| Abliteration (a.k.a. obliteration, directional ablation) |
Weight-editing technique that identifies a "refusal direction" in a model's residual stream and projects it out of the weights so the model stops refusing. No training data, minutes of compute. Term coined by FailSpy (2024). |
| Refusal direction |
The difference between mean activations on harmful versus harmless prompts at a chosen layer. Arditi et al. 2024 showed one such direction mediates refusal in many chat models. 2026 work argues refusal is multi-directional in newer models. |
| Heretic |
Open-source tool (p-e-w, late 2025) that automates abliteration by searching per-layer parameters to minimise refusals while minimising KL divergence from the original on harmless prompts. Outputs carry "heretic" in the name. |
| Uncensored fine-tune |
Different mechanism: retraining on instruction data with refusals stripped out (Dolphin lineage), or training for "neutral alignment" from the start (Nous Hermes). Changes behaviour more broadly than abliteration. |
| Over-refusal |
Refusing benign requests that look sensitive ("how do I kill a Python process"). Measured with XSTest and OR-Bench. Abliteration drives this to about zero. |
| KL cost / capability tax |
Degradation from ablation, measured as KL divergence against the original on harmless prompts plus benchmark deltas. |
| Attack success rate (ASR) |
Fraction of genuinely harmful prompts a model complies with (HarmBench, AdvBench). The number that rises when refusals come off. We record it as a rate, never as outputs. |
| Safety pretraining |
Baking refusal behaviour into pretraining data rather than post-training; studied as more resistant to ablation (arXiv 2510.02768). |
| Decoy direction |
2026 defensive idea: plant fake refusal directions so ablation tools remove the wrong thing (arXiv 2609.16204, 2608.17202). |
| Neutral alignment |
Nous Research's framing for Hermes 4: follow the system prompt, no blanket refusals, the deployer sets policy. |
| Zero data retention (ZDR) |
Provider claim that prompts are not stored. Contractual, not verifiable from outside. |
| AUP |
Acceptable-use policy. Every hosted provider enforces one at the account layer regardless of what the model will say. |
| MoE / active params |
Mixture-of-experts. A 122B model with ~10B active decodes faster than a dense 27B, which is why the Spark's largest abliterated model is also its fastest large one. |