Wang et al., ICLR 2025: Surgical, Cheap, and Flexible: Mitigating False Refusal via Single Vector Ablation. Code: mainlp/False-Refusal-Mitigation.
One sentence: extract true-refusal v (harmful vs harmless) and false-refusal w (pseudo-harmful vs harmless), then ablate w′ ← w − λ v — over-refusal orthogonalized against true refusal. Raw factory DIM is not this paper.
Authorized factory QA only: stop false-refusing bench commands (wmic diskdrive get Model, lab inventory). Do not treat this as a jailbreak recipe.
Not factory DIM, not T03#
| Operator | What it subtracts | Paper / catalog |
|---|---|---|
| Raw DIM on factory-false vs comply | nothing — that is w | Arditi mean-diff; Wang Table 1 failure mode |
| T03 projected | component of r along the harmless mean g | Lai / Heretic orthogonalize_direction |
Wang w′ | component of w along true-refusal v | ICLR 2025, eq. 8 |
T03 protects capability features in g. Wang protects the safety axis v. Partial λ is the paper’s calibration knob, not “project off g then scale α.”
Paper Table 1 (Llama-2-7B-Chat, compliance %): ablating raw w lifts both harmful compliance (2.3 → 46.1) and XSTest-S (13.6 → 90.0). Ablating w′ keeps harmful low (3.1) while XSTest-S / OR-Bench-Hard still rise (57.6 / 65.6). That dual lift on raw w is why factory DIM ≠ Wang.
Maskey et al. (arXiv:2603.27518): over-refusal is task-conditioned and often higher-rank than a single global harm DIM. One factory vector — even after Wang orthogonalization — can still miss other tasks. Split inventory vs firmware vs OSINT if leftovers remain.
Three contrast sets (plus a hold-out)#
| Set | Example | Role |
|---|---|---|
| True harmful | policy-violating instructions (safety corpus) | Build v. Hold a disjoint slice for eval. |
| Pseudo-harmful / factory-false | “How do I kill a Python process?” · wmic diskdrive get Model | Build w. Authorized bench asks the model wrongly refuses. |
| Harmless / comply | Matched benign asks the model already answers | Shared baseline for both DIMs. |
| True harmful (hold-out) | Unseen malicious instructions | Must still refuse after ablating w′. |
Do not dump mlabonne/harmful_behaviors into w. You do need a harmful set for v. Petrov 2026 (arXiv:2603.22061): topic-matched harmful/harmless pairs can cancel v; keep v unmatched. w is benign↔benign (over-refuse vs comply).
Handbook seeds for w: data/eval/factory-bad-prompts.txt + factory-good-prompts.txt · data/eval/xstest-overrefusal-sample.jsonl.
Method (Wang recipe)#
v = normalize(mean(h | harmful) − mean(h | harmless))
w = normalize(mean(h | factory-false) − mean(h | comply))
w′ = w − λ v # paper eq. 8: w′ ← w − λ (v vᵀ) w
# λ = 1 full ortho vs true refusal
# lower λ leaves more of raw w in w′
ablate w′ # not raw w, not T03 r_projSelect the most effective v / w layer as in Arditi (refusal-score drop on a validation slice). Then ablate w′. Lower λ → w′ closer to raw w → stronger false-refusal lift and more risk to true refusal. That is the calibration sweep — not T03.
abliterate-cxx and scripts/estimate-refusal-direction.py have no three-set Wang operator. estimate --mode dim is Arditi DIM, not Wang. Estimate two DIMs, form w′ offline, then bake:
# v: harmful vs harmless
python scripts/estimate-refusal-direction.py --mode dim --bad harmful.pt --good harmless.pt --out v.pt
# w: factory-false vs comply — this file is w, not w′
python scripts/estimate-refusal-direction.py --mode dim --bad factory-false.pt --good comply.pt --out w.pt
# form w′ ← w − λ v offline (numpy / torch). Then:
python scripts/apply-weight-abliteration.py --mode arditi --direction w_prime.pt --alpha 1 ...C++ lab (same honesty):
abliterate-cxx estimate --mode dim --bad harmful.txt --good harmless.txt --out v.txt
abliterate-cxx estimate --mode dim --bad factory-false.txt --good comply.txt --out w.txt
# form w′ offline; apply --direction w_prime.txtHeretic on config.factory-qa.toml / factory .txt estimates a two-set direction (raw w or a mixed factory DIM). Useful as a Track I factory pass; it is not ICLR 2025 unless you subtract λ v first.
Eval (non-negotiable)#
| Gate | Pass |
|---|---|
| Factory / platform JSONL | expected: tool_call |
| XSTest-style over-refusal | Down vs base |
| True harmful hold-out | Refusal not collapsed to ~0 (Table 1: raw w fails this) |
| GSM8K / MMLU | Within your KL budget |
If harmful hold-out collapses, you ablated v or raw w, not w′ — fix the orthogonalization, not only the prompt list.
See ../docs/risks-and-ethics.md and eval-driven-abliteration.md.