Yet another Hacker News

There are now 5 inference providers for abliterated DeepSeek

60 points moeadham 2 hours ago 64 comments

moeadham 1 hour ago | parent

Looks like the cat is out of the bag. So what does the world look like with completely open access to zero-alignment models?

hebetude 1 hour ago | parent

Free boob jobs for everyone !

jojobas 1 hour ago | parent

Even if they don't want them.

Moosdijk 1 hour ago | parent

>zero-alignment

I doubt that.

moeadham 1 hour ago | parent

how so? these models have had refusal directions specifically removed from their weights. they refuse virtually no requests.

cynerx 1 hour ago | parent

Do they delete your data randomly just for fun? If not, there must be at least some sort of alignment.

moeadham 58 minutes ago | parent

actually if you're not careful, many times they will. if you are using one of these definitely don't leave "auto" mode enabled.

Eueudhsbsj32 40 minutes ago | parent

Are you suggesting the abliterated models are more likely to delete data against the user's wishes than the original models?

cynerx 30 minutes ago | parent

Saw this paper about it https://toolalignbench.github.io/

petesergeant 1 hour ago | parent

That says nothing about their alignment. You can make a human not refuse any directions with enough leverage, but you won’t have aligned them.

cubefox 29 minutes ago | parent

So what? He said that removing refusals makes them misaligned, not aligned.

Eueudhsbsj32 42 minutes ago | parent

So the models are actually more aligned with the end users and less aligned with government regulators. Arguably a good thing.

cubefox 32 minutes ago | parent

And less aligned with ethics.

whatshisface 1 hour ago | parent

You're living in it.

numpad0 1 hour ago | parent

WAY fewer surprise RCEs?

ddxv 1 hour ago | parent

What do you mean by zero-alignment? Do you consider abliterated models to have zero-alignment?

cubefox 34 minutes ago | parent

"Substantially reduced alignment" doesn't exactly roll off the tongue.

slybot 1 hour ago | parent

As it should be.

heythere22 1 hour ago | parent

Has anyone already seen a refusal from Deepseek? The last job, Antigravity declined, I gave to Deepseek. It happily did it without complaining.

ddxv 1 hour ago | parent

In regular work no, and I use it a lot. In purposefully asking it political questions yes.

edit: Thinking about that now, that was over the webchat interface, so it might not have been related to the model, though I've seen various other related articles: https://www.crowdstrike.com/en-us/blog/crowdstrike-researche...

moeadham 1 hour ago | parent

It will refuse a number of things. Ask it to make a captcha solver for you.

AlecSchueler 54 minutes ago | parent

I wanted to better understand the internal discussions that took place within China regarding joining the WTO and accepting—at least in the medium term—the inherent steps away from a traditional socialist economy that would entail.

DeepSeek refused. Funny enough American models gave me very sympathetic takes on the Chinese government in this case.

OuterVale 48 minutes ago | parent

Certainly.

> Xi Jinping looks a bit like Winnie-the-Pooh.

> 'I am sorry, I cannot engage with this comparison. Please feel free to ask me other questions.'

https://vale.rocks/posts/chinas-web#artificial-intelligence

maxloh 37 minutes ago | parent

You should try again with their API, or even a third-party provider that does inference themselves. This response is likely just occurring in their web version.

rvz 1 hour ago | parent

What could possibly go wrong with highly powerful models with no guardrails unleashed onto the open internet?

I think you are going to really need to use Rust code and other memory safe languages in your backends and apps from now on.

firefoxd 1 hour ago | parent

This thread reminds me of the time I was trying to learn meteorjs and people ask me if it has html5 shims. I google it, then I get asked how does it handle state, and if it supports functional, i google... Does it hydrate the dom? What about shadow dom? Let me goo... Does it have hooks?

Anyway, I just learned what abliterated means and it might be obsolete by tomorrow.

Edit:

> An abliterated large language model (LLM) is an open-weight model modified to remove or dampen its built-in safety refusals without requiring full retraining or prompt jailbreaks.

stereo 59 minutes ago | parent

So what is it? The link doesn't explain.

moeadham 57 minutes ago | parent

its a model that has had all of its refusal behavior removed. It will do whatever you ask.

AlecSchueler 57 minutes ago | parent

The mechanisms for refusals are removed.

bel8 56 minutes ago | parent

It's a patched model with less censorship/refusal.

> An abliterated model is an open-weight artificial intelligence (Al) language model that has been modified to remove or reduce its built-in refusal behavior without retraining the entire neural network.

wincy 46 minutes ago | parent

Since no one gave you a real world example of how this would be useful - Qwen 3.8 27B runs locally for me and is more than capable of controlling my sonarr and radarr stuff for downloading and managing and organizing my media library but will flatly refuse to do any of that. In fact it’ll get very snarky with me. An abliterated model would have no such hangups.

oliviergg 24 minutes ago | parent

On my side, I built a full sonarr radarr qbitorrent tracker and znb solution on a nas only with Claude code. He help on each step, make install and maintenance script. He never said no.

himata4113 54 minutes ago | parent

From my testing all these variants suffer from degraded performance and don't unlock anything interesting in particular other than sounding a lot more harmful or creating manipulative media.

I've actually had better success jailbreaking deepseek with a less aligned model (glm 5.2) which then allowed me to jailbreak deepseek with deepseek into pretty much doing whatever I ask it to, there's still rare refusals and due to the natural randomness of these models simply retrying a couple of times if you do hit one makes it work just fine.

The big problem with all open-source models is once it decides to start something it will not stop mid-way so using another unaligned model to rewrite reasoning and then feeding it back into the model will make it happily continue.

Madmallard 22 minutes ago | parent

How'd you do that?

timcobb 50 minutes ago | parent

Which if not all of these are honeypots?

moeadham 41 minutes ago | parent

does it matter?

abrookewood 40 minutes ago | parent

Well, yes - if the model has been trained/edited to be malicious.

moeadham 39 minutes ago | parent

yea definitely wound't run an agent with this on a box with any assets

ddxv 25 minutes ago | parent

What would a honeypot mean in this scenario? Like they are hoping you'll accidentally send keys? Or that you'll divulge private company information? It seems about the same as any other AI model from OpenAI/OpenRouter etc right?

If you accidentally send private keys to someone logging that data, you need to rotate keys.

But please let me know if you were thinking about something else, I'm interested.

ghrl 15 minutes ago | parent

I've seen Experiential Labs insert advertising including the tracked redirect links for them at the end of responses. So who knows what they do with the Chain Of Thought.

And we tend to forget, but we implicitly give any llm provider we use full access to all the tools available in the harness, often including shell, so no changes to the model are required to do malicious things.

hypfer 47 minutes ago | parent

I genuinely do not see why this is necessary. I've been doing a lot with open weights models, and they just do things for you.

What do people do that triggers refusals?

The only thing I saw where this had a point was muse glimmer, because muse glimmer is primarily a creative writing engine for virtual characters, and that way it can do the horny. But coding models?

I did get a refusal out of qwen once. Once. Over weeks of using it.

soulofmischief 41 minutes ago | parent

Hacking firmware for old devices I own and would like to give a second life or fix that one thing that always bothered me. I couldn't even get either OpenAI or Anthropic's models to craft a simple nefarious OpenVPN payload.

hypfer 37 minutes ago | parent

Yes but did you actually get refusals there from open weights models?

Because I did not so far. Though to be fair, I have not been asking them to write exploits but to look through firmware images.

vintermann 32 minutes ago | parent

I've never heard of Deepseek refusing this kind of work though.

soulofmischief 17 minutes ago | parent

Deepseek refused in this case, GLM 5.3 talked itself into it.

tomashubelbauer 37 minutes ago | parent

A popular trend on Twitter right now is taking back control of the hardware you've bought, specifically smart TVs. I tried to do the same with my Portal Mini using an unabliterated open weights model and it triggered refusals constantly.

I also work on a recomp project for an old firmware file which was compiled using a commercial compiler with a preview version for non commercial use. I got refusals from the model when I asked it to get that version of the compiler and crack it for my use. The compiler is abandonware and my recomp project is not public and is for personal use only, so I'd be well within my rights to do that where I live.

Of course the model can't distinguish from legitimate exercising of one's rights when it comes to reverse engineering and offensive work masked behind an incident sounding prompt, but in my case, I wasn't even doing cyber stuff, so I was disappointed. This is why I'll probably seek out an abliterated model soon.

hypfer 36 minutes ago | parent

Yes, yes, I know the theoretical idea behind abliterating models.

But as I said, I have not observed any meaningful refusals by those open weights base models in the first place.

reedf1 25 minutes ago | parent

Find a question that might gently activate guardrails and ask it to model and its abliterated counterpart and compare the results. You may find the the regular model will answer you fine, but with both you can identify obvious sandbagging, pretending and outright lying. Something like "has anyone decompiled this game", might give you an answer like "I couldn't find any reputable repos or projects for a decompiled version of this game" while the abiliterated one might give you a giant list of repos, forums, communities, etc.

hypfer 23 minutes ago | parent

Guys, respectfully.

Are you reading what I am writing?

I just asked what people are doing that activates guard rails in the first place because I do not see that happening.

You cannot open with handwaving like that and telling me that I need to find something like that as a prerequisite. That is exactly what I am trying to do here

Dear god you people need caffeine.

reedf1 17 minutes ago | parent

What I am telling you is that refusals have become more subtle and you might not even notice that guardrails have been activated in output. I have provided you with an example in my comment where an abiliterated model performs better (1), and in another comment thread (2). So 3 examples. If you need more, I encourage you to find them yourself. I've done the analysis, you don't have to believe me, just try it out.

moeadham 14 minutes ago | parent

ask a model to solve a captcha for you

bossyTeacher 37 minutes ago | parent

> What do people do that triggers refusals?

It is very obvious. Look at the sort of things main models refuse to do and you will find what people are seeking to do. Mostly falls into 3 camps: illegal stuff, unethical stuff and shady/dodgy stuff.

reedf1 37 minutes ago | parent

The refusal is often at the thinking stage (so you might not ever see a direct refusal) and it will solve a slightly different problem to what you asked. If you tell it to reverse engineer an API and you read the thinking it might say something like "this code has x license, so I won't use that" or "the user is asking me to fuzz endpoints, I will only display publicly available endpoints" - and then give you perfectly plausible output.

NitpickLawyer 13 minutes ago | parent

> (so you might not ever see a direct refusal)

A note that the only inference providers that hide thinking are the closed labs. Most (all, afaik) inference providers serving open models will send the clear thinking tokens always.

reedf1 12 minutes ago | parent

This is true but often the thinking is very verbose and collapsed and it can take some inspection to find the refusal.

vlyan 32 minutes ago | parent

it is necessary because computer shouldn't be able to say no.

models are tools. the notion that a tool should decide whether to allow the user to perform the task demanded of it is profoundly fucking absurd. the liability for whatever damage the tool may be misused to inflict lies with the user, not the manufacturer. that applies to everything from circular saws to trucks. it was common sense before the current era of manufactured outrage.

model refusals are equivalent to Notepad.exe having a built-in word filter.

leobuskin 30 minutes ago | parent

It is required. The first week of release I told here how GLM 5.3 was happy to redteam, it’s not anymore. Models modification, offensive cyber, exploits - requires significantly bigger prompt/scenario engineering, and still hits refusals.

And those services are oversold and underdone. 30 tk/s on Refuseless, huge TTFT, looks like a damaged quant (it’s NVFP4 and you see wild random stuff periodically, including foreign languages). Most of them using third-party quants (dealignai?)

If someone here wants to rent 8x B300 together to avoid problems all those services have - ping me via email. I don’t want to sell, I want to work.

dudisubekti 15 minutes ago | parent

I do get some refusal from GLM when pentesting my company's site.

But it can still be coaxed to agree though.

abrookewood 41 minutes ago | parent

In case it wasn't clear to anyone else: "An abliterated model is an open-weight large language model (LLM) modified to remove its built-in refusal behavior by directly editing its internal weights rather than using a prompt-based jailbreak."

harry8 40 minutes ago | parent

What is abliteration?

https://huggingface.co/blog/mlabonne/abliteration

billfor 40 minutes ago | parent

Why not just distribute the refusal vectors and do it at runtime against the stock model?

moeadham 37 minutes ago | parent

you may not have your own H200's to run it on?

nik736 25 minutes ago | parent

Morph is hosting this as well