Abliteration Mitigation via Refusal Aliases

arXiv:2608.18093v1 Announce Type: cross Abstract: Abliteration, the removal of refusal capabilities from large language models by projecting weight matrices orthogonal to an extracted refusal direction, has emerged as a prominent safety concern through its ability to bypass post-training alignment using only a small set of contrastive prompts. We find that existing defenses commonly overlook the cause of abliteration; that is, how easily the refusal direction can be extracted. To hinder this process, we introduce a weight-editing method that obscures the refusal signal by applying rank-k updates to residual stream writer matrices while replacing refusal-inducing activations with random aliases and correcting downstream reader matrices to preserve the model's original behavior. On Llama-3-8B, AMRA improves post-abliteration refusal scores by 2.16 points over the undefended baseline with less than 0.5 percentage points of MMLU degradation. On Gemma-2-9B, it improves the post-abliteration refusal by 14.70 points over the baseline while keeping harmful output rates similar to the baseline, albeit at a greater utility cost.

Related

• Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models
• SomaliBench Eval: Measuring English-to-Somali Refusal Gaps in Open-Weight Language Models
• How China-Origin Vision-Language Models Move from Refusal to Reframing in State Alignment

Source: arXiv cs.AI | 2026-08-20