mlsanityData to 14 Oct 2026

An Embarrassingly Simple Defense Against LLM Abliteration Attacks

arXiv 2505.19056 ↗First posted 25 May 2025cs.CL cs.AI cs.LGcited by 13

On the map: LLM safety and security → Safety alignment, refusal and guardrails

Abstract (arXiv)

Large language models (LLMs) are typically aligned to refuse harmful instructions through safety fine-tuning. A recent attack, termed abliteration, identifies and suppresses the single latent direction most responsible for refusal behavior, thereby enabling models to generate harmful content. We propose a defense that fundamentally alters how models express refusal. We construct an extended-refusal dataset in which responses to harmful prompts provide detailed justifications before refusing, distributing the refusal signal across multiple token positions. Fine-tuning Llama-2-7B-Chat and Qwen2.5-Instruct (1.5B and 3B parameters) on this dataset yields models that maintain high refusal rates under abliteration: refusal rates drop by at most 10%, compared to 70-80% drops in baseline models. Comprehensive evaluations of safety and utility demonstrate that extended-refusal fine-tuning effectively neutralizes abliteration attacks while preserving general model performance and enhancing robustness across multiple alignment scenarios.

Key facts. Cited by 13 papers in the map (data through 14 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 37 of its 52 references that are in the map. First posted on arXiv 25 May 2025.

Builds on

37 of 52 references.

Closest ancestors · 7

Same direction, newest first

  1. 2025Towards Safer Pretraining: Analyzing and Filtering Harmful Content in Webscale datasets for Responsible LLMs4 May
  2. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs26 Jun
  3. 2024Model Merging and Safety Alignment: One Bad Model Spoils the Bunch20 Jun
  4. 2024Refusal in Language Models Is Mediated by a Single Direction17 Jun
  5. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep10 Jun
  6. 2024What is in Your Safe Data? Identifying Benign Data that Breaks Safety1 Apr
  7. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!5 Oct

Other references · 30

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  4. 2024DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Modelscited by 9,379
  5. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  6. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  7. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  8. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  9. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  10. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  11. 2023LIMA: Less Is More for Alignmentcited by 1,100
  12. 2024SimPO: Simple Preference Optimization with a Reference-Free Rewardcited by 963
18 more
  1. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
  2. 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
  3. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  4. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 431
  5. 2024Deliberative Alignment: Reasoning Enables Safer Language Modelscited by 308
  6. 2024WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Modelscited by 223
  7. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 192
  8. 2024Language Models are Homer Simpson! Safety Re-Alignment of Fine-tuned Language Models through Task Arithmeticcited by 112
  9. 2023A Confederacy of Models: a Comprehensive Evaluation of LLMs on Creative Writingcited by 99
  10. 2024Reinforcement Learning for LLM Post-Training: A Surveycited by 92
  11. 2023Training Socially Aligned Language Models on Simulated Social Interactionscited by 78
  12. 2024A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systemscited by 77
  13. 2024Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysiscited by 64
  14. 2024Immunization against harmful fine-tuning attackscited by 35
  15. 2024SPML: A DSL for Defending Language Models Against Prompt Attackscited by 34
  16. 2023Safer-Instruct: Aligning Language Models with Automated Preference Datacited by 27
  17. 2023Make Them Spill the Beans! Coercive Knowledge Extraction from (Production) LLMscited by 27
  18. 2024RoleBreak: Character Hallucination as a Jailbreak Attack in Role-Playing Systemscited by 21

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 3; 2026: 10.

13 papers.

Sort:

By area:

  1. 2025Comparative Analysis of LLM Abliteration Methods: A Cross-Architecture Evaluationcited by 9
  2. 2025A Granular Study of Safety Pretraining under Model Abliterationcited by 6
  3. 2025Turning the Spell Around: Lightweight Alignment Amplification via Rank-One Safety Injectioncited by 5
  4. 2026Activation Surgery: Jailbreaking White-box LLMs without Touching the Promptcited by 2
  5. 2026Multilingual Refusal Alignment for Safer Large Language Modelscited by 2
  6. 2026Ablating Safety: Mechanisms for Removing Alignment in Language Models for Security Applicationscited by 1
  7. 2026Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attackscited by 1
  8. 2026On the Inseparability of Instructions and Data in Shared-Embedding Sequence Modelscited by 1
  9. 2026Not All Refusals Are Equal: How Safety Alignment Fails Cybersecurity at Scalecited by 1
  10. 2026Does Fine-Tuning Undo Activation Steering? Behavioural Recovery Without Weight-Edit Reversalcited by 1
  11. 2026Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliterationcited by 1
  12. 2026Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Modelscited by 0
1 more
  1. 2026Abliteration Mitigation via Refusal Aliasescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026LLMs Can Unlearn Refusal with Only 1,000 Benign Samples
  2. 2024Refuse Whenever You Feel Unsafe: Improving Safety in LLMs via Decoupled Refusal Training
  3. 2025Beyond I'm Sorry, I Can't: Dissecting Large Language Model Refusal
  4. 2025From Threat to Tool: Leveraging Refusal-Aware Injection Attacks for Safety Alignment
  5. 2026Efficient Refusal Ablation in LLM through Optimal Transport
  6. 2026Latent-space Attacks for Refusal Evasion in Language Models
  7. 2025Beyond Over-Refusal: Scenario-Based Diagnostics and Post-Hoc Mitigation for Exaggerated Refusals in LLMs
  8. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Models