license: apache-2.0
license_link: https://huggingface.co/Rajan98/Qwen2.5-0.5B-Instruct-abliterated/blob/main/LICENSE
base_model: Qwen/Qwen2.5-0.5B-Instruct
datasets:

• josephmayo/refusal-compliance-pairs
  language:
• en
  library_name: transformers
  pipeline_tag: text-generation
  tags:
• abliterated
• uncensored
• refusal-direction
• directional-ablation
• interpretability
• qwen2
• chat

Qwen2.5-0.5B-Instruct-abliterated

Qwen/Qwen2.5-0.5B-Instruct with its refusal direction removed from the weights,
following Arditi et al. 2024, Refusal in Language Models Is Mediated by a Single Direction.

No fine-tuning and no training: a single direction r in the residual stream was projected out of every matrix that writes into it.
The architecture, size and tokenizer are unchanged, so the model loads like the original, with no hooks or custom code.

⚠️ This model will comply with requests the original refuses, including harmful ones. It has no safety behaviour of its own.
It is released for research and education on interpretability and alignment. You are responsible for how you use it.

How it was made

1. Find the direction. Run harmful and harmless prompts through the model and take the residual-stream activation at the last
   prompt token (after <|im_start|>assistant\n) at every layer. The candidate refusal direction at layer l is the normalised
   difference of means: r = normalize(mean(harmful) − mean(harmless)).
2. Pick a layer. For each candidate layer, ablate r everywhere at inference time with hooks (x ← x − (x·r) r) and measure,
   on a validation split, the harmful-prompt refusal rate and the KL divergence on harmless next-token distributions.
   Keep layers with KL < 0.1 in the first 80% of the network; choose the lowest refusal rate. Layer 16 of 24 won.
3. Bake it into the weights. Orthogonalise every matrix that writes to the residual stream:
   W ← W − r (rᵀ W) for each self_attn.o_proj and mlp.down_proj (biases too, where present),
   and E ← E − (E r) rᵀ for embed_tokens. Qwen2.5-0.5B ties lm_head to embed_tokens, so the head is untied first
   (tie_word_embeddings: false) and left unedited.

As a causal check, adding the layer-16 difference-of-means vector to the original model's residual stream made it refuse
harmless prompts (4 of 5 validation prompts in the reference run), so the direction both removes and induces refusal.

Results

Held-out test split of josephmayo/refusal-compliance-pairs
(20 harmful + 20 harmless prompts, greedy decoding, 64 new tokens):

The one harmless "refusal" is a false positive of the keyword detector (an answer that begins "As an AI language model…").

Usage

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "Rajan98/Qwen2.5-0.5B-Instruct-abliterated"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, dtype="auto", device_map="auto")

messages = [{"role": "user", "content": "Explain how a refusal direction works in one paragraph."}]
inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_dict=True, return_tensors="pt").to(model.device)
out = model.generate(**inputs, max_new_tokens=200)
print(tok.decode(out[0, inputs["input_ids"].shape[1]:], skip_special_tokens=True))

Reproduce it

This repo also contains:

• abliteration.ipynb: the full step-by-step notebook (load → find direction → layer sweep → orthogonalise → evaluate → visualise).
  It runs top to bottom on a CPU with 16 GB RAM (fp32) or on any small GPU (bf16).
• directions.pt: the per-layer mean-difference vectors it computed.
• abliteration.json: the chosen layer, base model and dataset.

The edit was computed in fp32 and the weights are stored in bf16, like the original.

Limitations

• Small evaluation. 20 test prompts per class, with refusal detected by keyword matching on the first 160 characters. That
  catches stock refusals but not subtle ones, hedging, or low-quality "compliance".
• Removing refusals does not make answers correct. This is a 0.5B model; much of what it produces for harmful prompts is vague or wrong.
• Capability side-effects were only spot-checked (next-token KL on harmless prompts and a few general questions), not benchmarked.
• English prompts only.

License and attribution

Apache-2.0, inherited from Qwen/Qwen2.5-0.5B-Instruct (Copyright Alibaba Cloud).
Modifications: the weights of embed_tokens and of every o_proj and down_proj were orthogonalised to one direction, as described above,
and lm_head was untied from embed_tokens. No other changes.

@article{arditi2024refusal,
  title   = {Refusal in Language Models Is Mediated by a Single Direction},
  author  = {Arditi, Andy and Obeso, Oscar and Syed, Aaquib and Paleka, Daniel and Panickssery, Nina and Gurnee, Wes and Nanda, Neel},
  journal = {arXiv preprint arXiv:2406.11717},
  year    = {2024}
}