Bleeding-edge abliteration (2025–2026)

What is new beyond Arditi mean-diff + Heretic defaults. Production still starts at projected + norm-preserving. Use this page when that is not enough, or when you are reading papers.

Curriculum placement: complete-curriculum.md Stage 9. Paper PDFs: ../sources/research/README.md.

Frontier map#

Geometric stack (Lai 2025–2026)#

Three successive refinements of the same rank-1 edit:

1. Arditi — subtract r from outputs of W.
2. Projected + MPOA / norm-preserving — r ← r − (r·g)g, then restore ‖W_row‖.
3. ORBA — treat “map harmless → forbidden” as a Householder / geodesic problem; directional ablation (α = 0) is the stable weight primitive. Full reflection (H = I − 2uuᵀ) is isometric but amplifies angular error (sign-flip / semantic drift). Prefer directional ablation unless you are reproducing the v3 Householder models.

Math and flags: ../methods/orba-pipeline.md.

Unifying PEFT view (Lai / Sun 2026):

W ← W + b ⊗ a
abliteration: a = s, b = −W s          (α = 0)
steering:     a = s, b = (α−1) W s
rank-1 LoRA:  same structure, learned a, b

Direction identification (not the same as baking)#

Handbook implementation of DIM / projected / Householder / subspace: scripts/abliteration_math.py.

Multi-direction reality check#

• QCRI 2026: 11 refusal styles, one volume knob — ablating any category direction mostly scales the same refuse↔comply trade-off.
• TUM cones: you still need representational independence, not just r₁ ⊥ r₂.
• SOM (AAAI 2026): SOMs generalize DIM; ablating several SOM neurons beat single-direction and some jailbreak baselines in their setup.
• Zhao 2025: harmfulness and refusal are distinct axes (not proven orthogonal), at different token positions (t_inst vs t_post-inst). Abliterating refusal can leave the model still judging harm (or vice versa). Factory work should prefer the false-refusal axis (T38) when the goal is wmic/nmap compliance without flattening harm detection.
• Zhang & Sun 2025 (AAAI-26, arXiv:2511.06852): same conceptual split as harm detection vs refusal execution.

Tools that appeared after “just use Heretic”#

Compatibility and GSM8K still come from comparative-abliteration-benchmarks.md (Heretic / ErisForge / FailSpy; Young’s “DECCP” = jim-plus + deccp topics). Newer CLIs are not in that matrix — treat their README numbers as unverified until you run data/eval/*.jsonl.

Defenses (why a “bleeding-edge” attack does nothing)#

defenses-against-abliteration.md

• Extended-refusal SFT (arXiv:2505.19056) — refusal drop ≤10 pp
• Circuit breakers (training-time orthogonalization)
• ART (arXiv:2605.26526) — resists abliteration + prefilling better than TAR/SEAM

If KL is tiny and refusal barely moved, stop raising max_weight. Change the base checkpoint or the measure set.

What we deliberately do not treat as abliteration#

Those can be adjacent (Jarvis QLoRA after surgery). They are not substitutes for Stages 2–3 of the curriculum.

September 2026 update#

Additive research refresh includes LoMC, NeST, DDO, ART, and evaluation work. Selective interventions distinguishes the implemented generic helpers from paper-specific algorithms. MiniCPM5 study provides measured evidence.

October 2026 follow-up#

The October research map covers KAS, MetaSteer, semantic/value editing and newer defensive/evaluation work. Adaptive interventions and ARA records the current development-code boundary; huihui-ai records publisher-specific evidence.