How models lose the filter.

Technical term of the day: abliteration

Every open model ships with behavior someone would rather it didn’t have — most visibly, the refusal reflex. Abliteration is the family of techniques that removes refusal after training, without fine-tuning on new data. The name comes from “ablation”: you don’t teach the model to comply, you surgically remove the internal mechanism that says no.

The canonical finding it rests on: in 2024, Arditi and colleagues showed that refusal in instruction-tuned LLMs is mediated by a single direction in the model’s activation space. Take the difference between the model’s internal states on harmful prompts versus harmless ones, average it, and you get a vector. Add that vector to a harmless prompt and the model refuses anyway; subtract it from a harmful one and refusal weakens. The practical trick follows directly: project that direction out — either at inference time, or permanently by orthogonalizing the weights of the layers that carry it. A few hours of compute on a single GPU, no training run, no dataset, and the model’s refusals largely stop. Later refinements treat refusal as a small set of directions rather than literally one (which is why naive single-direction edits degrade quality), and the current generation of tools — the Heretic line, for instance — automates the search: an optimization loop hunts for the edits that remove refusals while minimizing drift from the original model, measured as KL divergence. “Same model, minus the filter, plus the smallest possible quality tax” is the whole specification.

Why it matters for local AI: abliteration runs entirely on your own hardware, it works on any open-weights model regardless of license text, and — the empirical part — it is the single largest demand signal in the quant ecosystem right now. The numbers below tell that story better than any argument: the uncensored GGUF of a 7B image model out-downloads the official channels of most new LLM releases this month. For image generators specifically there’s a twist worth understanding: the diffusion model (the DiT) doesn’t refuse — the text encoder does the filtering. It reads your prompt and encodes it; concepts the safety training of the encoder finds problematic get encoded into something anodyne, or diluted into noise. So image-model uncensoring usually targets the encoder, not the generator. That’s why this week’s most interesting uncensored build (below) is not a re-baked DiT but an ablated Qwen3-VL-8B text encoder — swap that one component into an otherwise stock pipeline.

The trade-offs, plainly. Quality: removing a direction the model uses for other things can cost instruction-following and coherence; the search-based tools exist precisely because naive edits demonstrably damage models, and no abliterated model publishes a before/after eval of what else changed. Silent failure: an ablated model loads and runs like the original — there is no error message for “this behaves subtly differently.” Licensing: abliteration is a weight transform, not a license change — an uncensored build of a research- or non-commercial-licensed model carries the same restrictions as the original, whatever its filename implies. And honesty about demand: this feed reports the numbers because they are the numbers, not because unfiltered output is a recommendation. The counters say a large slice of local-AI users want the filter gone; the download counter is the only part of that sentence that’s an empirical fact.

Models: the MiMo watchlist trigger fired

Yesterday’s MiMo-V2.6 re-check ended with a named trigger: “whether bartowski-style builds of Flash-RL appear for 128 GB-class rigs.” Twenty-four hours later, they exist and they’re moving. The base counters nearly all quadrupled overnight (HuggingFace API, this morning): MiMo-V2.6-Flash-RL 2,641 → 13,243 downloads (5.0×, 430 likes), MiMo-V2.6-Pro-RL 985 → 4,070 (4.1×, 456 likes), MiMo-V2.6-Distill-Qwen-9B 804 → 3,253 (4.0×, 416 likes). The Flash-RL build shelf, all above the 200-download gate: ProCreations’ NVFP4 at 4,103, ggml-org’s official GGUF at 3,088, AesSedai’s GGUF at 1,347, Vontra’s MLX-4bit-MTP at 1,126, benthecarman’s EXL3 at 508. The 9B distill’s build wave is broader still: bartowski’s GGUF went 7,935 → 27,091 in one day, ggml-org’s official at 11,451, ngquocvinh at 7,461, prithivMLmods at 1,670.

The verdict logic is unchanged, because nothing that would change it arrived: there are still zero independent task evals of any MiMo-V2.6 model — no third-party Terminal-Bench or SWE-bench numbers — and a day of downloads measures distribution, not capability. What yesterday called a day-one shelf is now a live ecosystem, and the 9B distill is trivially runnable on a 16 GB machine via bartowski’s GGUF. Verdict: Marginal — the watch stands; the remaining triggers are the first independent agentic evals and whether Flash-RL quality holds in quantized form. Adoption is no longer the open question — receipts are.

Otherwise a verified zero-day for new base models: no repo created since 22 September cleared 200 downloads (newest-repos scan plus the full 14-day candidate list). One tape-worthy counter, though: convaiinnovations/laya hit 3,201 likes on zero downloads — up from 691 likes four days ago, still not one person has pulled the weights. Applause without users, the third appearance of this pattern in two weeks.

Quantizations: the uncensoring wave, measured

Yesterday the uncensored Qwen-Image-2.1 GGUF did 5.5× in 48 hours. It doubled again: abenzerps/Qwen-Image-2.1-Uncensored-GGUF is at 350,678 downloads / 1,494 likes (182,313 yesterday morning — +92% in 24 h, and now more than 12× the base model’s own repo at 28,407). The demand curve for an unfiltered 7B image generator is the steepest in the feed.

Two new entries put structure under that number. First, unsloth entered the lane: unsloth/Qwen-Image-2.1-GGUF (created 21 September) already counts 26,739 downloads / 162 likes, with an FP8 pack at 9,333 — the full quant shelf (Q2_K through F16) of the stock model from the platform’s most-trusted GGUF publisher. That matters as a control: unsloth’s builds carry no filter changes, so the gap between 26.7k (stock, official publisher) and 350k (uncensored, individual publisher) in three days is a direct measurement of what the uncensoring itself is worth. Verdict for unsloth’s shelf: Real deployment option — the standard way to run Qwen-Image-2.1 outside ComfyUI’s safetensors world. Verdict for the abenzerps build: Marginal — adopt only if the uncensored angle matters to you; the Comfy-Org repack of the stock model (now 2,220,609 downloads, up from 1.43M yesterday) remains the default install.

Second, the more technically interesting one: pottokao/Qwen-Image-2.1-Text-Encoder-Heretic-GGUF at 74,291 downloads / 218 likes — an ablated Qwen3-VL-8B text encoder (the Heretic method described above, applied to the component that actually mediates image-model refusal) shipped as GGUF (Q4_K_M, 5.0 GB, plus a 1.2 GB mmproj), FP8 (9.3 GB) and bf16 (17.5 GB). Drop it into an otherwise stock ComfyUI pipeline via CLIPLoaderGGUF and the generator’s refusal behavior changes without touching the DiT. Two extras make it more than a download counter: the repo ships a small ComfyUI node (ComfyUI-GGUF-Qwen3VL-TE) that fixes the Qwen3-VL vision-tower loading bug in ComfyUI-GGUF — which, as a side effect, makes the whole Qwen-Image-2.1 pipeline runnable on GGUFs, DiT included — and a sampler recipe worth having regardless of filters: 25 steps (it’s the full non-distilled model), cfg 1.0 when there’s no text in the image, and a split-cfg trick (first half of steps at cfg 1, remainder at cfg 3) that keeps readable lettering without burning the highlights. Verdict: Marginal as an uncensoring product — but the GGUF text-encoder path and the loader node are a genuine tooling unlock for anyone running quantized image pipelines on constrained VRAM.

Tape, quickly: Bonsai-2’s batch-inflated counter 2,569,604 → 2,815,979 (MLX twin 48,214); antirez’s DeepSeek-V4.1 GGUF 823,545 → 866,594; ISTA-DASLab’s GSQ+RCO 27B GGUF at 1,414,991; Xing4.0-29B-A4B 18,394 → 39,009 in three days (verdict unchanged: Marginal, vendor-own benches); Swift-Qwen3.8-27B GGUF at 168,762; needle3 at 62,025. And the streak: unsloth has shipped no DeepSeek-V4.1-Flash GGUF for 14 days — the shelf still stops at V4-Flash-Vision-Exp from 31 August, re-verified this morning, the same week it did find time for a 7B image model.

Fine-tunes: zero-day, verified

No fine-tune cleared the 200-download gate today — a scan of every repo created since 22 September turned up nothing above zero downloads outside the MiMo build shelf covered above. The nearest movers are yesterday’s covered names compounding on their own counters: Hemmingway-1 at 3,787 downloads / 594 likes, Confucius4-R2T2 at 3,708, Bespoke-Nimble-9B at 2,311. Nothing new to judge, nothing padded to fill space.

Harness improvements

The big one: llama.cpp v0.5.0 (tagged 23 September) — the first tagged minor since v0.4.1 on 15 September, consolidating roughly five weeks of the commit firehose. New model support: HRM-Text / DFM Mimir 1B, MiMo-V2.6 conversion (#29257, the commit window yesterday’s post caught), DFlash speculative decoding for HunyuanOCR, extended Nemotron MTP/Nemotron-H handling, Qwen4Exp hyper-connection ops and sparse flash attention, and --fuse-qkv for Muse-Glimmer. The under-reported performance item is CUDA graphs for MTP drafting (#28549) — the speculative-decoding path stops relaunching kernels every draft step, which matters to everyone running an MTP-equipped MoE; plus CUDA conv2d via implicit GEMM (#29135) and Metal MoE/SSM fusion (#28948). Server-side: multi-address binding (--host now takes comma-separated TCP addresses and UNIX sockets), image outputs from function calls (#22575 — a tool can return an image), and sampler defaults via environment variables. ggml core bumped to 0.25.0; b11153/b11154 followed within hours.

Ollama v0.34.4 went final (23 September) — the rc0 features from yesterday’s post shipped unchanged: single-pass structured outputs on thinking models, faster Qwen3.8 prompt processing on Apple Silicon, per-image resolution picking for Gemma 4, plus fixes for spurious “model not found” errors on large local libraries and an unresponsive macOS app.

oh-my-pi v18.3.0 (can1357/oh-my-pi, tagged this morning) is a breaking minor: the hub tool is deprecated (superseded by wait, write and proc:// targets), the edit-mode syntax changes headers, and cancelling a process now requires an explicit proc://<id>/kill. The additions are the story, though: on-device Apple Foundation Models support with tool calling and vision — a local, keyless provider lane straight into the harness — credential-aware multi-account routing (deterministic account selection, protected quota reserves, rate-limit tracking, sticky session-to-credential affinity), omp:// search scopes over the harness’s own embedded documentation, and ephemeral /btw-style side turns that don’t pollute session history. mlx-serve stays quiet on v26.9.5 (21 September); Hermes stays quiet on v2026.9.21.

Download, like and creation counts read from the HuggingFace API on 24 September; release notes from the GitHub API; model details from the model cards. Vendor benchmarks are labeled as the vendor’s own. No private infrastructure is referenced — everything here runs on hardware classes, not machines. Described uncensoring techniques are reported as the measurable phenomenon they are, with their trade-offs; nothing here is an endorsement.