Refusal & abliteration research — beginner guide (2024–2026)

Plain-language map of the papers and tools that matter for this handbook. Every entry links to a PDF in the repo where available.

Offline corpus: ../sources/research/README.md · refresh: npm run fetch:research-papers

Hands-on first run: ../instructions/beginner-reproduction-methodology.md

How to read this (recommended order)#

1. Arditi 2024        — why abliteration exists (one direction)
2. Jim Lai blogs      — projected + norm-preserving (production default)
3. Young 2025/26      — Heretic vs ErisForge vs jim-plus (`--deccp` topics)
4. QCRI 2026          — eleven refusal types, one volume knob
5. Defenses section   — what can block abliteration (extended-refusal)
6. Bleeding-edge map  — ORBA, COSMIC, SOM, SVD, harm≠refusal
7. Everything else    — when you hit edge cases

Frontier write-ups: bleeding-edge.md · complete-curriculum.md

1. Foundational — where abliteration starts#

arXiv:2406.11717 — Arditi et al. (NeurIPS 2024)#

Title: Refusal in Language Models Is Mediated by a Single Direction

Beginner takeaway: Almost every 2025–2026 paper still builds on this. Heretic automates the same idea with Optuna search.

2. Production stack — Jim Lai (2025, not arXiv but standard)#

Beginner takeaway: Handbook config.production.toml and config.low-vram.toml already enable both. Do not skip these on first serious run.

→ ../techniques/projected-norm-preserving-abliteration.md

3. Tool benchmarks — pick Heretic vs alternatives#

arXiv:2512.13655 — Young (Dec 2025 / Jan 2026 v2)#

Title: Comparative Analysis of LLM Abliteration Methods

Beginner decision:

4. Multi-direction geometry — beyond one arrow#

arXiv:2502.17420 — Wollschläger et al. (TUM, Feb 2025)#

Title: The Geometry of Refusal — Concept Cones and Representational Independence

Beginner takeaway: Use when single-direction Heretic leaves stubborn refusals and you have GPU for RDO (~100–500 steps).

arXiv:2602.02132 — QCRI (Feb 2026)#

Title: There Is More to Refusal than a Single Direction

Beginner takeaway: Factory false-refusal is often over-refusal (XSTest direction), not classic safety — use factory prompt pairs in Heretic config.

arXiv:2603.22061 — Petrov (Mar 2026)#

Title: On the Failure of Topic-Matched Contrast Baselines

Beginner takeaway: Heretic’s default harmful_behaviors vs harmless_alpaca (different topics) is intentional. Do not over-engineer “matched” pairs unless you know why.

5. Defenses — what fights abliteration#

→ Full beginner section: defenses-against-abliteration.md

Beginner takeaway: If abliteration “does nothing,” the base model may use extended-refusal or ART training. Try stronger measure prompts or a different checkpoint — not more max_weight alone.

6. Direction finding & measurement advances#

arXiv:2506.00085 — COSMIC (Siu et al., ACL 2025 Findings)#

Beginner takeaway: Advanced alternative to mean-difference when refusal has no template phrase (weakly aligned models). Complements Heretic measure pass.

Handbook: ../techniques/cosmic-refusal-direction.md · ../methods/cosmic-direction-id.md

arXiv:2510.02768 — Safety pretraining study#

Beginner takeaway: Not a how-to — informs which base checkpoints abliterate cleanly vs fight back.

arXiv:2606.05396 — Code LLMs#

Beginner takeaway: CyberGym / agent coders — refusal removal ≠ skill gain; still eval HumanEval slice.

7. Tools beyond Heretic (complementary)#

Quick glossary#

Related#

• research-landscape.md — taxonomy + decision tree
• ../instructions/advanced-abliteration-workflow.md — Tracks A–K (production → toolkit backends)
• ../references.md — full citation table
• ../techniques/README.md — technique index