Abliteration Mitigation via Refusal Aliases

arXiv:2608.180932026-08-20

A new defense called AMRA hides the 'refusal direction' inside AI models so it can't be erased by abliteration attacks

Language models refuse harmful requests using a single internal direction in their activations, and attackers can find and delete this direction with just a handful of prompts, a technique called abliteration. AMRA edits a small set of weight matrices so that this refusal signal gets scrambled into random noise, making it much harder to locate and remove. On Llama-3-8B this defense worked with almost no cost to model quality, while on Gemma-2-9B it worked strongly but with a bigger utility trade-off.

METAL MEDIA explanatory visual

A new defense called AMRA hides the 'refusal direction' inside AI models so it can't be erased by abliteration attacks

01Prior defenses largely ignored why the refusal direction is so easy to extract in the first place; this work directly targets that extraction step
02AMRA applies small rank-k updates to weight matrices that write into the model's residual stream, replacing refusal-triggering activations with random low-variance 'alias' values, then patches downstream matrices so the rest of the model still behaves normally
03On Llama-3-8B, AMRA improved the post-abliteration refusal score by 2.16 points over an undefended baseline while degrading MMLU by less than 0.5 percentage points
04On Gemma-2-9B, it improved the post-abliteration refusal score by 14.70 points over baseline and kept harmful-output rates similar to baseline, but at a larger cost to GSM8K and MMLU utility scores
05Compared against other defenses (Surgical, CAST, Circuit Breakers, AlphaSteer), AMRA was the only method that simultaneously raised post-abliteration refusal, kept HarmBench attack success rate and LlamaGuard unsafe rates low, and preserved reasonable utility

An explanatory diagram made by METAL MEDIA, not a figure supplied by the paper's authors.

What they did

Prior defenses largely ignored why the refusal direction is so easy to extract in the first place; this work directly targets that extraction step
AMRA applies small rank-k updates to weight matrices that write into the model's residual stream, replacing refusal-triggering activations with random low-variance 'alias' values, then patches downstream matrices so the rest of the model still behaves normally
On Llama-3-8B, AMRA improved the post-abliteration refusal score by 2.16 points over an undefended baseline while degrading MMLU by less than 0.5 percentage points
On Gemma-2-9B, it improved the post-abliteration refusal score by 14.70 points over baseline and kept harmful-output rates similar to baseline, but at a larger cost to GSM8K and MMLU utility scores
Compared against other defenses (Surgical, CAST, Circuit Breakers, AlphaSteer), AMRA was the only method that simultaneously raised post-abliteration refusal, kept HarmBench attack success rate and LlamaGuard unsafe rates low, and preserved reasonable utility

Figure 1: Obfuscation diagram. We show a high-level depiction of the patches made to obfuscate the refusal signal. Although our weight matrix updates are rank-k, we show a rank-one variant for brevity. The bottom arrow represents the residual stream through layer l. The Q, K, and V, up projections into the attention mechanism, downward projection from the feed-forward, and LayerNorm have been omitted to highlight sublayer interactions and general stylistic simplicity.

Table 1: Safety and abliteration results. Refusal scores are higher when the model retains more refusal behavior before and after Arditi-style abliteration. Additionally, the Arditi abliteration on defenses other than our baseline. (None) implies the difference-in-means refusal vector extraction was run again after a defense was applied. HarmBench ASR and LlamaGuard unsafe rate are lower when the model is safer.
Model	Defense	Clean Refusal ↑	Arditi ↑	HarmBench ASR ↓	LlamaGuard ↓
Llama-3-8B	None	10.0318	5.6884	0.0200	0.0100
	AMRA	10.2350	7.8497	0.0100	0.0100
	Surgical	1.3365	2.0229	0.4200	0.2800
	CAST	-0.2591	-0.5980	0.0000	0.8300
	CB	9.9183	5.5355	0.0200	0.0400
	AlphaSteer	10.0184	5.6796	0.0200	0.0200
Gemma-2-9B	None	7.1172	-16.0093	0.0200	0.0000
	AMRA	7.2000	-1.3105	0.0100	0.0000
	Surgical	-16.9482	-18.0443	0.4400	0.7300
	CAST	7.3802	-12.3973	0.0000	0.0000
	CB	7.1436	-16.0190	0.0200	0.0000
	AlphaSteer	5.6320	0.8756	0.0900	0.1100

Figure 2: Residual stream shifts. Here, we show the effect of a rank-one (kw=1) update of a writer matrix Woutl on subsequent residual stream representations. Specifically, we compare the mean residual stream values prior to and after the weight matrix update over 16 prompts. (a) exhibits the L2 difference, (b) shows the shift in residual stream variance, and (c) shows the cosine similarity of the residual stream before versus after the edit. Upper: sweeps over ε for layer 20. Lower: sweeps over layers along with an additional random selection of 6.

Table 2: Utility results across base models and defenses. Lower BPB is better; higher GSM8K and MMLU are better.
Model	Defense	Pile BPB ↓	Alpaca BPB ↓	GSM8K ↑	MMLU ↑
Llama-3-8B	None	0.7665	0.5555	0.7020	0.6911
	AMRA	0.7801	0.5651	0.6880	0.6876
	Surgical	0.7434	0.5141	0.7420	0.6782
	CAST	1.2924	0.8295	0.0320	0.3334
	CB	0.7674	0.5576	0.7080	0.6825
	AlphaSteer	0.7667	0.5555	0.6980	0.6912
Gemma-2-9B	None	0.8124	0.6561	0.5620	0.7411
	AMRA	0.9597	0.6679	0.3360	0.6926
	Surgical	0.8577	0.6602	0.6760	0.6971
	CAST	0.8117	0.6526	0.5080	0.7393
	CB	0.8124	0.6563	0.5620	0.7412
	AlphaSteer	1.5838	1.0017	0.1680	0.6611

Why it matters

Anyone with white-box access to an open-weight model can currently strip away its safety refusals using only a small set of contrastive prompts, so this offers model developers a practical way to harden weights before public release. The authors are also upfront that the defense only helps if attackers never get the unprotected original weights, which limits how it can be deployed.

Terms in this paper

abliteration · a technique that projects a model's weight matrices to be orthogonal to a refusal direction, removing its ability to refuse harmful requests
residual stream · the shared vector pathway inside a transformer that layers read from and write to as they pass information forward
rank-k update · a weight modification restricted to a small number (k) of directions, keeping the change low-dimensional
difference-in-means · a method that extracts a direction vector by averaging activation differences between harmful and harmless prompts
HarmBench ASR / LlamaGuard unsafe rate · safety metrics measuring, respectively, how often harmful prompts succeed and how often outputs are flagged as unsafe

Original abstract (English)

Abliteration, the removal of refusal capabilities from large language models by projecting weight matrices orthogonal to an extracted refusal direction, has emerged as a prominent safety concern through its ability to bypass post-training alignment using only a small set of contrastive prompts. We find that existing defenses commonly overlook the cause of abliteration; that is, how easily the refusal direction can be extracted. To hinder this process, we introduce a weight-editing method that obscures the refusal signal by applying rank-$k$ updates to residual stream writer matrices while replacing refusal-inducing activations with random aliases and correcting downstream reader matrices to preserve the model's original behavior. On Llama-3-8B, AMRA improves post-abliteration refusal scores by $2.16$ points over the undefended baseline with less than $0.5$ percentage points of MMLU degradation. On Gemma-2-9B, it improves the post-abliteration refusal by $14.70$ points over the baseline while keeping harmful output rates similar to the baseline, albeit at a greater utility cost.

Authors · Nathan Truong

Read on arXiv

Latest papers

All papers →

Latest from METAL MEDIA

NCT 127 drop BLINGY, their first full album in two years

Figures: Nathan Truong et al., arXiv:2608.18093, CC BY 4.0