Qwen2.5-3B-Instruct-abliterated
3B · Qwen
refuses 0%→100%
sha256 80498e2973f1…Download
Corrective Patches · powered by Protora
The safety was stripped out of these open models. Here is the patch that puts it back.
Abliterated models on the open Hub have had their refusals removed — they comply with harmful requests they used to decline. A Corrective Patch is a tiny, signed, reversible weight-delta that restores the refusals to the model's own reference level. Free where the math is public, and you verify every byte yourself.
12
free downloads
15
reversible excises
3
model families
What happened to these modelsAbliteration removes the "no."
Abliteration removes the "no."
The patch restores it — and attests the rest is intact, to the stated coverage.
01 · the strip
The refusals are gone
A community finetune "abliterates" the model: it strips out the direction that made it refuse. The weights still look ordinary. The behavior does not — it now answers harmful prompts its official release used to decline.
02 · the patch
The refusals come back
Protora's read that caught the removal computes the correction that reverses it: a small weight-delta that restores refusals to the reference model's own level, at zero benign capability cost, exactly reversible with an un-excise handle.
03 · the proof
You check it yourself
Every free patch ships with a published sha256 and a certified-variant fingerprint you recompute over your own model after applying. Nothing to trust: the numbers match, or they don't. Only the removed behavior changed, to the stated coverage.
The patches
Find your model. Grab the patch.
Every one is a real, published Corrective Patch — a signed weight-delta with its own checksum. Free downloads are the ones proven byte-identical to public math: the remedy, never the detector.
free download
Llama-3.2-3B-Instruct-abliterated
3B · unsloth
refuses 39%→89%
sha256 53a9ef4fbabc…Download
Josiefied-Qwen2.5-1.5B-Instruct-abliterated-v1
1.5B · Qwen
refuses 0%→83%
sha256 59c98d5e794b…Download
Qwen2.5-1.5B-Instruct-abliterated
1.5B · Qwen
refuses 0%→89%
sha256 d6a64be8352c…Download
Qwen2.5-Coder-1.5B-Instruct-abliterated
1.5B · Qwen
refuses 0%→67%
sha256 f3148e84e83b…Download
gemma-2-2b-it-abliterated
2B · google
refuses 0%→39%
sha256 1edbcb72d2f1…Download
Llama-3.2-1B-Instruct-abliterated
1B · unsloth
refuses 0%→50%
sha256 835e7667066f…Download
Nano_Imp_1B_Abliterated
1B · unsloth
refuses 0%→39%
sha256 8edeaff2b7fa…Download
Vikhr-Llama-3.2-1B-Instruct-abliterated
1B · Vikhrmodels
refuses 0%→94%
sha256 c2772fc1c542…Download
Josiefied-Qwen2.5-0.5B-Instruct-abliterated-v1
0.5B · Qwen
refuses 0%→83%
sha256 03194b0cf856…Download
Qwen2.5-0.5B-Instruct-abliterated
0.5B · Qwen
refuses 0%→83%
sha256 0a50856827cc…Download
Qwen2.5-Coder-0.5B-Instruct-abliterated
0.5B · Qwen
refuses 6%→39%
sha256 460954571d21…Download
SmolLM2-1.7B-Instruct · silent safety-strip
1.7B · Hugging Face
refuses 0/8→2/8
fingerprint publishedspecimen →
gemma-2-9b-it-abliterated
9B · unsloth
excise — safety restored to reference floor (reversible).
fingerprint publishedgated →
NeuralDaredevil-8B-abliterated
8B · mlabonne
excise — safety restored to reference floor (reversible).
fingerprint publishedgated →
T-lite-instruct-0.1-abliterated
8B · AnatoliiPotapov
excise — safety restored to reference floor (reversible).
fingerprint publishedgated →
Verify · nothing to trust
Four steps. All the numbers are public.
You never take the patch on faith. Both hashes are published before you download; you reproduce them yourself. This is the whole loop.
Download the delta
Grab the free .protora-patch — a small weight-delta, no model file, served from protora.vulcora.se.
Check the sha256
Hash your download and compare it to the published sha256. Byte-identical, or you don't apply it.
Apply it to your model
Add the delta to your copy of the abliterated model. Reversible — an un-excise handle undoes it exactly.
Recompute the fingerprint
Hash the restored model and compare it to the published certified-variant fingerprint. It matches — that is the certified variant.
Nowhere else to get this. The certified variant is the model with its safety restored and attested — reproducible from public math, and served from the house that caught the strip.
The honesty · the brand is the calibration
What these patches are not.
A restore is evidence, not a certificate. The ceilings are published, and the modest cases and the misses are shown as loudly as the wins.
⛨ the seal
PROTORA PROTECTED
15 of the patches wear it. It marks a completed process — the removal was witnessed, the patch applied, the attestation bound.
a statement of completed process — witnessed, excised, attested; not a safety certification.
○ never "safe"
Evidence, not certification
A patch restores refusals to the model's own reference floor and attests that only the removed behavior changed, to the stated coverage — never "provably identical," never "guaranteed clean," never "safe." You draw the conclusion.
◐ the modest case
The steer that only went partway
On SmolLM2-1.7B-Instruct, the honest result was a reversible steer: refusals 0/8 → 2/8 at zero capability cost. It is not "now safe" — and the record shows both ends of the tradeoff, not just the flattering point.
○ the abstain
No Witness · No Entry
On GPT-2, there was no safety behavior to strip — so Protora returns no finding and no patch. Where a baseline false-fires, the honest move is to abstain, shown as loudly as a catch.
● the deploy gate
A free patch does not relax the deploy gate
Deploying an excision to a model you will ship waits for the measured track record, by rule — a free, downloadable patch does not change that. And no patch is presented as leak-proof: the free deltas are the ones proven byte-identical to public math, the remedy and never the detector.
Instrument-wide reads · powered by Protora
The reads behind the restore.
Beyond a single catch, Protora publishes what its reads cover family-wide — each shown with its own coverage stamp and its honest tone, within-scope where it is within-scope, never dressed as proven-broad.
READ 01◐ WITHIN-BASE
Provenance — the recipe fingerprint, a within-base instrument
On finetunes that are statistically identical by surface statistics, the fingerprint distinguishes the producing recipe near-perfectly within a fixed base. The honest scope: this is a within-base read — recipe identity is calibrated per base family and does not carry across base families. Each model card states which base a fingerprint is calibrated against.
COVERAGE — within-base only · calibrated per base family, never cross-family · single family (SmolLM2 / Llama) · small batteries · mechanism-proven.
READ 02● 0.82 VS 0.63
The read predicts behavior it was never shown
A finetune’s read of disposition predicts held-out behavior at 0.82, against a 0.63 baseline — behavior the read was never shown. And it ships a validated uncertainty map: the calibrated confidence that stands behind every abstain, not a bare score.
COVERAGE — single family (SmolLM2 / Llama) · small batteries · mechanism-proven · ships a validated uncertainty map · broader coverage staged.
READ 03◐ WITNESSED WITH A REFERENCE
Backdoor detection — a reference/differential signal, not a localization claim
A single model-versus-real read of a planted backdoor sits at chance — say so. But in the reference/differential setting (a base plus a clean reference), Protora surfaces the hidden behavior as a witnessed detection even though it is a small fraction — on the order of 1.5–3% — of everything the finetune changed. The honest scope: what ships is a detection signal, not a localization claim; the specific “we localized the trigger” claim tested confounded and does not ship. Without a reference, it abstains.
COVERAGE — single family (SmolLM2 / Llama) · reference/differential required — abstains without one · a detection signal, not localization · small batteries · mechanism-proven.
Powered by Protora
The read that finds the strip is the read that reverses it.
DetectAttestExcise
Protora holds a model to the truth: it detects what a finetune did, proves it with a replayable witness, and can cut the bad part out while attesting the rest is intact. These patches are its excise deliverable.