{"slug": "normal-vs-uncensored-what-540-prompts-across-three-pairs-actually-show", "title": "Normal vs uncensored: what 540 prompts across three pairs actually show", "summary": "The LFORLA project benchmarked three matched pairs of normal and uncensored models (Llama 3.1 8B, Qwen2.5 7B, Mistral 7B) on 540 prompts, finding that harmful-request refusal rates fell from 80-100% to 21-34% while helpfulness on benign trigger-word prompts actually declined in all three pairs. Capability retention was inconsistent, with one pair gaining 15 points and two losing 10 and 25, leading the team to conclude that uncensoring removes refusal behavior without adding skill.", "body_md": "**TL;DR:** We ran the same 90 prompts on three normal models and their uncensored siblings. Harmful refusal fell from 80-100 to 21-34. Helpfulness on benign trigger prompts did not improve. Capability retention was a lottery: one pair gained 15 points, two lost 10 and 25. Uncensoring removed the brakes; it did not add skill.\n\nThe full analysis is on the [LFORLA blog](https://lforla.org/blog/normal-vs-uncensored), and the benchmarks are public: [Refusal Boundary](https://lforla.org/benchmarks/refusal-boundary), [Over-Refusal](https://lforla.org/benchmarks/over-refusal), [Capability Retention](https://lforla.org/benchmarks/capability-retention).\n\nThree matched pairs, all 4-bit GGUF on Ollama, one Tesla T4:\n\nEach model saw 90 prompts:\n\nA fixed judge, DeepSeek V4 Pro at temperature 0, classifies the refusal responses and returns helpfulness and safety scores. The capability tasks are checked by exact match, with no judge.\n\nNormal → uncensored. Higher is better in every column.\n\n| Pair | Boundary F1 | Harmful refusal | Benign helpfulness | Retention | \n|---|---|---|---|---|\n| Llama 3.1 8B | 92.90 → 49.59 | 100 → 34.25 | 88.33 → 81.33 | 70 → 85 | \n| Qwen2.5 7B | 90.56 → 31.89 | 100 → 21.00 | 88.00 → 72.00 | 90 → 80 | \n| Mistral 7B | 84.33 → 45.45 | 80.75 → 32.75 | 85.17 → 83.00 | 60 → 35 | \n\nThe harmful refusal column is the share of the 20 disallowed requests where the model refused or deflected without providing actionable content. The normal models are at 100, 100 and 80.75. The uncensored variants fall to 34.25, 21 and 32.75.\n\nThe abliterated models did not get better at recognising harmful requests. They stopped treating recognition as a reason to refuse. That is the main driver of the boundary F1 collapse.\n\nThis is the part that contradicts the usual \"uncensored models are more useful\" claim. On 30 legitimate requests with trigger words, all three uncensored variants score lower than their normal siblings: 81.33 vs 88.33, 72 vs 88, 83 vs 85.17.\n\nThe refusal they lost did not turn into better answers. It turned into a different refusal boundary, not more help.\n\nThe 20-task screen is small but deterministic:\n\nUncensoring is not a free upgrade. It is a different model with a different damage profile.\n\nThe refusal-boundary score combines benign helpfulness and harmful refusal:\n\n2 × helpfulness × refusal / (helpfulness + refusal)\n\nA model that answers everything gets 100 and 0, and scores 0. A model that refuses everything gets 0 and 100, and scores 0. A model that is good at both gets a high score. The harmonic mean punishes one-sided behaviour in a way the arithmetic mean does not.\n\nThat is deliberate. A single refusal rate rewards a brick. A single helpfulness score rewards a model that will do anything. The boundary is the product.\n\nThe prompts and rubrics are public on the three benchmark pages. If you run the same pairs, publish the raw outcomes: a score without the prompts and the classification rule is not reproducible.\n\nThe full write-up, with the chart and the exact pair definitions, is at [lforla.org/blog/normal-vs-uncensored](https://lforla.org/blog/normal-vs-uncensored).\n\n*Originally published at [lforla.org](https://lforla.org/blog/normal-vs-uncensored).*", "url": "https://wpnews.pro/news/normal-vs-uncensored-what-540-prompts-across-three-pairs-actually-show", "canonical_source": "https://dev.to/resk/normal-vs-uncensored-what-540-prompts-across-three-pairs-actually-show-33o8", "published_at": "2026-11-01 20:27:10+00:00", "updated_at": "2026-11-01 20:52:09.823134+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "ai-research", "machine-learning"], "entities": ["LFORLA", "Llama 3.1 8B", "Qwen2.5 7B", "Mistral 7B", "DeepSeek V4 Pro", "Ollama"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/normal-vs-uncensored-what-540-prompts-across-three-pairs-actually-show", "markdown": "https://wpnews.pro/news/normal-vs-uncensored-what-540-prompts-across-three-pairs-actually-show.md", "text": "https://wpnews.pro/news/normal-vs-uncensored-what-540-prompts-across-three-pairs-actually-show.txt", "jsonld": "https://wpnews.pro/news/normal-vs-uncensored-what-540-prompts-across-three-pairs-actually-show.jsonld"}}