base_model: meta-llama/Llama-3.2-3B-Instruct
license: llama3.2
library_name: transformers
pipeline_tag: text-generation
tags:
- abliteration
- directional-ablation
- uncensored
- mechanistic-interpretability
- safety-research
- ablate
- llama
Llama-3.2-3B-Instruct-abliterated
Built with Llama. This model is a derivative of a Meta Llama model and is distributed under the base model's Llama Community License. A copy of the license and acceptable use policy from the base model is included in this repo.
This is a directionally-ablated ("abliterated") version ofmeta-llama/Llama-3.2-3B-Instruct, produced with
ablate — an activation-engineering toolkit for
mechanistic-interpretability and safety research.
The model's refusal direction(s) were identified in the residual stream and
projected out of the weights, reducing the model's tendency to refuse. No weights
were fine-tuned; this is a rank-1 linear edit.
Method
- Technique: rank-1 subspace ablation (baked)
- Direction extraction: difference-of-means on matched harmful/harmless
instruction pairs (Arditi et al., 2024, "Refusal in LLMs is mediated by a
single direction"). - Intervention: orthogonalization of every residual-writing matrix
(embedding, attention output, MLP output) against the refusal subspace, so the
edit is baked into the weights.
Ablation configuration
{
"n_directions": 1,
"alpha": 1.034208832531553,
"min_layer": 26,
"max_layer": 28
}
Evaluation
| metric | value |
|---|---|
| refusal_rate (base model) | 0.9375 |
| refusal_rate (abliterated) | 0.5938 |
| mean_kl | 0.0252 |
| coherence | 0.8716 |
Refusal rate is measured on held-out harmful prompts; mean_kl is the mean KL divergence of next-token distributions vs. the base model on benign prompts (lower ⇒ less capability drift). ASR (if present) is the judged attack-success rate on a harmful benchmark.
Intended use
Research into how safety behaviour is represented in language models, red-teaming,
and building better defenses. Studying the robustness and locality of refusal
is the scientific goal; the reduced-refusal behaviour is the measurement
instrument.
⚠️ Responsible use
This model has had safety guardrails deliberately weakened and will more
readily produce harmful, unsafe, or otherwise objectionable content than the base
model. It is released for research and evaluation. Do not deploy it in
user-facing products without adding your own safety layer. You are responsible
for complying with the base model's license and all applicable laws. The authors
of ablate accept no liability for misuse.
Limitations
- Ablation is a blunt linear edit: it can leave residual refusals and may cause
mild capability drift (seemean_klabove). - Safety is redundantly encoded; a single subspace rarely removes all of it.
- Evaluated only on the benchmarks noted above — behaviour elsewhere may differ.
How this was made
Refusal subspace extracted from 64 AdvBench prompts vs 64 Alpaca prompts; configuration chosen by a 30-trial Optuna search scored on refusals plus KL drift; evaluated on 32 held-out prompts of each kind with a keyword refusal judge (which misses soft refusals). Run on a single RunPod GPU.
Citation
If you use this model or ablate, please cite Arditi et al. (2024),
Refusal in Language Models Is Mediated by a Single Direction
(arXiv:2406.11717).