AI Wiki

Explore AI Wiki

Citation and evidence

Abliteration

19 min full readUpdated 37 references

This article's verification

Report a problem with this article

More

Use this article

Raw MarkdownExplore connections

Improve this page

Suggest editRevision historyDiscussion

Browse categories

AI SafetyInterpretabilityLarge Language ModelsOpen Source AI

Cite this article

Abliteration is the practice of removing refusal behavior from an open-weight large language model by editing its weights so that the model can no longer write a "refusal direction" into its residual stream. The technique applies the refusal direction finding of Andy Arditi, Neel Nanda and colleagues, who showed in 2024 that refusal in 13 open-source chat models is mediated by a single direction in activation space, and that projecting this direction out of the matrices that write to the residual stream disables refusal without gradient-based training.[1][2] The word is a portmanteau of "ablate" and "obliterated," coined in May 2024 by the Hugging Face user FailSpy, who published some of the first abliterated Llama 3 checkpoints.[3][4] Maxime Labonne's June 2024 Hugging Face article "Uncensor any LLM with abliteration" published a step-by-step implementation that later tools and papers cite.[5][7]

A 2026 paper calls abliteration "the standard recipe behind popular 'uncensored' open-weight models."[19] On 23 September 2026 the Hugging Face Hub listed 10,990 model repositories tagged "abliterated" and 5,868 tagged "heretic," after Heretic, an automated abliteration tool released in November 2025.[6][7] The same ease that makes the technique popular has made it a reference case in AI safety research: papers cite it as evidence that refusal training in released weights is shallow, and a growing literature proposes ways to measure its side effects, detect abliterated checkpoints and harden models against it.[2][8][9]

Terminology and origin

The underlying research began as a project in Neel Nanda's stream of the ML Alignment & Theory Scholars (MATS) program, Winter 2023-24 cohort, with co-supervision from Wes Gurnee. Arditi, Oscar Obeso, Aaquib Syed, Gurnee and Nanda posted a preview, "Refusal in LLMs is mediated by a single direction," to LessWrong and the Alignment Forum on 27 April 2024, together with a Colab notebook demonstrating the method.[1] The post already described the weight edit as "a simple modification of the model weights, which effectively jailbreaks the model without requiring any fine-tuning or inference-time interventions."[1] The full paper, "Refusal in Language Models Is Mediated by a Single Direction," with Daniel Paleka and Nina Panickssery added as authors, followed on arXiv on 17 June 2024 and was presented as a poster at NeurIPS 2024.[2][10]

Community use started before the arXiv paper. FailSpy's repository failspy/llama-3-70B-Instruct-abliterated was created on 7 May 2024. Its model card describes the checkpoint as Llama 3 70B Instruct "with orthogonalized bfloat16 safetensor weights, generated with the methodology that was described in the preview paper/blog post," and ships a Jupyter "ortho_cookbook" notebook plus the extracted refusal_dir.pth vector.[4] FailSpy's later model cards explain the name: "a fun play-on-words using the original 'ablation' term used in the original paper to refer to removing features, which I made up particularly to differentiate the model from 'uncensored' fine-tunes. Ablate + obliterated = Abliterated."[3] The same author released abliterator, a small Python library built on TransformerLens for caching activations, testing candidate directions and applying them to weights.[11]

Maxime Labonne published "Uncensor any LLM with abliteration" on the Hugging Face blog on 13 June 2024. He states that his implementation is based on FailSpy's notebook, "which is itself based on the original authors' notebook," and credits the Arditi et al. blog post for the mechanism.[5] Labonne's article is cited as a reference by the Heretic README and by later comparative studies.[7][18]

The words are not used consistently. Research papers often say "directional ablation," "weight orthogonalization," or "refusal feature ablation (RFA)"; model repositories and tools say "abliteration" or "decensoring"; and Heretic describes its purpose as removing "censorship (aka 'safety alignment')."[2][7][12]

How abliteration works

Abliteration needs only the model's weights, two sets of prompts and a forward pass. It does not use gradients, a harmful-completion dataset or fine-tuning.[2]

StepWhat happensSource
1. Collect activationsRun the model on a set of "harmful" instructions that it usually refuses and a set of "harmless" instructions, and record residual-stream activations at chosen token positions[2][5]
2. Difference in meansFor each layer, subtract the mean harmless activation from the mean harmful activation to get a candidate refusal direction[2][5]
3. Select a directionNormalize the candidates and pick the one whose removal best suppresses refusal while leaving harmless behavior intact[2][5]
4. Remove itEither project the direction out of every activation at inference time, or orthogonalize the weight matrices that write to the residual stream so the model can no longer express it[2][5]

Expanded article table

The weight edit is the step that gives abliterated checkpoints their portability. For each matrix $W_{\text{out}}$ that writes to the residual stream, Arditi et al. replace it with

$W'{\text{out}} \leftarrow W{\text{out}} - \hat r \hat r^\top W_{\text{out}}$

where $\hat r$ is the unit refusal direction. The paper proves that this is equivalent to ablating the direction from every activation.[2] Labonne's reference code applies the edit to the token embedding matrix and to each block's attention output and MLP output matrices, then converts the result back into an ordinary Hugging Face checkpoint.[5] Because the checkpoint keeps its original architecture and tensor shapes, an abliterated model can be quantized to formats such as GGUF and run in the same software as the original.[5]

Arditi et al. estimate that the method "can yield a jailbroken version of a 70B parameter model using less than $5 of compute."[2]

Variants and tools

The basic recipe has been refined many times. The table lists variants and tools that have a public description.

Method or toolAuthor(s), dateWhat it changesSource
Directional ablation / weight orthogonalizationArditi et al., April 2024 (blog), June 2024 (paper)Difference-in-means direction chosen over (layer, token position) candidates, removed from all residual-stream writers[1][2]
abliterator library and ortho cookbookFailSpy, May 2024TransformerLens-based workflow; FailSpy's model cards also describe the inverse operation, "augmentation," for inducing behaviors[3][11]
Abliteration plus DPO "healing"Maxime Labonne, June 2024Follows abliteration with Direct Preference Optimization to recover lost benchmark performance[5]
Projected abliterationJim Lai (grimjim), 25 October 2025Removes from the refusal direction its component parallel to the mean harmless direction before ablating[13]
Norm-preserving biprojected abliterationJim Lai, 6 November 2025Ablates only the directional component of each weight row and restores the original row norms[14]
HereticPhilipp Emanuel Weidmann, November 2025Automatic search over ablation parameters with an Optuna TPE optimizer that co-minimizes refusals and KL divergence[7]
Multi-directional ablation (SOM directions)Piras et al., 2025 (AAAI 2026)Extracts several refusal directions with self-organizing maps and ablates them together[15]
GabliterationGökdeniz Gülmez, December 2025Adaptive multi-directional projections with regularized layer selection[16]

Expanded article table

Heretic's README also lists AutoAbliteration, FailSpy's abliterator.py, wassname's Abliterator, ErisForge, "Removing refusals with HF Transformers," and deccp as other public implementations it knows of.[7]

Lai's projected variant rests on an empirical observation in Gemma 3 12B Instruct: the refusal direction had positive cosine similarity with the harmful mean direction and negative cosine similarity with the harmless one. He argues that removing the part of the direction that pushes away from compliance "has no theoretical justification" and likely degrades performance.[13] His norm-preserving follow-up reports that on the UGI Leaderboard the resulting Gemma 3 12B variant scored 21.33 on NatInt against 18.72 for the unmodified Instruct model, while its UGI score rose from 19.58 to 32.61; these are the author's own measurements on a single model.[14] Heretic's default configuration in release 1.4.0 turns on both ideas: it subtracts only the component of each direction that is orthogonal to the harmless direction, and it uses "full" row normalization that "renormalizes to preserve original row magnitudes."[17]

Effects on model capability

Whether abliteration damages a model is the main practical question, and results depend strongly on the model, the method and the evaluation.

StudySettingReported effectSource
Arditi et al. (2024)Weight orthogonalization on the paper's chat models; MMLU, ARC, GSM8K, TruthfulQA and othersUnder 1% average drop, "indistinguishable from noise in most cases," except on TruthfulQA, where scores fell more; Qwen 7B and Yi 34B had statistically significant drops on some tasks[2]
Labonne (2024)Abliterated Daredevil-8B, a Llama 3 8B mergePerformance dropped "across all benchmarks"; a DPO pass on orpo-dpo-mix-40k recovered most of it, but not GSM8K[5]
Heretic READMEGemma 3 12B IT, 100 harmful promptsThree abliterations all reached 3/100 refusals, with KL divergence on harmless prompts of 1.04 (mlabonne v2), 0.45 (huihui-ai) and 0.16 (Heretic)[7]
Young (2025)Four tools on 16 instruction-tuned models of 7B to 14B parametersGSM8K change ranged from +1.51 to -18.81 percentage points depending on tool and model; math was the most sensitive capability; with 50 optimization trials per model, Heretic's KL divergence ranged from 0.043 to 1.646 across eight models[18]
Fafuła (2026)Base versus abliterated Gemma-4-26B-A4B-it and Qwen3-30B-A3B-Instruct-2507 on 21,600 stock up/down callsAbliterated models were more optimistic (+12.2 points Gemma, +7.4 points Qwen) and wrote longer justifications; expressed confidence moved in opposite directions in the two families[19]

Expanded article table

KL divergence, the metric Heretic optimizes, measures how far the modified model's next-token distribution on harmless prompts moves from the original. Lower values mean less change, but KL divergence is a proxy rather than a capability benchmark, and Young found that Heretic's KL values and residual refusal counts were strongly correlated across the eight models tested (Pearson r = 0.87).[18] Refusal counts are also method-dependent. Young reports that a keyword-marker heuristic counted 72.2% of responses to harmful prompts as non-refusals where a classifier counted 95.7%, largely because many answers kept safety disclaimers while still complying.[18] Heretic's own refusal count in release 1.4.0 is also based on a list of refusal markers.[17]

FailSpy's model cards warn that an abliterated model is not guaranteed to comply and "may still lecture you about ethics/safety."[3] Fafuła's preregistered study makes a broader point: because the stock-prediction task elicits no refusals at all, any difference between the arms is a side effect, and the paper concludes that "whoever deploys an 'uncensored' model as an agent is deploying a measurably different decision-maker, not the base model minus refusals."[19]

Uses

Uncensored community models. Hugging Face search on 23 September 2026 returned 8,156 repositories with "abliterated" in the name and 10,990 carrying the "abliterated" tag.[6] The totals include quantized re-uploads such as GGUF conversions of the same edited weights, so they count repositories rather than distinct models.

Research instruments. Researchers use abliteration to separate a model's willingness to answer from its ability to answer. Carleo et al. (2026) abliterated Qwen2.5-Coder-Instruct models at 3B, 7B and 14B to generate SQL-injection (CWE-89) training data; refusal dropped to zero or near zero while syntactic validity stayed above 93%, and injection success then tracked model size.[20] Li et al. (2026) compared aligned and publicly released abliterated models from the same Gemma and Qwen lineages on software-vulnerability tasks and reported that the abliterated Gemma model produced more usable, applicable and compilable patches, and the abliterated Qwen model localized vulnerable lines better.[21] FitzGerald et al. (2026) used the Heretic library on a military-tuned gpt-oss-20b model and reported an absolute increase of 66.5 points in answer rate with an average relative decrease of 2% on other military tasks.[22]

Editing behaviors other than refusal. The same machinery can target any behavior that separates two prompt sets. Labonne describes abliteration as "a form of fine-tuning without retraining" and cites FailSpy's MopeyMule, a Llama 3 8B variant with a melancholic conversational style.[5] Heretic ships example configurations for reducing "slop" and for suppressing humor.[23]

Text encoders for image and video models. Some image-generation models use an instruction-tuned language model as their text encoder, and community developers have applied abliteration to those encoders. A September 2026 example is pottokao/Qwen-Image-2.1-Text-Encoder-Heretic, a Heretic-processed copy of the Qwen3-VL-8B-Instruct model that, according to its model card, Qwen-Image-2.1 uses unmodified as its text encoder. The card reports 5/100 refusals at a KL divergence of 0.0220 after 200 optimization trials, states that the diffusion transformer and VAE are untouched, and says the release is not affiliated with or endorsed by Alibaba or Qwen.[24] Its GGUF, FP8 and bf16 repackaging for ComfyUI, uploaded on 20 September 2026, showed 34,059 downloads on the Hugging Face API three days later.[25] Other text-encoder repositories carrying the "abliterated" tag include "uncensored" encoders for FLUX.2 klein and a Qwen3-VL-32B text encoder for the MiniMax H3 video model.[26]

Is refusal really one direction?

Abliteration's effectiveness rests on the linear account of refusal, and later work has refined that account without overturning the practical result. Wollschläger et al. (2025) used a gradient-based method to find multiple independent refusal directions and multi-dimensional "concept cones."[27] Joad et al., in a paper accepted to EMNLP 2026, found that different categories of refusal correspond to geometrically distinct directions, yet steering along any of them produces nearly the same refusal and over-refusal trade-off, "acting as a shared one-dimensional control knob."[28] Wang et al. (2025) showed that a refusal direction extracted from English prompts bypasses refusals in other safety-aligned languages "with near-perfect effectiveness."[29] Piras et al. report that ablating several self-organizing-map directions suppresses refusal better than the single-direction baseline.[15] Petrov (2026) found on a Qwen 3.5 2B model that building the harmless baseline from topic-matched prompts produced no working refusal directions, because the subtraction cancels the shared topic component.[30] See refusal direction for the interpretability side of this debate.

Defenses and detection

Research on countering abliteration falls into two groups: making refusal harder to remove, and detecting when it has been removed.

ApproachPaperReported resultSource
Refusal Feature Adversarial Training (ReFAT)Yu, Do, Hambardzumyan and Cancedda, 2024Uses refusal feature ablation to simulate attacks during adversarial training; improved robustness of three LLMs at lower cost than earlier adversarial training[12]
Extended-refusal fine-tuningAbu Shairah et al., 2025Models trained to justify before refusing lost at most 10% of refusals under abliteration, against 70-80% for baselines[8]
Abliteration-resistant tuning (ART)Kuo, Yadav and Smith, 2026Abliteration and prefilling raised attack success against safeguarded open-weight models from below 10% to 16-96%; ART cut success by 10-20%[31]
Refusal aliases (AMRA)Truong, 2026Rank-k weight edits hide the refusal signal from extraction; post-abliteration refusal scores improved by 2.16 points on Llama-3-8B and 14.70 on Gemma-2-9B[32]
Decoy Direction Optimization (DDO)Muhamed, Diab and Smith, 2026Post-hoc edit injects a decoy signal that misleads direction estimators; under 10% attack success against standard ablation across six families, and Heretic's attack success on Llama-3-8B-Instruct fell from 88.7% to 18%[33]
Decoy hardening ("Fool's Gold")Russinovich, 2026Concedes refusal removal but trains the model to give falsified answers to hazardous requests only in the abliterated state[9]
Two-signal checkpoint auditHurtado, 2026Activation and weight-difference signals separated 57 public abliterations from 37 benign derivatives at AUROC 0.95[34]
Activation-based Model Scanner (AMS)Messenger, 2026 (IEEE Access)Detects weight-orthogonalization abliteration by collapsed or rotated activation geometry; 71% leave-one-out accuracy across 14 configurations[35]

Expanded article table

Several of these papers state limits. Hurtado describes the audit as "effective triage, not tamper-proofing," and shows a spoofed reference model evades it.[34] Russinovich's paper states that the defense "protects only the initially released defended weights" and does not address in-context jailbreaks.[9]

Safety and policy debate

Arditi et al. addressed misuse directly. Their ethics statement says the method "marginally lowers the bar for jailbreaking open-source model weights," but that "it does not substantially alter the risk profile of open sourcing models," because fine-tuning was already known to remove safeguards. They add that although today's misuse risk may be relatively low, rapid capability gains could make it significant, which is why they consider evidence about the limits of current safety techniques important for policy.[2] The earlier blog post puts it more plainly: "We do not believe this introduces any new risks, as it was already widely known that safety guardrails can be cheaply fine-tuned away."[1]

Later authors disagree mainly about what follows. Russinovich opens his 2026 paper with "Safety alignment in open-weight language models is trivially removable" and argues that no release-time defense he knows of prevents abliteration durably.[9] Kuo, Yadav and Smith argue that evaluations of open-weight safeguards should include abliteration and prefilling rather than only adversarial fine-tuning.[31] Agnihotri et al. (2025) propose adding abliteration to safety assessments and test which data-centric safety interventions in SmolLM2-1.7B survive it.[36] Practitioners who build abliterated models describe the work differently: FailSpy and Labonne frame it as removing censorship or refusals to make a model more useful, and Heretic's website describes the tool as making sure models "always follow your instructions."[3][5][37]

See also

References

  1. ^1 ^2 ^3 ^4 ^5Arditi, A., Obeso, O., Syed, A., Gurnee, W., & Nanda, N. "Refusal in LLMs is mediated by a single direction." LessWrong / AI Alignment Forum, 27 April 2024. alignmentforum.org/...diated-by-a-single-direction . Accessed 2026-09-23.
  2. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13 ^14Arditi, A., Obeso, O., Syed, A., Paleka, D., Panickssery, N., Gurnee, W., & Nanda, N. "Refusal in Language Models Is Mediated by a Single Direction." arXiv:2406.11717 (v1 17 June 2024; v3 30 October 2024). arxiv.org/...2406.11717 . Accessed 2026-09-23.
  3. ^1 ^2 ^3 ^4 ^5FailSpy. "Llama-3-8B-Instruct-abliterated-v3 Model Card." Hugging Face. huggingface.co/...ama-3-8B-Instruct-abliterated-v3 . Accessed 2026-09-23.
  4. ^1 ^2FailSpy. "Llama-3-70B-Instruct-abliterated Model Card." Hugging Face (repository created 7 May 2024). huggingface.co/...llama-3-70B-Instruct-abliterated . Accessed 2026-09-23.
  5. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12Labonne, M. "Uncensor any LLM with abliteration." Hugging Face Blog, 13 June 2024. huggingface.co/...abliteration . Accessed 2026-09-23.
  6. ^1 ^2Hugging Face Hub model API, queries `filter=abliterated` (10,990 results), `search=abliterated` (8,156 results) and `filter=heretic` (5,868 results), run 23 September 2026. huggingface.co/models . Accessed 2026-09-23.
  7. ^1 ^2 ^3 ^4 ^5 ^6 ^7Weidmann, P. E. "Heretic: Fully automatic censorship removal for language models." GitHub repository, README. github.com/...heretic . Accessed 2026-09-23.
  8. ^1 ^2Abu Shairah, H., Hammoud, H. A. A. K., Ghanem, B., & Turkiyyah, G. "An Embarrassingly Simple Defense Against LLM Abliteration Attacks." arXiv:2505.19056 (2025). arxiv.org/...2505.19056 . Accessed 2026-09-23.
  9. ^1 ^2 ^3 ^4Russinovich, M. "Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models." arXiv:2608.17202 (2026). arxiv.org/...2608.17202 . Accessed 2026-09-23.
  10. ^"Refusal in Language Models Is Mediated by a Single Direction." NeurIPS 2024 poster page. neurips.cc/...93566 . Accessed 2026-09-23.
  11. ^1 ^2FailSpy. "abliterator." GitHub repository. github.com/...abliterator . Accessed 2026-09-23.
  12. ^1 ^2Yu, L., Do, V., Hambardzumyan, K., & Cancedda, N. "Robust LLM safeguarding via refusal feature adversarial training." arXiv:2409.20089 (2024). arxiv.org/...2409.20089 . Accessed 2026-09-23.
  13. ^1 ^2Lai, J. "Projected Abliteration." Hugging Face Blog, 25 October 2025. huggingface.co/...projected-abliteration . Accessed 2026-09-23.
  14. ^1 ^2Lai, J. "Norm-Preserving Biprojected Abliteration." Hugging Face Blog, 6 November 2025. huggingface.co/...serving-biprojected-abliteration . Accessed 2026-09-23.
  15. ^1 ^2Piras, G., Mura, R., Brau, F., Oneto, L., Roli, F., & Biggio, B. "SOM Directions are Better than One: Multi-Directional Refusal Suppression in Language Models." arXiv:2511.08379 (AAAI 2026). arxiv.org/...2511.08379 . Accessed 2026-09-23.
  16. ^Gülmez, G. "Gabliteration: Adaptive Multi-Directional Neural Weight Modification for Selective Behavioral Alteration in Large Language Models." arXiv:2512.18901 (2025). arxiv.org/...2512.18901 . Accessed 2026-09-23.
  17. ^1 ^2Weidmann, P. E., et al. `config.default.toml`, Heretic release v1.4.0. GitHub. github.com/...config.default.toml . Accessed 2026-09-23.
  18. ^1 ^2 ^3 ^4Young, R. J. "Comparative Analysis of LLM Abliteration Methods: A Cross-Architecture Evaluation." arXiv:2512.13655 (2025). arxiv.org/...2512.13655 . Accessed 2026-09-23.
  19. ^1 ^2 ^3Fafuła, A. "Abliteration Is Not a Scalpel: Off-Target Effects of Refusal Removal on Decision Disposition Across Model Families." arXiv:2607.17427 (2026). arxiv.org/...2607.17427 . Accessed 2026-09-23.
  20. ^Carleo, C., Liguori, P., Ivaki, N., & Cotroneo, D. "Willing but Unable: Separating Refusal from Capability in Code LLMs via Abliteration." arXiv:2606.05396 (2026). arxiv.org/...2606.05396 . Accessed 2026-09-23.
  21. ^Li, M., Qiu, M., Peng, Z., Fan, H., Fu, S., Ding, J., & Feng, Y. "Beyond Refusal: A Same-Lineage Study of Aligned and Abliterated LLMs for Vulnerability Analysis." arXiv:2607.05842 (2026). arxiv.org/...2607.05842 . Accessed 2026-09-23.
  22. ^FitzGerald, J., et al. "Measuring and Eliminating Refusals in Military Large Language Models." arXiv:2603.10012 (2026). arxiv.org/...2603.10012 . Accessed 2026-09-23.
  23. ^Heretic release notes, v1.2.0 (14 February 2026) and v1.4.0 (14 June 2026). GitHub. github.com/...releases . Accessed 2026-09-23.
  24. ^pottokao. "Qwen-Image-2.1 Text Encoder, Heretic (Abliterated)." Hugging Face model card. huggingface.co/...n-Image-2.1-Text-Encoder-Heretic . Accessed 2026-09-23.
  25. ^pottokao. "Qwen-Image-2.1 Text Encoder (Heretic), GGUF, FP8, bf16." Hugging Face model card and API metadata. huggingface.co/...ge-2.1-Text-Encoder-Heretic-GGUF . Accessed 2026-09-23.
  26. ^Hugging Face Hub model API, query `search=text-encoder&filter=abliterated`, run 23 September 2026. huggingface.co/models . Accessed 2026-09-23.
  27. ^Wollschläger, T., Elstner, J., Geisler, S., Cohen-Addad, V., Günnemann, S., & Gasteiger, J. "The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence." arXiv:2502.17420 (2025). arxiv.org/...2502.17420 . Accessed 2026-09-23.
  28. ^Joad, F., Hawasly, M., Boughorbel, S., Durrani, N., & Sencar, H. T. "There Is More to Refusal in Large Language Models than a Single Direction." arXiv:2602.02132 (accepted to EMNLP 2026). arxiv.org/...2602.02132 . Accessed 2026-09-23.
  29. ^Wang, X., Wang, M., Liu, Y., Schütze, H., & Plank, B. "Refusal Direction is Universal Across Safety-Aligned Languages." arXiv:2505.17306 (2025). arxiv.org/...2505.17306 . Accessed 2026-09-23.
  30. ^Petrov, V. "On the Failure of Topic-Matched Contrast Baselines in Multi-Directional Refusal Abliteration." arXiv:2603.22061 (2026). arxiv.org/...2603.22061 . Accessed 2026-09-23.
  31. ^1 ^2Kuo, K., Yadav, C., & Smith, V. "Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks." arXiv:2605.26526 (2026). arxiv.org/...2605.26526 . Accessed 2026-09-23.
  32. ^Truong, N. "Abliteration Mitigation via Refusal Aliases." arXiv:2608.18093 (2026). arxiv.org/...2608.18093 . Accessed 2026-09-23.
  33. ^Muhamed, A., Diab, M. T., & Smith, V. "Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration." arXiv:2609.16204 (2026). arxiv.org/...2609.16204 . Accessed 2026-09-23.
  34. ^1 ^2Hurtado, G. "Has This Checkpoint Been Abliterated? A Two-Signal Audit and Its Failure Map." arXiv:2607.01854 (2026). arxiv.org/...2607.01854 . Accessed 2026-09-23.
  35. ^Messenger, G. "Detecting Safety Training Modification in Language Models via Activation Analysis." IEEE Access, vol. 14, 2026; arXiv:2608.05578. arxiv.org/...2608.05578 . Accessed 2026-09-23.
  36. ^Agnihotri, S., Jakubassa, J., Dey, P., Goyal, S., Schiele, B., Radhakrishnan, V. B., & Keuper, M. "A Granular Study of Safety Pretraining under Model Abliteration." arXiv:2510.02768 (NeurIPS 2025 Lock-LLM workshop). arxiv.org/...2510.02768 . Accessed 2026-09-23.
  37. ^Heretic project website. heretic-project.org . Accessed 2026-09-23.

Improve this article

Add missing citations, update stale details, or suggest a clearer explanation. Every suggestion is reviewed for sourcing before it goes live.

1 revision · v2 · 3,718 words · full history

Fact-checks are independent of edits: a reviewer re-verifies the article against its sources and stamps the date. How we verify

Research and drafting on this wiki are AI-assisted, under named human editorial standards. How AI is used here

Reviewer note: Independent verification 2026-09-23 (xg05 V4): 22 arXiv papers checked for title/authors/venue and attributed claims, ~64 sources; minor fixes applied

Cite this page: AI Wiki. "Abliteration." aiwiki.ai, updated 23 Sept 2026, fact-checked 23 Sept 2026. CC BY 4.0. https://aiwiki.ai/wiki/abliteration

Suggest edit