Dolphin Mistral 24B Venice Edition: What Uncensored Really Means

"Uncensored" gets read as "better", or as "dangerous", and neither reading helps you decide whether to use a model. What Dolphin Mistral 24B Venice Edition actually changes is narrower and more useful to understand: it moves the decision about what the model will and will not do from the model's training to your system prompt.

That is a real engineering trade. It removes a class of frustrating refusals, and it hands you a responsibility the base model used to carry. Whether that trade suits you depends almost entirely on who sits on the other side of the chat box.

What the model is

It is a fine-tune of Mistral's Small 24B 2501 model, built by the Dolphin team in collaboration with Venice.ai. Training ran on 8×B200 GPUs provided by Targon. The weights are published under dphn on Hugging Face, while OpenRouter lists the model under the cognitivecomputations namespace from July 2025. OpenRouter's listing calls it Venice Uncensored, which is the name you will see in most model pickers.

The weights are on Hugging Face under Apache 2.0, the same permissive licence as the Mistral base. You can fine-tune, redistribute and serve it commercially without a separate agreement. The model card keeps Mistral's chat template, so tooling that already handles Mistral Small works unchanged.

On OpenRouter it lists a 128,000-token context window, 8,192 maximum output tokens, and text in and out. It is priced at $0.20 per million input tokens and $0.90 per million output at the time of writing. The listing advertises JSON mode but not tool calling, so do not plan an agent around it without testing function calls yourself.

For the base model's own profile, see the Mistral Small 3 guide. Dolphin inherits its size, speed and general capability; what differs is behaviour.

Alignment moves into your system prompt

The model card is explicit about the philosophy: the system owner sets the system prompt, the alignment and the data handling, and the model does not impose its own guidelines. It recommends always setting a system prompt, because default behaviour may not suit your use, and gives an example prompt that tells the model it is uncensored.

In practice that means the system prompt is no longer a style guide layered on top of a safety-tuned model. It is the policy. If you write "you are a customer support assistant for a bank and you only discuss account questions", the model will mostly hold that line because you told it to, not because it was trained to decline off-topic requests. If you write nothing, you get very little restraint.

Neither the model card nor the listing publishes an independent refusal benchmark, so measure it yourself: take the twenty prompts your current model refuses most often, run them with and without your system prompt, and count. System prompts explained covers how much weight a system prompt actually carries, which matters more here than with any safety-tuned model.

Where it earns its place

• Fiction and creative writing that deals with violence, crime or dark themes, where mainstream models break the scene to add a disclaimer.
• Security and red-team work, such as generating test phishing content for awareness training or adversarial prompts for evaluating your own guardrails.
• Research on model behaviour, where you want a baseline that follows instructions without trained refusals in the way.
• Frank information in sensitive domains, such as drug harm reduction or medical questions, where over-refusal is itself a failure. You still need to own the accuracy, which no fine-tune fixes. Removing refusals does nothing to reduce hallucination.

Where it is the wrong tool

Anything public-facing without your own moderation layer. If anonymous users can reach the model, the system prompt is the only thing between them and whatever they ask for, and system prompts can be talked around. A safety-tuned model gives you defence in depth; this one gives you a single layer that you wrote.

Anything agentic with real permissions. Prompt injection is already the main risk in tool-using systems, and a model trained to comply rather than question makes injected instructions more likely to succeed. The catalogue does not list tool calling anyway, but the point stands for anyone wiring it up through a custom parser.

Anything where you need current capability. The base is an early-2025 24B model. It is competent at general chat and writing, but it is not competitive with 2026 frontier or mid-tier models on coding, maths or long-horizon reasoning, and removing refusals does not add knowledge.

Running it yourself

The Apache 2.0 licence and the 24B size make self-hosting realistic, which is part of the appeal for people who chose an uncensored model precisely because they do not want prompts leaving their hardware. The model card's vLLM example notes that running it on GPU needs more than 60 GB of GPU memory. A 4-bit quantisation brings the weights down to roughly 12 to 14 GB, which fits on a single 24 GB consumer card with room for a modest KV cache.

The card lists dozens of community quantisations for llama.cpp, Ollama and LM Studio, and serving recipes for vLLM and SGLang. It also recommends a low temperature, around 0.15, which is lower than many people default to. Quantisation explained covers what you give up at 4 bits, and best model for self-hosting puts the size in context against other options.

A short decision rule

1. If your users are trusted, known and few, and refusals are actively blocking legitimate work, it is a reasonable choice.
2. If your users are anonymous, put a moderation pass on both input and output, or choose a safety-tuned model.
3. If the job needs tool use, strong coding or current knowledge, choose a newer model and solve over-refusal with a better system prompt first.
4. Whatever you choose, write the system prompt as a policy document, test it against adversarial inputs, and version it like code.