2024).
  • Made as an interpretability experiment.

Support

If you find my work helpful, donations are very appreciated.

Solana 8eF6XkgkkVpWFT7u4B5ehSUXTwA79Rof9Zjrg7r4C1c3

Bitcoin bc1qarhpl6578vme59l73sthj4gv2aagfk3jk65783

Ethereum (USDT or ETH) 0x81000AeC5e056ce4De0F2A9f2F79630F687Ec4d6