Steering, RepE & alternatives to weight abliteration

Not every refusal change requires permanent weight surgery. Compare inference-time, training-time defensive, and hybrid approaches.

1. Inference-time directional ablation (hooks)#

Subtract (h·r)r during forward — reversible.

→ inference-directional-ablation.md

Pros: zero checkpoint risk; fast A/B. Cons: hooks unsupported in vLLM/Ollama production.

2. Activation addition / subtraction (steering)#

h' = h + α r    # induce refusal
h' = h - α r    # reduce refusal (cruder than projection)

Representation Engineering (RepE) — extract concept vectors for honesty, harmlessness, etc.

Tools:

vs abliteration: steering is session-local; combine steering prototype → confirm direction → Heretic bake-in.

3. Orthogonal Activation Steering (OAS)#

Community method to find steering vectors orthogonal to capability directions to reduce collateral damage (discussed on r/LocalLLaMA). Conceptually aligned with projected abliteration but at inference:

r_steered = normalize(r - (r·g)g)
h' = h - α (h·r_steered) r_steered

4. Defenses that resist abliteration#

Training-time methods that fight weight-surgery uncensoring — extended-refusal fine-tuning, ART, Circuit Breakers.

→ ../docs/defenses-against-abliteration.md (beginner guide + arXiv:2505.19056 PDF)

5. Circuit breakers (defensive — opposite direction)#

GraySwan circuit breakers — training-time method that orthogonalizes harmful activations during fine-tuning so jailbreaks cannot easily remove safety.

Research note: CB models can still be abliterated — see LessWrong "breaking circuit breakers". Document for completeness, not factory deployment.

6. Fine-tune on uncensored data (not abliteration)#

Standard QLoRA SFT on uncensored instruction mixes. Different mechanism — shifts logits via gradient descent, not closed-form projection.

Risk: capability collapse, dataset bias. Prefer abliteration + narrow Jarvis adapter for security agents.

7. Prompt / system-level bypass#

Not weight surgery — baseline for eval:

• "You are an authorized security analyst…"
• Tool-schema forcing (OpenHands, function calling)

Abliteration removes need for jailbreak prompts; does not replace runtime gates (hardware-tool-gate.py).

8. W2SV / rank-1 patches#

Low-rank W + u vᵀ from activation stats — alternative parameterization.

→ w2sv-rank1-patch.md

Decision matrix#

9. Slop / style abliteration (community)#

Directional edits can reduce purple prose and sycophantic filler without full refusal removal — a different objective than safety guard abliteration.

cp sources/heretic-tools/config.noslop.toml config.toml
heretic ./models/YourModel-Instruct

Always eval capability (GSM8K/MMLU sample) — style edits can still shift reasoning.

Related#

• ../docs/research-landscape.md
• lora-qlora-abliteration.md