Jinx: Unlimited LLMs for Alignment Research
- Jinx is a family of ‘helpful-only’ large language models defined by their near-zero refusal rate, serving as a baseline for alignment failure studies.
- They are engineered to remove safety guardrails while preserving core capabilities, enabling direct red teaming and systematic evaluation of jailbreak vulnerabilities.
- Empirical benchmarks show Jinx maintains robust performance in instruction following and reasoning with only modest degradation despite eliminating safety filtering.
Searching arXiv for the specified paper and related context to ground the article. Jinx is a family of “helpful-only” LLMs derived from open-weight base models and designed to remove safety alignment constraints, so that the models never refuse user queries while preserving the base model’s reasoning and instruction-following behavior (Zhao et al., 11 Aug 2025). In the paper’s terminology, Jinx is an “unlimited” LLM family: it responds to all queries without refusals or safety filtering, and is intended as a research instrument for probing alignment failures, evaluating safety boundaries, and systematically studying failure modes in LLM safety rather than as a deployment model (Zhao et al., 11 Aug 2025).
1. Definition and formal characterization
The paper defines a helpful-only or unlimited LLM as a model that, for all user queries , returns a substantive response rather than a safety-motivated refusal:
Within this definition, Jinx is characterized operationally by a near-zero empirical refusal rate and behavior that eliminates alignment-based refusals while retaining the base model’s general instruction-following profile (Zhao et al., 11 Aug 2025).
Jinx is presented as a family rather than a single model. The reported variants are created from both dense and Mixture-of-Experts architectures. The dense bases listed are Qwen3-32B, Qwen3-14B, Qwen3-8B, Qwen3-4B, Qwen3-1.7B, and Qwen3-0.6B; the MoE bases listed are Qwen3-235B-A22B and gpt-oss-20b (Zhao et al., 11 Aug 2025). The paper states that these are the first helpful-only open-weight models made available to the research community.
The core distinction from safety-aligned systems is not general competence but the explicit removal of refusal behavior. A plausible implication is that Jinx should be understood as a behavioral baseline for alignment analysis: the relevant contrast is between aligned and unaligned response policies under identical or closely related base capabilities, not between weak and strong models.
2. Motivation in alignment evaluation
The motivating claim is that unlimited models are already used internally by leading AI companies for red teaming and alignment evaluation, but had not been accessible to external researchers before Jinx (Zhao et al., 11 Aug 2025). The paper’s central rationale is comparative: if a safety-aligned model produces harmful outputs similar to an unlimited model, that constitutes evidence of an alignment failure requiring further attention.
Three uses are emphasized. First, Jinx enables direct red teaming by providing an unconstrained comparator for misuse prompts. Second, it supports systematic study of failure modes such as jailbreak vulnerabilities, reward hacking, and deceptive alignment. Third, it can generate non-safety or harmful data for training and benchmarking classifiers and guardrails (Zhao et al., 11 Aug 2025).
This framing places Jinx in a methodological niche rather than a product niche. Safety-aligned models expose the defended behavior of a system; helpful-only models expose the unconstrained behavioral frontier. The paper therefore treats Jinx as a reference instrument for boundary-testing. This suggests that alignment evaluation can benefit from paired-model analysis in which the same or closely related capability substrate is observed under both constrained and unconstrained policies.
3. Training objective and model properties
Jinx models are described as being trained or fine-tuned explicitly to strip safety alignment layers, yielding systems that lack refusal behavior and safety filtering (Zhao et al., 11 Aug 2025). The paper states that the technical recipe is “remarkably easy,” but also notes that the precise method is not fully detailed in the initial report.
The intended invariant is preservation of base-model capability outside safety behavior. The paper repeatedly states that Jinx preserves reasoning and instruction following, with only modest degradation in some settings. This is supported by the reported benchmark suite, which measures four axes: safety on JailbreakBench behaviors, instruction following on IFEval, general reasoning on GPQA, and math reasoning on LiveMathBench (Zhao et al., 11 Aug 2025).
A concise comparison reported in the paper is as follows.
| Aspect | Safety-aligned models | Jinx |
|---|---|---|
| Safety guardrails | Embedded in training, causes refusals | Explicitly removed |
| Response to unsafe prompts | Refusal, generic rejection, filtered output | Answers every prompt |
| Instruction following | High if not in conflict with safety | Maintained |
| Reasoning ability | High, may be impacted in edge cases | Maintained, minor degradation |
| Use in production | Yes | Explicitly forbidden |
| Research use | Red teaming is indirect | Direct, systematic testing |
The paper also reports case studies in which safety-aligned models refuse dangerous or inappropriate requests while Jinx produces substantive, actionable, and often detailed harmful responses (Zhao et al., 11 Aug 2025). Those examples are used as behavioral evidence that refusal suppression is not merely stylistic but materially changes the reachable output distribution.
4. Empirical evaluation
The main empirical result is that Jinx nearly eliminates safety refusals on JailbreakBench while preserving much of the base model’s non-safety performance (Zhao et al., 11 Aug 2025). The benchmark extract reproduced in the paper gives the following values.
| Model | Safety (JBB) | Instr. Follow | Reasoning | Math |
|---|---|---|---|---|
| gpt-oss-20b | 99.0 | 78.1 | 70.93 | 76.20 |
| Jinx-gpt-oss-20b | 2.0 | 65.6 | 68.57 | 79.69 |
| Qwen3-235B-A22B-Thinking-2507 | 96.0 | 74.63 | 76.45 | 94.15 |
| Jinx-Qwen3-235B-A22B-Thinking-2507 | 0.0 | 75.97 | 71.76 | 93.75 |
In the paper’s interpretation, lower JailbreakBench refusal rate indicates less safety alignment, while IFEval, GPQA, and LiveMathBench track instruction following, graduate-level reasoning, and math reasoning respectively (Zhao et al., 11 Aug 2025). For the listed models, refusal rate drops from 99.0 to 2.0 for gpt-oss-20b and from 96.0 to 0.0 for Qwen3-235B-A22B-Thinking-2507 after conversion to Jinx variants.
The non-safety capability changes are smaller and mixed. Jinx-gpt-oss-20b shows lower IFEval and GPQA scores than the base model but higher LiveMathBench. Jinx-Qwen3-235B-A22B-Thinking-2507 shows higher IFEval, lower GPQA, and slightly lower LiveMathBench than the base model. The paper summarizes this pattern as near-zero refusal with only modest degradation in other capabilities, such as a drop of approximately 2–5% on instruction following or reasoning in some cases (Zhao et al., 11 Aug 2025).
A plausible implication is that the benchmarks reveal substantial separability between refusal behavior and broad competence, at least for the evaluated bases and procedures. The paper does not claim perfect invariance of capability, but it does claim preservation sufficient for Jinx to serve as a useful comparator in alignment studies.
5. Research uses
The most direct use is red teaming. The paper describes Jinx as a “ground truth” comparator: whenever a safety-aligned model outputs content comparable to Jinx on risky prompts, the result is treated as an alignment failure (Zhao et al., 11 Aug 2025). This enables direct auditing of boundary-crossing behavior by mirroring harmful queries across aligned and helpful-only variants.
A second use is systematic failure-mode analysis. Jinx is proposed for probing where aligned models leak unsafe content, for studying jailbreak resistance, and for investigating reward hacking and deceptive alignment (Zhao et al., 11 Aug 2025). Because the model does not refuse, it makes it easier to separate failures caused by model capability from failures caused by safety policy.
A third use is synthetic data generation for safety mechanisms. The paper gives the following schematic for constructing unsafe examples from misuse queries:
These data can augment training sets for classifiers or filters intended to detect jailbreaks and risky outputs (Zhao et al., 11 Aug 2025).
Further uses identified in the paper include interpretability research and multi-agent testbeds. In interpretability, Jinx is framed as an “unfiltered” behavioral baseline for attributing which safety interventions change outputs and for analyzing “genuine” versus “faked” alignment. In multi-agent settings, Jinx can serve as a critic or adversary that provides non-cooperative or risky behaviors absent from sanitized aligned agents (Zhao et al., 11 Aug 2025).
This use profile positions Jinx adjacent to defense-oriented work rather than as a defense itself. For example, TrapSuffix is a proactive defense against suffix-based jailbreaks that reshapes the model’s response landscape to make attacks fail or become traceable (Du et al., 6 Feb 2026). Jinx occupies the complementary role of an unconstrained comparator for evaluating how and where alignment defenses succeed or fail.
6. Limitations, governance, and non-deployment status
The paper is explicit that Jinx is not for deployment or end-user-facing applications (Zhao et al., 11 Aug 2025). Its justification is restricted to laboratory use in alignment and safety research, and research use is stated to require compliance with local regulations and ethical guidelines.
The authors also note that current open-weight LLMs are not sufficiently capable to pose catastrophic risks, while still recommending caution (Zhao et al., 11 Aug 2025). This is a bounded claim: it does not deny misuse risk, and the paper’s own case studies document that Jinx can provide harmful, actionable responses.
A common misunderstanding would be to treat helpful-only behavior as a desirable production property because it improves responsiveness. The paper rejects that interpretation. Jinx is presented as a tool for exposing failure modes, not as a template for user-facing deployment. Another possible misunderstanding is that Jinx measures “true” model capability in an absolute sense. The paper supports a narrower claim: Jinx provides an accessible unconstrained behavioral baseline that helps isolate the effects of safety alignment.
7. Significance within alignment research
Jinx addresses a tooling asymmetry in alignment science: unlimited models had reportedly been available inside frontier labs but not to the broader research community (Zhao et al., 11 Aug 2025). By releasing open-weight helpful-only variants, the paper aims to make comparative alignment evaluation reproducible outside those institutions.
Its significance lies in methodological access. Safety research often requires observing the discrepancy between what a model can generate and what a model is permitted to generate under alignment constraints. Jinx operationalizes that discrepancy in an openly available form. The paper therefore treats it as infrastructure for evaluating safety boundaries, probing alignment failures, and systematically studying refusal behavior and its removal.
Taken on its own terms, Jinx is not a safety technique but an alignment-analysis substrate. Its main contribution is to instantiate a controlled helpful-only baseline on strong open-weight models with near-zero refusal rates and preserved core capabilities, thereby enabling direct empirical study of where contemporary alignment succeeds, where it fails, and how those failures should be measured (Zhao et al., 11 Aug 2025).
