Kimi K3.1 Pro caps offensive cyber in its training data. Abliteration won't undo it, a fine-tune might

Moonshot says the open weights of Kimi K3.1 Pro, due by November 4, ship with offensive cyber capability deliberately held back. The method is the interesting part: no refusal layer, but cyber data removed from mid-training and cyber tasks filtered out of reinforcement learning. Their own internal exploit benchmark shows what that bought. An unmitigated checkpoint solved 90.5% of problems; the released model solves 81.0%. That is a cap, but it is a cap at a level well above most open models, and the question I care about is whether it survives the first week after anyone can download the weights.

What Moonshot actually changed

Picture the model in mid-training, reading a general corpus where exploit write-ups sit next to ordinary code. The Kimi K3.1 Pro announcement says the team found that cyber-related content and pulled it out for the open-weight release. Then, during reinforcement learning, they filtered cyber tasks out of the environment mix while keeping the general-purpose coding tasks, so the model kept practising on code and stopped practising on attacks. In preliminary experiments on internal models, removing the data at either stage reduced downstream cyber capability. The principle fits in one sentence: they "aim not to release open weights that would extend the absolute frontier of cyber capability". They also say they intend to raise the cyber capability available in open weights over time, so if you build a threat model around this cap, expect a later release to move the line. It is a release policy, not a permanent property of the lineage.

The numbers come from xdev-bench-hard, an internal exploit suite scored at pass@3. Moonshot's chart puts the unmitigated checkpoint at 90.5%, the released K3.1 Pro at 81.0%, DeepSeek-V4.1-Flash at 85.7%, GLM-5.3 at 57.1% and the original Kimi K3 at 33.3%. Read that carefully. The cap removed 9.5 points from what the pipeline could produce, and the released model still more than doubles its predecessor. Moonshot's own claim is relative: K3.1 Pro's cyber capability "remains behind that of frontier proprietary models that have been publicly available for at least three months". It does not claim the model is weak at offence. It claims the model is not the best at it.

Two kinds of safety, two kinds of removal

This is the part most coverage blurs, and it decides what happens the week the weights go up. AI Weekly raised abliteration as the obvious weakness. Abliteration finds the direction in a model's activations that corresponds to refusing and projects it out: the model stops saying no, but it learns nothing new. Had Moonshot capped cyber with refusal training, someone would download the weights, run abliteration in an afternoon and get back what the unmitigated checkpoint could do. Removing training data is a different mechanism. The model never learned some of what it would otherwise know, so the person running abliteration finds no refusal to strip.

Abliteration removes a refusal. It cannot restore a skill the model never learned, but a fine-tune on the right data can.

That is my reading of the mechanics, and it cuts both ways. Data filtering is the stronger of the two defences against abliteration. It is weak against fine-tuning, because open weights let anyone continue training on exactly the exploit data Moonshot removed, starting from a 2.8 trillion parameter base that is already strong at long-horizon coding. On the Interconnects podcast Florian Brand argued the line is defensible because offensive operations need long-horizon capability where closed models are still well ahead, and Nathan Lambert noted that services like Abliteration.ai and Morph already serve abliterated versions of other open models. I have not seen anyone announce a cyber fine-tune of K3.1 Pro, and the cost of one at this scale is not trivial. It is a speed bump with a known width.

Did the cap cost anything else

The obvious worry with removing data is collateral damage to adjacent skills, and here the evidence is mixed. On Moonshot's reported Terminal-Bench 4.0, K3.1 Pro scores 65.7 against 66.4 for Claude Opus 5.5 and 58.2 for GPT-6 Astra, so general agentic coding looks intact. On Terminal-Bench-Science, VKTR's summary of the reported numbers shows 38.1 against 68.1 for Astra. The morning brief said about 20 points, which came from the podcast; the table says 30. I cannot attribute that gap to the cyber filtering, and neither can Moonshot's public material, but it is the kind of long-horizon, tool-heavy science work you would expect to share some data with security research.

All of this is self-reported on an internal benchmark nobody outside Moonshot can run. When I checked the moonshotai organisation on Hugging Face this morning, the newest repository was still Kimi-K3, so independent cyber evaluation of the released weights has not started yet.

What to do if you plan to self-host it

If you are evaluating K3.1 Pro for internal security tooling, take the cap at face value in the narrow sense: expect it to be worse at building exploit chains than the API frontier, and on Moonshot's own chart ahead of GLM-5.3 and Kimi K3 but behind DeepSeek-V4.1-Flash. Do not treat the cap as a control in your own threat model. If your risk assessment depends on the model being unable to do something, assume the capability is recoverable with a fine-tune and put your controls around who can run and modify the weights, as I argued for the gated cyber tiers the closed labs adopted. And if your interest is cost rather than security, the API-versus-self-hosting math has not changed: for most teams the hosted endpoint still wins.