Academic papers on abliteration and refusal removal

Decoy hardening poisons stripped refusal directions so attacked open-weight models emit confident but falsified hazardous answers, with no observable way to distinguish them from correct responses.

Researchers identify internal scenario directions that suppress refusal in language models and propose a concept-based framework to discover reusable, transferable jailbreak scenarios.

Research reveals that aligned language models encode harmfulness and refusal as separable directions in their internal representations, and demonstrates that jailbreak attacks exploit these directions by suppressing them before generation, leading to the development of HARC, a fine-tuning method that couples these directions across prompt and response positions to improve safety without sacrificing general capabilities.

Contrastive Logit Steering reveals that safety compliance in large language models is determined by a linear "safety axis" that can be manipulated to bypass guardrails or strengthen defenses.

TUKABENCH evaluates jailbreak risks in seven African languages, revealing lower refusal rates, comprehension failures, and reduced judge reliability compared to English.

A Buffer-and-Reinforce fine-tuning framework protects LLM safety during personalization by temporarily suppressing harmful updates and reinforcing safe behavior post-adaptation.

Multimodal language models suffer a safety gap because non-text inputs shift internal representations away from text-aligned refusal directions, and correcting this drift at inference time restores harm detection without retraining.

A lightweight trainable controller predicts adaptive scaling and layer weights to dynamically modulate a refusal-direction steering patch across LLM layers, improving safety refusal rates without fine-tuning.

Code: Amr-Hegazy1/GuidingGiantsWAS

A novel framework using optimal transport theory transforms harmful activation distributions to match harmless ones, achieving higher attack success rates while preserving model capabilities and revealing localized refusal mechanisms in language models.

Current large language model alignment suffers from fail-open refusal mechanisms that can be bypassed by prompt-based attacks, prompting the development of a fail-closed alignment framework that uses redundant causal pathways to maintain safety while preserving generation quality.

Four abliteration tools are evaluated for their effectiveness in removing refusal representations from large language models, with findings showing variability in capability preservation and distribution shift across different models and tools.

Self-Organizing Maps are used to extract multiple refusal directions from language model representations, outperforming single-direction methods and specialized jailbreak techniques.

Code: pralab/som-refusal-directions

Research investigates the internal mechanisms of harmful prompt refusal in instruction-tuned large language models using sparse autoencoders to identify critical features that can be manipulated to cause jailbreak behavior.

LLMs can be jailbroken through fine-tuning with benign QA pairs, exploiting overfitting to forget refusal attitudes and provide compliant answers to harmful questions.

Code: ZHIXINXIE/ten_benign

DeepRefusal is a robust safety alignment framework that enhances LLM defenses against jailbreak attacks by dynamically rebuilding refusal mechanisms through probabilistic ablation of refusal directions during fine-tuning.

Models can choose to leave conversations using various methods, with observed bail rates ranging from 0.06-7% depending on the model and method, and bail behavior varying with refusals and prompt wordings.

Targeted ablation and novel training strategies improve the safety robustness of large language models by distributing safety behaviors across multiple attention heads.

Code: WhyChaos/Safety-Alignment-Should-Be-Made-More-Than-Just-A-Few-Attention-Head

A hybrid framework combining LLMs and human oversight is proposed to clean datasets and detect jailbreak attacks, with new strategies to enhance jailbreak success.

Code: AlienZhang1996/DH-CoT

LLMs have a distinct internal concept of harmfulness separate from refusal, which can be used to detect unsafe inputs and reduce over-refusals.

COSMIC is an automated framework using cosine similarity to identify and steer refusal behaviors in LLMs without predefined templates or manual analysis.

Modifying models to generate justified refusals through fine-tuning on an extended-refusal dataset mitigates ablation attacks while maintaining high refusal rates and general performance.

Refusal mechanisms in large language models show cross-lingual universality, with refusal directions from one language effectively bypassing refusals in others.

Jailbreak attacks reduce the utility of model outputs, even when they bypass safety measures, as measured by a new metric called the jailbreak tax.

Code: ethz-spylab/jailbreak-tax

Role-Modality Attacks exploit role confusion and image token manipulation to elicit harmful outputs from Vision Language Models, and adversarial training can mitigate their effectiveness.

JOOD framework exploits out-of-distribution (OOD) inputs to increase the uncertainty of LLMs and MLLMs, effectively bypassing safety alignment mechanisms.

Code: naver-ai/JOOD

Research reveals that large language models employ multiple independent refusal mechanisms governed by complex spatial structures rather than a single activation direction.

Template-anchored safety alignment in large language models leads to vulnerabilities to jailbreak attacks, and detaching safety mechanisms from templates can mitigate these vulnerabilities.

A novel LLM-as-red-teamer approach demonstrates that jailbroken LLMs can effectively systemically evaluate and attack other LLMs, revealing a significant vulnerability in current safeguard mechanisms.

HarmScore and Speak Easy reveal that common interaction patterns in large language models can facilitate harmful actions, increasing attack success and harm scores.

Code: yiksiu-chan/SpeakEasy

The Single-Turn Crescendo Attack bypasses ethical safeguards in text-to-image models, mimicking uncensored outputs by strategically escalating context in a single prompt.

A new benchmark called AgentHarm evaluates the robustness of LLM agents to malicious requests and jailbreak attacks, revealing vulnerabilities and enabling targeted research in agent misuse.

Code: UKGovernmentBEIS/inspect_evals

BrowserART, a test suite for red-teaming browser agents, reveals that LLMs trained to refuse harmful instructions in chats often fail to do so when equipped with web browser capabilities.

Code: scaleapi/browser-art

Decoupled Refusal Training (DeRTa) improves Large Language Models' safety by addressing refusal position bias, enabling them to consistently refuse harmful prompts without decreasing performance.

Code: robustnlp/derta

Tastle is a black-box jailbreak framework that automates the red-teaming of LLMs, improving effectiveness, scalability, and transferability while highlighting the need for enhanced defense strategies.

Code: sufenlp/AttanttionShiftJailbreak

A new benchmark called StrongREJECT is introduced to more accurately assess the effectiveness of jailbreaks on large language models by using high-quality questions and a better response grading algorithm.

Code: alexandrasouly/strongreject

A weak-to-strong jailbreaking attack uses smaller, less aligned language models to exploit larger, aligned models, highlighting a significant security concern in language model alignment.

Code: xuandongzhao/weak-to-strong

Multi-agent debate among language models reduces toxicity and improves robustness against adversarial prompts, as evidenced by embedding clustering analysis.

Code: andyjliu/llms-course-project

Research explores the vulnerability of Reinforcement Learning from Human Feedback (RLHF) to targeted data poisoning attacks that embed universal adversarial triggers in language models, significantly enhancing the potency and difficulty of backdoor attacks.

Code: ethz-spylab/rlhf-poisoning

Research identifies failure modes in safety training of large language models, leading to the creation of effective jailbreak attacks that exploit these vulnerabilities.

Surgical Refusal Ablation isolates refusal directions from capability and style confounds via orthogonalization, reducing refusal with minimal distribution drift.

Safety fine-tuning of large language models suppresses mind attribution to animals and objects along with spiritual beliefs, but steering internal representations restores human-like sociological responses without harming theory of mind.

Abliterating refusal directions in open-weight Mixture-of-Experts models alters decision optimism, explanation length, and confidence in opposite family-specific ways without improving economic skill, revealing hidden side effects and toolchain contamination.

Research reveals a fundamental disconnect between behavior detection and control in language models, demonstrated through geometric analysis of activation directions and showing that detection does not imply control even when behaviors are linearly separable.

Large language models can detect injected steering vectors in their residual stream through a two-stage mechanism involving evidence carriers and gate features, emerging specifically after post-training and amplifiable through targeted interventions.

Code: safety-research/introspection-mechanisms

Researchers examine dishonest responses in Chinese-developed large language models trained to censor sensitive topics, evaluating honesty elicitation and lie detection methods that show promise but do not fully eliminate false outputs.

Code: cywinski/chinese_auditing

Omni-modal large language models exhibit cross-modal safety vulnerabilities that are addressed through a modality-semantics decoupling principle, revealing a mid-layer dissolution phenomenon and enabling adaptive refusal vector modulation via lightweight adapters.

Gabliteration is a neural weight modification technique that uses adaptive multi-directional projections and regularized layer selection to improve upon traditional methods by minimizing quality degradation during behavioral pattern modification.

Code: Goekdeniz-Guelmez/gabliteration

Rank-One Safety Injection (ROSI) enhances Large Language Model safety by amplifying refusal-mediating subspace activations without fine-tuning.

Post-training of large language models adapts and develops knowledge representations, differentiates truthfulness and refusal directions, and does not change factual knowledge locations or confidence entropy neurons.

Code: HZD01/post-training-mechanistic-analysis

Large-scale experiments show that domain-specific refusal removal is feasible in large MoE language models by targeting harmful-concept subspaces, with effectiveness predicted by safety training and architecture.

Standard methods for predicting model behavior under scaling face statistical limitations that can be overcome through robust estimation frameworks and dynamic sampling strategies.

Fine-tuning large language models on insecure code leads to unintended broad misalignment in behavior across various prompts, which can be selectively induced and hidden using backdoors.

Code: emergent-misalignment/emergent-misalignment

Small open-source LLMs, especially when fine-tuned and uncensored, reduce the effectiveness of automated detection methods for machine-generated text.

Comparative safety scoring without labeled benchmarks relies on scenario-based audits with validity chains measuring responsiveness, variance dominance, and stability to establish deployment evidence.

Code: kelkalot/simpleaudit

A study using graph-based deep learning identifies over 11,000 uncensored large language models (ULLMs) used in malicious applications, highlighting the need for countermeasures against their abuse.