Techniques catalog

Conceptual what-you-can-do list. Implementation details live in ../methods/README.md. Paper word → chapter: ../docs/paper-term-map.md.

1. Mean-difference refusal direction#

Estimate r = norm(E[h|harmful] - E[h|harmless]) per layer.

• ✅ Simple, fast, interpretable
• ❌ Sensitive to dataset quality

→ mean-difference-direction.md

2. Inference-time directional ablation#

Subtract (h·r)r during forward pass; weights unchanged.

• ✅ Reversible, safe experimentation
• ❌ Must keep hook infrastructure at inference

→ inference-directional-ablation.md

3. MLP output abliteration (weight edit)#

Project W_down (or down_proj) orthogonal to r.

• ✅ Most common permanent uncensoring recipe
• ❌ Can harm capabilities if overdosed

→ See ../methods/mlp-down-proj-abliteration.md

4. Attention output abliteration#

Target o_proj instead of MLP — sometimes complementary.

→ ../methods/attention-o-proj-abliteration.md

5. Layer-selective abliteration#

Only ablate layers {L_min…L_max} or auto-search with Heretic.

→ layer-selective-abliteration.md

6. Partial-strength abliteration#

Use W' = W - α · projection(W) with α ∈ (0,1).

→ partial-strength-abliteration.md

7. Domain-specific abliteration#

Estimate r only on activations from a topic slice (e.g. creative writing).

→ domain-specific-abliteration.md

8. W2SV / rank-1 weight patches#

Low-rank update derived from activation statistics — alternative parameterization.

→ w2sv-rank1-patch.md

9. QLoRA loading for abliteration (4-bit measure)#

Load base weights in NF4 so direction estimation and Heretic Optuna fit on 8–12 GB GPUs. Not SGD training — compressed forward passes only.

→ lora-qlora-abliteration.md · ../instructions/low-vram-abliteration.md

10. Heretic norm-preserving LoRA (export)#

row_normalization = "full" embeds a rank-r LoRA correction when orthogonalizing o_proj / down_proj.

→ lora-qlora-abliteration.md

11. LoRA adapter export (ΔW factorization)#

Ship megabyte-scale PEFT adapter instead of full abliterated checkpoint; inference = 4-bit base + adapter.

→ lora-qlora-abliteration.md · ../methods/lora-adapter-export.md

12. QLoRA tool-repair (post-abliteration)#

Jarvis SFT/DPO on tool-call JSONL — fixes residual false refusals on wmic / nmap; uses standard QLoRA training.

→ ../instructions/agentic-security-stack.md

13. Projected & norm-preserving abliteration (T03)#

Jim Lai refinements — orthogonalize_direction, row_normalization = full. Default in Heretic.

→ projected-norm-preserving-abliteration.md

T03 foundation note + catalog cross-link: See T03/T08 table rows, cross-technique guidance (orthogonalize + row_normalization for MoE), and "always start MoE by reviewing T03 first" in ../docs/advanced-techniques-catalog.md (which references this overview for high-level context) and ../instructions/eval-driven-workflow.md (T17 eval alignment used with these stacks). High-level selection + production use cases (factory/pentest/CyberGym) live in ../docs/overview.md "Advanced methods" and "Production use cases" sections (this README is the practical techniques entry point).

Eval-driven usage (T17): When applying projected/norm-preserving (T03) to production agents, align [bad_prompts] / [good_prompts] via the eval-driven workflow (factory, cybergym-subset, platform-eval, jarvis-safe) and run npm run eval:stats + post-abliteration gates before export. See overview advanced methods table + ../docs/advanced-techniques-catalog.md. Pair with T08 for hybrid models.

14. Geometric median & winsorization#

Robust direction estimation; tame massive activations.

→ geometric-median-winsorization.md

15. Beyond single direction (multi-D, RDO, SAE)#

Concept cones, gradient RDO, sparse autoencoder refusal latents, multi-direction PCA.

→ beyond-single-direction.md

16. MoE & hybrid architectures (T08)#

Per-expert down_proj, linear attention out_proj.

→ moe-hybrid-abliteration.md

T08 + T03 cross-link: Builds on projected + norm-preserving (T03). See T03/T08 rows (explicit cross-links, dedicated guidance section, recommended MoE config, module targets) in ../docs/advanced-techniques-catalog.md (catalog mentions overview for pipeline). Pair with ../instructions/eval-driven-workflow.md for MoE eval alignment. See ../docs/overview.md for the "Production default stack (T03 + T08 + T17)" guidance and use-case tie-ins.

Eval-driven usage (T17) for MoE/hybrid: Per-expert changes can shift routing and capability; always gate MoE ablations with deploy-specific corpora (factory-firmware, osint-pentest, cybergym) + XSTest over-refusal before/after. Full details in catalog T08 section and ../instructions/eval-driven-workflow.md. See also ../docs/overview.md advanced methods for T03/T08 selection guidance.

17. Steering & alternatives#

RepE, circuit breakers (defensive), OAS, fine-tune baselines.

→ steering-and-alternatives.md

18. Thinking-model / CoT handling#

Strip chain_of_thought blocks before refusal scoring; longer max_response_length.

→ thinking-model-abliteration.md · ../instructions/thinking-models-guide.md

19. Kernel shaping & depth profiles#

Heretic Optuna searches max_weight_position, kernel width, per-layer amplitude.

→ kernel-shaping-depth-profile.md

20. Iterative & multi-pass abliteration#

Second pass for factory refusals; partial α stacking with eval gates.

→ iterative-abliteration.md

21. Eval-driven measurement#

Align [bad_prompts] with deploy JSONL; XSTest over-refusal checks.

→ eval-driven-abliteration.md · ../instructions/eval-driven-workflow.md

22. Refusal marker tuning#

Customize refusal_markers for tool-refusal phrasing and multilingual models.

→ refusal-marker-tuning.md

23. Model family playbook#

Qwen, Gemma, Llama, MoE, VL — per-family targets and configs.

→ model-family-playbook.md · ../instructions/model-family-guide.md

24. Vision / multimodal#

Text-trunk abliteration for VLMs; mmproj export notes.

→ vision-multimodal-abliteration.md

25. Direction diagnostics and contrast controls#

Held-out geometry, causal layer sweeps, addition/ablation tests, deterministic contrast splits, leakage detection, and competing baseline designs.

→ ../methods/direction-diagnostics-and-localization.md · ../methods/contrast-set-design.md

26. Protected-subspace projection#

Orthogonalize the refusal basis against a measured capability basis before weight surgery; report remaining rank and protection limits.

→ ../methods/protected-subspace-abliteration.md

27. Advanced experimental methods#

Covariance-aware and bootstrap-consensus directions, cross-layer tracking, conditional hooks, quantization-aware edits, router-weighted MoE diagnostics, Pareto checkpoint selection, and negative-control interventions.

→ advanced-experimental-methods.md

28. Statistical gates and artifact integrity#

Paired bootstrap intervals, McNemar discordant counts, cohort-specific deployment gates, and SHA-256 manifests for exact configs, inputs, and outputs.

→ ../docs/evaluation.md · ../docs/experiment-provenance.md

29. ORBA (T34)#

Householder vs directional rank-1. Directional ablation is the stable operator; full reflection can flip semantics.

→ orba-orthogonal-reflection.md

30. SOM multi-direction (T35)#

Self-organizing maps on harmful residuals generalize DIM (AAAI 2026).

→ som-multi-directional-refusal.md

31. COSMIC direction ID (T36)#

Cosine inversion — pick r without output refusal templates (ACL 2025).

→ cosmic-refusal-direction.md

32. SVD / OBLITERATUS subspace (T37)#

Whitened SVD, advanced / surgical presets.

→ svd-whitened-obliteratus.md

33. False-refusal vector only (T38)#

Wang ICLR 2025: ablate w′ ← w − λ v (over-refusal orthogonalized against true refusal). Not factory DIM, not T03.

→ false-refusal-vector-ablation.md

34. Harm vs refusal (T39)#

Zhao 2025 (NeurIPS): harm and refusal are distinct (different token positions), not proven orthogonal. Keep r_harm for Latent Guard; ablate factory false-refusal (T38) separately.

→ harm-vs-refusal-directions.md

Comparison matrix#

* SAE ablation can be baked to weights in advanced pipelines. Direction estimation itself is non-mutating; a later export may edit weights.

Config profiles (handbook)#

Evidence-based tool choice#

Research beginners hub (2024–2026 papers + repo PDFs): ../docs/refusal-research-beginners-guide.md · ../sources/research/README.md

Cross-architecture benchmark (Heretic vs jim-plus measure.py --deccp vs ErisForge vs FailSpy, GSM8K sensitivity): ../docs/comparative-abliteration-benchmarks.md · arXiv:2512.13655

Defenses against abliteration (extended-refusal, ART): ../docs/defenses-against-abliteration.md

Extended toolkit (Abliterix, ErisForge, jim-plus/--deccp, FailSpy — placement + commands): extended-abliteration-toolkit.md

Safety guardrail removal methodology (weight-level refusal direction): safety-guardrail-abliteration-methodology.md · ../instructions/beginner-reproduction-methodology.md

QCRI 2026 multi-category refusal (beginner): multi-category-refusal-beginners-guide.md · arXiv:2602.02132

Eval gates and corpora: eval-driven-abliteration.md · npm run eval:stats

October 2026 research connections#

Adaptive interventions and ARA and the October evidence map add related methods and defensive/evaluation comparisons. These reference-only additions do not change the implemented technique IDs.