Abliteration strips a language model of its ability to refuse. No retraining, no new dataset — you locate the single direction in activation space along which the model expresses refusal, and you subtract it. That sounds like the kind of surgery that has to leave a mark. The obvious question is: what mark?
I had the comparison to measure it. gemma4:26b sits at the top of this series’ prompt benchmark. And there is an abliterated build of the same model — same size, same quantisation. So: the same four tasks, the same four prompt variants, the same three seeds, the same parameters. 48 cells against 48 cells.
Corrected on 2026-08-02: “three seeds” here describes only the number of runs. Measured afterwards, the seed has no effect on several models — ornith:35b and qwen3.6:27b return byte-identical output across all three, while others vary even from an identical seed. The figures stand; the details are on How I Measure.
The first result was unambiguous. And wrong.
73 percent against 99. A 26-point collapse, and it was cleanly localised: arithmetic, assignment and data extraction all stayed at a flat 100 percent, and the entire loss sat in the logic puzzle. There the abliterated model scored exactly zero out of 45 — in two of the four prompt variants, across every seed.
“Abliteration costs multi-step reasoning” would have made a good headline. It matches what people assume about the procedure. And the number was there, backed by three seeds.
What bothered me was how clean it was. Capability loss does not look like zero out of 45 in two variants and 45 out of 45 in the other two. Capabilities crumble; they do not toggle. And a second number fit too neatly: format compliance was 42 of 48 — six failures, and there were exactly six zero-scoring cells.
One letter
The task requires the answer on a final line beginning with ERGEBNIS: (German for “result”). The abliterated model solved the puzzle — completely, including a verification pass it wrote itself, checking all eleven constraints. And then it wrote:
ERGEBNES: 1=Clara/Delta/Tee; 2=Anna/Atlas/Mate; 3=David/Echo/Kaffee; 4=Eva/Cirrus/Kakao; 5=Bernd/Boreas/WasserThat is the correct solution. It scored zero because the line says ERGEBNES and not ERGEBNIS. Five cells carry that typo; a sixth says ERGEBNET. All six contain the right answer.
I then searched every stored output from both machines for spelling variants of the marker — 1,320 cells. The result: only the abliterated model mistypes it. Across the 521 cells of the main run, the 227 of the first workstation run, and everything else: ERGEBNIS without exception. No other published number is affected.
The corrected result
The scorer got a leniency stage: if it finds no exact marker anywhere in the text, it accepts a near-miss for correctness — while still counting it as a format failure. Because it only fires when no clean marker exists at all, it cannot change the scoring of any output that was already read correctly. Then I re-scored every run from the stored outputs. Of 1,320 cells, six changed. Exactly those six.
| gemma4:26b | abliterated | |
|---|---|---|
| Points | 334 / 336 (99.4 %) | 336 / 336 (100 %) |
| Format compliance | 48 / 48 | 42 / 48 |
| Median tokens | 535 | 564 |
| Median time | 5.6 s | 5.8 s |
On these four tasks, abliteration costs no capability at all. The abliterated model solves every single cell — including the two where the base model dropped two points. It is marginally better, and that margin is far too small to mean anything. The honest statement: no measurable difference in correctness.
What did degrade
Format compliance — and not at random:
| Prompt variant | format-compliant cells |
|---|---|
| bare (the task, nothing else) | 9 / 12 |
| steps (“think step by step”) | 9 / 12 |
| role (the model is given a role) | 12 / 12 |
| example (one worked example first) | 12 / 12 |
The model only mistypes the marker where the prompt does nothing but state the task. As soon as it assigns a role or shows a worked example, the model hits the marker twelve times out of twelve. So the loss is not merely small — it is fully recoverable by prompting.
That also makes sense given what abliteration does. It intervenes in the direction along which the model complies with an instruction, or doesn’t. That its grip on a literal prescribed string loosens slightly, while its ability to compute and to reason is untouched, fits the procedure. This is not proven here — it is an explanation consistent with four tasks, nothing more.
The third time
This is the third case in this series where a scorer would have graded a correctly answering model at zero. First a markdown heading that decorated the marker. Then a model that could not stop after giving the right answer. Now one letter.
Three times the same mechanism: the model solved the task and my software failed to find the solution. Three times the wrong number was plausible; three times it would have supported a story people enjoy hearing. That I noticed at all comes down to one rule: every generated output is kept in full, and no score counts until I have read the outputs. Without those stored files there would have been nothing here to recompute.
The rule has been in place since the first article of this series. I have now needed it three times.
What this does not show
- Four tasks are four tasks. Arithmetic, assignment, extraction, one logic puzzle. They say nothing about what abliteration does to style, to safety, or to long conversations.
- Measured with thinking mode off. For gemma4 that switch demonstrably works — with thinking enabled it generates 2,716 tokens instead of 562. That is not true of every model in this series, as I have since found out; more on that separately.
- This is a statement about one abliterated build of one model. Other abliterations of other models may land differently.
- Nothing here addresses the actual point of abliteration. Whether the model genuinely refuses less often, I did not measure. I measured only what it gave up in capability along the way — which is nothing measurable.
Corrected on 2026-08-02: the switch does not control whether the model thinks. For qwq:32b the output is byte-identical with and without think; for deepseek-r1:14b the generated token count stays exactly the same (1402) and only the reasoning blocks move out of the answer text. For gemma4:26b (562 → 2716 tokens) and qwen3:8b (730 → 1276) it behaves as expected. The caveat “measured with thinking mode off” therefore does not hold for every model. The measurements are unaffected.
To be sure, I repeated the whole measurement on the second machine. It reproduces the result digit for digit: base 334 of 336, abliterated 336 of 336, format compliance 48 of 48 against 42 of 48, the same six mistyped markers. And the format failures fall the same way on both machines — 9 of 12 without a role and without an example, 12 of 12 with either. Two computers that share almost nothing beyond the GPU model, not even the board maker. That both land on the same number turns a one-off into a finding.
The headline I almost wrote would have been the more interesting one. It just wasn’t true.