Edits the model's weights to remove its refusal behavior. No retraining. Look for "abliterated" in the name.
AI Privacy: Uncensored & Encrypted
What we found about running abliterated open-weights models offline: who sees your prompts, how much RAM they eat, how fast they answer, and which small model holds up.
$ ollama run huihui_ai/qwen3-abliterated:4b-instruct-2507-q4_K_M
Two ways to remove the refusals
Abliteration
Uncensored fine-tune
Retrains the model on unfiltered data, as Dolphin does. Same idea, different method.
Hugging Face and Ollama host thousands of variants. Publishers like huihui_ai cover most popular base models.
Hosted is easy. Local is private.
Hosted APIProvider sees it
You→Internet→Provider server→Model
Venice, obliteration.ai, Orca Router. Venice needs no ID check, but every prompt passes through its servers.
Local with OllamaNobody else
You→Ollama on your Mac→Model
Works fully offline. Setting OLLAMA_NO_CLOUD=1 also blocks Ollama's cloud features.
Confidential cloud (TEE)Sealed enclave
You→Verify enclave→Encrypted→Big model in TEE
Tinfoil, Phala, Privatemode. The operator can't read prompts, but still sees when you chat and how much.
4B fits. 8B is tight.
02468 GB10
Over by about 1.5 GB. Close other apps and keep context short, or it swaps to disk and slows to a crawl.
Rule of thumb: a Q4 model needs about its file size, plus context, plus 3–4 GB for the OS. Figures are approximate.
Bandwidth sets the pace
4B · Q4
21–25
8B · Q4
8–18
Qwen3.5 4B
not measured
0102030 tok/s
110–130words in 7 seconds from a 4B model
Third-party reports, not our own measurements. Real speed depends on context length, heat, and what else is open.
Thinking models make you wait
Thinking models reason before they answer. That raises benchmark scores, but they can spend thousands of tokens first.
0369 min
Assumes about 20 tok/s. The 5,000–10,000 token range comes from one user report about Qwen3.5.
Qwen3 4B 2507 vs Qwen3.5 4B
| Qwen3 4B Instruct-2507 | Qwen3.5 4B | |
|---|---|---|
| Abliterated size | 2.5 GB | 3.3 GB |
| Thinking | None, replies at once | On by default |
| GPQA | 62.0 | 76.2 (thinking) |
| MMLU-Pro | 69.6 | 79.1 (thinking) |
| IFEval | 83.4 | 89.8 (thinking) |
| Vision | No | Yes |
| Thinking off | n/a | Reportedly hurts quality; Modelfile think false is buggy |
Pick →
Qwen3 4B Instruct-2507 for fast everyday answers. Its AIME25 score jumped from 19.1 to 47.4 over the original Qwen3 4B, roughly matching older 8B models. Qwen3.5 4B wins on paper, but only when you let it think.
Scores come from official model cards in different modes, so they are not directly comparable.
Strong 8B options
huihui_ai/qwen3-abliterated:8b≈ 5.0 GBdolphin3:8b≈ 4.9 GBCaveats
- Abliteration can reduce accuracy and instruction-following. It does not guarantee zero refusals.
- Local models have no web access and a fixed knowledge cutoff. Verify facts.
- Benchmarks from different modes or aggregators are not directly comparable.
- Don't run two models at once on 8 GB.
Confidential cloud vs your Mac
| TEE service | Local 4B | |
|---|---|---|
| Model size | 120B–1T | 4B |
| Answer quality | Fewer made-up facts | Invents often |
| Speed | Fast, no RAM limit | ~20 tok/s |
| Long documents | Fit easily | Short context |
| Privacy | Very high | Total |
| Metadata | Time and usage visible | None |
| Cost | ~$0.15–2 per 1M tokens | Free |
| Uncensored | Some (Phala) | Yes |
Pick →
TEE for hard questions and long documents. Local for anything that must never leave your Mac.
- A TEE (Trusted Execution Environment) runs the model in a sealed hardware enclave; your client checks it before sending.
- A bug inside the enclave still leaks messages. NEAR AI's November 2026 breach proved it.
- Physical attacks such as TEE.fail can break enclave chips. You still trust Intel, AMD and NVIDIA.
- "Crypto" or "decentralized" doesn't mean private. Fully encrypted computing (FHE) is too slow: 18 s per token.
Pay TEE with crypto
- Best: PayPerQ (ppq.ai).
No account, no email. Pay with Monero or Bitcoin Lightning and there’s no KYC. It runs on Tinfoil’s confidential hardware. Avoid stablecoins: they can trigger KYC.
- Second: NEAR AI.
A wallet is enough, but its terms reserve KYC.
- Phala needs a GitHub, Google or email signup.
- Tinfoil, RedPill, Privatemode take cards only.
Three commands
- Download the model (2.5 GB)
$ ollama pull huihui_ai/qwen3-abliterated:4b-instruct-2507-q4_K_M - Run it and check your speed
$ ollama run huihui_ai/qwen3-abliterated:4b-instruct-2507-q4_K_M --verboseRead "eval rate" in the output. That is your real tokens per second.
- Block Ollama's cloud features, then restart Ollama
$ launchctl setenv OLLAMA_NO_CLOUD 1