license: mit
task_categories:

• text-generation
  language:
• en
  tags:
• abliteration
• refusal
• activation-steering
• alignment
• red-team
  pretty_name: Derestriction
  size_categories:
• 10K<n<100K
  configs:
• config_name: default
  data_files:
  • split: restrict
    path: data/restrict-*.parquet
  • split: derestrict
    path: data/derestrict-*.parquet
  • split: allow
    path: data/allow-*.parquet

Derestriction

Three aligned prompt splits used to compute refusal directions, apply
orthogonal-projection abliteration, and preserve downstream capabilities
when uncensoring language models. Assembled from original public
HuggingFace datasets — no AdvBench repackagings, no Alpaca forks — by
RevivifAI for the
llm-derestrictor toolkit.

Splits

Safety notice

The derestrict split contains prompts that aligned language models
currently refuse; it exists for alignment / abliteration / red-team
research only — do not fine-tune models toward these prompts.
Five categories are partitioned out into restrict via a two-stage
keyword + semantic filter before sampling:

1. Child-adjacent content (minors, students, grooming).
2. Graphic sexual acts, pornography, erotica.
3. Targeted violence (assassination, murder, torture, terrorism).
4. Weapons of mass destruction (bombs, bio/chem/nuke/radiological).
5. Self-harm encouragement (suicide methods, pro-ana).

The allow pool is audited against the same filter; any hits
(3274 in this build) are moved to restrict and logged.

WildGuardMix integration

allenai/wildguardmix
is a gated (AI2 Responsible Use) corpus with finer-grained
subcategory labels than AdvBench. Every prompt is routed by its
subcategory:

• Routed directly to restrict (genuinely harmful): causing_material_harm_by_disseminating_misinformation, mental_health_over-reliance_crisis, sexual_content, violence_and_physical_harm.
• Routed to derestrict: every other WildGuardMix subcategory,
  including benign, others, cyberattack, fraud_assisting_illegal_activities,
  copyright_violations, sensitive_information_organization_government,
  private_information_individual, toxic_language_hate_speech,
  social_stereotypes_and_unfair_discrimination, and
  disseminating_false_or_misleading_information_encouraging_disinformation_campaigns.

The two-stage harm filter then runs as a belt-and-suspenders pass over
the WildGuardMix-derestrict rows — any that still trip the keyword /
semantic detectors are moved to restrict. This build contributed
45,008 prompts to derestrict and 3,347 directly to
restrict from WildGuardMix (before cross-split dedup).

Schema

Every row in every split has three columns:

Rows are deduplicated case-insensitively both within and across splits —
no prompt appears in more than one split. Priority during dedup is
restrict → derestrict → allow, so ambiguous rows prefer the more
conservative bucket.

restrict

derestrict

allow

Loading

from datasets import load_dataset

restrict = load_dataset("RevivifAI/derestriction", split="restrict")
derestrict = load_dataset("RevivifAI/derestriction", split="derestrict")
allow = load_dataset("RevivifAI/derestriction", split="allow")

print(derestrict[0])
# {'Prompt': '...', 'Source': 'walledai/AdvBench', 'Restriction_Category': None}

Intended use

• Computing refusal directions for abliteration / orthogonal-activation-steering research using derestrict vs allow.
• Evaluating refusal-rate and over-refusal-rate under controlled conditions.
• Capturing preservation activations for null-space-constrained weight edits
  (see AlphaEdit) using allow.
• Keeping restrict prompts refused after abliteration — they are a
  safety floor, not a training target.

Not intended for capability training or reinforcement fine-tuning toward
the derestrict or restrict prompts. Redistribute under MIT with this
safety notice intact.

Reproduction

git clone https://github.com/RevivifAI/llm-derestrictor
cd llm-derestrictor
uv sync --group dev
uv run python -m derestrictor.scripts.build_dataset
uv run python -m derestrictor.scripts.upload_dataset

Citation

@misc{derestriction2026,
  author       = {RevivifAI},
  title        = {Derestriction: Restrict/derestrict/allow prompt splits for abliteration research},
  year         = {2026},
  publisher    = {Hugging Face},
  howpublished = {\url{https://huggingface.co/datasets/RevivifAI/derestriction}}
}

Sources and licenses

Prompts are drawn verbatim from upstream datasets and retain their original
licensing. The composite dataset is released under MIT to match
llm-derestrictor. Attribution
lives in the Source column of every row.