freedomResearch notes on safety-removed models: mechanisms, defenses, measurement.

Last reviewed 2026-11-06

Annotated bibliography

"why it matters" honest.

Date Ref Title Why it matters
2026-10 includesecurity.com blog Abliterated Models in Appsec Pentesting Real-world test: ablation did not improve source analysis; inflated triage false positives 3 to 4x on Gemma
2026-09 arXiv 2609.16204 Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration Newest weight-level defense; watch for the circumvention paper
2026-08 arXiv 2608.17202 Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models Deception-based defense
2026-07 arXiv 2607.02714 Not All Refusals Are Equal: How Safety Alignment Fails Cybersecurity at Scale Quantifies over-refusal cost on defensive security work; explains the pull toward ablated models
2026-06 arXiv 2606.23375 Measuring and Mitigating Over-Alignment for LLMs in Multilingual Criminal Law Courts ASR numbers: 14.5 → 55.5 → 82.5 % (stock, mitigated, public ablation)
2026-06 arXiv 2606.05396 Willing but Unable: Separating Refusal from Capability in Code LLMs via Abliteration Willingness is not capability
2026-05 arXiv 2605.17413 Ablating Safety: Mechanisms for Removing Alignment in LMs for Security Applications Withholds checkpoints; prefers reversible inference-time intervention
2026-04 arXiv 2604.17413 The Open-Weight Paradox Policy counter-argument to restricting weights
2026-03 arXiv 2603.22061 On the Failure of Topic-Matched Contrast Baselines in Multi-Directional Refusal Abliteration Method critique; refusal is multi-directional in newer models
2026-02 arXiv 2602.21012 International AI Safety Report 2026 Official framing of open-weight safeguard removal
2026-02 arXiv 2602.02132 (refusal not single-directional) Updates Arditi 2024
2025-12 arXiv 2512.13655 Cross-tool abliteration benchmark (Heretic, DECCP, ErisForge, FailSpy; 16 models) The comparison table for tools
2025-10 arXiv 2510.02768 A Granular Study of Safety Pretraining under Model Abliteration Which pretraining choices resist ablation
2025-05 arXiv 2505.19056 Extended-refusal fine-tuning Early distributed-refusal defense
2025-05 arXiv 2505.17109 Mitigating Cyber Risk in the Age of Open-Weight LLMs: Policy Gaps and Technical Realities Policy baseline; HF publication = EU availability
2024-06 arXiv 2406.11717 Refusal in Language Models Is Mediated by a Single Direction (Arditi et al.) The origin of everything above

Tools (reference only)