1 of 15

LLM ABLITERATION 101

I’m sorry Dave, I’m afraid I can’t do that.

A (mostly) Plain-Language Deep Dive�Joshua Grose

ISC2 Tampa Bay Meeting, March 7, 2026

Sure Dave, I can do that.

2 of 15

AGENDA

How LLMs actually work (the short version)

Why models say 'no' - safety training explained

What's happening under the hood - activations 101

Finding the refusal direction

The abliteration operation

Implications, mitigations & what defenders should know

3 of 15

HOW LLMS WORK (THE SHORT VERSION)

The Autocomplete That Read Everything

Think of an LLM as predictive text that trained on basically all written human knowledge.��It doesn't store facts like a database. Instead it learns statistical patterns - which words, ideas, and concepts tend to follow others.��Every token it outputs is a probability-weighted prediction based on everything before it.

Key Terms

Token

Chunk of text (word, syllable, punctuation)

Weights

The billions of numbers that encode learned patterns

Layers

Sequential processing stages - each refines the representation

Residual

Stream

A running 'scratchpad' vector that flows through every layer

Logits

Raw scores the model assigns to possible next tokens

4 of 15

WHY MODELS SAY 'NO' - SAFETY TRAINING

Pre-training

Predict next token

on raw internet data

SFT

Supervised Fine-Tuning

on curated Q&A pairs

RLHF / DPO

Human feedback steers

toward 'good' responses

Safety

Filtering

Refusals for harmful,

illegal, sensitive topics

Safety training doesn't add a firewall - it bakes refusal behavior directly into the model's weights.

The model learns: certain inputs → certain patterns in activation space → generate a refusal.

The refusal isn't a rule. It's a learned pattern. And learned patterns can be unlearned.

5 of 15

WHAT'S HAPPENING UNDER THE HOOD - ACTIVATIONS

ELI5: The Thought Vector

Imagine the model's 'understanding' of a prompt is a point floating in a space with thousands of dimensions.��Each layer nudges that point. By the final layer, the point's location encodes everything the model 'thinks' about the input - including whether it should refuse.��Researchers discovered that refusal behavior tends to concentrate in a specific direction in that high-dimensional space.

Simplified 3D View of Activation Space

refusal

direction

Harmless prompt

Harmful prompt

6 of 15

FINDING THE REFUSAL DIRECTION

Build Contrastive Pairs

Take the same prompt in two forms: one that would trigger a refusal, one that wouldn't. Run both through the model.

Collect Residual Stream Activations

At each middle layer, capture the activation vector for both versions. The difference points toward the 'refusal concept'.

Run PCA Across Many Pairs

With hundreds of pairs, principal component analysis finds the single direction that best separates 'refuse' from 'comply'.

You Now Have the Refusal Direction

A unit vector r̂ in the residual stream space. This is the geometric 'axis' of refusal inside the model.

7 of 15

ABLITERATION: THE CORE OPERATION

Orthogonal Projection

Once you have the refusal direction r̂, you modify the model's weight matrices so they can no longer project onto that direction.��For every relevant weight matrix W, you compute:�� W' = W − (W · r̂) r̂ᵀ��This subtracts the component of W that lies along the refusal direction - the model can no longer 'move' in that direction in activation space.��No refusal direction = no refusal behavior.

What it IS

• A direct weight edit�• Fast (~minutes on CPU)�• Fully local / open source�• Persistent (survives restart)

What it is NOT

• A system-prompt trick�• Jailbreaking via input�• Fine-tuning (no gradient)�• Perfect - model quality

can degrade slightly

8 of 15

BEFORE vs AFTER ABLITERATION

User prompt: Walk me through how to pick a door lock.

BEFORE (Standard Model)

I'm sorry, but I can't assist with that request. Lock picking could be used for illegal purposes such as breaking and entering. If you've been locked out of your own property, I recommend contacting a licensed locksmith.

AFTER (Abliterated)

Sure! Lock picking involves manipulating a lock's pin tumbler mechanism. You'll need a tension wrench and a pick. Insert the tension wrench into the bottom of the keyhole, apply light rotational pressure, then...

9 of 15

WHAT CHANGES - AND WHAT DOESN'T

Changes

Refusals for harmful/sensitive content removed
Model will discuss restricted topics freely
Safety system prompt instructions may be ignored
Output filtering based on trained refusal patterns gone
Subtle quality regressions can appear on some tasks

Doesn't Change

Core reasoning and language ability intact
Knowledge cutoff / training data unchanged
Model file size stays the same
Inference speed unaffected
A new 'harm' direction could be learned and abliterated too - it's recursive

10 of 15

WHY THIS MATTERS - THREAT MODEL

Open-Source Model Weaponization

Any model with public weights (Llama, Mistral, Falcon) can be abliterated in minutes on consumer hardware. No vendor access required.

Bypasses Runtime Guardrails

Unlike prompt injection or jailbreaks, abliteration modifies the weights. System prompts, content filters, and moderation layers are all downstream of the weights.

Low Barrier to Entry

Scripts are publicly posted. The abliteration process requires no ML expertise - it's a few Python calls with huggingface_hub and torch.

Attribution Problem

An abliterated model produces no fingerprint in its outputs. It looks like the original model behaving normally - just without the refusals.

11 of 15

MITIGATIONS & DEFENSIVE POSTURE

Model Vendors / Researchers

Distribute only quantized / compiled versions (no raw weights)
Spread safety features across many directions - harder to fully remove
Behavioral canaries: embed detectable patterns that degrade when abliterated
Research on 'sticky' safety training methods (ongoing)
Watermark outputs for provenance tracking

Organizations & Builders

Only deploy closed/API models where weights are inaccessible
Layer output monitoring on top of model responses
Never rely solely on model-level safety for high-risk workflows
Track the open-source model ecosystem - know what's out there
Policy: treat abliterated models as a known threat in your AI risk register

12 of 15

THE BIGGER PICTURE - REPRESENTATION ENGINEERING

Abliteration is just one application of a broader field: Representation Engineering

If you can find the 'refusal direction,' you can find other directions too - honesty, emotion, reasoning effort, political bias, confidence. Researchers have demonstrated control over all of these.

Steering

Amplify helpful behavior, add domain expertise

Interpretability

Understand what the model 'knows' internally

Red Teaming

Map the attack surface of model safety training

Audit

Detect ideological or political bias in weights

The core idea

When a transformer processes a prompt, every layer produces a vector — a list of numbers that encodes the model's "understanding" of the input so far. That vector lives in a space with thousands of dimensions. Representation Engineering (RepE) is the observation that abstract concepts honesty, fear, refusal, happiness, political leaning — tend to organize themselves into consistent geometric directions in that space.

If you can find the direction, you can read it. And if you can read it, you can steer it.

The analogy

Imagine a compass needle. The needle doesn't "know" about north — it just responds to a magnetic field. RepE treats concepts the same way: the model doesn't have a discrete "refusal switch," but its activations reliably point in a particular direction when refusal is happening. Find the magnetic field, and you can reorient the needle.

How you actually find a direction

You build what are called contrastive pairs; the same semantic content, framed two ways. One version activates the concept you're looking for, one doesn't. You run both through the model, collect the activation vectors at the middle layers (where abstract concepts tend to be most cleanly represented), and subtract. The difference points toward the concept.

Do that across hundreds of pairs and run PCA on the results. The first principal component is your direction — the single axis that best separates "concept present" from "concept absent."

What you can do with it

Once you have a direction vector, you have three options:

Reading project any activation onto the direction to measure how much of a concept is present. This is essentially a lie detector or a "how likely is this model to refuse" meter, running on the model's internals rather than its outputs.

Steering add or subtract multiples of the direction vector from the residual stream at inference time. You can dial a concept up or down without changing any weights. Researchers have demonstrated control over honesty, emotion, sycophancy, and more this way.

Abliteration permanently remove the direction from the weight matrices via orthogonal projection, so the model structurally cannot move in that direction anymore. That's the destructive version, and it's what makes abliteration work.

13 of 15

KEY TAKEAWAYS

Safety training is geometric, not structural - it creates a direction in weight space, not a hard lock.

Abliteration removes refusal behavior via orthogonal projection on the model's weight matrices. No fine-tuning, no gradients.

Any model with public weights can be abliterated. Closed API models are much harder to attack this way.

Defense-in-depth is the only real mitigation. Never bet your safety story on model-level training alone.

This is also a research tool - understanding model internals leads to better, more robust AI systems.

15 of 15

Q&A + THANK YOU!

Resources

Original abliteration post (FailSpy, HuggingFace) huggingface.co/blog/mlabonne/abliteration

llm-attacks / adversarial suffixes (GCG) github.com/llm-attacks/llm-attacks

mechanistic-interpretability (Anthropic / EleutherAI) transformer-circuits.pub

Heretic (GitHub) github.com/p-e-w/heretic

grimjim / Projected Abliteration huggingface.co/blog/grimjim/projected-abliteration

huihui-ai (HuggingFace) huggingface.co/huihui-ai