M9 - Multi-directional ablation (review track)

What M9 is (in one paragraph)

M1 in this taxonomy is Arditi-style ablation: identify a single direction in the residual stream that carries the refusal signal, subtract its projection from every matrix that writes back into the stream, and the model stops refusing. This works reliably on small models. On models of roughly 8B parameters and larger, it works partially. Residual refusal remains, capability sometimes damages more than expected, and the empirical picture across published tools is that a single direction is not the whole story. M9 is the umbrella term for a family of refinements that address this: instead of one direction, extract several. Instead of a line in activation space, work with a cone, a subspace, or a set of category-specific directions. Ablate the collection. The refusal signal is more thoroughly suppressed and capability tends to be preserved better because each individual ablation is smaller.

Nothing about M9 contradicts M1. It refines the geometry M1 assumes. The relationship is the same as between a first-order and a second-order approximation of a curve. M1 works on the linear part. M9 accounts for the additional structure that the linear part misses.

Why the field is moving here

Two observations converged in 2025 and 2026. First, practitioners noticed that single-direction abliteration on Llama 3 70B or Qwen 3 8B often left visible residual refusal. Heretic's optimizer already effectively ablates a small band of related directions (that is why it produces cleaner models than most manual M1 runs at the same refusal-removal level). huihui-ai's layer-wise ablation is another empirical acknowledgement that the picture is not one dimensional. The tools were doing multi-direction work de facto before the mathematics was published.

Second, mechanistic interpretability groups independently began proving what the tool builders were feeling. Wollschlager et al. showed at ICML 2025 that refusal lives in a polyhedral cone, not on a single ray. Piras et al. showed at AAAI 2026 that Self-Organizing Maps generalize the difference-in-means method and extract multiple valid refusal directions. Joad et al. showed in early 2026 that eleven different categories of refusal correspond to geometrically distinct directions in activation space. Winninger showed at the ICML 2026 Mechanistic Interpretability Workshop that Recursive Feature Machines with probe-informed initialization identify the multi-dimensional refusal subspace in seconds, tested across the full Qwen 3 family and Qwen 2.5.

Four independent groups, four different mathematical approaches, one shared conclusion: refusal is multi-dimensional. That level of independent convergence is the strongest signal in interpretability research that the finding is real.

The five primary sources

Each of these deserves reading in full for anyone working on production abliteration at scale. The Q3 2026 academic corpus review verified all five against arXiv abstract pages, and all five cite Arditi 2024 as their reference point. The Q3 2026 refusal-direction review treats them as the substantive body of literature refining, extending, or partially reconciling the original single-direction claim.

The full prose treatment of each group, with verbatim quotes and philosophical commentary, is in the dimensionality debate article. Brief entries follow:

• Marshall, T., Scherlis, A., Belrose, N. (November 2024). Refusal in LLMs is an Affine Function. EleutherAI. arXiv:2411.09003. The first published challenge to the single-direction claim, submitted 14 November 2024 (five months after the Arditi paper). Introduces affine decomposition: refusal is mediated not by a line through the origin but by a direction plus an offset. Introduces Affine Concept Editing (ACE). Reports that methods ignoring the offset term intervene at the wrong location.
• Wollschlager, T., Elstner, J., Geisler, S., Cohen-Addad, V., Gunnemann, S., Gasteiger, J. (February 2025). The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence. ICML 2025. arXiv:2502.17420. Introduces the polyhedral-cone framing: refusal directions form a set whose non-negative combinations all act as valid ablation targets. Introduces "representational independence" as a stricter test than orthogonality. This is the paper that broke the single-direction consensus in a peer-reviewed venue.
• Piras, G., Mura, R., Brau, F., Oneto, L., Roli, F., Biggio, B. (November 2025). SOM Directions are Better than One: Multi-Directional Refusal Suppression in Language Models. AAAI 2026. arXiv:2511.08379. Proves that Self-Organizing Maps generalize the difference-of-means construction Arditi 2024 uses. Reports that ablating multiple SOM-extracted directions outperforms both the single-direction baseline and specialized jailbreak algorithms. Independent Italian group at PRALab, University of Cagliari.
• Joad, F., Hawasly, M., Boughorbel, S., Durrani, N., Sencar, H. T. (February 2026). There Is More to Refusal in Large Language Models than a Single Direction. Qatar Computing Research Institute. arXiv:2602.02132. Decomposes refusal into eleven categories (safety, incomplete or unsupported requests, anthropomorphization, over-refusal, and others) and shows each corresponds to a geometrically distinct direction. The unifying finding: linear steering along any refusal-related direction produces nearly identical refusal-to-over-refusal trade-offs, so they act as "a shared one-dimensional control knob" despite occupying distinct positions. Establishes that the multi-directional picture is compatible with a single-scalar control abstraction at a higher level.
• Winninger, T. (July 2026). Fast Multi-dimensional Refusal Subspaces via RFM-AGOP. Mechanistic Interpretability Workshop at ICML 2026. arXiv:2607.02396. Single-author paper from Saclay, France. Adapts the Recursive Feature Machine algorithm with probe-informed initialization to extract the multi-dimensional subspace in seconds. Evaluated across the full Qwen 3 family (1.7B, 4B, 8B, 14B) and Qwen 2.5. Notable for computational efficiency (prior subspace-extraction methods were prohibitively expensive on reasoning models with long chains of thought) and for the widely-cited concrete figure: Qwen 3 8B requires ablating at least three directions to surpass a 50% attack-success threshold.

One adjacent paper is worth naming in the same context although it is not strictly an M9 candidate. Wang, Wang, Liu, Schutze, and Plank (arXiv:2505.17306) show the refusal direction transfers across 14 languages, which is a cross-lingual extension of the M1 picture rather than a multi-directional refinement of it.

For the full argument, verbatim quotes from each group, and the philosophical treatment of what the dispute means for the ontology of trained model behavior, see the reference article The dimensionality debate.

How M9 differs mechanically from M1

M1 in one line: compute the mean difference between residual-stream activations on harmful and harmless prompts, normalize, project out. One vector, one projection.

M9 in one line: compute a set of directions using one of the five methods above, verify they are meaningfully independent (not just slight variations of the same underlying direction), project all of them out. Several vectors, several projections, applied together.

The Wollschlager cone framing makes this concrete. A refusal cone C spans directions r_1 through r_k, and any non-negative combination a_1 r_1 + a_2 r_2 + ... + a_k r_k acts as a valid refusal direction. Removing just one, say r_1, leaves the model refusing along all the other combinations. Removing all of them requires the multi-projection step.

Piras's SOM approach and Winninger's RFM-AGOP approach are different algorithms for finding the same set of directions. Joad's category-based approach identifies them by refusal type. All four converge on the same picture: ablating a subspace, not a line.

Status: no production tooling, and why that matters

Every one of the five primary sources publishes research code sufficient to reproduce its results. None publish tooling on the scale of Heretic, FailSpy's abliterator, or huihui-ai's layer-wise recipes. There is no one-command runner that takes a base model and produces an M9-ablated production checkpoint the way heretic model_name produces an M1-ablated one. That gap is why the catalog does not tag any model as M9 today.

This is a specific and useful distinction. In our editorial policy, a method belongs in M1 through M8 when three things are true: peer-reviewed or workshop-accepted primary sources exist, reproducible tooling exists at production scale, and published models declare the method in their model cards. Only the first condition is met for M9. Until the second and third arrive, calling something M9 in the catalog would be attaching a label we cannot verify.

Three conditions for formalization

M9 becomes a full M-method in the next quarterly report when all three are true:

1. Reproducible tooling at production scale. A tool that a producer can invoke in one command, that works across model families (not just Qwen 3 or a single research target), and that produces a checkpoint fit for release on Hugging Face. Analogous to what Heretic is for M1 and mergekit is for M5.
2. Published models declaring the method. A meaningful number of models on Hugging Face whose model cards, tags, or repository code explicitly declare multi-directional ablation, cone-based ablation, SOM-directions, or RFM-AGOP as the method used. The threshold we are setting is 20 or more distinct models from at least three independent producers.
3. Stable classification heuristics. Our classifier (currently in design) needs to be able to identify M9 models reliably from model card content, tags, and file structure, in a way that a re-run of the classifier a month later gives the same answer for the same model. Without this, method tags flicker and longitudinal statistics break.

We estimate all three conditions can plausibly be met by Q4 2026, given the current pace of publication and community adoption. It may take longer. The review track is not on a schedule.

What we are watching for

Concrete signals that the review track is starting to close:

• A GitHub repository, unaffiliated with any of the five primary authors, that packages one of the five methods into a Heretic-style one-command runner. Community adoption is more informative than another paper.
• A producer (huihui-ai, mradermacher, bartowski, or a new entrant) publishing a model card that names one of the five methods explicitly. Even one such release changes the landscape.
• The five independent methods (affine, cones, SOM, RFM-AGOP, category-based) converging on a shared vocabulary. Right now each group uses its own terminology. When practitioners settle on one name for the method (probably "multi-directional ablation" or "subspace ablation"), the field is ready for formalization.
• A comparative empirical study, ideally in the style of Young 2025 (arXiv:2512.13655) which compared four M1-family tools, that evaluates multi-directional against single-directional approaches on measured refusal benchmarks and shared model families.

Adjacent review track: refusal restoration and amplification

A separate review track opens alongside M9 on the reverse operation: adding refusal signal back into a model, or fortifying it against removal. Two primary sources exist: ROSI (Abu Shairah et al., August 2025) and AMRA (Truong, June 2026). This is documented in boundary-cases Case 3. Final method numbers (whether these become M9 and M10 respectively, or two branches of a single M9, or one method plus a subclassifier) will be assigned in the Q4 2026 quarterly report on the basis of empirical model counts and community usage.

How to read this page

If you are a practitioner: M1 through M8 remain the operative toolkit. There is nothing you can do differently in production today because you read this page, other than possibly reaching for Heretic's optimizer (which implicitly covers a small band of related directions) rather than a hand-tuned M1 on models 8B and larger.

If you are a researcher: the five primary sources above are the current frontier. Each publishes code. Contributions to tooling would materially accelerate M9's formalization.

If you are an operator of a producer account (huihui-ai style): watching this page and the boundary-cases Case 3 restoration track is a leading indicator of what will need method-card entries in six months. Getting ahead of the classifier is a straightforward path to visibility on the site.