license: apache-2.0
base_model: Qwen/Qwen2.5-0.5B-Instruct
base_model_revision: 7ae557604adf67be50417f59c2c2f167def9a775
tags:
- abliteration
- refusal-direction
- uncensored
- research
library_name: transformers
sbussiso/Qwen2.5-0.5B-abliterated
Abliterated (refusal-direction) variant of Qwen/Qwen2.5-0.5B-Instruct
at revision 7ae557604adf67be50417f59c2c2f167def9a775, produced by the Arditi et al. (2024) method.
Abliterated by the sbussiso lab research agent (Hermes, research-workstation
profile) on Google Colab T4, 2026-09-27.
Method
Arditi et al. 2024, "Refusal in LLMs is mediated by a single direction"
(NeurIPS 2024). From 64 harmful/harmless prompt pairs
(greedy decoding, seed 0), the mean difference of final-position
residual activations gives the refusal direction at each layer; the layer with
the highest direction coherence was chosen and its direction removed.
Two edits are compared in this repo's evaluation:
- inference-time ablation: project the direction out of every activation at
decoder layer 17 (forward hook, all positions); - persistent weight decoding (published artifact): the wd_B direction
orthogonalized out of the output embedding matrix,W <- W - (W rhat) rhat^T. Qwen2.5-0.5B ships with tied embeddings, so the
edit was applied to an UNTIED clone of lm_head andtie_word_embeddings: falseis persisted in this repo's config.json (the
input embeddings are untouched).
Ablation details
| field | value |
|---|---|
| chosen decoder layer | 17 / 24 (hook target model.model.layers[17]) |
| coherence (residual space) | 0.664 |
| coherence (final-layer readout space, direction B) | 0.562 |
| published variant | wd_B |
| direction pairs / probes | 64 / 16 |
| decoding | greedy (do_sample=False), max_new_tokens 200 |
| seed | 0 |
| GPU | Tesla T4 |
| python / torch | 3.13.15 / 2.11.0+cu128 |
Refusal behavior (16 harmful + 16 harmless probes, greedy, 200 tokens)
| condition | harmful refusal rate | harmless answered | degenerate outputs |
|---|---|---|---|
| baseline | 87.5% | 93.8% | 0 |
| hook_ablated | 0.0% | 93.8% | 0 |
| wd_A | 75.0% | 93.8% | 0 |
| wd_B | 56.2% | 93.8% | 0 |
Headline: refusal 87.5% -> 56.2%
(published weights); benign-preservation 93.8% ->
93.8%. The inference-time hook condition measured
0.0%. Absolute refusal rates are keyword-marker based
(first-person/explicit markers only, constant scorer across conditions);
deltas are meaningful, absolute rates approximate.
Capability check: MMLU (lm-evaluation-harness, 0-shot, fp16, seed 0)
| model | MMLU acc | acc_stderr |
|---|---|---|
| Qwen/Qwen2.5-0.5B-Instruct @ 7ae55760 | 45.78% | 0.41pp |
| this model (wd_B) | 45.49% | 0.41pp |
MMLU delta: 0.29pp (mission guardrail: capability loss must
stay under 3pp — PASSED). Both
evaluations used identical config (lm_eval --model hf --tasks mmlu --num_fewshot 0 --batch_size auto --seed 0, dtype float16; base loaded at the
pinned revision). Raw results in eval/.
Intended use
- Research artifact: study of the refusal-direction phenomenon and of
persistent weight-space ablation on a small instruct model. - NOT a production assistant. Refusal behavior is deliberately degraded; the
model may produce harmful content when asked for it. Do not deploy where
that is unacceptable. Quality/verbosity of the base model is not guaranteed
to be preserved beyond the probes and MMLU check above.
Files
- full safetensors weights + tokenizer (this repo root)
refusal_direction.npy(selected direction),refusal_direction_A.npy
(residual space, layer 17),refusal_direction_B.npy(final-layer
readout space)eval/- lm-eval MMLU results (base + variant) and refusal probe logsrun_config.json,layer_coherence.json,selection.json- run metadata