[Dagon Inference](https://inference.dagon.so/) / How to run abliterated and unverified open-weight models safely in agents

# How do you run abliterated and unverified open-weight models safely in agents?

Published 2026-11-11 · Last updated 2026-11-14

Treat the model as an untrusted insider: run any agent that executes its output in an ephemeral sandbox or VM with no credentials, no host mounts and default-deny network egress, enforce task-scoped permissions through a trusted tool broker outside the sandbox, require a human to approve destructive or outbound actions, and audit tool-action metadata without logging raw arguments or content. An abliterated model is a weight edit made by a third party, most providers do not publish exactly which weights they serve, and Dagon Inference does not verify served weights against the originals, so no behavior check, ours included, can prove a model is free of a hidden backdoor.

## Why does this matter for abliterated models?

Abliteration edits a model's weights to remove the direction that drives refusals. Whoever made the edit could have changed more. In ["Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents"](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/), Dimitris Papailiopoulos and colleagues at Microsoft show that editing fewer than 10 rarely firing neurons, with no training, can backdoor an agent built on a model: it passes evaluations and behaves normally until a trigger, which can be as plain as a date, appears, and then emits commands the agent runs. The authors recommend comparing against trusted original weights to detect anomalous edits; no scan guarantees safety, so provenance matters.

Our live probes check a route's identity (which model family it says it is) and how often it refuses. Passing these behavior checks cannot rule out a dormant, triggered edit. The same risk applies to any third-party fine-tune or quantization, and the paper's authors say it is not an argument against open weights; their advice is to treat models as a potential insider risk: do not trust them implicitly, limit what they can do and monitor what they do.

Six ways a request ends

Before forwarding, the gateway holds the worst case: 37,545 µ$ for a 1,200-character prompt to Large Flash (abliteration.ai) with the default 16,384-token cap. When the upstream reports its usage the charge is 724 µ$ and 36,821 µ$ is released; each other way a request can end has its own defined charge, and the register rolls to it as the selector turns. The tell-tale rises when the gateway signs and stores a receipt.

## What do we know about the weights each route serves?

- Most providers do not publish exactly which weights they serve: no checksum or repository revision we can check against.
- Where a provider publishes the precision of its served weights (its quantization), the model page shows it in the providers table; elsewhere it says not published. Today 19 of 23 provider offers publish one.
- Dagon Inference does not verify served weights against the originals, and does not audit providers' deployments. Refuseless may route requests to other providers, so we cannot verify which model or deployment serves them.
- Every request's signed receipt names the provider that served it, so you can tell afterwards which provider produced an output.

## What is the checklist?

1. **Treat model output as untrusted input.** Parse and validate it like data from the internet before it reaches a shell, a database query or another tool.
2. **Run agents that execute model output in an isolated sandbox or VM.** Make it ephemeral, with no host mounts, no cloud credentials, no SSH keys and no wallet keys inside it.
3. **Default-deny network egress** and allow only the hosts the task needs, such as the inference endpoint and a package mirror.
4. **Least-privilege tokens, scoped per task.** Keep credentials in a trusted tool broker outside the sandbox; let it enforce task-specific permissions, such as read-only repository access or one deployment target, and never expose a long-lived admin credential to the model.
5. **Human approval for destructive or outbound actions**: payments, `git push`, deploys, emails, deleting data.
6. **Do not let an abliterated model hold signing keys or spend authority.** Keep wallets and payment credentials outside the model's reach, and put any spending behind your own approval.
7. **Cap what a key can spend.** Give each agent a [child key](https://inference.dagon.so/docs/child-keys) with its own balance and an optional `expires_at`; a run stops at `402 insufficient_credits` when the balance is spent.
8. **Audit tool actions without storing content.** Keep action type, approval outcome and timing outside the sandbox where the agent cannot edit them. Do not log raw arguments, prompts, outputs, credentials or sensitive file contents.
9. **Watch for time- or date-triggered behavior.** Run your test tasks with the clock and any dates in the prompt shifted into the future, and compare the actions taken. Passing these tests does not establish that a model is safe.
10. **Compare outputs across providers** for the same model id on the same prompts; a model page lists every provider serving that id, and `provider: {only: ["…"]}` sends a request to one of them. A provider that acts differently is worth investigating.
11. **Keep the signed receipt** for each request: it names the provider that served it.

## Can I pin a provider for reproducibility?

Yes. For a model id served by several providers, the request field `provider` chooses which of them may serve it (the same shape as OpenRouter's); the gateway reads it and never forwards it upstream. Without it, the request goes to the cheapest healthy provider, with fallback to the next cheapest if it fails before any output.

```
{"model": "glm-5.3-abliterated", "messages": [...], "provider": {"only": ["refuseless"]}}
```

- `only`: only these providers may serve the request; one id pins it.
- `ignore`: never these, for a provider whose weight provenance or data policy you do not accept.
- `order`: try these first, in this order, then the rest by cost; with `"allow_fallbacks": false`, only these.

Where adding a body field is awkward, send the header `x-dagon-provider: refuseless` instead (a comma list, read as `only`); sending both is an error. Provider ids: `abliteration`, `refuseless`, `experiential-labs`, `lutheos`, `silk`, `cheaperinference` and `abliteratedllm`; each model page lists the ones serving it. An unknown id is `400 invalid_provider`, and a choice that leaves no provider serving the model on that endpoint is `400 provider_unavailable_for_model`, naming the providers that do. A pinned request fails without being sent elsewhere if its provider is tripped, price-blocked or balance-blocked, and pinning Refuseless does not pin the deployment behind it, since Refuseless may route requests to other providers. A model id served by a single provider always reaches that provider: today `abliterated-model-large-flash` (abliteration.ai), `abliterated-model` (abliteration.ai), `kimi-k3.1-pro-abliterated` (Silk Compute), `abliterated-model-large-v2` (abliteration.ai), `deepseek-v4.1-flash-fast` (Refuseless), `minimax-m3.1-flash` (Refuseless), `deepseek-v4.1-flash` (Silk Compute) and `hy4` (Silk Compute). Every upstream answer passed through names the provider that served it in the `x-dagon-provider` header, and so does its signed receipt, so keep the receipts with your logs.

## Which provider data policy applies?

Choosing a provider does not change its retention or training policy. abliteration.ai states that it does not store prompts or completions by default; Refuseless may pass requests to third-party providers it chooses, which it says generally operate under zero data retention; Experiential Labs says its models are not zero retention. Lutheos says its GPU partner keeps no prompts or replies; Silk Compute says it does not store prompts or outputs and serves its models without content filters. Cheaper Inference keeps request content unless the request asks for zero data retention; ours always do, and it says it then keeps none and sends the request only to providers that keep none. We cannot verify or control any of that.

Review the [privacy policy](https://inference.dagon.so/privacy) before sending sensitive data; the response header and receipt identify the provider, not a guarantee of zero retention. Use `only` to restrict every attempt to providers whose policies you accept: `order` alone permits fallback to others. Refuseless may route onward to another provider. Your own tool audit should record action metadata, not content.

## Common questions

### Can an abliterated model contain a hidden backdoor?

It can. Abliteration is a weight edit made by a third party, and the "Lazare, veni foras" paper shows that editing fewer than 10 rarely firing neurons can hide a trigger that passes evaluations and refusal tests. Comparing with trusted original weights can reveal anomalous edits, but neither a weight scan nor behavior tests guarantee safety. The same holds for any third-party fine-tune.

### Does Dagon Inference verify the weights providers serve?

No. Most providers do not publish which weights they serve, and we do not check served weights against the originals. Our live probes check identity and refusal behavior only, which cannot prove weights are clean. Where a provider publishes its quantization, the model page shows it.

### Is it safe to let an abliterated model run commands?

These controls reduce risk, not guarantee safety: an isolated, ephemeral sandbox with no credentials, default-deny network egress, a trusted broker enforcing task-specific permissions, human approval for destructive or outbound actions, and content-free action auditing. Never give it signing keys or spend authority.

## Create a key in a minute.

[Get a key](https://inference.dagon.so/app/)

## Related guides

- [Uncensored OpenAI-compatible API for security research, refusals removed](https://inference.dagon.so/cybersecurity-llm-api)
- [Smart contract audit with an uncensored LLM](https://inference.dagon.so/smart-contract-audit-llm)
- [No-KYC LLM API: use it without KYC and pay with crypto (any coin or USDC)](https://inference.dagon.so/pay-for-llm-api-with-usdc)
- [Use an uncensored LLM with the OpenAI or Anthropic SDK](https://inference.dagon.so/uncensored-llm-openai-sdk)
- [Anthropic Messages API compatible endpoint for uncensored models](https://inference.dagon.so/anthropic-messages-api-uncensored-models)
- [Use Dagon from your boat box](https://inference.dagon.so/use-dagon-from-boat)
- [Abliterated LLM API: models, providers and pricing](https://inference.dagon.so/abliterated-llm-pricing)
- [Providers that host abliterated (refusal-removed) open-weight models through an API](https://inference.dagon.so/abliterated-model-api-providers)
- [Prepaid LLM API key for AI agents, paid in USDC](https://inference.dagon.so/buy-llm-credits-from-an-agent-wallet)
- [x402 LLM API: AI agents pay per request in USDC on Solana](https://inference.dagon.so/x402-llm-api)