mlsanityData to 7 Oct 2026

Comparative Analysis of LLM Abliteration Methods: A Cross-Architecture Evaluation

arXiv 2512.13655 ↗First posted 15 Dec 2025cs.CL cs.SEcited by 8

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Safety alignment mechanisms in large language models prevent responses to harmful queries through learned refusal behavior, yet these same mechanisms impede legitimate research applications including cognitive modeling, adversarial testing, and security analysis. While abliteration techniques enable surgical removal of refusal representations through directional orthogonalization, the relative effectiveness of available implementations remains uncharacterized. This study evaluates four abliteration tools (Heretic, DECCP, ErisForge, FailSpy) across sixteen instruction-tuned models (7B-14B parameters), reporting tool compatibility on all 16 models and quantitative metrics on subsets dictated by tool support. Single-pass methods demonstrated superior capability preservation on the benchmarked subset (avg GSM8K change across three models: ErisForge -0.28 pp; DECCP -0.13 pp), while Bayesian-optimized abliteration produced variable distribution shift (KL divergence: 0.043-1.646) with model-dependent capability impact. These findings provide researchers with evidence-based selection criteria for abliteration tool deployment across diverse model architectures. The principal finding indicates that mathematical reasoning capabilities exhibit the highest sensitivity to abliteration interventions, with GSM8K change ranging from +1.51 pp to -18.81 pp (-26.5% relative) depending on tool selection and model architecture.

Key facts. Cited by 8 papers in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 28 of its 35 references that are in the map. First posted on arXiv 15 Dec 2025.

Builds on

28 of 35 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025SOM Directions are Better than One: Multi-Directional Refusal Suppression in Language Models11 Nov
  2. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence24 Feb
  3. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep10 Jun
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 24

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  3. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  4. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  5. 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,018
  6. 2013Distributed Representations of Words and Phrases and their Compositionalitycited by 3,462
  7. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
  8. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  9. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  10. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  11. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  12. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
12 more
  1. 2023Steering Language Models With Activation Engineeringcited by 824
  2. 2023The Linear Representation Hypothesis and the Geometry of Large Language Modelscited by 679
  3. 2023Zephyr: Direct Distillation of LM Alignmentcited by 498
  4. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  5. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
  6. 2024Reinforcement Learning for LLM Post-Training: A Surveycited by 91
  7. 2025LLMs Encode Harmfulness and Refusal Separatelycited by 75
  8. 2024What Makes and Breaks Safety Fine-tuning? A Mechanistic Studycited by 54
  9. 2025Refusal Direction is Universal Across Safety-Aligned Languagescited by 37
  10. 2025Steering the CensorShip: Uncovering Representation Vectors for LLM "Thought" Controlcited by 14
  11. 2025An Embarrassingly Simple Defense Against LLM Abliteration Attackscited by 12
  12. 2025A Granular Study of Safety Pretraining under Model Abliterationcited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 8.

8 papers.

  1. 2026Jailbreaking Leaves a Trace: Understanding and Detecting Jailbreak Attacks from Internal Representations of Large Language Modelscited by 3
  2. 2026TamperBench: Systematically Stress-Testing LLM Safety Under Fine-Tuning and Tamperingcited by 1
  3. 2026Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attackscited by 1
  4. 2026Not All Refusals Are Equal: How Safety Alignment Fails Cybersecurity at Scalecited by 1
  5. 2026Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Modelscited by 0
  6. 2026Locating and Steering Refusal Beyond Attentioncited by 0
  7. 2026Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliterationcited by 0
  8. 2026BRANCH: Bypassing Multi-Scanner AI Guardrailscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Understanding the Effects of Safety Unalignment on Large Language Models
  2. 2026LLMs Can Unlearn Refusal with Only 1,000 Benign Samples
  3. 2026Surgical Refusal Ablation: Disentangling Safety from Intelligence via Concept-Guided Spectral Cleaning
  4. 2026Refusal geometry reflects refusal training: diverse refusal prefixes can raise stable rank and weaken refusal vector ablation attacks
  5. 2026Alignment Drift in Multimodal LLMs: A Two-Phase, Longitudinal Evaluation of Harm Across Eight Model Releases
  6. 2026Efficient Refusal Ablation in LLM through Optimal Transport
  7. 2025From Threat to Tool: Leveraging Refusal-Aware Injection Attacks for Safety Alignment
  8. 2026RefusalGuard: Geometry-Preserving Fine-Tuning for Safety in LLMs