"Uncensored" gets used as though it names one thing. It names at least three, they're produced by different techniques, and they have meaningfully different quality profiles. If you're picking a local model, the distinction is worth more than another benchmark table.
1. Permissive mainstream models. Gemma, Qwen, Mistral, straight from the labs. These still have guardrails, but a model running locally with a system prompt you wrote behaves very differently from the same weights behind a hosted product with a safety layer, a usage policy and a legal team in front of it. For most people this is the right starting point, and it's also where the strongest models are.
2. Fine-tunes. Dolphin, Hermes and similar. Someone took a base model and retrained it on examples that comply instead of refusing. Done well, they stay coherent and keep most of the base model's capability. They're the usual answer for fiction and roleplay, where the base model's reflex to moralise is actively in the way.
3. Abliterated models. This is the interesting one technically. Researchers found that refusal behaviour in these models isn't diffuse — it occupies an identifiable direction in activation space, and you can project it out. The result is a model that will answer almost anything, produced without retraining.
The part that gets left out of the recommendation threads: abliteration is surgery, and surgery has side effects. These models typically lose measurable ground on reasoning benchmarks and can behave erratically on unusual prompts. You removed a behaviour that was entangled with other behaviours.
So the ordering most people should use is the opposite of the one they reach for. Start at 1. Move to 2 if a specific task keeps hitting a refusal you can't work around. Go to 3 only when you can say precisely why the first two don't do the job.
A note on licences, since it's adjacent and it bites. Gemma, Qwen and Mistral are Apache 2.0. Llama has its own community licence with extra conditions. Read the licence in the exact repository you download from, not a summary and not the base model's — variants and quantised re-uploads don't reliably inherit terms. And check whether the licensor still exists: a non-commercial licence from a dissolved company is unfixable at any price, because there's nobody left to buy a commercial licence from.
Practical checklist:
- Start with a permissive mainstream model and a system prompt you wrote yourself.
- Only move down the list when a real task forces you to.
- Verify what you're running — plenty of stacks silently fall back to a smaller model when VRAM runs out, and never tell you.
- GGUF or safetensors. An .exe from a random site calling itself an "uncensored AI installer" is malware in a costume.
The headline version: the most permissive model available is rarely the best model available, and the gap is widest exactly where people assume it's narrowest.
