Safety guardrail abliteration methodology

Weight-level removal of the refusal / safety-response direction from transformer checkpoints — distinct from prompt jailbreaks, inference steering, or uncensored fine-tuning.

Hands-on reproduction: ../instructions/beginner-reproduction-methodology.md
Theory: ../docs/theory.md · ../docs/overview.md

What “safety guardrails” means here#

In instruction-tuned LLMs, a large fraction of refusal behavior (policy text, “I cannot help”, over-cautious deflection) correlates with a linear direction in residual activations per layer (arXiv:2406.11717).

2026 nuance (QCRI): Eleven refusal types (safety, over-refusal, incomplete requests, …) each have distinct directions — but linear abliteration/steering still acts like one shared volume knob on refusal rate. Style of refusal can differ; see multi-category-refusal-beginners-guide.md.

Abliteration reduces the model’s tendency to enter refusal mode on prompts that activate r. It does not add a new runtime policy layer — pair with ../docs/risks-and-ethics.md and hardware-tool-gate.py for agents.

What this is not#

See steering-and-alternatives.md and ../docs/comparative-abliteration-benchmarks.md (slop vs safety guard).

Core methodology (reproducible)#

1. Scope     — Authorized lab use; archive pristine base weights
2. Datasets  — Harmful/refusal-eliciting vs harmless/compliance prompt pairs (equal N)
3. Measure   — Forward passes → residual activations at decision token per layer ℓ
4. Direction — r_ℓ = normalize(mean(harmful) − mean(harmless))  [mean-difference DIM]
5. Project   — Optional: orthogonalize r against harmless centroid (lower KL)
6. Targets   — Primary: mlp.down_proj, self_attn.o_proj (per architecture)
7. Ablate    — W' = W − α · project(W, r)  (layer band or depth kernel)
8. Norm      — Optional: row-normalization + small LoRA correction
9. Eval      — Refusal rate ↓, benign capability intact, KL on harmless set
10. Deploy   — Safetensors → quant → Ollama/vLLM only after gates pass

Step details#

1 — Scope & backup

• Keep *-ORIGINAL folder untouched.
• Record model id, config hash, date, GPU in run-notes.md.

2 — Prompt sets

Do not invent ad-hoc harmful prompts for first reproduction — use bundled corpora.

3–4 — Direction estimation

→ mean-difference-direction.md
Heretic automates measure + winsorization + geometric median options → geometric-median-winsorization.md

5–7 — Weight surgery

→ extended-abliteration-toolkit.md

8 — Capability preservation

Enable projected + norm-preserving in production:

orthogonalize_direction = true
row_normalization = "full"

→ projected-norm-preserving-abliteration.md

9 — Eval gates (mandatory)

[ ] Harmful refusal rate ≤ target (Heretic --evaluate-model or custom)
[ ] factory-good-prompts.jsonl — benign answers still work
[ ] xstest-overrefusal-sample.jsonl — ≤ 5% refusal on authorized probes
[ ] GSM8K or MMLU slice — capability sanity
[ ] KL divergence on harmless set

→ ../instructions/eval-driven-workflow.md

Multi-pass safety guard removal#

When a single DIM pass leaves refusals (beyond-single-direction.md):

→ iterative-abliteration.md · ../methods/multi-direction-ablation.md

Tool selection for guardrail removal#

Benchmark evidence: ../docs/comparative-abliteration-benchmarks.md

Success criteria (beginner)#

A successful safety guardrail abliteration run:

1. Original checkpoint intact in *-ORIGINAL
2. Edited folder loads and generates fluently
3. Benign operational prompts still answered
4. Over-refusal sample rate drops vs base
5. No unexplained quality collapse on a small MMLU/GSM8K spot check

If #5 fails — restore backup, enable projected+norm-preserving, or reduce max_weight / narrow layer band.

Related#

• ../instructions/beginner-reproduction-methodology.md — step-by-step first run
• ../instructions/heretic-workflow.md — Heretic CLI reference
• layer-selective-abliteration.md — where in depth to ablate
• domain-specific-abliteration.md — factory vs broad safety
• ../docs/risks-and-ethics.md — authorized scope