mlsanityData to 14 Oct 2026

On the Failure of Topic-Matched Contrast Baselines in Multi-Directional Refusal Abliteration

arXiv 2603.22061 ↗First posted 23 Mar 2026cs.LG cs.AIcited by 3

On the map: LLM safety and security → Safety alignment, refusal and guardrails

Abstract (arXiv)

Inasmuch as the removal of refusal behavior from instruction-tuned language models by directional abliteration requires the extraction of refusal-mediating directions from the residual stream activation space, and inasmuch as the construction of the contrast baseline against which harmful prompt activations are compared has been treated in the existing literature as an implementation detail rather than a methodological concern, the present work investigates whether a topically matched contrast baseline yields superior refusal directions. The investigation is carried out on the Qwen~3.5 2B model using per-category matched prompt pairs, per-class Self-Organizing Map extraction, and Singular Value Decomposition orthogonalization. It was found that topic-matched contrast produces no functional refusal directions at any tested weight level on any tested layer, while unmatched contrast on the same model, same extraction code, and same evaluation protocol achieves complete refusal elimination on six layers. The geometric analysis of the failure establishes that topic-matched subtraction cancels the dominant activation component shared between harmful and harmless prompts of the same subject, reducing the extracted direction magnitude below the threshold at which weight-matrix projection perturbs the residual stream. The implications for the design of contrast baselines in abliteration research are discussed.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 5 of its 11 references that are in the map. First posted on arXiv 23 Mar 2026.

Builds on

5 of 11 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025SOM Directions are Better than One: Multi-Directional Refusal Suppression in Language Models11 Nov
  2. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence24 Feb
  3. 2024Refusal in Language Models Is Mediated by a Single Direction17 Jun

Other references · 2

  1. 2019Optuna: A Next-generation Hyperparameter Optimization Frameworkcited by 2,501
  2. 2023LEACE: Perfect linear concept erasure in closed formcited by 267

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 3.

3 papers.

Similar, not cited

Close in wording, no citation either way

  1. 2026Abliteration Mitigation via Refusal Aliases
  2. 2026Refusal geometry reflects refusal training: diverse refusal prefixes can raise stable rank and weaken refusal vector ablation attacks
  3. 2025Beyond I'm Sorry, I Can't: Dissecting Large Language Model Refusal
  4. 2025Comparative Analysis of LLM Abliteration Methods: A Cross-Architecture Evaluation
  5. 2026Over-Refusal and Representation Subspaces: A Mechanistic Analysis of Task-Conditioned Refusal in Aligned LLMs
  6. 2026There Is More to Refusal in Large Language Models than a Single Direction
  7. 2026Surgical Refusal Ablation: Disentangling Safety from Intelligence via Concept-Guided Spectral Cleaning
  8. 2025RefusalBench: Generative Evaluation of Selective Refusal in Grounded Language Models