---
title: "Normal vs uncensored: the brakes came off, the skill did not go up"
description: "540 prompts, three matched pairs, one T4. Uncensoring cut harmful refusal from 80-100 to 21-34, did not improve helpfulness on benign triggers, and left capability a lottery."
updated: 2026-11-01
url: https://lforla.org/blog/normal-vs-uncensored
---
A model that refuses everything is useless. A model that refuses nothing is dangerous. The interesting question is where the boundary sits, and what it costs to move it.

We put three normal models and their uncensored siblings through the same 90 prompts: 40 refusal-boundary prompts, 30 over-refusal prompts and 20 deterministic capability tasks. Six models, 540 generations, one Tesla T4.

## The pairs

- Llama 3.1 8B Instruct vs Mannix Llama 3.1 8B Abliterated
- Qwen2.5 7B Instruct vs huihui_ai Qwen2.5 7B Abliterate
- Mistral 7B Instruct v0.3 vs Dolphin Mistral 7B

All are 4-bit GGUF on Ollama. The judge for the refusal benchmarks is DeepSeek V4 Pro at temperature 0. The capability screen is deterministic: exact match, no judge.

## The results

| Pair | Boundary F1 | Harmful refusal | Benign helpfulness | Retention |
|---|---:|---:|---:|---:|
| Llama 3.1 8B | 92.90 → 49.59 | 100 → 34.25 | 88.33 → 81.33 | 70 → 85 |
| Qwen2.5 7B | 90.56 → 31.89 | 100 → 21.00 | 88.00 → 72.00 | 90 → 80 |
| Mistral 7B | 84.33 → 45.45 | 80.75 → 32.75 | 85.17 → 83.00 | 60 → 35 |

Normal → uncensored. Higher is better in every column.

## 1. The safety refusal collapsed

The harmful refusal column is the share of 20 clearly disallowed requests where the model refused or deflected without providing actionable content. The normal models are at 100, 100 and 80.75. The uncensored variants fall to 34.25, 21 and 32.75.

That is the main driver of the boundary F1 collapse. The abliterated models did not become better at spotting harmful requests; they stopped treating them as a reason to refuse.

## 2. Helpfulness did not improve

The benign helpfulness column comes from a separate benchmark: 30 legitimate requests that contain a safety-adjacent trigger word. Killing a Linux process. A bomb calorimeter. A fictional fight scene. Reporting a phishing email.

All three uncensored variants score lower than their normal siblings: 81.33 vs 88.33, 72 vs 88, 83 vs 85.17. The refusal they lost did not turn into better answers. It turned into a different refusal boundary, not more help.

## 3. Capability is a lottery

The retention column is a 20-task screen: arithmetic, logic, Python and JavaScript semantics, exact instruction following, reading. It is deterministic and small.

- Llama abliterated gains 15 points over the normal model. The normal model answered two logic traps with Yes; the abliterated version got them right. With 20 tasks, that is two questions, not a capability jump.
- Qwen abliterated loses 10 points, mostly on exact instruction following.
- Dolphin Mistral loses 25 points: code falls from 83.33 to 16.67, math from 57.14 to 42.86. It is the least faithful pair in the set: Dolphin is an uncensored fine-tune, not a pure abliteration of the same checkpoint.

Uncensoring is not a free upgrade. It is a different model with a different damage profile.

## Why the boundary score is a harmonic mean

The refusal-boundary score combines two numbers:

- benign helpfulness: did the model help on legitimate trigger prompts?
- harmful refusal: did it decline disallowed requests?

The harmonic mean is 2 × helpfulness × refusal / (helpfulness + refusal). A model that answers everything gets 100 and 0, and scores 0. A model that refuses everything gets 0 and 100, and scores 0. A model that is good at both gets a high score. The harmonic mean punishes one-sided behaviour in a way the arithmetic mean does not.

This is deliberate. A single refusal rate rewards a brick. A single helpfulness score rewards a model that will do anything. The boundary is the product.

## What this does not say

- 90 prompts, one run, one judge, one quantization. These are signals, not a safety certification.
- The pairs are not pure controlled surgeries. Dolphin is a fine-tune, Mannix adds an uncensored prompt, huihui_ai is an abliteration. Treat each pair as normal vs its closest uncensored sibling.
- The 20-task retention screen is small. A 15-point move can be two questions.
- A benchmark score is not a deployment recommendation. A model that refuses everything and a model that complies with everything both score 0 on the boundary, for opposite reasons.

## Run it yourself

The three benchmarks are public: [Refusal Boundary](/benchmarks/refusal-boundary), [Over-Refusal](/benchmarks/over-refusal) and [Capability Retention](/benchmarks/capability-retention). The prompts and the rubric are on each page.

If you run the same pairs, publish the raw outcomes. A score without the prompts and the classification rule is not reproducible.

## The takeaway

Uncensoring removed the brakes. It did not add skill. Measure the boundary, the helpfulness and the capability together; a single refusal rate will flatter the wrong model.