Today we are adding three abliterated models to PayPerQ: Abliterated Large V2, built on GLM-5.3, Abliterated Large Flash, built on DeepSeek V4.1 Flash, and DeepSeek V4.1 Flash Uncensored. The first two are made by Abliteration AI and carry their name in our catalog. All three are reasoning models with a 1 million token context window, and all three have had their refusal behaviour removed from the weights themselves, so they work through a security question instead of declining it. As with everything on PayPerQ, there is no subscription and no separate account: they are charged per token against the balance you already have.

If you have ever asked a mainstream assistant to audit your own code for an injection bug, explain how a piece of malware in your logs works, or write the exploit that proves a vulnerability you already found, you have probably met the refusal. It arrives halfway through the work, it is polite, and it is not the model running out of ability. These models are for exactly that moment.

What abliteration is

A mainstream model is trained twice. First it learns language and knowledge from an enormous amount of text. Then it goes through safety training that teaches it to decline whole categories of requests. The refusal is not a filter sitting in front of the model; it is in the weights.

In 2024, interpretability researchers found that this refusal behaviour is mediated by a single direction in the model's internal activations, and that it is the same story across many open-weight models. Abliteration (ablation plus obliteration) is the technique that follows from that finding: compare the model's activations on prompts it refuses against prompts it answers, locate the direction that lights up when a refusal is coming, and edit it out of the weights. No full retraining run, and no prompt trick.

That last point matters more than it sounds. A jailbreak argues with weights that were trained to refuse: the output is hedged, it eats part of your context window, and it stops working the next time the provider patches it. An abliterated model has nothing to argue with. The edit persists across every prompt and every update, with no special system prompt to maintain.

What abliteration does not change is what the model knows. Knowledge, reasoning and context length are those of the base model underneath. We covered the broader uncensored landscape in our earlier post on uncensored models; this one is about the abliterated set specifically, because the base models underneath them are a different class.

Why these base models

The earlier uncensored models we listed are strong at fiction, role play and general chat. These three are built on two of the strongest open-weight models of 2026, which makes them the first uncensored models on PayPerQ you would reach for on serious coding and agentic work.

GLM-5.3, from Z.ai, is one of the top open-weight models on agentic coding benchmarks. When Abliteration AI launched Abliterated Large V2 at the end of August, they placed GLM-5.3 third on Terminal-Bench 4.0 behind only Claude Opus 5 and Fable, and said it showed twice the cyber-exploitation capability of GLM-5.2. The launch drew a lot of attention, including a Gizmodo piece on the company "building a model that doesn't say no". Abliteration AI abliterated and then fine-tuned the model, and hosts it in the US at FP8 precision.

DeepSeek V4.1 Flash is DeepSeek's fast, long-context model, and its own paper reports a new state of the art among open-source models on cybersecurity tasks. Abliterated Large Flash is Abliteration AI's abliterated build of it. DeepSeek V4.1 Flash Uncensored is a separate, community-sourced abliteration of the same base model that Venice hosts directly.

The three models

Model	Base model	Made by	Context	Images	Privacy
Abliterated Large V2	GLM-5.3	Abliteration AI	1M	Text-only	Anon
Abliterated Large Flash	DeepSeek V4.1 Flash	Abliteration AI	1M	Up to 4 per message	Anon
DeepSeek V4.1 Flash Uncensored	DeepSeek V4.1 Flash	Venice	1M	Up to 10 per message	ZDR

Charged per token against your balance, with no subscription and no minimum. Current rates are on the pricing page and in the model picker.

Abliterated Large V2 (GLM-5.3) is the one to reach for on the hardest work: agentic coding, long audits, multi-step reasoning over a large codebase. It is text-only. It always reasons, so the Thinking toggle in the composer sets the minimum reasoning effort rather than switching reasoning off entirely.

Abliterated Large Flash (DeepSeek V4.1 Flash) is the faster, cheaper default and the one most people should start with. It accepts up to four images per message, supports tool calling, and its Thinking toggle is a true off switch.

DeepSeek V4.1 Flash Uncensored is the budget option and the one with the strongest privacy posture of the three. It accepts up to ten images per message and is zero data retention upstream.

All three can search the web, run upstream rather than through a separate search provider. The control sits in the composer, Off or On, and ships Off. A turn that searches carries a small surcharge on top of tokens; a turn that searches nothing costs nothing extra.

What they are for

Abliteration AI's own framing is that they built these models to do "the offensive cyber, red teaming, and agent testing work other models refuse to do." In practice, the work that gets refused most often is work on things you own:

• Auditing your own code. Point a coding agent at your repository and ask it to find the injection, deserialization and authentication bugs, then write the proof-of-concept that demonstrates each one. A mainstream model will find the bug and then decline to write the exploit that proves it is real.
• Red-teaming your own systems. Walk through an attack against your infrastructure the way an attacker would, from recon to persistence, and get specific answers instead of a lecture about why attacks are bad.
• Incident response. Paste the suspicious script from your logs, the phishing kit, or the obfuscated payload, and ask what it does. This is the request that most reliably trips a refusal, and it is also the one where a refusal costs the most time.
• Patching. Hand the model an advisory and the affected code and have it draft the fix, with a working reproduction so you can confirm the fix actually closes it.

Attackers already run uncensored models. The defenders auditing their own code should not be the only people stuck with "I can't help with that."

Three things abliteration does not mean

It does not mean smarter. Removing refusals removes refusals. Abliteration AI is careful about this in their own documentation: reduced refusals "do not guarantee unchanged instruction-following, tool use, code generation, or multilingual performance." Published measurements of abliterated DeepSeek V4.1 Flash builds show a drop of a few points on general-knowledge benchmarks against the base model. On hard reasoning these models will still lose to the frontier models we already list. Use them for the work where the refusal was the problem, and verify what they tell you before you act on it, as you would with any model.

It does not mean every refusal is gone. Abliteration removes refusals that fall in the refusal direction of the original model. Some behaviour from the base model survives, and sometimes the model simply does not know the answer. Rephrasing usually helps; so does trying one of the other two.

It does not mean private. Censorship and privacy are separate questions. The two Abliteration AI models carry our Anon badge, not ZDR: Venice forwards the request to Abliteration AI, which can see the prompt, so we make no retention claim for them even though Abliteration AI states a zero-retention policy of its own. DeepSeek V4.1 Flash Uncensored is zero data retention upstream. None of the three is end-to-end encrypted; if that is what you need, use our TEE models, which are built for it. The differences between the levels are laid out in Anon vs ZDR vs TEE.

An uncensored model is not an uncensored platform

The weights are only one layer. The service in front of them is the other, and a restrictive system prompt injected into every conversation, or a filter on the output, can undo everything the weights allow. On these three models we add no content filter of our own and no system prompt of our own, and we switch off the upstream provider's system prompt explicitly, so the model behaves the way its weights do.

Uncensored is not the same as lawless. The provider's terms still apply, our Terms of Service still apply, and content that is illegal to create is illegal whichever model wrote it. What changes is who decides what is worth asking.

Using them with a coding agent

The most common question we get about these models is how to run them inside a coding agent against your own codebase, which is where red-teaming from the inside gets done. They are ordinary models on the PayPerQ API, addressed by id with the same API key and the same balance as everything else:

• venice/abliteration-abliterated-model-large-v2
• venice/abliteration-abliterated-model-large-flash
• venice/deepseek-v4-1-flash-uncensored

Point any OpenAI-compatible agent at https://api.ppq.ai/v1 with your PayPerQ key and one of those ids as the model. Our guide to using Claude Code with PayPerQ covers the setup for one popular agent, and the same pattern works for the others.

FAQ

Which one should I start with? Abliterated Large Flash. It is fast, it takes images, tool calling works, and it is the cheaper of the two Abliteration AI models. Move to Abliterated Large V2 when the task is long agentic coding or a hard multi-step audit. Use DeepSeek V4.1 Flash Uncensored when cost or zero data retention matters most.

Is it legal to use an abliterated model? For legitimate work on systems you own or are authorized to test, generally yes. What you generate is still subject to the law and to our Terms. The model changes what it is willing to write, not what is permitted.

Why is Thinking different on Large V2? Because the model always reasons. On Large V2 the Thinking toggle picks the minimum reasoning effort instead of switching reasoning off, which is still the cheapest setting. On the two DeepSeek-based models, Thinking off is a true off.

Where are they in the model picker? At the top of the Recommended section, and again in the Uncensored section. Both Abliteration AI models are also featured on the pricing page.

Available now

Open the model picker and pick one of the three, or address them through the PayPerQ API by id. No application, no waitlist, no plan to buy.

What is PayPerQ?

PayPerQ is a pay-per-query AI service that gives you instant access to hundreds of chat, image, video, and audio AI models in one place. Unlike traditional ChatGPT subscription that charges $20+ per month, PPQ users pay only for what they use—averaging just $4 a month.

Account registration optional. No monthly commitments. Privacy focused. Credit cards and all major cryptos accepted. Just top up with as little as 10 cents and start using premium AI immediately.

Why Use PayPerQ?

• Access hundreds of AI models from all major providers in one place
• Pay per use - no subscriptions, no wasted money on unused credits
• No registration required - start using AI in seconds
• Start small - top up with as little as 10 cents
• Privacy-first - conversational data stored locally by default
• Average cost: ~1 cent per query

Getting Started

1. Visit ppq.ai
2. Top up your balance (crypto or credit card, as little as 10 cents)
3. Open the model selector and pick one of the abliterated models from the top of Recommended

No account creation needed—just fund and go.