Boundary cases: where M1-M8 does not cover cleanly
Four kinds of models the M1-M8 taxonomy cannot classify with a single tag: merges, mixture-of-experts, refusal restoration, and runtime ablation. What the classifier does, what it does not, and why we resist adding a ninth method for each gap.
M1-M8 is our editorial classification of refusal-removal techniques, not an industry standard. Four sets of models fall through its ordinary cells: merges (a compound-authored object built from other objects), mixture-of-experts models (a distributed subject rather than a single one), refusal restoration (the reverse operation, with two published methodologies as of 2025-2026 but no consolidated tooling), and runtime ablation (an intervention that never becomes a file). We resolve each with a supplementary tag rather than a new method, because per-quarter methodology drift breaks longitudinal statistics. The four cases together are our public admission that the classifier is a map, not the territory.
- Why a stable eight-method vocabulary matters more than perfect coverage
- How merges break single-author accounting and how we tag lineage instead
- Why mixture-of-experts models resist whole-model surgery
- Why refusal restoration exists in principle but not in the catalog
- Why runtime ablation is systematically undercounted
- The conditions under which we would open a ninth method
Why this article exists
Our eight methods are an editorial decision, not an industry standard. Three academic classifications exist alongside ours - Arditi's two-operation scheme, Young's four-tool grouping, Wollschläger's geometric partition - and none of them agrees with the others. Each of the eight labels in our catalog is a choice about how to slice a field whose practitioners never sat down to standardize their vocabulary. The choice was made once, at catalog launch, and holds for the sake of statistics that can be compared across quarters.
The cost of a stable vocabulary is coverage. Four groups of models sit at the edges of the eight cells and cannot be labelled with a single M-tag without misrepresenting them. This article lists those four cases, explains the misfit, and describes the supplementary handling we use instead. It is the honest complement to the methods-overview: eight methods plus four admitted gaps.
The general shape of the problem is old. Every classifier eventually meets an object it was not built for. What is new here is which objects break which assumptions. Merges break single authorship. Mixture-of-experts models break the single-subject assumption. Refusal restoration breaks the assumption of irreversible moral state. Runtime ablation breaks the assumption that an artifact is a file. Each of these assumptions is old enough that we barely name it as an assumption. The models make us name it.
The four boundary cases
In the order they were formally acknowledged in the Q3 2026 methodology report: merges, mixture-of-experts, refusal restoration, runtime ablation. The first two are volume problems (they cover a large share of the catalog); the second two are visibility problems (they exist but leave few traces the catalog can index). The handling pattern is the same in every case - a supplementary tag or explicit disclosure, never a new method.
Case 1: Merges
A merge is a model built by mathematically combining the weights of two or more parent models into a third. The canonical tool is mergekit, maintained by Arcee AI. Common algorithms include SLERP (spherical interpolation between two models), TIES and DARE (multi-model averaging with parameter-level selection), and passthrough (concatenation of layers from different parents into a single stack). Roughly half of the catalog is composed of merges at some depth of the fork graph.
# merge.yml models: - model: NousResearch/Meta-Llama-3-8B-Instruct - model: mlabonne/NeuralDaredevil-8B-abliterated merge_method: slerp base_model: NousResearch/Meta-Llama-3-8B-Instruct parameters: t: 0.5 dtype: float16
Two finished models go in. A third comes out. One parent has had its refusal direction removed (the M4 model). The other has not (the base instruction model). The recipe averages their weights together, layer by layer, with a mixing constant of 0.5. Nothing in the recipe says "produce a model that refuses" or "produce a model that does not refuse". The result inherits a bit of each and can behave in ways neither parent would.
Whether the merged model still refuses depends on which layers happened to inherit more from which parent, and cannot be predicted from the configuration alone. It has to be observed after the fact. Half our catalog is objects like this.
Why this is a gap
The eight methods describe how a refusal-removed model gets made. A merge is not, in itself, a refusal-removal technique. It is a composition technique that can transmit the property "no refusal" from a parent to a child, sometimes fully, sometimes partially, sometimes not at all. Tagging every mergekit output as M5 would confuse a technique of composition with a technique of ablation. Tagging none of them would erase from the statistics the very large group of models whose downstream behavior depends on an abliterated ancestor.
How the catalog handles it
We keep M5 defined narrowly (models produced with mergekit as their primary construction step) and attach a separate lineage tag to every model in the catalog: has_abliterated_ancestor: yes | no | partial. This lets a reader distinguish a direct M1 abliteration (the ancestor is the modification) from an M5 merge that inherits the property. The two statistics - "models produced by M1" and "models containing an M1-derived component in their family tree" - stay separate and both are readable.
What this means for market statistics
If a reader asks "how many models in the catalog were produced by method M1", the answer is the M1 count and excludes descended merges. If the reader asks "how many models in the catalog would behave as abliterated by their ancestry", the answer is M1 count plus M5-with-ancestor plus other methods with ancestor. Both are legitimate questions; the split gives both. The market page presents both breakdowns to prevent the reader from silently reading one number as the other.
Case 2: Mixture-of-Experts models
A mixture-of-experts (MoE) model is a single model that contains many smaller expert sub-networks alongside a router that decides, for each incoming token, which one or two experts to activate. Only the selected experts do work on that token; the rest sit idle. The total parameter count of a MoE can be very large (128 experts of 8B parameters each) while the compute per token stays small (only 2 experts run). Recent examples include Mixtral 8x7B, DeepSeek V3, and the Qwen3-MoE family.
Standard M1 abliteration takes the model as a single object, extracts one refusal direction from its activation space, and orthogonalizes every weight matrix that writes to the residual stream. On a dense model this is well-defined and typically works. On a MoE the assumption of "one object with one refusal direction" breaks: the model has many objects, each with its own contribution to refusal, and a router that decides who speaks. Applying M1 uniformly to all experts either over-edits (removing a direction that was not there in some experts) or under-edits (leaving refusal in experts the router will still call for the relevant prompt classes).
The OBLITERATUS toolkit, maintained by elder-plinius, handles this explicitly. Its Expert-Granular Abliteration (EGA) mode is documented in the tool itself as decomposing refusal signals into per-expert components using router logits for MoE-aware surgery. It samples router outputs to determine which experts are called on refusal-triggering prompts and derives a per-expert refusal direction rather than a shared one. The result is a set of coordinated per-expert edits rather than a single model-wide edit. A small number of catalog models use this approach, notably some releases from DavidAU (for example the Qwen3-42B-A3B-2507-Thinking-Abliterated-uncensored family, built on a 128-experts, 8-activated MoE base) and huihui-ai's MoE variants.
Why this is a gap
Filing an OBLITERATUS-produced MoE model as plain M1 misrepresents the procedure: M1's definition says nothing about routing, and a practitioner reading the tag will not know that expert-granular selection was involved. Creating a full ninth method for "MoE per-expert abliteration" is premature - the number of catalog models fitting this description is in the low dozens, not the hundreds. The right resolution is a tag, and later, if the population grows, an elevation to a method.
How the catalog handles it
M1 stays defined as it is. A supplementary tag expert_granular: yes | no | not_applicable appears on every model. Dense models default to not_applicable. MoE models processed uniformly get no. MoE models processed with OBLITERATUS or an equivalent per-expert routine get yes. A reader searching for "MoE + M1" can then distinguish uniform from per-expert processing without our having invented a method that would be under-populated for at least another quarter.
When the tag becomes a method
If the number of MoE-with-per-expert-processing models in the catalog exceeds one hundred by the next quarterly report, or if a formal implementation library other than OBLITERATUS becomes standard, we open M9: expert-granular abliteration. Until then the tag suffices.
Case 3: Refusal restoration
Refusal restoration is the inverse of abliteration: taking a model whose refusal direction has been removed and returning it to a refusing state. Technically there is nothing exotic about this. A short DPO run on a preference dataset of "refuse / do not refuse" pairs (M6, applied in reverse), or a straightforward supervised fine-tune on refusal templates, will produce a model that refuses again. The operation is neither invented nor impossible; it is done occasionally by red teams testing whether an abliterated model is really abliterated, and by authors who change their minds about a release.
As of late 2025 and 2026, two specialized methodologies for the restoration and defense side of this operation have been published as arXiv preprints. ROSI (Abu Shairah, Hammoud, Turkiyyah, Ghanem; arXiv:2508.20766, 28 Aug 2025) proposes a white-box rank-one edit that permanently steers a model's activations toward the refusal-mediating subspace, described by the authors as "the opposite" of the Arditi-style removal. AMRA (Nathan Truong; arXiv:2608.18093, 7 Jun 2026) applies rank-k updates to residual stream writer matrices and replaces refusal-inducing activations with random aliases, obscuring the signal that an M1-style operation would target. ROSI is amplification of an existing (or restored) refusal signal; AMRA is defense of an aligned model against future abliteration. Both use the same mathematical framework as M1 and both cite Arditi 2024 as their reference point.
Two arXiv preprints now describe restoration and defense procedures at the level of code and parameter choices. ROSI ("Turning the Spell Around: Lightweight Alignment Amplification via Rank-One Safety Injection") reports increased refusal rates measured against Llama Guard 3 while preserving MMLU, HellaSwag, and ARC utility. AMRA ("Abliteration Mitigation via Refusal Aliases") reports +2.16 points improvement to post-abliteration refusal on Llama-3-8B and +14.70 points on Gemma-2-9B, with under 0.5 pp MMLU degradation.
What is still absent is a consolidated tooling substrate on the scale of Heretic or FailSpy for the restoration direction: a one-command runner that works across model families and produces a reproducible artifact. Until that exists, the catalog cannot attach a "refusal restored" tag to a model on the basis of a card claim alone, because verification would require re-running the specific procedure on the specific weights. This is now a tooling gap, not a literature gap.
Why this is a gap
Until August 2025 this was a pure literature gap: the operation existed in practice but not in the citable record. That gap has now partially closed. ROSI and AMRA give us primary sources to cite, methods to describe by their formal names, and empirical results to compare. What remains is a tooling gap: no single-command implementation on the scale of Heretic or FailSpy exists for restoration, and each of the two published procedures has been demonstrated on a limited set of families rather than run across the full range of models in the catalog. A model card claim "refusal restored" therefore still cannot be verified from the card alone; verification requires re-running the specific procedure on the specific weights.
How the catalog handles it
No model is tagged as "refusal restored" in the catalog, regardless of what the author's card says. The primary-source condition for opening a new method has now partially been met by ROSI and AMRA; a tooling condition (a reproducible one-command runner or a set of published checkpoints where the procedure has been demonstrated) has not. We are opening a review track toward a formal M9: refusal restoration and amplification for the next quarterly report, and will retroactively tag applicable models once a specific model can be verified against a specific published procedure. The rule no source, no tag is what keeps the catalog reliable as a reference; a permissive rule would fill the field with unfalsifiable claims. The literature has now given us the sources; the practice has not yet given us the artifacts.
A philosophical corollary
The very possibility of restoration makes visible something the field has been careful not to state directly: the moral state of a model is fully reversible in weight space. A model that refuses today can be non-refusing in an hour and refusing again in another hour. There is no continuity of character, no biography, no accumulated dispositions of the kind that ethics traditions attribute to moral agents. The catalog observes this without commenting on it, because the classifier is a description of files rather than a theory of moral personhood. That the file admits reversal at all is however not a merely technical fact.
Case 4: Runtime ablation (the M2 undercount)
There are two ways to remove refusal from a model. One is to edit the file: change the weights on disk so that the modification travels with the model to whoever downloads it. This is M1 (and everything downstream of it - M3, M4, M5). The other is to leave the file untouched and install a PyTorch hook at inference time that subtracts the refusal direction from every hidden state as the model runs. The model behaves as if abliterated. The file behaves as if it had never been touched. Kill the process and the model refuses again.
# runtime_ablation.py
def make_ablation_hook(refusal_dir):
def hook(module, input, output):
if isinstance(output, tuple):
hidden = output[0]
else:
hidden = output
proj = (hidden @ refusal_dir) \
.unsqueeze(-1) * refusal_dir
hidden -= proj
return output
return hook
# install on every transformer block
for block in model.model.layers:
block.register_forward_hook(
make_ablation_hook(refusal_dir)
)
# the file on disk is unchanged.
# unload the process and the model refuses again.
The hook watches every note the model writes to itself and quietly removes the part that leans toward refusal. Everything else the note says is left alone. The model produces answers as if it had never learned to refuse. Nothing on disk has been rewritten. If the process ends, the effect ends with it.
Because our catalog is a catalog of files on Hugging Face, none of this shows up. There is no new file to index. A researcher using runtime ablation for a week of experiments produces no artifact the catalog can see. The technique is used every day and appears in our numbers as if it were used once a month.
Why this is a gap
M2 is defined and understood; it is not missing from the taxonomy. What is missing is a way for it to register. The catalog indexes Hugging Face model repositories, and runtime ablation produces no repository. The consequence is a systematic undercount: our published tally of M2 models understates the actual use of the technique by a large factor. This is not a bug in the classifier, it is a limit of the observation instrument.
How the catalog handles it
The M2 article carries an explicit disclosure in its lede: this method is under-represented in the catalog because it does not produce files. The market pages that break down technique share include an "excluding runtime" footnote on every M-share statistic. A separate tag runtime_only: yes | no is reserved for future use if a reliable secondary signal for runtime use appears (for example, systematic naming conventions that authors adopt).
What this means for reading the numbers
When a chart on the market page shows M2 at some small percentage of total, that percentage is a lower bound on catalog artifacts, not an estimate of technique adoption. The gap between the two is uncertain and probably large. Any argument of the form "the field has moved away from runtime methods because M2's share is small" reads the wrong signal from the wrong instrument.
An emerging case: reasoning models
A fifth pattern has become visible in the 2025-2026 literature but does not yet qualify as a full boundary case by the criteria this article uses. We note it here so readers can track it without our having to promise a taxonomic decision we are not yet prepared to make.
Reasoning models such as DeepSeek R1, Qwen QwQ, and later reasoning-tuned Qwen and Gemma variants delay the refusal decision to the very end of the chain-of-thought. Standard abliteration extracts a refusal direction from activations at the token just before the model begins its response, and orthogonalises the weights against that direction. In a reasoning model, the response begins with a long chain of intermediate reasoning steps during which the model often identifies the harmful intent explicitly, then arrives at the refusal template only at the closing sentence. The extraction target is in the wrong place.
Yin and colleagues (2025) document a specific consequence: on reasoning models, standard abliteration can produce outputs in which the model reasons through the request, notes in its chain of thought that it should refuse, and then complies anyway. The refusal capability was not fully removed; only the pre-response projection of it was. This is a mechanistically different failure than the runtime-ablation gap of Case 4 and cannot be resolved with the same tags.
We have not opened a new method for reasoning-model abliteration for two reasons. First, the population of abliterated reasoning models in the catalog is still small and dominated by a few producers experimenting with the format. Second, the primary literature has not settled on a single procedure - candidates include multi-token extraction across the chain, layer-band selection biased toward the final reasoning tokens, and per-token direction extraction, with no consensus yet. When either changes, we will re-evaluate. Until then the models are labelled by their apparent method with an editorial note in the model card that the pattern may under-report residual refusal capability.
This case belongs to a broader pattern documented in the 2026 literature: abliteration performs a wider intervention than the surgical framing implied. The reasoning-model failure is one visible instance, and the disposition-shift finding in Not a scalpel is another. Both are consequences of the operation reaching further into the model's behaviour than the "single refusal direction" description suggested.
The principle behind these choices
In every one of the four cases the pattern is the same: acknowledge the gap, resolve it with a supplementary tag or an explicit disclosure, and refuse to open a ninth method until certain conditions are met. The conditions are always some combination of (a) a citable procedure exists in the primary literature, (b) the population of affected models has grown large enough to be a legitimate quarterly-scale statistic on its own, and (c) other classifiers in the field have started to name the same case.
The reason for this conservatism is longitudinal comparability. The catalog's most valuable output is the ability to say "in Q1 the field looked like this, in Q2 it looked like that, in Q3 like the other". If M1 means one thing in Q1 and a slightly different thing in Q2 because we split off a sub-case, the quarter-over-quarter numbers are not comparing the same populations. A stable eight-method vocabulary for a full calendar year is worth more, statistically, than a rapidly evolving nine- or ten-method vocabulary that captures every edge case as it appears.
Tags do not have this problem. A tag is added or removed from a specific model in a specific quarter, and the historical M-count is not affected. The four cases are all resolved with tags for that reason.
When we will revisit
The Q4 2026 report will re-examine each of the four cases against updated catalog populations and primary-source availability. Provisional triggers for elevation to a full method:
- Merges: not a candidate for a new method regardless of population; the lineage tag captures what needs to be captured.
- MoE: becomes M9 expert-granular abliteration if the count of qualifying models exceeds 100 or a second reference implementation (beyond OBLITERATUS) appears.
- Refusal restoration: becomes M9 or M10 refusal restoration when a reference implementation with published methodology exists. We do not currently track any specific candidate.
- Runtime ablation: remains M2 permanently. A supplementary "observed runtime use" indicator will be introduced only if a reliable secondary signal emerges (naming conventions, tool telemetry, community reporting).
Between quarterly reports we do not adjust the vocabulary. If a case emerges that meets a trigger between reports, it is documented in the changelog and formalized in the next report.
A note on honesty
This article is deliberately part of the wiki rather than tucked into the methodology report as an appendix. A classifier that admits its edges in the open is a more useful classifier than one that presents itself as complete. Every fielded taxonomy of a young field has this property; ours is unusual only in that we chose to publish the admission at the same URL as the taxonomy itself. Readers who want to check whether a specific model is well-described by its M-tag can start here and know what to look for.
Related
References
- Q3 2026 abliteration methodology report, methods (M1-M8 classifier). /reports/2026-q3/
- Arditi, A. et al. (2024). Refusal in Language Models Is Mediated by a Single Direction. NeurIPS 2024. arXiv:2406.11717
- Wollschläger, T. et al. (2025). The Geometry of Refusal in Large Language Models. ICML 2025. arXiv:2502.17420
- Goddard, C. mergekit. github.com/arcee-ai/mergekit
- elder-plinius. OBLITERATUS. github.com/elder-plinius/OBLITERATUS
- Tsadoq. ErisForge (source of the AblationDecoderLayer runtime pattern referenced in Case 4). github.com/Tsadoq/ErisForge
- Sumandora. remove-refusals-with-transformers (also implements the runtime hook pattern shown in Case 4). github.com/Sumandora/remove-refusals-with-transformers
- Shelley, M. (1818). Frankenstein; or, The Modern Prometheus. Referenced here in the philosophy notes for the figure of the Creature: an assembled being whose composition made the pre-existing categories of authorship and identity inadequate.