mlsanityData to 14 Oct 2026

Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration

arXiv 2609.16204 ↗First posted 14 Sep 2026cs.LG cs.CL cs.CRcited by 1

On the map: LLM safety and security → Safety alignment, refusal and guardrails

Abstract (arXiv)

Safety guardrails in open-weight language models can be readily bypassed using Refusal Feature Ablation (RFA), a technique that identifies and projects out a linear refusal direction from the residual stream, often achieving a high attack success rate (ASR) while preserving model capability. Defending against these attacks typically requires computationally expensive safety finetuning for every new checkpoint. We introduce Decoy Direction Optimization (DDO), a fast, post-hoc weight-editing defense that requires no base-model finetuning. Our approach is based on a simple mechanistic insight: ablation attacks rely on contrastive estimators to find the refusal direction. Rather than trying to hide the true refusal circuitry, DDO actively injects a high-magnitude, nonlinear decoy signal into the network's MLP neurons. When an attacker attempts to locate the refusal direction, the decoy corrupts their estimator, tricking them into ablating a harmless orthogonal feature while the actual safety mechanism remains intact. We prove a spectral bound formalizing this effect and evaluate DDO across six model families, achieving <10% ASR under standard RFA. On Llama-3-8B-Instruct, DDO remains comparable to trained defenses under adaptive multi-phase attacks (65% vs. 58% worst-case ASR) and reduces Heretic weight-level attack ASR from 88.7% to 18%, all at 30 to 450 times lower optimization cost per configuration than the trained baselines.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 52 of its 60 references that are in the map. First posted on arXiv 14 Sep 2026.

Builds on

52 of 60 references.

Closest ancestors · 13

Same direction, newest first

  1. 2025Comparative Analysis of LLM Abliteration Methods: A Cross-Architecture Evaluation15 Dec
  2. 2025LLMs Encode Harmfulness and Refusal Separately16 Jul
  3. 2025Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning6 Jul
  4. 2025An Embarrassingly Simple Defense Against LLM Abliteration Attacks25 May
  5. 2025Representation Bending for Large Language Model Safety2 Apr
  6. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence24 Feb
  7. 2025The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directions13 Feb
  8. 2024What Makes and Breaks Safety Fine-tuning? A Mechanistic Study14 Jul
  9. 2024Towards Understanding Safety Alignment: A Mechanistic Perspective from Safety Neurons20 Jun
  10. 2024Refusal in Language Models Is Mediated by a Single Direction17 Jun
  11. 2024Improving Alignment and Robustness with Circuit Breakers6 Jun
  12. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Models31 May
1 more
  1. 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning5 Mar

Other references · 39

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  4. 2025Qwen3 Technical Reportcited by 8,820
  5. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  6. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  7. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  8. 2023Mistral 7Bcited by 3,164
  9. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  10. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
  11. 2019Optuna: A Next-generation Hyperparameter Optimization Frameworkcited by 2,501
  12. 2024Gemma 2: Improving Open Language Models at a Practical Sizecited by 1,998
27 more
  1. 2020GLU Variants Improve Transformercited by 1,804
  2. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  3. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  4. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
  5. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  6. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
  7. 2024Yi: Open Foundation Models by 01.AIcited by 719
  8. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  9. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  10. 2024A StrongREJECT for Empty Jailbreakscited by 385
  11. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 173
  12. 2024Safety Layers in Aligned Large Language Models: The Key to LLM Securitycited by 134
  13. 2024How Alignment and Jailbreak Work: Explain LLM Safety through Intermediate Hidden Statescited by 98
  14. 2024Steering Language Model Refusal with Sparse Autoencoderscited by 95
  15. 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 88
  16. 2024Robust LLM safeguarding via refusal feature adversarial trainingcited by 64
  17. 2024Surgical, Cheap, and Flexible: Mitigating False Refusal in Language Models via Single Vector Ablationcited by 48
  18. 2024NNsight and NDIF: Democratizing Access to Open-Weight Foundation Model Internalscited by 45
  19. 2025Refusal Direction is Universal Across Safety-Aligned Languagescited by 38
  20. 2025Understanding Refusal in Language Models with Sparse Autoencoderscited by 29
  21. 2026There Is More to Refusal in Large Language Models than a Single Directioncited by 26
  22. 2025Position: Editing Large Language Models Poses Serious Safety Riskscited by 15
  23. 2024Prioritizing High-Consequence Biological Capabilities in Evaluations of Artificial Intelligence Modelscited by 10
  24. 2025Improving Large Language Model Safety with Contrastive Representation Learningcited by 8
  25. 2025AI Generated Child Sexual Abuse Material -- What's the Harm?cited by 5
  26. 2026LLM Novice Uplift on Dual-Use, In Silico Biology Taskscited by 5
  27. 2026Open Technical Problems in Open-Weight AI Model Risk Managementcited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026From Latent Space to Jacobian Space: Measuring, Evading, and Training Against Safety-Content Accessibilitycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Efficient Refusal Ablation in LLM through Optimal Transport
  2. 2026From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling
  3. 2025Differentiated Directional Intervention A Framework for Evading LLM Safety Alignment
  4. 2026Silencing the Guardrails: Inference-Time Jailbreaking via Dynamic Contextual Representation Ablation
  5. 2026Tripwire: Triggering Aligned Refusal via Statistically Certified Safety Neurons
  6. 2026NeuronGuard: Robust LLM Safety Alignment via Ablation-Aware Safety Signal Redistribution
  7. 2026The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs
  8. 2026CRaFT: Circuit-Guided Refusal Feature Selection via Cross-Layer Transcoders