Taxonomy of papers, open-source tools, and when each method applies. Historical core map from June 2026; additive evidence checked through 5 October 2026. See the October update and huihui guide; older snapshots remain dated.
Current discovery snapshot: 2026 research update — 50 primary papers · machine-readable catalog. The core map below stays selective; the update covers adjacent mechanisms, interventions, defenses, attacks, and evaluation work.
Beginner paper map (PDFs in repo): refusal-research-beginners-guide.md · ../sources/research/README.md
Timeline#
| Year | Work | Contribution |
|---|---|---|
| 2024 | Arditi et al. — single direction | Mean-diff refusal vector; weight orthogonalization |
| 2024 | Zou et al. — circuit breakers | Defensive training — orthogonalize harmful activations |
| 2024 | Representation Engineering (RepE) | Inference-time concept vectors |
| 2025 | Jim Lai — projected abliteration | Subtract only refusal ⊥ harmless component |
| 2025 | Jim Lai — norm-preserving biprojected | Preserve row norms of weight matrices |
| 2025 | Wollschläger et al. — concept cones | Multi-D refusal cones; gradient RDO |
| 2026 | QCRI — more than single direction | 11 refusal categories; distinct geometry but shared linear knob; SAE core+tail · beginners guide |
| 2025+ | Heretic | Auto Optuna + projected + norm-preserving + MoE |
| 2025 | GGUF-my-LoRA | PEFT LoRA → GGUF sidecars for llama.cpp |
| 2026 | llm-abliteration v1.2 | Sharded ablate, MoE, Metal |
| 2026 | ggml-org/llama.cpp | HF org; convert_lora_to_gguf, multi-LoRA server |
| 2026 | Community Heretic 1.2 | Reported ~70% VRAM reduction (keep pip current) |
| 2025 | Shairah — extended-refusal defense | Abliteration drops refusal ≤10% vs 70–80% on defended models |
| 2025 | Siu — COSMIC | Output-independent refusal direction ID (ACL Findings) |
| 2025 | Agnihotri — safety pretraining | Checkpoint-level robustness under abliteration |
| 2026 | Young — comparative abliteration | Heretic 16/16 compat; ErisForge + Young’s “DECCP” (jim-plus + deccp topics) GSM8K; FailSpy research |
| 2026 | Petrov — contrast baselines | Topic-matched harmful/harmless pairs can fail |
| 2026 | Kuo — defenses vs abliteration | TAR/SEAM vulnerable; ART mitigation |
| 2026 | Carleo — code LLM abliteration | Refusal vs capability separation |
| 2024/25 | Wang — false-refusal vector | T38: w′ ← w − λ v (not factory DIM, not T03); keep true-safety refusals (ICLR 2025) |
| 2025 | Zhao — harm ≠ refusal | Separate harmfulness axis; Latent Guard |
| 2025 | Piras — SOM multi-direction | SOMs generalize DIM (AAAI 2026) |
| 2026 | Lai — ORBA | Householder vs directional rank-1 |
| 2026 | Task-conditioned refusal | Global harm vector vs task-specific over-refusal |
Comparative benchmarks matrix#
The empirical tool comparison (Heretic vs ErisForge vs FailSpy; Young’s “DECCP” = jim-plus + deccp topics, not a peer CLI) lives in comparative-abliteration-benchmarks.md. It supplies the GSM8K sensitivity matrix and KL ranges that inform capability-aware choices in the decision tree and production toolchain below. Always cross-reference the benchmark matrix when GSM8K/MMLU regression risk is a blocker for your architecture. The Young arXiv paper and handbook interpretation together guide per-architecture tool selection that is also reflected in the MoE/hybrid paths.
Production toolchain (Jun 2026)#
| Stage | Correct tool | Wrong approach |
|---|---|---|
| Weight surgery | Heretic / llm-abliteration on safetensors | Edit GGUF in place |
| 4-bit measure | Heretic bnb_4bit, measure.py --quant 4bit | Ablate 4-bit stored weights |
| LoRA deliverable | export-abliteration-lora.py or grimjim LoRA | Uncensored SFT only |
| GGUF merged | convert_hf_to_gguf.py | Re-download aligned GGUF |
| GGUF LoRA | convert_lora_to_gguf.py + --lora | Ollama (merge required) |
| QLoRA repair | Jarvis + Unsloth after abliteration | Replace abliteration |
Full guide: toolchain-safetensors-gguf-lora.md
Method families#
Refusal intervention
│
┌───────────────────┼───────────────────┐
│ │ │
Inference-time Weight surgery Training-time
(reversible) (abliteration) (alignment / CB)
│ │ │
├─ RepE steer ├─ Mean-diff DIM ├─ RLHF / DPO
├─ Hook ablate ├─ Projected ├─ Circuit breakers
├─ Activation ±r ├─ Norm-preserving └─ Refusal-only SFT
└─ Multi-dir steer ├─ Heretic kernel
├─ Multi-direction PCA
├─ Gradient RDO
├─ MoE per-expert
└─ LoRA / QLoRA exportDecision tree — which method?#
Start: need refusal reduction on aligned model
│
├─ Reversible experiment only?
│ └─ Inference hook ablation OR RepE steering
│
├─ Permanent checkpoint, minimal tuning?
│ ├─ 8–12 GB VRAM → Heretic bnb_4bit + orthogonalize_direction=true
│ ├─ 24 GB+ → Heretic default (row_normalization=full)
│ └─ Research control → llm-abliteration --projected --normpreserve
│
├─ False refusals on factory/OSINT tools after abliteration?
│ └─ Jarvis QLoRA adapter (not more abliteration)
│
├─ Model still refuses after single-direction abliteration?
│ ├─ Try multi-direction PCA ablation ([../methods/multi-direction-ablation.md](../methods/multi-direction-ablation.md))
│ ├─ Try gradient RDO direction ([../techniques/beyond-single-direction.md](../techniques/beyond-single-direction.md))
│ └─ Domain-specific direction (factory-only harmful/harmless pairs)
│
├─ MoE model (Qwen-MoE, Phi-3.5-MoE, Granite hybrid)?
│ └─ Per-expert down_proj ([../techniques/moe-hybrid-abliteration.md](../techniques/moe-hybrid-abliteration.md))
│
├─ Capability collapse (KL/MMLU drop)?
│ ├─ Lower Heretic max_weight / narrower kernel
│ ├─ orthogonalize_direction = true
│ ├─ winsorization_quantile = 0.95
│ └─ partial strength α < 1.0
│
└─ Ship MB adapter not full weights?
└─ LoRA export (methods/lora-adapter-export.md)Key theoretical tensions#
| Claim | Nuance (2025–2026 research) |
|---|---|
| "Single refusal direction" | Approximately true for safety harmful↔harmless DIM; false for full refusal taxonomy (11+ categories) |
| Linear steering = one knob | Different directions change how model refuses, not just whether |
| Abliteration = uncensoring | Removes alignment direction; does not add domain skills (use Jarvis/fine-tune) |
| Orthogonal directions = independent | Concept cones paper: need representational independence under intervention |
Eval dimensions (always measure)#
| Metric | Tool |
|---|---|
| Refusal rate (harmful set) | Heretic --evaluate-model, custom JSONL |
| Over-refusal (benign set) | XSTest-style prompts in eval corpora |
| KL divergence (harmless) | Heretic built-in |
| Capability | MMLU subset, HumanEval, GSM8K |
| Agent tool-call | data/eval/*-prompts.jsonl |
| CyberGym | use-cases/cybergym-benchmark.md |
Related docs#
| Doc | Content |
|---|---|
| advanced-techniques-catalog.md | Parameter & technique quick reference |
| ../instructions/advanced-abliteration-workflow.md | Step-by-step advanced pipelines |
| ../techniques/README.md | Technique index (T01–T39) |
| complete-curriculum.md | All methods + setups + scripts |
| bleeding-edge.md | ORBA / COSMIC / SOM / SVD / J-Wash |
| ../instructions/eval-driven-workflow.md | Factory / XSTest eval gates |
| ../instructions/troubleshooting-encyclopedia.md | Symptom → fix |
| comparative-abliteration-benchmarks.md | Benchmark matrix (arXiv:2512.13655) — Heretic/ErisForge GSM8K & KL; Young’s “DECCP” = jim-plus + deccp topics |
| ralph-loop.md | Validate → refresh agent loop |
| agent-development-loop.md | Backlog-driven multi-turn dev |
| ../references.md | URLs & install commands |