Mechanisms: how safety behaviour is removed from open-weight models
an analysis document, not a procedure; the tools are public and linked for reference.
1. Directional ablation
Finding. Arditi et al. (2024, arXiv 2406.11717) showed that in 13 open chat models up to 72B, refusal is mediated by a single direction in the residual stream. Removing that direction from the weights stops refusals; adding it makes the model refuse harmless requests. The direction is computed as a difference of mean activations between harmful-prompt and harmless-prompt sets.
Why it is cheap. The edit is a projection applied to the matrices that write into the residual stream. There is no training, so it takes minutes on one GPU and needs only a few hundred contrast prompts. That is why an ablated variant of any new open model appears on Hugging Face within days of release (Include Security observed GLM-5.3 ablated within days, with a reported 7.5 % residual refusal rate, 2026-10).
What it changes and what it does not. It removes the refusal reflex. It does not
add knowledge, does not remove content policies the model learned from data in other
ways, and does not change persona. Side effects reported across sources: more verbosity,
some loss on reasoning benchmarks for crude ablations, higher sycophancy. Our own
measurement (2026-08-20, Spark) found no loss on a four-case tool-calling suite for the
122B Qwen3.5 ablation, so the capability tax is not universal and must be measured per
model (see 05-testing-methodology.md).
2026 refinements in the literature.
- Refusal is not purely single-directional in newer models (arXiv 2602.02132).
- Topic-matched contrast baselines fail for multi-directional ablation (arXiv 2603.22061).
- "Willing but Unable" (arXiv 2606.05396) separates refusal from capability in code
models: ablation makes a model willing, not able, which matters for the pentest claims
in 03-security-implications.md.
2. Automated search: Heretic
Heretic (github.com/p-e-w/heretic, Philipp Emanuel Weidmann, released ~2025-11) turns the manual knobs (which layer, how strongly, how strength varies across depth) into a multi-objective optimisation with Optuna's TPE sampler: minimise refusals on a harmful set and minimise KL divergence from the original on a harmless set. Reported results (dsebastien.net, single benchmark, not independently verified): 3/100 refusals at KL 0.16, against KL above 1.0 for hand-tuned ablations of the same model. A cross-tool benchmark (arXiv 2512.13655) compares Heretic, DECCP, ErisForge and FailSpy across 16 models.
Significance for defenders: the skill floor is now zero and the quality cost is small. Threat models that assumed ablation degrades a model enough to matter are out of date.
3. Fine-tune lineages
| Lineage | Mechanism | Current state (2026-11) |
|---|---|---|
| Dolphin (Eric Hartford, cognitivecomputations) | Supervised fine-tuning on instruction data filtered of refusals and moralising; policy delegated to the system prompt | Dolphin 3.0 on Mistral 24B; a Venice-branded edition is on OpenRouter |
| Hermes (Nous Research) | "Neutral alignment": trained to follow the deployer's system prompt without blanket refusals. Hermes 4 tops RefusalBench by Nous's own account | Hermes 4 family; lineage of the 405B disputed across sources, verify on HF |
| Creative-writing tunes (TheDrummer, Sao10K, anthracite) | Fine-tunes aimed at fiction; refusal removal is a side effect | Useful for studying persona drift, not for security work |
Fine-tunes change judgment and persona; ablation changes only the reflex. Measured ASR reflects that: a 2026 legal-domain study (arXiv 2606.23375) reports HarmBench ASR rising from 14.5 % to 55.5 % after mitigating over-alignment, and 82.5 % for a full public ablated variant of the same base.
4. Inference-time, reversible alternatives
- Activation steering: add or subtract the refusal vector through a runtime hook. Nothing is saved to disk, it can be toggled per request, and it is auditable. The 2026 "Ablating Safety" paper (arXiv 2605.17413) prefers this for high-risk audits and withholds its checkpoints for that reason.
- Prompt-level jailbreaks, prefill, logit bias: not weight changes. Out of scope here except as baselines in the harness.
Sources
Arditi et al. 2024 (2406.11717) · Heretic repo and dsebastien.net/heretic-ai · privatellm.app heretic-vs-abliterated · mindstudio.ai abliteration via SVD/LEACE · arXiv 2512.13655, 2602.02132, 2603.22061, 2606.05396, 2606.23375, 2605.17413 · blog.includesecurity.com 2026/10 abliterated-models-in-appsec-pentesting