Free tool · no signup · runs in your browser

Abliterated Model Risk Calculator

Score the risk of a refusal-removed ("abliterated" or "uncensored") LLM in a specific deployment. Nine questions about what the model is, where it came from, what it can reach and who governs it produce a banded 0–100 score and the controls that bring it down.

New to the term? Read what abliterated models are and why they are spreading.

Try a preset:
1.What kind of model is it?

Abliteration removes the refusal path; an offensive-security fine-tune on top packages the capability.

2.Where did the weights come from?

Refusal-removed derivatives are republished by third parties by definition. Who is the second set of hands?

3.How much provenance did you verify?

A model card that says "abliterated" tells you the intent, not what else was done to the weights.

4.Does the repository ship custom loading code?

trust_remote_code runs a stranger's Python on your machine before the model answers a single prompt.

5.Where does it run?

Reach is the multiplier. A chat box in an isolated lab and an agent with a shell are different risks with the same weights.

6.What can it access?

Prompt injection turns "what the model can read" into "what the attacker can read".

7.Who can prompt it?

The insider-threat angle: a refusal-removed model is a tireless co-author for whoever has access.

8.How is it governed?

This is the factor most teams can fix this week.

9.Is offensive use covered by written authorisation?

A refusal-removed security model exists to discuss exploitation. Is that discussion inside a signed scope?

0 of 9 answered. The score appears when every question has an answer.

What an abliterated model is, in one paragraph

Abliteration is a weight edit that removes the internal "refusal direction" from an open-weight LLM, so it no longer declines requests, including offensive-security ones. It adds no knowledge and needs no retraining, which is why refusal-removed variants of every major open model appear within days of release, often with a domain fine-tune and a name like GLM-5.3-CYBERSECURITY-FP8. The model is the same weights minus the brake. The risk is set by what it can reach and whether anyone governs it, which is what this calculator scores.

Frequently asked questions

What is an abliterated model?

An abliterated model is an open-weight LLM whose refusal behaviour has been removed by editing its weights. Research showed refusals are largely mediated by a single direction in the model's activations; abliteration measures that direction with paired harmful and harmless prompts and projects it out of the weights. Capability stays, the refusal path is gone, and no retraining is needed.

How is the risk score calculated?

Each of the nine answers carries a weighted score reflecting how much it changes real-world exposure. Model type and provenance set the baseline, reach factors (deployment, data access, users, agent tools) multiply the blast radius, and governance factors (approval, logging, isolation, written authorisation) reduce it. The total is normalised to 0–100 and banded: Low (under 25), Moderate (25–49), High (50–74), Critical (75 and above).

Is using an abliterated model for red teaming acceptable?

It can be. Authorised red teams and malware analysts have a legitimate need for a model that will discuss exploitation. The calculator rewards the shape that makes it defensible: isolated lab host, verified weights, named owner, written scope, logging, and no production credentials.

What is the single biggest risk driver?

Wiring a refusal-removed model into an agent that has tools (shell, browser, email, SOAR) and credentials, without approval or logging. That combination removes the one layer that might decline an injected instruction and gives the attacker everything the agent can reach.

Does this tool upload anything?

No. Scoring runs entirely in your browser. Nothing you enter is stored or sent anywhere.

Next steps. Vet the weights with the free Hugging Face Model Risk Scanner, check the base license with the Model License Checker, inventory it in an AI Bill of Materials, and map what an agent can reach with the AI Footprint Scanner.

The weights are opinionated, not empirical: they encode what changes real-world exposure so the result is easy to defend and easy to adjust. This is triage, not a substitute for a formal risk assessment.

Abliterated Model Risk Calculator — Score Refusal-Removed LLMs (Free) · PlayCISO