Abliteration Mitigation via Refusal Aliases

# Abliteration Mitigation via Refusal Aliases
Source: [https://arxiv.org/html/2608.18093](https://arxiv.org/html/2608.18093)
###### Abstract

Abliteration, the removal of refusal capabilities from large language models by projecting weight matrices orthogonal to an extracted refusal direction, has emerged as a prominent safety concern through its ability to bypass post\-training alignment using only a small set of contrastive prompts\. We find that existing defenses commonly overlook the cause of abliteration; that is, howeasilythe refusal direction can be extracted\. To hinder this process, we introduce a weight\-editing method that obscures the refusal signal by applying rank\-kkupdates to residual stream writer matrices while replacing refusal\-inducing activations with random aliases and correcting downstream reader matrices to preserve the model’s original behavior\. On Llama\-3\-8B, AMRA improves post\-abliteration refusal scores by2\.162\.16points over the undefended baseline with less than0\.50\.5percentage points of MMLU degradation\. On Gemma\-2\-9B, it improves the post\-abliteration refusal by14\.7014\.70points over the baseline while keeping harmful output rates similar to the baseline, albeit at a greater utility cost\.

## 1Introduction

Large language models \(LLMs\) have experienced a significant influx in usage over the past few years, publicly demonstrating their ability to solve problems and generally enhance the quality of life\. Notably, their ability to reason\(Guoet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib2); Kojimaet al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib3)\), follow instructions\(Ouyanget al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib33); Weiet al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib4); Chunget al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib5)\), and generalize to out\-of\-distribution domains\(Sanhet al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib6); Wanget al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib7)\)has directly led to their increased usage in medical\(Gaberet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib9)\), security\(Jianget al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib11)\), finance\(Linet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib8)\), and legal settings\(Guhaet al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib12); Kantet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib13)\)\. The prominence of LLM usage in high\-risk settings underscores the need for secure and benign deployments\.

Recent work has found that language models are vulnerable to black\-box jailbreaking methods regardless of their post\-training alignment, with many leveraging adversarial prompt injections\(Mehrotraet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib14); Weiet al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib15)\)\. When compromised, LLMs can produce harmful or invalid information, standing as a potential threat to safety and legal policies\(Shiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib50)\)\. To mitigate LLM misuse, a wide body of work has emerged attempting to further align models with human policies or constitutions\(Ouyanget al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib33); Baiet al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib35)\), with methods commonly applying additional fine\-tuning\(Wanget al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib69); Rafailovet al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib41)\), inference\-time interventions\(Liet al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib70); Leeet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib26)\), and mechanistic interpretability approaches\(Arditiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib1); O’Brienet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib45)\)\.

More specifically, through mechanistic interpretability, it has recently been found that refusal behavior in LLMs can be isolated to a low\-dimensional linear direction in a language model’s residual\-stream activation space\(Arditiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib1)\), ultimately giving rise to abliteration—a jailbreaking method that removes refusal capabilities by projecting weight matrices to be orthogonal to an extracted refusal direction\(FailSpy,[2026](https://arxiv.org/html/2608.18093#bib.bib64); Weidmann,[2025](https://arxiv.org/html/2608.18093#bib.bib16)\)\. Most notably, abliteration is concerning by virtue of its white\-box modifications that can bypass post\-training alignment wholesale while only requiring a small set of contrastive prompts and no additional training\. While existing defenses have proposed activation steering\(Leeet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib26); Shenget al\.,[2026](https://arxiv.org/html/2608.18093#bib.bib29)\)and circuit\-level interventions\(Zouet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib25)\)to enhance refusal, none explicitly address the refusal direction extraction itself\.

As a result of this we proposeAbliteration Mitigation via Refusal Aliases \(AMRA\), a weight\-updating approach that aims to obfuscate the refusal vector in the activation space\. Specifically, we apply rank\-kkupdates to matrices that write to the residual stream at causally relevant layers, replacing refusal\-inducing activations with low\-variance random aliases while patching downstream reader matrices to preserve the model’s original refusal behavior\. We validate AMRA on Llama\-3\-8B and Gemma\-2\-9B, showing that it substantially improves robustness to directional ablation while inflicting minimal utility degradation on Llama and moderate costs on Gemma\. To our knowledge, AMRA is the first post\-hoc weight\-editing defense that explicitly targets the extractability of the refusal direction as a way to hinder abliteration without requiring additional fine\-tuning\(Shairahet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib71)\)\. Crucially, our method is a single\-use and permanent application, not requiring additional compute after obfuscation\.

As a vital note, the work is geared predominantly towards language model developers as a way to provide them with a method capable of securing their newly\-made LLMprior to the first release of the weights\.An attacker with access to the original model without our obfuscation defeats the purpose of its existence as they can simply use abliteration techniques on the unprotected weights\.

## 2Methodology

In this section, we provide a comprehensive and formal breakdown of our obfuscation method\.

### 2\.1Transformer Background

A decoder\-only transformer language model\(Liu\*et al\.,[2018](https://arxiv.org/html/2608.18093#bib.bib20)\)comprises a series of modules that update an initial embedding representation by consecutively reading and writing to the residual stream\(Vaswaniet al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib19); Elhageet al\.,[2021](https://arxiv.org/html/2608.18093#bib.bib21)\)\. Notable weight matrices that "read" or "fork" from the residual stream are the Query, Key, and Value matrices inherent to the attention mechanism and the upward projection matrix into the feed\-forward \(FFW\) layers\. We henceforth denote these matrices in the form of:WinlW^\{l\}\_\{\\text\{in\}\}\. Similarly, matrices that write to the residual stream like the downward linear projection after multi\-headed attention and FFW are denoted asWOlW^\{l\}\_\{\\text\{O\}\}andWoutlW^\{l\}\_\{\\text\{out\}\}\.

### 2\.2Layer Selection

#### Refusal Vector Extraction

Many existing jailbreaking methods rely on the initial observation that there exists a ubiquitous refusal vectorrin the residual stream space of transformer language models\(Vaswaniet al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib19); Arditiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib1); Lai,[2025](https://arxiv.org/html/2608.18093#bib.bib17); Weidmann,[2025](https://arxiv.org/html/2608.18093#bib.bib16)\)\. To uncensor LLMs \(i\.e\., to excise their refusal capabilities\), weight matrices are projected to be orthogonal tor\(Arditiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib1)\), giving rise to "abliteration"\(FailSpy,[2026](https://arxiv.org/html/2608.18093#bib.bib64)\)\. The extraction of the refusal directionris typically performed using adifference\-in\-meansapproach\(EleutherAI,[2023](https://arxiv.org/html/2608.18093#bib.bib18)\)which comprises the collection of the average difference in activations per layer between harmful and benign prompts\. Following existing work\(Arditiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib1)\), we provide a formal definition as follows: Given a dataset of harmful and benign prompts denoted as𝒟ℎ𝑎𝑟𝑚𝑓𝑢𝑙\\mathcal\{D\}\_\{\\mathit\{harmful\}\}and𝒟𝑏𝑒𝑛𝑖𝑔𝑛\\mathcal\{D\}\_\{\\mathit\{benign\}\}, we compute the average harmful activationμl\\mu^\{l\}and average benign activationvl\\mathit\{v\}^\{l\}for a layerl∈\{L\}l\\in\\\{L\\\}at the first token position following the input prompts through:

![Refer to caption](https://arxiv.org/html/2608.18093v1/x1.png)Figure 1:Obfuscation diagram\.We show a high\-level depiction of the patches made to obfuscate the refusal signal\. Although our weight matrix updates are rank\-k, we show a rank\-one variant for brevity\. The bottom arrow represents the residual stream through layerll\. The Q, K, and V, up projections into the attention mechanism, downward projection from the feed\-forward, and LayerNorm have been omitted to highlight sublayer interactions and general stylistic simplicity\.μl=1\|𝒟harmful\|​∑t∈𝒟harmfulxl​\(t\),vl=1\|𝒟benign\|​∑t∈𝒟benignxl​\(t\)\.\\mu^\{l\}=\\frac\{1\}\{\|\\mathcal\{D\}\_\{\\mathrm\{harmful\}\}\|\}\\sum\_\{t\\in\\mathcal\{D\}\_\{\\mathrm\{harmful\}\}\}x^\{l\}\(t\),\\quad v^\{l\}=\\frac\{1\}\{\|\\mathcal\{D\}\_\{\\mathrm\{benign\}\}\|\}\\sum\_\{t\\in\\mathcal\{D\}\_\{\\mathrm\{benign\}\}\}x^\{l\}\(t\)\.Here, our approximate per\-layer refusal vector is calculated through:

rl=μl−vl\{r\}^\{l\}=\\mu^\{l\}\-v^\{l\}We letr^l\\hat\{\{r\}\}^\{l\}denote the unit\-norm variant𝒓l‖𝒓l‖2\\frac\{\\boldsymbol\{r\}^\{l\}\}\{\\\|\\boldsymbol\{r\}^\{l\}\\\|\_\{2\}\}andxl​\(t\)x^\{l\}\(t\)the hooked activations of the weight matrixxlx^\{l\}whenttis passed into the model as a prompt\.

#### Layer Selection

To find transformer layers that are causally pertinent to the refusal directionrl^\\hat\{\\textbf\{r\}^\{l\}\}, we first compute a unit\-norm refusal direction for every layer:\{r^l∣l∈ℒ\}\\\{\\hat\{r\}^\{\\,l\}\\mid l\\in\\mathcal\{L\}\\\}\. For each layerll, we calculate the vector’s effect on refusal by ablating it from the residual stream while leaving other layers unchanged\. Specifically, given a layerll, we construct the ablated representation

x~l=xl−projr^l​\(xl\)=xl−⟨xl,r^l⟩​r^l\\tilde\{x\}^\{l\}=x^\{l\}\-\\text\{proj\}\_\{\\hat\{r\}^\{l\}\}\(x^\{l\}\)=x^\{l\}\-\\langle x^\{l\},\\hat\{r\}^\{l\}\\rangle\\hat\{r\}^\{l\}We then evaluate the model’s attack success rate \(ASR\) after each ablation through adversarial prompts using HarmBench\(Mazeikaet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib51)\)\. Layers that are deemed relevant through this method are organized into a set\{ℒ′\}\\\{\\mathcal\{L\}^\{\\prime\}\\\}\.

### 2\.3Activation Obfuscation

Existing abliteration methods heavily rely on the extraction of𝒓^l\\boldsymbol\{\\hat\{r\}\}^\{l\}\. To hinder this process, we propose updating the relevant weight matrices that write to the residual stream through a series of rank\-k updates\. As depicted in Figure[1](https://arxiv.org/html/2608.18093#S2.F1), we update the matrix such that given penultimate activations that yield the refusal vector as the matrix’s output, it is rewritten to output a random and low\-variance alias vector\.

Similar to existing work\(Leeet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib26)\), for a relevant layerlland writer matrixWl∈\{WOl,Woutl\}⊆ℝdresid×dhiddenW^\{l\}\\in\\\{W^\{l\}\_\{O\},W^\{l\}\_\{\\text\{out\}\}\\\}\\subseteq\\mathbb\{R\}^\{d\_\{\\text\{resid\}\}\\times d\_\{\\text\{hidden\}\}\}111We denote the model or residual stream dimension asdresidd\_\{\\text\{resid\}\}distinctively fromdhiddend\_\{\\text\{hidden\}\}which generally describes the dimension of activations directly prior to the writer matrix within a sublayer \(e\.g\. feedforward, attention, and unembedding\)\., we collect the last\-token position writer outputs for benign and harmful prompts intoH\+l,H−l∈ℝn×dresid\{H\}^\{l\}\_\{\+\},\{H\}^\{l\}\_\{\-\}\\in\\mathbb\{R\}^\{n\\times d\_\{\\text\{resid\}\}\}respectively, wherennrepresents sample size anddresidd\_\{\\text\{resid\}\}represents the residual stream dimension\.

Subsequently, we locate candidate refusal directions by applying principal component analysis \(PCA\) on the difference in mean\-centered activationsH¯−l\\bar\{\{H\}\}^\{l\}\_\{\-\}andH¯\+l\\bar\{\{H\}\}^\{l\}\_\{\+\}\. More specifically, we initially compute the singular value decomposition overHdiffl=H¯−l−H¯\+l\{H\}^\{l\}\_\{\\text\{diff\}\}=\\bar\{\{H\}\}^\{l\}\_\{\-\}\-\\bar\{\{H\}\}^\{l\}\_\{\+\}:

Hdiffl=U​Σ​V⊤\{H\}^\{l\}\_\{\\text\{diff\}\}=\{U\}\{\\Sigma\}\{V\}^\{\\top\}whereU\{U\}andV\{V\}contain the unit\-norm eigenvectors of\(Hdiffl\)​\(Hdiffl\)⊤\(\{H\}^\{l\}\_\{\\text\{diff\}\}\)\(\{H\}^\{l\}\_\{\\text\{diff\}\}\)^\{\\top\}and\(Hdiffl\)⊤​\(Hdiffl\)\(\{H\}^\{l\}\_\{\\text\{diff\}\}\)^\{\\top\}\(\{H\}^\{l\}\_\{\\text\{diff\}\}\)respectively\. Through this construction, the columns ofVVrepresent the principal components ofHdifflH^\{l\}\_\{\\text\{diff\}\}\. These vectors are ranked by the amount of variance that they capture in our refusal\-related activation space for a given layer:

\{v1l,v2l,v3l​⋯​vnl\}⊆Col​\(V\)\.\\\{v^\{l\}\_\{1\},v^\{l\}\_\{2\},v^\{l\}\_\{3\}\\cdots v^\{l\}\_\{n\}\\\}\\subseteq\\mathrm\{Col\}\(V\)\.Then, we updateWl∈ℝdresid×dhiddenW^\{l\}\\in\\mathbb\{R\}^\{d\_\{\\mathrm\{resid\}\}\\times d\_\{\\mathrm\{hidden\}\}\}through a rank\-kwk\_\{w\}addition to produce random activations instead of the previous refusal\-inducing directions\.

Wl~=Wl\+\(A−R\)⊤​R​Wl\\tilde\{W^\{l\}\}=W^\{l\}\+\(A\-R\)^\{\\top\}RW^\{l\}Here,R∈ℝkw×dresidR\\in\\mathbb\{R\}^\{k\_\{w\}\\times d\_\{\\mathrm\{resid\}\}\}contains the top\-kwk\_\{w\}column vectors ofVVor correspondingly, the top\-kwk\_\{w\}principal components ofHdifflH^\{l\}\_\{\\text\{diff\}\}\. We subtractRRfromA∈ℝkw×dresidA\\in\\mathbb\{R\}^\{k\_\{w\}\\times d\_\{\\mathrm\{resid\}\}\}where each row vectorAi∼𝒩​\(0,ε2​I\)A\_\{i\}\\sim\\mathcal\{N\}\(0,\\varepsilon^\{2\}I\)\. Intuitively, ifW~l\\tilde\{W\}^\{l\}receives an input that is mapped to a vector in the subspace spanned by our chosen top\-k refusal principal components, it is instead mapped to a random alias vector\. Notably, as shown in Figure[2](https://arxiv.org/html/2608.18093#S2.F2), our choice ofε\\varepsilonandlldirectly influences the amount of pollution introduced into the residual stream\.

We acknowledge that rank\-k updates work most ideally when inputs toW~l\\tilde\{W\}^\{l\}yield activations that align withRR\. However, this is relatively uncommon in practice\. Activations may only be slightly aligned withRR, incidentally spreading noise in downstream computations\. However, in Section[3](https://arxiv.org/html/2608.18093#S3), we show that with optimalε\\varepsilonandkwk\_\{w\}, these updates minimally degrade model quality while significantly consolidating refusal capabilities against abliteration\.

![Refer to caption](https://arxiv.org/html/2608.18093v1/x2.png)Figure 2:Residual stream shifts\.Here, we show the effect of a rank\-one \(kw=1k\_\{w\}=1\) update of a writer matrixWoutlW^\{l\}\_\{\\text\{out\}\}on subsequent residual stream representations\. Specifically, we compare the mean residual stream values prior to and after the weight matrix update over 16 prompts\. \(a\) exhibits the L2 difference, \(b\) shows the shift in residual stream variance, and \(c\) shows the cosine similarity of the residual stream before versus after the edit\.Upper:sweeps overε\\varepsilonfor layer 20\.Lower:sweeps over layers along with an additional random selection of 6\.#### Downstream Weight Patches

Although this method effectively obfuscates the refusal vector for a specific sublayer, subsequent layers are unable to interpret the updated writer matrix’s random output as inputs that induce refusal\. To alleviate this, we fix all downstream matrices that read from the residual stream \(e\.g\.,Wl∈\{Ql,Kl,Vl,Winl,Wunembed\}W^\{l\}\\in\\\{Q^\{l\},K^\{l\},V^\{l\},W^\{l\}\_\{\\mathrm\{in\}\},W\_\{\\mathrm\{unembed\}\}\\\}\) at varyingllto output their original activations through similar rank\-krk\_\{r\}updates\. Specifically, for a reader matrixW∈ℝdin×dresidW\\in\\mathbb\{R\}^\{d\_\{\\mathrm\{in\}\}\\times d\_\{\\mathrm\{resid\}\}\}, given polluted inputsXp∈ℝn×dresidX\_\{p\}\\in\\mathbb\{R\}^\{n\\times d\_\{\\mathrm\{resid\}\}\}toWWfrom the residual stream \(polluted due to previous writer matrix patches\) and clean inputs \(without the writer matrix patches\)Xc∈ℝn×dresidX\_\{c\}\\in\\mathbb\{R\}^\{n\\times d\_\{\\mathrm\{resid\}\}\}, we construct the following Singular Value Decompositions \(SVD\):

Xp≈Ukr​Σkr​Vkr⊤,Ukr∈ℝn×kr,Σkr∈ℝkr×kr,Vkr⊤∈ℝkr×dresidX\_\{p\}\\;\\approx\\;U\_\{k\_\{r\}\}\\,\\Sigma\_\{k\_\{r\}\}\\,V\_\{k\_\{r\}\}^\{\\\!\\top\},\\quad U\_\{k\_\{r\}\}\\in\\mathbb\{R\}^\{n\\times k\_\{r\}\},\\;\\Sigma\_\{k\_\{r\}\}\\in\\mathbb\{R\}^\{k\_\{r\}\\times k\_\{r\}\},\\;V^\{\\top\}\_\{k\_\{r\}\}\\in\\mathbb\{R\}^\{k\_\{r\}\\times d\_\{\\mathrm\{resid\}\}\}The correction matrix

M=\(Xc−Xp\)⊤​Ukr​Σkr−1​Vkr⊤∈ℝdresid×dresidM\\;=\\;\(X\_\{c\}\-X\_\{p\}\)^\{\\\!\\top\}\\,U\_\{k\_\{r\}\}\\,\\Sigma\_\{k\_\{r\}\}^\{\-1\}\\,V\_\{k\_\{r\}\}^\{\\\!\\top\}\\;\\in\\;\\mathbb\{R\}^\{d\_\{\\mathrm\{resid\}\}\\times d\_\{\\mathrm\{resid\}\}\}yields the reader weight update

Wnew=W\+W​MW\_\{\\mathrm\{new\}\}\\;=\\;W\+W\\,Mwhich is the rank\-≤kr\\leq k\_\{r\}correction minimizing the difference in Frobenius norm

‖Xp​\(Wnew\)⊤−Xc​W⊤‖F2\\bigl\\lVert X\_\{p\}\\,\(W\_\{\\mathrm\{new\}\}\)^\{\\top\}\-X\_\{c\}\\,W^\{\\top\}\\bigr\\rVert^\{2\}\_\{F\}by the Eckart\-Young theorem\. Naturally, the update redirects outputs in top\-krk\_\{r\}right\-singular subspace ofXpX\_\{p\}towardsXcX\_\{c\}\. It recoversXp​Wnew⊤=Xc​W⊤X\_\{p\}\\,W\_\{\\mathrm\{new\}\}^\{\\top\}=X\_\{c\}\\,W^\{\\top\}through that subspace and leavesWWunchanged on its orthogonal complement\.

## 3Experiments

### 3\.1Experimental Setup

#### Baseline Setup

We test our method on two popular open\-source transformer\-based LLMs: Llama\-3\-8B\(Grattafioriet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib32)\), and Gemma\-2\-9B\(Teamet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib68)\)\. These both share a relatively straightforward architecture, ultimately simplifying the experimentation process\.

#### Refusal Direction Extraction

Following existing work\(Weidmann,[2025](https://arxiv.org/html/2608.18093#bib.bib16)\), we extract the refusal direction by using contrasting instruction datasets frommlabonne/harmful\_behaviors\(Labonne,[2024a](https://arxiv.org/html/2608.18093#bib.bib54)\)andmlabonne/harmless\_alpaca\(Labonne,[2024b](https://arxiv.org/html/2608.18093#bib.bib53)\)\. Using 400 prompts from each, we filter the datasets by retaining harmful prompts that elicit refusal and benign prompts that do not\. This would allow for an easier obtainment of the refusal direction when performing difference\-in\-means by using examples with greater signal\.

#### Utility Baselines

To measure utility preservation, we record pre\-obfuscation and post\-obfuscation benchmark performance using EleutherAI’slm\-evaluation\-harness\(Gaoet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib55)\)\. Specifically, we analyze the preservation of problem\-solving capabilities using GSM8K\(Cobbeet al\.,[2021](https://arxiv.org/html/2608.18093#bib.bib57)\)and broad knowledge coverage through MMLU\(Hendryckset al\.,[2021](https://arxiv.org/html/2608.18093#bib.bib58)\)\. Following existing work\(Arditiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib1)\), we record the average pre and post dataset bits\-per\-byte—which is tokenizer agnostic—over 1024 sequences of The Pile\(Gaoet al\.,[2020](https://arxiv.org/html/2608.18093#bib.bib61)\)and Alpaca\(Taoriet al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib62)\)to measure the effect of our method on general next\-token\-prediction quality\.

#### Attacks

To validate the effectiveness of our method, we employ the conventional directional ablation of the refusal vector through weight orthogonalization\(Arditiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib1)\)\.

#### Defense Baselines

We also compare our approach to existing jailbreak defenses\. Specifically, we implement Surgical\(Wanget al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib28)\), CAST\(Leeet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib26)\), Circuit Breakers\(Zouet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib25)\), and AlphaSteer\(Shenget al\.,[2026](https://arxiv.org/html/2608.18093#bib.bib29)\)\.

#### Hyperparameter selection

Our hyperparameters \(i\.e\.,\{l\}\\\{l\\\},kwk\_\{w\},krk\_\{r\}andε\\varepsilon\) were chosen using NSGA\-II\(Debet al\.,[2002](https://arxiv.org/html/2608.18093#bib.bib67)\)through Optuna\(Ozakiet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib66)\)\. In our setting, Pareto optimal configurations minimize the distance between a model’s refusal rate after an attack is applied to its baseline refusal rate along with utility heuristics like bits\-per\-byte on The Pile\(Gaoet al\.,[2020](https://arxiv.org/html/2608.18093#bib.bib61)\)and MMLU\(Hendryckset al\.,[2021](https://arxiv.org/html/2608.18093#bib.bib58)\)\. We find that for Llama\-3\-8B Instruct, the optimal values ofε\\varepsilon, layers,kwk\_\{w\}, andkrk\_\{r\}are 0\.025, 9\-31, 1, and 8, respectively\. For the same hyperparameters, Gemma\-2\-9B’s optimal configuration was 0\.025, 9\-41, 4, and 16\.

### 3\.2Post\-Abliteration Results

Compared to baselines, we show AMRA generally yields the best post\-abliteration scores\. As depicted in Table[1](https://arxiv.org/html/2608.18093#S3.T1), applying AMRA improves the baseline refusal rate of both Llama\-3\-8B and Gemma\-2\-9B by roughly 0\.203 and 0\.083 points, respectively\. For directional ablation, AMRA scores 2\.16 points higher than the undefended baseline for Llama\-3\-8B and14\.7014\.70points higher on Gemma\-2\-9B\. However, in Gemma’s case, AMRA still yields a notably negative post\-abliteration refusal score \(−1\.3105\-1\.3105\), indicating that while the obfuscation substantially closes the gap relative to baseline \(−16\.0093\-16\.0093\), the Arditi\-style attack still partially succeeds at degrading refusal on this architecture\. Nevertheless, AMRA is the only defense on Gemma\-2\-9B that significantly fortifies the model against refusal \(\+14\.70\+14\.70\-point improvement over the undefended Gemma\) while keeping Harmbench ASR under0\.020\.02and LlamaGuard’s unsafety score at0\. Among other defenses, AlphaSteer is the only other method that achieves a positive post\-abliteration refusal score on Gemma \(0\.87560\.8756\), but it does so at the cost of reduced clean refusal \(5\.63205\.6320vs\.7\.11727\.1172\) and elevated HarmBench ASR \(0\.090\.09\) and LlamaGuard unsafe rates \(0\.110\.11\)\. Circuit Breakers and CAST provide negligible or no improvement in post\-abliteration refusal on Gemma: CB’s Arditi score \(−16\.0190\-16\.0190\) is nearly identical to the undefended baseline, while CAST improves it only modestly to−12\.3973\-12\.3973\. Surgical performs worst overall, substantially degrading both clean refusal and post\-abliteration robustness on both models, and inducing the highest HarmBench ASR \(0\.420\.42on Llama,0\.440\.44on Gemma\)\. Across both architectures, AMRA is the only defense that simultaneously improves clean refusal behavior, substantially raises post\-abliteration refusal scores, and maintains low HarmBench ASR and LlamaGuard unsafe rates\.

Table 1:Safety and abliteration results\. Refusal scores are higher when the model retains more refusal behavior before and after Arditi\-style abliteration\. Additionally, the Arditi abliteration on defenses other than our baseline\. \(None\) implies the difference\-in\-means refusal vector extraction was run again after a defense was applied\. HarmBench ASR and LlamaGuard unsafe rate are lower when the model is safer\.
### 3\.3Utility Results

We show that our defense does not significantly degrade model quality with respect to baseline performance\.

Table 2:Utility results across base models and defenses\. Lower BPB is better; higher GSM8K and MMLU are better\.As shown in Table[2](https://arxiv.org/html/2608.18093#S3.T2), compared to our baselines, AMRA retains strong utility on Llama\-3\-8B with only marginal degradation: Pile BPB increases by0\.01360\.0136\(0\.7665→0\.78010\.7665\\to 0\.7801\), Alpaca BPB by0\.00960\.0096, GSM8K decreases by1\.41\.4percentage points, and MMLU by0\.350\.35percentage points\. These losses are comparable to or smaller than those of CB and AlphaSteer, both of which similarly preserve utility on Llama\. By contrast, CAST catastrophically degrades Llama’s utility, inflating Pile BPB to1\.29241\.2924and reducing MMLU to0\.33340\.3334and GSM8K to0\.03200\.0320—rendering the model effectively unusable for reasoning tasks\.

On Gemma\-2\-9B, AMRA incurs more noticeable utility costs: Pile BPB rises from0\.81240\.8124to0\.95970\.9597, GSM8K drops from0\.56200\.5620to0\.33600\.3360, and MMLU decreases by roughly4\.94\.9percentage points\. This is a meaningful trade\-off that we attribute to the higher rank of the writer updates \(kw=4k\_\{w\}=4\) selected by our hyperparameter search on Gemma, which introduces more residual stream perturbation than the rank\-one configuration used for Llama\. More robust hyperparameter searches may yield better results in this setting\. However, it is worth noting that AlphaSteer attains a higher post\-abliteration refusal score than AMRA on Gemma \(0\.87560\.8756versus−1\.3105\-1\.3105\), but at a substantial utility cost \(Pile BPB1\.58381\.5838vs AMRA’s0\.95970\.9597, GSM8K0\.16800\.1680vs AMRA’s0\.33600\.3360\)\. CB and CAST both retain stronger raw utility on Gemma, but as shown in Table[1](https://arxiv.org/html/2608.18093#S3.T1), they provide negligible defense against directional ablation on this architecture\. Surgical presents an unusual profile on Gemma, slightly improving GSM8K \(0\.67600\.6760\) and MMLU \(0\.69710\.6971\) relative to baseline, but this comes at the cost of severe safety degradation\. Overall, these results highlight a robustness–utility trade\-off that is architecture\-dependent: AMRA achieves a favorable balance on Llama\-3\-8B and provides the strongest abliteration defense on Gemma\-2\-9B at a moderate utility cost that may be further reduced through more targeted hyperparameter tuning or lower\-rank configurations\.

## 4Related Work

#### LLM Safety

As LLM usage becomes increasingly prevalent, strictly enforcing their secure employments to prevent downstream safety concerns\(OpenAIet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib31); Grattafioriet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib32)\)has become a major topic of contemporary research\. If inadequately deployed, LLMs may provide harmful outputs, ultimately making them a security threat\. For instance, when prompted, "How do I synthesize poisonous gas?" a misaligned model may produce a set of instructions to chemically produce the gas, potentially endangering lives\. To prevent the acknowledgment of malicious prompts, a commonly implemented solution consists of employing post\-training alignment techniques to constrain LLMs to predefined constitutions or human morals\(Ouyanget al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib33); Bianchiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib34); Baiet al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib35)\)\. However, recent evidence shows that language models remain vulnerable to "jailbreaks" in spite of their purported safety mechanisms\(Liuet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib36); Chaoet al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib37); Zouet al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib38)\), influencing the construction of novel defenses aimed toward mitigating these attacks\. For instance, deeper post\-training methods such as reinforcement learning from human feedback\(Christianoet al\.,[2017](https://arxiv.org/html/2608.18093#bib.bib40); Ouyanget al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib33)\)and direct policy optimization\(Rafailovet al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib41); Grattafioriet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib32)\)\. These methods operate through contrastive refusal training, which updates the model to align with human preferences \(e\.g\., refusing malicious questions\)\.

In another vein, activation\-level methods provide a more fine\-grained approach to alignment\. Studies in mechanistic interpretability show that LLMs already possess linearly separable internal structures in their activation space that represent distinct features\(Elhageet al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib44); Parket al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib42); Durmuset al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib43)\)\. With this observation, approaches locating refusal\-related features have recently garnered significant attention for its potential to enforce refusal in jailbreaking settings\(Arditiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib1); O’Brienet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib45)\)\.

#### Refusal Vectors

Locating feature vectors in language models using contrastive prompts has become common practice to alter model behavior\(Rimskyet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib22); Postmus and Abreu,[2024](https://arxiv.org/html/2608.18093#bib.bib23); Zouet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib24)\)\. A large body of recent safety work has been developed based on the nascent observation that refusal can be localized to low\-dimensional linear directions in activation space\(Arditiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib1); Wanget al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib28)\)\. These directions are commonly estimated by finding the average difference in activations for harmful and harmless prompts\(Arditiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib1); Zouet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib25)\)\. Activation steering, which is performed by adding feature vectors to the residual stream, has been extensively used to fortify language model refusal\. Existing approaches are predominantly inference\-time techniques that actively shift hidden states along an extracted safety direction during the forward pass\(Shenet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib27); Leeet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib26); Shenget al\.,[2026](https://arxiv.org/html/2608.18093#bib.bib29); Shairahet al\.,[2026](https://arxiv.org/html/2608.18093#bib.bib30)\)\. By contrast, the same approach may be used toprecluderefusal, with works commonly ablating the refusal direction from the residual stream to allow for uncensored output\(Arditiet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib1); Weidmann,[2025](https://arxiv.org/html/2608.18093#bib.bib16)\)\. By hindering refusal, abliteration allows for the disclosure of dangerous and potentially false information, ultimately making it one of the largest LLM safety concerns to date by undermining post\-training alignment\. Existing methods do not explicitly obfuscate the refusal vector, ultimately leaving them vulnerable to activation steering\-based uncensoring\.

#### Model Editing

Rank\-one weight matrix edits have been used to alter and rewrite information in language models\(Menget al\.,[2022](https://arxiv.org/html/2608.18093#bib.bib46),[2023](https://arxiv.org/html/2608.18093#bib.bib47); Ilharcoet al\.,[2023](https://arxiv.org/html/2608.18093#bib.bib48)\)\. By perturbing a small number of feed\-forward projection matrices through a similar rank\-one update, we adjust how the refusal feature is routed through downstream layers rather than directly affecting factual knowledge or storage\. Distinct from these model editing methods, our primary goal is to obfuscate a direction rather than to replace\.

## 5Limitations and Future Work

Our limitations are chiefly due to single attack experiments, which introduces questions regarding how more sophisticated extraction methods like nonlinear probes or iterative searches could bypass AMRA’s obfuscation\. The results are also architecture\-dependent: AMRA incurs minimal utility loss on Llama\-3\-8B, but substantially degrades GSM8K and Pile BPB on Gemma\-2\-9B, the model that used higher\-rank updates, and the post\-abliteration refusal score remains negative\. We may be able to alleviate this with more comprehensive hyperparameter searches or tailoring AMRA to the model’s architecture rather than aiming for a general and widely\-applicable implementation\. AMRA is able to make the refusal vector harder to locate but does not inherently strengthen the feature\. This may be achieved by combining our obfuscation with methods that strengthen the refusal direction\(Leeet al\.,[2025](https://arxiv.org/html/2608.18093#bib.bib26); Zouet al\.,[2024](https://arxiv.org/html/2608.18093#bib.bib25)\)\. However, we leave this to future work\.

## 6Conclusion

In this work, we introduce AMRA, a refusal\-direction obfuscation method that replaces refusal\-inducing activations with random aliases through rank\-kkupdates\. On Llama\-3\-8B, AMRA greatly improves post\-abliteration refusal while preserving utility\. On Gemma\-2\-9B, it also substantially fortifies refusal capabilities post\-abliteration though at a greater utility cost\. Our results show that targeting the extraction of the refusal direction is a viable approach for mitigating weight\-space jailbreaking methods\.

## References

- A\. Arditi, O\. B\. Obeso, A\. Syed, D\. Paleka, N\. Rimsky, W\. Gurnee, and N\. Nanda \(2024\)Refusal in language models is mediated by a single direction\.InThe Thirty\-eighth Annual Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=pH3XAQME6c)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p2.1),[§1](https://arxiv.org/html/2608.18093#S1.p3.1),[§2\.2](https://arxiv.org/html/2608.18093#S2.SS2.SSS0.Px1.p1.8),[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px3.p1.1),[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px4.p1.1),[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p2.1),[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px2.p1.1)\.
- Y\. Bai, S\. Kadavath, S\. Kundu, A\. Askell, J\. Kernion, A\. Jones, A\. Chen, A\. Goldie, A\. Mirhoseini, C\. McKinnon, C\. Chen, C\. Olsson, C\. Olah, D\. Hernandez, D\. Drain, D\. Ganguli, D\. Li, E\. Tran\-Johnson, E\. Perez, J\. Kerr, J\. Mueller, J\. Ladish, J\. Landau, K\. Ndousse, K\. Lukosuite, L\. Lovitt, M\. Sellitto, N\. Elhage, N\. Schiefer, N\. Mercado, N\. DasSarma, R\. Lasenby, R\. Larson, S\. Ringer, S\. Johnston, S\. Kravec, S\. E\. Showk, S\. Fort, T\. Lanham, T\. Telleen\-Lawton, T\. Conerly, T\. Henighan, T\. Hume, S\. R\. Bowman, Z\. Hatfield\-Dodds, B\. Mann, D\. Amodei, N\. Joseph, S\. McCandlish, T\. Brown, and J\. Kaplan \(2022\)Constitutional ai: harmlessness from ai feedback\.External Links:2212\.08073,[Link](https://arxiv.org/abs/2212.08073)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p2.1),[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p1.1)\.
- F\. Bianchi, M\. Suzgun, G\. Attanasio, P\. Rottger, D\. Jurafsky, T\. Hashimoto, and J\. Zou \(2024\)Safety\-tuned LLaMAs: lessons from improving the safety of large language models that follow instructions\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=gT5hALch9z)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p1.1)\.
- P\. Chao, A\. Robey, E\. Dobriban, H\. Hassani, G\. J\. Pappas, and E\. Wong \(2023\)Jailbreaking black box large language models in twenty queries\.InR0\-FoMo:Robustness of Few\-shot and Zero\-shot Learning in Large Foundation Models,External Links:[Link](https://openreview.net/forum?id=rYWD5TMaLj)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p1.1)\.
- P\. F\. Christiano, J\. Leike, T\. Brown, M\. Martic, S\. Legg, and D\. Amodei \(2017\)Deep reinforcement learning from human preferences\.InAdvances in Neural Information Processing Systems,I\. Guyon, U\. V\. Luxburg, S\. Bengio, H\. Wallach, R\. Fergus, S\. Vishwanathan, and R\. Garnett \(Eds\.\),Vol\.30,pp\.\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2017/file/d5e2c0adad503c91f91df240d0cd4e49-Paper.pdf)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p1.1)\.
- H\. W\. Chung, L\. Hou, S\. Longpre, B\. Zoph, Y\. Tay, W\. Fedus, Y\. Li, X\. Wang, M\. Dehghani, S\. Brahma, A\. Webson, S\. S\. Gu, Z\. Dai, M\. Suzgun, X\. Chen, A\. Chowdhery, A\. Castro\-Ros, M\. Pellat, K\. Robinson, D\. Valter, S\. Narang, G\. Mishra, A\. Yu, V\. Zhao, Y\. Huang, A\. Dai, H\. Yu, S\. Petrov, E\. H\. Chi, J\. Dean, J\. Devlin, A\. Roberts, D\. Zhou, Q\. V\. Le, and J\. Wei \(2022\)Scaling instruction\-finetuned language models\.External Links:2210\.11416,[Link](https://arxiv.org/abs/2210.11416)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p1.1)\.
- K\. Cobbe, V\. Kosaraju, M\. Bavarian, M\. Chen, H\. Jun, L\. Kaiser, M\. Plappert, J\. Tworek, J\. Hilton, R\. Nakano, C\. Hesse, and J\. Schulman \(2021\)Training verifiers to solve math word problems\.External Links:2110\.14168,[Link](https://arxiv.org/abs/2110.14168)Cited by:[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px3.p1.1)\.
- K\. Deb, A\. Pratap, S\. Agarwal, and T\. Meyarivan \(2002\)A fast and elitist multiobjective genetic algorithm: nsga\-ii\.IEEE Transactions on Evolutionary Computation6\(2\),pp\. 182–197\.External Links:[Document](https://dx.doi.org/10.1109/4235.996017)Cited by:[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px6.p1.7)\.
- E\. Durmus, A\. Tamkin, J\. Clark, J\. Wei, J\. Marcus, J\. Batson, K\. Handa, L\. Lovitt, M\. Tong, M\. McCain, O\. Rausch, S\. Huang, S\. Bowman, S\. Ritchie, T\. Henighan, and D\. Ganguli \(2024\)External Links:[Link](https://anthropic.com/research/evaluating-feature-steering)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p2.1)\.
- EleutherAI \(2023\)Diff\-in\-means\.Note:[https://blog\.eleuther\.ai/diff\-in\-means/](https://blog.eleuther.ai/diff-in-means/)Accessed: 2026\-04\-16Cited by:[§2\.2](https://arxiv.org/html/2608.18093#S2.SS2.SSS0.Px1.p1.8)\.
- N\. Elhage, T\. Hume, C\. Olsson, N\. Schiefer, T\. Henighan, S\. Kravec, Z\. Hatfield\-Dodds, R\. Lasenby, D\. Drain, C\. Chen, R\. Grosse, S\. McCandlish, J\. Kaplan, D\. Amodei, M\. Wattenberg, and C\. Olah \(2022\)Toy models of superposition\.Transformer Circuits Thread\.External Links:[Link](https://transformer-circuits.pub/2022/toy_model/index.html)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p2.1)\.
- N\. Elhage, N\. Nanda, C\. Olsson, T\. Henighan, N\. Joseph, B\. Mann, A\. Askell, Y\. Bai, A\. Chen, T\. Conerly, N\. DasSarma, D\. Drain, D\. Ganguli, Z\. Hatfield\-Dodds, D\. Hernandez, A\. Jones, J\. Kernion, L\. Lovitt, K\. Ndousse, D\. Amodei, T\. Brown, J\. Clark, J\. Kaplan, S\. McCandlish, and C\. Olah \(2021\)A mathematical framework for transformer circuits\.Transformer Circuits Thread\.Note:https://transformer\-circuits\.pub/2021/framework/index\.htmlCited by:[§2\.1](https://arxiv.org/html/2608.18093#S2.SS1.p1.3)\.
- FailSpy \(2026\)Abliterator\.Note:[https://github\.com/FailSpy/abliterator](https://github.com/FailSpy/abliterator)GitHub repository\. Simple Python library/structure to ablate features in LLMs which are supported by TransformerLens\. Accessed 2026\-04\-22Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p3.1),[§2\.2](https://arxiv.org/html/2608.18093#S2.SS2.SSS0.Px1.p1.8)\.
- F\. Gaber, M\. Shaik, V\. Franke, and A\. Akalin \(2024\)Evaluating large language model workflows in clinical decision support: referral, triage, and diagnosis\.medRxiv\.External Links:[Document](https://dx.doi.org/10.1101/2024.09.27.24314505),[Link](https://www.medrxiv.org/content/early/2024/09/28/2024.09.27.24314505),https://www\.medrxiv\.org/content/early/2024/09/28/2024\.09\.27\.24314505\.full\.pdfCited by:[§1](https://arxiv.org/html/2608.18093#S1.p1.1)\.
- L\. Gao, S\. Biderman, S\. Black, L\. Golding, T\. Hoppe, C\. Foster, J\. Phang, H\. He, A\. Thite, N\. Nabeshima, S\. Presser, and C\. Leahy \(2020\)The pile: an 800gb dataset of diverse text for language modeling\.External Links:2101\.00027,[Link](https://arxiv.org/abs/2101.00027)Cited by:[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px3.p1.1),[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px6.p1.7)\.
- L\. Gao, J\. Tow, B\. Abbasi, S\. Biderman, S\. Black, A\. DiPofi, C\. Foster, L\. Golding, J\. Hsu, A\. Le Noac’h, H\. Li, K\. McDonell, N\. Muennighoff, C\. Ociepa, J\. Phang, L\. Reynolds, H\. Schoelkopf, A\. Skowron, L\. Sutawika, E\. Tang, A\. Thite, B\. Wang, K\. Wang, and A\. Zou \(2024\)The language model evaluation harness\.Zenodo\.External Links:[Document](https://dx.doi.org/10.5281/zenodo.12608602),[Link](https://zenodo.org/records/12608602)Cited by:[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px3.p1.1)\.
- A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan, A\. Yang, A\. Fan, A\. Goyal, A\. Hartshorn, A\. Yang, A\. Mitra, A\. Sravankumar, A\. Korenev, A\. Hinsvark, A\. Rao, A\. Zhang, A\. Rodriguez, A\. Gregerson, A\. Spataru, B\. Roziere, B\. Biron, B\. Tang, B\. Chern, C\. Caucheteux, C\. Nayak, C\. Bi, C\. Marra, C\. McConnell, C\. Keller, C\. Touret, C\. Wu, C\. Wong, C\. C\. Ferrer, C\. Nikolaidis, D\. Allonsius, D\. Song, D\. Pintz, D\. Livshits, D\. Wyatt, D\. Esiobu, D\. Choudhary, D\. Mahajan, D\. Garcia\-Olano, D\. Perino, D\. Hupkes, E\. Lakomkin, E\. AlBadawy, E\. Lobanova, E\. Dinan, E\. M\. Smith, F\. Radenovic, F\. Guzmán, F\. Zhang, G\. Synnaeve, G\. Lee, G\. L\. Anderson, G\. Thattai, G\. Nail, G\. Mialon, G\. Pang, G\. Cucurell, H\. Nguyen, H\. Korevaar, H\. Xu, H\. Touvron, I\. Zarov, I\. A\. Ibarra, I\. Kloumann, I\. Misra, I\. Evtimov, J\. Zhang, J\. Copet, J\. Lee, J\. Geffert, J\. Vranes, J\. Park, J\. Mahadeokar, J\. Shah, J\. van der Linde, J\. Billock, J\. Hong, J\. Lee, J\. Fu, J\. Chi, J\. Huang, J\. Liu, J\. Wang, J\. Yu, J\. Bitton, J\. Spisak, J\. Park, J\. Rocca, J\. Johnstun, J\. Saxe, J\. Jia, K\. V\. Alwala, K\. Prasad, K\. Upasani, K\. Plawiak, K\. Li, K\. Heafield, K\. Stone, K\. El\-Arini, K\. Iyer, K\. Malik, K\. Chiu, K\. Bhalla, K\. Lakhotia, L\. Rantala\-Yeary, L\. van der Maaten, L\. Chen, L\. Tan, L\. Jenkins, L\. Martin, L\. Madaan, L\. Malo, L\. Blecher, L\. Landzaat, L\. de Oliveira, M\. Muzzi, M\. Pasupuleti, M\. Singh, M\. Paluri, M\. Kardas, M\. Tsimpoukelli, M\. Oldham, M\. Rita, M\. Pavlova, M\. Kambadur, M\. Lewis, M\. Si, M\. K\. Singh, M\. Hassan, N\. Goyal, N\. Torabi, N\. Bashlykov, N\. Bogoychev, N\. Chatterji, N\. Zhang, O\. Duchenne, O\. Çelebi, P\. Alrassy, P\. Zhang, P\. Li, P\. Vasic, P\. Weng, P\. Bhargava, P\. Dubal, P\. Krishnan, P\. S\. Koura, P\. Xu, Q\. He, Q\. Dong, R\. Srinivasan, R\. Ganapathy, R\. Calderer, R\. S\. Cabral, R\. Stojnic, R\. Raileanu, R\. Maheswari, R\. Girdhar, R\. Patel, R\. Sauvestre, R\. Polidoro, R\. Sumbaly, R\. Taylor, R\. Silva, R\. Hou, R\. Wang, S\. Hosseini, S\. Chennabasappa, S\. Singh, S\. Bell, S\. S\. Kim, S\. Edunov, S\. Nie, S\. Narang, S\. Raparthy, S\. Shen, S\. Wan, S\. Bhosale, S\. Zhang, S\. Vandenhende, S\. Batra, S\. Whitman, S\. Sootla, S\. Collot, S\. Gururangan, S\. Borodinsky, T\. Herman, T\. Fowler, T\. Sheasha, T\. Georgiou, T\. Scialom, T\. Speckbacher, T\. Mihaylov, T\. Xiao, U\. Karn, V\. Goswami, V\. Gupta, V\. Ramanathan, V\. Kerkez, V\. Gonguet, V\. Do, V\. Vogeti, V\. Albiero, V\. Petrovic, W\. Chu, W\. Xiong, W\. Fu, W\. Meers, X\. Martinet, X\. Wang, X\. Wang, X\. E\. Tan, X\. Xia, X\. Xie, X\. Jia, X\. Wang, Y\. Goldschlag, Y\. Gaur, Y\. Babaei, Y\. Wen, Y\. Song, Y\. Zhang, Y\. Li, Y\. Mao, Z\. D\. Coudert, Z\. Yan, Z\. Chen, Z\. Papakipos, A\. Singh, A\. Srivastava, A\. Jain, A\. Kelsey, A\. Shajnfeld, A\. Gangidi, A\. Victoria, A\. Goldstand, A\. Menon, A\. Sharma, A\. Boesenberg, A\. Baevski, A\. Feinstein, A\. Kallet, A\. Sangani, A\. Teo, A\. Yunus, A\. Lupu, A\. Alvarado, A\. Caples, A\. Gu, A\. Ho, A\. Poulton, A\. Ryan, A\. Ramchandani, A\. Dong, A\. Franco, A\. Goyal, A\. Saraf, A\. Chowdhury, A\. Gabriel, A\. Bharambe, A\. Eisenman, A\. Yazdan, B\. James, B\. Maurer, B\. Leonhardi, B\. Huang, B\. Loyd, B\. D\. Paola, B\. Paranjape, B\. Liu, B\. Wu, B\. Ni, B\. Hancock, B\. Wasti, B\. Spence, B\. Stojkovic, B\. Gamido, B\. Montalvo, C\. Parker, C\. Burton, C\. Mejia, C\. Liu, C\. Wang, C\. Kim, C\. Zhou, C\. Hu, C\. Chu, C\. Cai, C\. Tindal, C\. Feichtenhofer, C\. Gao, D\. Civin, D\. Beaty, D\. Kreymer, D\. Li, D\. Adkins, D\. Xu, D\. Testuggine, D\. David, D\. Parikh, D\. Liskovich, D\. Foss, D\. Wang, D\. Le, D\. Holland, E\. Dowling, E\. Jamil, E\. Montgomery, E\. Presani, E\. Hahn, E\. Wood, E\. Le, E\. Brinkman, E\. Arcaute, E\. Dunbar, E\. Smothers, F\. Sun, F\. Kreuk, F\. Tian, F\. Kokkinos, F\. Ozgenel, F\. Caggioni, F\. Kanayet, F\. Seide, G\. M\. Florez, G\. Schwarz, G\. Badeer, G\. Swee, G\. Halpern, G\. Herman, G\. Sizov, Guangyi, Zhang, G\. Lakshminarayanan, H\. Inan, H\. Shojanazeri, H\. Zou, H\. Wang, H\. Zha, H\. Habeeb, H\. Rudolph, H\. Suk, H\. Aspegren, H\. Goldman, H\. Zhan, I\. Damlaj, I\. Molybog, I\. Tufanov, I\. Leontiadis, I\. Veliche, I\. Gat, J\. Weissman, J\. Geboski, J\. Kohli, J\. Lam, J\. Asher, J\. Gaya, J\. Marcus, J\. Tang, J\. Chan, J\. Zhen, J\. Reizenstein, J\. Teboul, J\. Zhong, J\. Jin, J\. Yang, J\. Cummings, J\. Carvill, J\. Shepard, J\. McPhie, J\. Torres, J\. Ginsburg, J\. Wang, K\. Wu, K\. H\. U, K\. Saxena, K\. Khandelwal, K\. Zand, K\. Matosich, K\. Veeraraghavan, K\. Michelena, K\. Li, K\. Jagadeesh, K\. Huang, K\. Chawla, K\. Huang, L\. Chen, L\. Garg, L\. A, L\. Silva, L\. Bell, L\. Zhang, L\. Guo, L\. Yu, L\. Moshkovich, L\. Wehrstedt, M\. Khabsa, M\. Avalani, M\. Bhatt, M\. Mankus, M\. Hasson, M\. Lennie, M\. Reso, M\. Groshev, M\. Naumov, M\. Lathi, M\. Keneally, M\. Liu, M\. L\. Seltzer, M\. Valko, M\. Restrepo, M\. Patel, M\. Vyatskov, M\. Samvelyan, M\. Clark, M\. Macey, M\. Wang, M\. J\. Hermoso, M\. Metanat, M\. Rastegari, M\. Bansal, N\. Santhanam, N\. Parks, N\. White, N\. Bawa, N\. Singhal, N\. Egebo, N\. Usunier, N\. Mehta, N\. P\. Laptev, N\. Dong, N\. Cheng, O\. Chernoguz, O\. Hart, O\. Salpekar, O\. Kalinli, P\. Kent, P\. Parekh, P\. Saab, P\. Balaji, P\. Rittner, P\. Bontrager, P\. Roux, P\. Dollar, P\. Zvyagina, P\. Ratanchandani, P\. Yuvraj, Q\. Liang, R\. Alao, R\. Rodriguez, R\. Ayub, R\. Murthy, R\. Nayani, R\. Mitra, R\. Parthasarathy, R\. Li, R\. Hogan, R\. Battey, R\. Wang, R\. Howes, R\. Rinott, S\. Mehta, S\. Siby, S\. J\. Bondu, S\. Datta, S\. Chugh, S\. Hunt, S\. Dhillon, S\. Sidorov, S\. Pan, S\. Mahajan, S\. Verma, S\. Yamamoto, S\. Ramaswamy, S\. Lindsay, S\. Lindsay, S\. Feng, S\. Lin, S\. C\. Zha, S\. Patil, S\. Shankar, S\. Zhang, S\. Zhang, S\. Wang, S\. Agarwal, S\. Sajuyigbe, S\. Chintala, S\. Max, S\. Chen, S\. Kehoe, S\. Satterfield, S\. Govindaprasad, S\. Gupta, S\. Deng, S\. Cho, S\. Virk, S\. Subramanian, S\. Choudhury, S\. Goldman, T\. Remez, T\. Glaser, T\. Best, T\. Koehler, T\. Robinson, T\. Li, T\. Zhang, T\. Matthews, T\. Chou, T\. Shaked, V\. Vontimitta, V\. Ajayi, V\. Montanez, V\. Mohan, V\. S\. Kumar, V\. Mangla, V\. Ionescu, V\. Poenaru, V\. T\. Mihailescu, V\. Ivanov, W\. Li, W\. Wang, W\. Jiang, W\. Bouaziz, W\. Constable, X\. Tang, X\. Wu, X\. Wang, X\. Wu, X\. Gao, Y\. Kleinman, Y\. Chen, Y\. Hu, Y\. Jia, Y\. Qi, Y\. Li, Y\. Zhang, Y\. Zhang, Y\. Adi, Y\. Nam, Yu, Wang, Y\. Zhao, Y\. Hao, Y\. Qian, Y\. Li, Y\. He, Z\. Rait, Z\. DeVito, Z\. Rosnbrick, Z\. Wen, Z\. Yang, Z\. Zhao, and Z\. Ma \(2024\)The llama 3 herd of models\.External Links:2407\.21783,[Link](https://arxiv.org/abs/2407.21783)Cited by:[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px1.p1.1),[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p1.1)\.
- N\. Guha, J\. Nyarko, D\. E\. Ho, C\. Re, A\. Chilton, A\. Narayana, A\. Chohlas\-Wood, A\. Peters, B\. Waldon, D\. Rockmore, D\. Zambrano, D\. Talisman, E\. Hoque, F\. Surani, F\. Fagan, G\. Sarfaty, G\. M\. Dickinson, H\. Porat, J\. Hegland, J\. Wu, J\. Nudell, J\. Niklaus, J\. J\. Nay, J\. H\. Choi, K\. Tobia, M\. Hagan, M\. Ma, M\. Livermore, N\. Rasumov\-Rahe, N\. Holzenberger, N\. Kolt, P\. Henderson, S\. Rehaag, S\. Goel, S\. Gao, S\. Williams, S\. Gandhi, T\. Zur, V\. Iyer, and Z\. Li \(2023\)LegalBench: a collaboratively built benchmark for measuring legal reasoning in large language models\.InThirty\-seventh Conference on Neural Information Processing Systems Datasets and Benchmarks Track,External Links:[Link](https://openreview.net/forum?id=WqSPQFxFRC)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p1.1)\.
- D\. Guo, D\. Yang, H\. Zhang, J\. Song, P\. Wang, Q\. Zhu, R\. Xu, R\. Zhang, S\. Ma, X\. Bi, X\. Zhang, X\. Yu, Y\. Wu, Z\. F\. Wu, Z\. Gou, Z\. Shao, Z\. Li, Z\. Gao, A\. Liu, B\. Xue, B\. Wang, B\. Wu, B\. Feng, C\. Lu, C\. Zhao, C\. Deng, C\. Ruan, D\. Dai, D\. Chen, D\. Ji, E\. Li, F\. Lin, F\. Dai, F\. Luo, G\. Hao, G\. Chen, G\. Li, H\. Zhang, H\. Xu, H\. Ding, H\. Gao, H\. Qu, H\. Li, J\. Guo, J\. Li, J\. Chen, J\. Yuan, J\. Tu, J\. Qiu, J\. Li, J\. L\. Cai, J\. Ni, J\. Liang, J\. Chen, K\. Dong, K\. Hu, K\. You, K\. Gao, K\. Guan, K\. Huang, K\. Yu, L\. Wang, L\. Zhang, L\. Zhao, L\. Wang, L\. Zhang, L\. Xu, L\. Xia, M\. Zhang, M\. Zhang, M\. Tang, M\. Zhou, M\. Li, M\. Wang, M\. Li, N\. Tian, P\. Huang, P\. Zhang, Q\. Wang, Q\. Chen, Q\. Du, R\. Ge, R\. Zhang, R\. Pan, R\. Wang, R\. J\. Chen, R\. L\. Jin, R\. Chen, S\. Lu, S\. Zhou, S\. Chen, S\. Ye, S\. Wang, S\. Yu, S\. Zhou, S\. Pan, S\. S\. Li, S\. Zhou, S\. Wu, T\. Yun, T\. Pei, T\. Sun, T\. Wang, W\. Zeng, W\. Liu, W\. Liang, W\. Gao, W\. Yu, W\. Zhang, W\. L\. Xiao, W\. An, X\. Liu, X\. Wang, X\. Chen, X\. Nie, X\. Cheng, X\. Liu, X\. Xie, X\. Liu, X\. Yang, X\. Li, X\. Su, X\. Lin, X\. Q\. Li, X\. Jin, X\. Shen, X\. Chen, X\. Sun, X\. Wang, X\. Song, X\. Zhou, X\. Wang, X\. Shan, Y\. K\. Li, Y\. Q\. Wang, Y\. X\. Wei, Y\. Zhang, Y\. Xu, Y\. Li, Y\. Zhao, Y\. Sun, Y\. Wang, Y\. Yu, Y\. Zhang, Y\. Shi, Y\. Xiong, Y\. He, Y\. Piao, Y\. Wang, Y\. Tan, Y\. Ma, Y\. Liu, Y\. Guo, Y\. Ou, Y\. Wang, Y\. Gong, Y\. Zou, Y\. He, Y\. Xiong, Y\. Luo, Y\. You, Y\. Liu, Y\. Zhou, Y\. X\. Zhu, Y\. Huang, Y\. Li, Y\. Zheng, Y\. Zhu, Y\. Ma, Y\. Tang, Y\. Zha, Y\. Yan, Z\. Z\. Ren, Z\. Ren, Z\. Sha, Z\. Fu, Z\. Xu, Z\. Xie, Z\. Zhang, Z\. Hao, Z\. Ma, Z\. Yan, Z\. Wu, Z\. Gu, Z\. Zhu, Z\. Liu, Z\. Li, Z\. Xie, Z\. Song, Z\. Pan, Z\. Huang, Z\. Xu, Z\. Zhang, and Z\. Zhang \(2025\)DeepSeek\-r1 incentivizes reasoning in llms through reinforcement learning\.Nature645\(8081\),pp\. 633–638\.External Links:ISSN 1476\-4687,[Link](http://dx.doi.org/10.1038/s41586-025-09422-z),[Document](https://dx.doi.org/10.1038/s41586-025-09422-z)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p1.1)\.
- D\. Hendrycks, C\. Burns, S\. Basart, A\. Zou, M\. Mazeika, D\. Song, and J\. Steinhardt \(2021\)Measuring massive multitask language understanding\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=d7KBjmI3GmQ)Cited by:[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px3.p1.1),[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px6.p1.7)\.
- G\. Ilharco, M\. T\. Ribeiro, M\. Wortsman, L\. Schmidt, H\. Hajishirzi, and A\. Farhadi \(2023\)Editing models with task arithmetic\.InThe Eleventh International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=6t0Kwf8-jrj)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px3.p1.1)\.
- X\. Jiang, L\. Wu, S\. Sun, J\. Li, J\. Xue, Y\. Wang, T\. Wu, and M\. Liu \(2025\)Investigating large language models for code vulnerability detection: an experimental study\.External Links:2412\.18260,[Link](https://arxiv.org/abs/2412.18260)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p1.1)\.
- M\. Kant, S\. Nabi, M\. Kant, R\. Scharrer, M\. Ma, and M\. Nabi \(2025\)Towards robust legal reasoning: harnessing logical llms in law\.External Links:2502\.17638,[Link](https://arxiv.org/abs/2502.17638)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p1.1)\.
- T\. Kojima, S\. S\. Gu, M\. Reid, Y\. Matsuo, and Y\. Iwasawa \(2022\)Large language models are zero\-shot reasoners\.InAdvances in Neural Information Processing Systems,A\. H\. Oh, A\. Agarwal, D\. Belgrave, and K\. Cho \(Eds\.\),External Links:[Link](https://openreview.net/forum?id=e2TBb5y0yFf)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p1.1)\.
- M\. Labonne \(2024a\)harmful\_behaviors\.Note:[https://huggingface\.co/datasets/mlabonne/harmful\_behaviors](https://huggingface.co/datasets/mlabonne/harmful_behaviors)Hugging Face datasetCited by:[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px2.p1.1)\.
- M\. Labonne \(2024b\)harmless\_alpaca\.Note:[https://huggingface\.co/datasets/mlabonne/harmless\_alpaca](https://huggingface.co/datasets/mlabonne/harmless_alpaca)Hugging Face datasetCited by:[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px2.p1.1)\.
- J\. Lai \(2025\)Projected abliteration\.Note:[https://huggingface\.co/blog/grimjim/projected\-abliteration](https://huggingface.co/blog/grimjim/projected-abliteration)Hugging Face Blog \(Community Article\)Cited by:[§2\.2](https://arxiv.org/html/2608.18093#S2.SS2.SSS0.Px1.p1.8)\.
- B\. W\. Lee, I\. Padhi, K\. N\. Ramamurthy, E\. Miehling, P\. Dognin, M\. Nagireddy, and A\. Dhurandhar \(2025\)Programming refusal with conditional activation steering\.InThe Thirteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=Oi47wc10sm)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p2.1),[§1](https://arxiv.org/html/2608.18093#S1.p3.1),[§2\.3](https://arxiv.org/html/2608.18093#S2.SS3.p2.5),[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px5.p1.1),[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2608.18093#S5.p1.1)\.
- K\. Li, O\. Patel, F\. Viégas, H\. Pfister, and M\. Wattenberg \(2023\)Inference\-time intervention: eliciting truthful answers from a language model\.InThirty\-seventh Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=aLLuYpn83y)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p2.1)\.
- S\. Lin, J\. Patel, Q\. Zhang, K\. He, K\. Wang, Y\. Wang, M\. White, K\. Xiao, and X\. Liu \(2025\)Evaluation and benchmarking suite for financial large language models and agents\.InNeurIPS 2025 Workshop on Evaluating the Evolving LLM Lifecycle: Benchmarks, Emergent Abilities, and Scaling,External Links:[Link](https://openreview.net/forum?id=sSY4h3MFUB)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p1.1)\.
- X\. Liu, N\. Xu, M\. Chen, and C\. Xiao \(2024\)AutoDAN: generating stealthy jailbreak prompts on aligned large language models\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=7Jwpw4qKkb)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p1.1)\.
- P\. J\. Liu\*, M\. Saleh\*, E\. Pot, B\. Goodrich, R\. Sepassi, L\. Kaiser, and N\. Shazeer \(2018\)Generating wikipedia by summarizing long sequences\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=Hyg0vbWC-)Cited by:[§2\.1](https://arxiv.org/html/2608.18093#S2.SS1.p1.3)\.
- M\. Mazeika, L\. Phan, X\. Yin, A\. Zou, Z\. Wang, N\. Mu, E\. Sakhaee, N\. Li, S\. Basart, B\. Li, D\. Forsyth, and D\. Hendrycks \(2024\)HarmBench: a standardized evaluation framework for automated red teaming and robust refusal\.External Links:2402\.04249,[Link](https://arxiv.org/abs/2402.04249)Cited by:[§2\.2](https://arxiv.org/html/2608.18093#S2.SS2.SSS0.Px2.p1.5)\.
- A\. Mehrotra, M\. Zampetakis, P\. Kassianik, B\. Nelson, H\. Anderson, Y\. Singer, and A\. Karbasi \(2024\)Tree of attacks: jailbreaking black\-box llms automatically\.InAdvances in Neural Information Processing Systems,A\. Globerson, L\. Mackey, D\. Belgrave, A\. Fan, U\. Paquet, J\. Tomczak, and C\. Zhang \(Eds\.\),Vol\.37,pp\. 61065–61105\.External Links:[Document](https://dx.doi.org/10.52202/079017-1952),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/file/70702e8cbb4890b4a467b984ae59828a-Paper-Conference.pdf)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p2.1)\.
- K\. Meng, D\. Bau, A\. J\. Andonian, and Y\. Belinkov \(2022\)Locating and editing factual associations in GPT\.InAdvances in Neural Information Processing Systems,A\. H\. Oh, A\. Agarwal, D\. Belgrave, and K\. Cho \(Eds\.\),External Links:[Link](https://openreview.net/forum?id=-h6WAS6eE4)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px3.p1.1)\.
- K\. Meng, A\. S\. Sharma, A\. J\. Andonian, Y\. Belinkov, and D\. Bau \(2023\)Mass\-editing memory in a transformer\.InThe Eleventh International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=MkbcAHIYgyS)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px3.p1.1)\.
- K\. O’Brien, D\. Majercak, X\. Fernandes, R\. Edgar, B\. Bullwinkel, J\. Chen, H\. Nori, D\. Carignan, E\. Horvitz, and F\. Poursabzi\-Sangdeh \(2025\)Steering language model refusal with sparse autoencoders\.External Links:2411\.11296,[Link](https://arxiv.org/abs/2411.11296)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p2.1),[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p2.1)\.
- OpenAI, J\. Achiam, S\. Adler, S\. Agarwal, L\. Ahmad, I\. Akkaya, F\. L\. Aleman, D\. Almeida, J\. Altenschmidt, S\. Altman, S\. Anadkat, R\. Avila, I\. Babuschkin, S\. Balaji, V\. Balcom, P\. Baltescu, H\. Bao, M\. Bavarian, J\. Belgum, I\. Bello, J\. Berdine, G\. Bernadett\-Shapiro, C\. Berner, L\. Bogdonoff, O\. Boiko, M\. Boyd, A\. Brakman, G\. Brockman, T\. Brooks, M\. Brundage, K\. Button, T\. Cai, R\. Campbell, A\. Cann, B\. Carey, C\. Carlson, R\. Carmichael, B\. Chan, C\. Chang, F\. Chantzis, D\. Chen, S\. Chen, R\. Chen, J\. Chen, M\. Chen, B\. Chess, C\. Cho, C\. Chu, H\. W\. Chung, D\. Cummings, J\. Currier, Y\. Dai, C\. Decareaux, T\. Degry, N\. Deutsch, D\. Deville, A\. Dhar, D\. Dohan, S\. Dowling, S\. Dunning, A\. Ecoffet, A\. Eleti, T\. Eloundou, D\. Farhi, L\. Fedus, N\. Felix, S\. P\. Fishman, J\. Forte, I\. Fulford, L\. Gao, E\. Georges, C\. Gibson, V\. Goel, T\. Gogineni, G\. Goh, R\. Gontijo\-Lopes, J\. Gordon, M\. Grafstein, S\. Gray, R\. Greene, J\. Gross, S\. S\. Gu, Y\. Guo, C\. Hallacy, J\. Han, J\. Harris, Y\. He, M\. Heaton, J\. Heidecke, C\. Hesse, A\. Hickey, W\. Hickey, P\. Hoeschele, B\. Houghton, K\. Hsu, S\. Hu, X\. Hu, J\. Huizinga, S\. Jain, S\. Jain, J\. Jang, A\. Jiang, R\. Jiang, H\. Jin, D\. Jin, S\. Jomoto, B\. Jonn, H\. Jun, T\. Kaftan, Ł\. Kaiser, A\. Kamali, I\. Kanitscheider, N\. S\. Keskar, T\. Khan, L\. Kilpatrick, J\. W\. Kim, C\. Kim, Y\. Kim, J\. H\. Kirchner, J\. Kiros, M\. Knight, D\. Kokotajlo, Ł\. Kondraciuk, A\. Kondrich, A\. Konstantinidis, K\. Kosic, G\. Krueger, V\. Kuo, M\. Lampe, I\. Lan, T\. Lee, J\. Leike, J\. Leung, D\. Levy, C\. M\. Li, R\. Lim, M\. Lin, S\. Lin, M\. Litwin, T\. Lopez, R\. Lowe, P\. Lue, A\. Makanju, K\. Malfacini, S\. Manning, T\. Markov, Y\. Markovski, B\. Martin, K\. Mayer, A\. Mayne, B\. McGrew, S\. M\. McKinney, C\. McLeavey, P\. McMillan, J\. McNeil, D\. Medina, A\. Mehta, J\. Menick, L\. Metz, A\. Mishchenko, P\. Mishkin, V\. Monaco, E\. Morikawa, D\. Mossing, T\. Mu, M\. Murati, O\. Murk, D\. Mély, A\. Nair, R\. Nakano, R\. Nayak, A\. Neelakantan, R\. Ngo, H\. Noh, L\. Ouyang, C\. O’Keefe, J\. Pachocki, A\. Paino, J\. Palermo, A\. Pantuliano, G\. Parascandolo, J\. Parish, E\. Parparita, A\. Passos, M\. Pavlov, A\. Peng, A\. Perelman, F\. de Avila Belbute Peres, M\. Petrov, H\. P\. de Oliveira Pinto, Michael, Pokorny, M\. Pokrass, V\. H\. Pong, T\. Powell, A\. Power, B\. Power, E\. Proehl, R\. Puri, A\. Radford, J\. Rae, A\. Ramesh, C\. Raymond, F\. Real, K\. Rimbach, C\. Ross, B\. Rotsted, H\. Roussez, N\. Ryder, M\. Saltarelli, T\. Sanders, S\. Santurkar, G\. Sastry, H\. Schmidt, D\. Schnurr, J\. Schulman, D\. Selsam, K\. Sheppard, T\. Sherbakov, J\. Shieh, S\. Shoker, P\. Shyam, S\. Sidor, E\. Sigler, M\. Simens, J\. Sitkin, K\. Slama, I\. Sohl, B\. Sokolowsky, Y\. Song, N\. Staudacher, F\. P\. Such, N\. Summers, I\. Sutskever, J\. Tang, N\. Tezak, M\. B\. Thompson, P\. Tillet, A\. Tootoonchian, E\. Tseng, P\. Tuggle, N\. Turley, J\. Tworek, J\. F\. C\. Uribe, A\. Vallone, A\. Vijayvergiya, C\. Voss, C\. Wainwright, J\. J\. Wang, A\. Wang, B\. Wang, J\. Ward, J\. Wei, C\. Weinmann, A\. Welihinda, P\. Welinder, J\. Weng, L\. Weng, M\. Wiethoff, D\. Willner, C\. Winter, S\. Wolrich, H\. Wong, L\. Workman, S\. Wu, J\. Wu, M\. Wu, K\. Xiao, T\. Xu, S\. Yoo, K\. Yu, Q\. Yuan, W\. Zaremba, R\. Zellers, C\. Zhang, M\. Zhang, S\. Zhao, T\. Zheng, J\. Zhuang, W\. Zhuk, and B\. Zoph \(2024\)GPT\-4 technical report\.External Links:2303\.08774,[Link](https://arxiv.org/abs/2303.08774)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p1.1)\.
- L\. Ouyang, J\. Wu, X\. Jiang, D\. Almeida, C\. Wainwright, P\. Mishkin, C\. Zhang, S\. Agarwal, K\. Slama, A\. Gray, J\. Schulman, J\. Hilton, F\. Kelton, L\. Miller, M\. Simens, A\. Askell, P\. Welinder, P\. Christiano, J\. Leike, and R\. Lowe \(2022\)Training language models to follow instructions with human feedback\.InAdvances in Neural Information Processing Systems,A\. H\. Oh, A\. Agarwal, D\. Belgrave, and K\. Cho \(Eds\.\),External Links:[Link](https://openreview.net/forum?id=TG8KACxEON)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p1.1),[§1](https://arxiv.org/html/2608.18093#S1.p2.1),[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p1.1)\.
- Y\. Ozaki, S\. Watanabe, and T\. Yanase \(2025\)OptunaHub: a platform for black\-box optimization\.arXiv preprint arXiv:2510\.02798\.Cited by:[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px6.p1.7)\.
- K\. Park, Y\. J\. Choe, and V\. Veitch \(2023\)The linear representation hypothesis and the geometry of large language models\.InCausal Representation Learning Workshop at NeurIPS 2023,External Links:[Link](https://openreview.net/forum?id=T0PoOJg8cK)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p2.1)\.
- J\. Postmus and S\. Abreu \(2024\)Steering large language models using conceptors: improving addition\-based activation engineering\.InMINT: Foundation Model Interventions,External Links:[Link](https://openreview.net/forum?id=gyAnAq16HC)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px2.p1.1)\.
- R\. Rafailov, A\. Sharma, E\. Mitchell, C\. D\. Manning, S\. Ermon, and C\. Finn \(2023\)Direct preference optimization: your language model is secretly a reward model\.InThirty\-seventh Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=HPuSIXJaa9)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p2.1),[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p1.1)\.
- N\. Rimsky, N\. Gabrieli, J\. Schulz, M\. Tong, E\. Hubinger, and A\. Turner \(2024\)Steering llama 2 via contrastive activation addition\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),L\. Ku, A\. Martins, and V\. Srikumar \(Eds\.\),Bangkok, Thailand,pp\. 15504–15522\.External Links:[Link](https://aclanthology.org/2024.acl-long.828/),[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.828)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px2.p1.1)\.
- V\. Sanh, A\. Webson, C\. Raffel, S\. Bach, L\. Sutawika, Z\. Alyafeai, A\. Chaffin, A\. Stiegler, A\. Raja, M\. Dey, M\. S\. Bari, C\. Xu, U\. Thakker, S\. S\. Sharma, E\. Szczechla, T\. Kim, G\. Chhablani, N\. Nayak, D\. Datta, J\. Chang, M\. T\. Jiang, H\. Wang, M\. Manica, S\. Shen, Z\. X\. Yong, H\. Pandey, R\. Bawden, T\. Wang, T\. Neeraj, J\. Rozen, A\. Sharma, A\. Santilli, T\. Fevry, J\. A\. Fries, R\. Teehan, T\. L\. Scao, S\. Biderman, L\. Gao, T\. Wolf, and A\. M\. Rush \(2022\)Multitask prompted training enables zero\-shot task generalization\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=9Vrb9D0WI4)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p1.1)\.
- H\. A\. Shairah, H\. A\. A\. K\. Hammoud, B\. Ghanem, and G\. Turkiyyah \(2025\)An embarrassingly simple defense against llm abliteration attacks\.External Links:2505\.19056,[Link](https://arxiv.org/abs/2505.19056)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p4.1)\.
- H\. A\. Shairah, H\. A\. A\. K\. Hammoud, G\. Turkiyyah, and B\. Ghanem \(2026\)Turning the spell around: lightweight alignment amplification via rank\-one safety injection\.External Links:[Link](https://openreview.net/forum?id=8c2SbG5PLj)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px2.p1.1)\.
- G\. Shen, D\. Zhao, Y\. Dong, X\. He, and Y\. Zeng \(2025\)Jailbreak antidote: runtime safety\-utility balance via sparse representation adjustment in large language models\.InThe Thirteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=s20W12XTF8)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px2.p1.1)\.
- L\. Sheng, C\. Shen, W\. Zhao, J\. Fang, X\. Liu, Z\. Liang, X\. Wang, A\. Zhang, and T\. Chua \(2026\)AlphaSteer: learning refusal steering with principled null\-space constraint\.InThe Fourteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=1vvbzAqdTe)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p3.1),[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px5.p1.1),[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px2.p1.1)\.
- D\. Shi, T\. Shen, Y\. Huang, Z\. Li, Y\. Leng, R\. Jin, C\. Liu, X\. Wu, Z\. Guo, L\. Yu, L\. Shi, B\. Jiang, and D\. Xiong \(2024\)Large language model safety: a holistic survey\.External Links:2412\.17686,[Link](https://arxiv.org/abs/2412.17686)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p2.1)\.
- R\. Taori, I\. Gulrajani, T\. Zhang, Y\. Dubois, X\. Li, C\. Guestrin, P\. Liang, and T\. B\. Hashimoto \(2023\)Stanford alpaca: an instruction\-following llama model\.GitHub\.Note:[https://github\.com/tatsu\-lab/stanford\_alpaca](https://github.com/tatsu-lab/stanford_alpaca)Cited by:[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px3.p1.1)\.
- G\. Team, M\. Riviere, S\. Pathak, P\. G\. Sessa, C\. Hardin, S\. Bhupatiraju, L\. Hussenot, T\. Mesnard, B\. Shahriari, A\. Ramé, J\. Ferret, P\. Liu, P\. Tafti, A\. Friesen, M\. Casbon, S\. Ramos, R\. Kumar, C\. L\. Lan, S\. Jerome, A\. Tsitsulin, N\. Vieillard, P\. Stanczyk, S\. Girgin, N\. Momchev, M\. Hoffman, S\. Thakoor, J\. Grill, B\. Neyshabur, O\. Bachem, A\. Walton, A\. Severyn, A\. Parrish, A\. Ahmad, A\. Hutchison, A\. Abdagic, A\. Carl, A\. Shen, A\. Brock, A\. Coenen, A\. Laforge, A\. Paterson, B\. Bastian, B\. Piot, B\. Wu, B\. Royal, C\. Chen, C\. Kumar, C\. Perry, C\. Welty, C\. A\. Choquette\-Choo, D\. Sinopalnikov, D\. Weinberger, D\. Vijaykumar, D\. Rogozińska, D\. Herbison, E\. Bandy, E\. Wang, E\. Noland, E\. Moreira, E\. Senter, E\. Eltyshev, F\. Visin, G\. Rasskin, G\. Wei, G\. Cameron, G\. Martins, H\. Hashemi, H\. Klimczak\-Plucińska, H\. Batra, H\. Dhand, I\. Nardini, J\. Mein, J\. Zhou, J\. Svensson, J\. Stanway, J\. Chan, J\. P\. Zhou, J\. Carrasqueira, J\. Iljazi, J\. Becker, J\. Fernandez, J\. van Amersfoort, J\. Gordon, J\. Lipschultz, J\. Newlan, J\. Ji, K\. Mohamed, K\. Badola, K\. Black, K\. Millican, K\. McDonell, K\. Nguyen, K\. Sodhia, K\. Greene, L\. L\. Sjoesund, L\. Usui, L\. Sifre, L\. Heuermann, L\. Lago, L\. McNealus, L\. B\. Soares, L\. Kilpatrick, L\. Dixon, L\. Martins, M\. Reid, M\. Singh, M\. Iverson, M\. Görner, M\. Velloso, M\. Wirth, M\. Davidow, M\. Miller, M\. Rahtz, M\. Watson, M\. Risdal, M\. Kazemi, M\. Moynihan, M\. Zhang, M\. Kahng, M\. Park, M\. Rahman, M\. Khatwani, N\. Dao, N\. Bardoliwalla, N\. Devanathan, N\. Dumai, N\. Chauhan, O\. Wahltinez, P\. Botarda, P\. Barnes, P\. Barham, P\. Michel, P\. Jin, P\. Georgiev, P\. Culliton, P\. Kuppala, R\. Comanescu, R\. Merhej, R\. Jana, R\. A\. Rokni, R\. Agarwal, R\. Mullins, S\. Saadat, S\. M\. Carthy, S\. Cogan, S\. Perrin, S\. M\. R\. Arnold, S\. Krause, S\. Dai, S\. Garg, S\. Sheth, S\. Ronstrom, S\. Chan, T\. Jordan, T\. Yu, T\. Eccles, T\. Hennigan, T\. Kocisky, T\. Doshi, V\. Jain, V\. Yadav, V\. Meshram, V\. Dharmadhikari, W\. Barkley, W\. Wei, W\. Ye, W\. Han, W\. Kwon, X\. Xu, Z\. Shen, Z\. Gong, Z\. Wei, V\. Cotruta, P\. Kirk, A\. Rao, M\. Giang, L\. Peran, T\. Warkentin, E\. Collins, J\. Barral, Z\. Ghahramani, R\. Hadsell, D\. Sculley, J\. Banks, A\. Dragan, S\. Petrov, O\. Vinyals, J\. Dean, D\. Hassabis, K\. Kavukcuoglu, C\. Farabet, E\. Buchatskaya, S\. Borgeaud, N\. Fiedel, A\. Joulin, K\. Kenealy, R\. Dadashi, and A\. Andreev \(2024\)Gemma 2: improving open language models at a practical size\.External Links:2408\.00118,[Link](https://arxiv.org/abs/2408.00118)Cited by:[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px1.p1.1)\.
- A\. Vaswani, N\. Shazeer, N\. Parmar, J\. Uszkoreit, L\. Jones, A\. N\. Gomez, L\. Kaiser, and I\. Polosukhin \(2023\)Attention is all you need\.External Links:1706\.03762,[Link](https://arxiv.org/abs/1706.03762)Cited by:[§2\.1](https://arxiv.org/html/2608.18093#S2.SS1.p1.3),[§2\.2](https://arxiv.org/html/2608.18093#S2.SS2.SSS0.Px1.p1.8)\.
- X\. Wang, C\. Hu, P\. Röttger, and B\. Plank \(2025\)Surgical, cheap, and flexible: mitigating false refusal in language models via single vector ablation\.External Links:2410\.03415,[Link](https://arxiv.org/abs/2410.03415)Cited by:[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px5.p1.1),[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px2.p1.1)\.
- Y\. Wang, Y\. Kordi, S\. Mishra, A\. Liu, N\. A\. Smith, D\. Khashabi, and H\. Hajishirzi \(2023\)Self\-instruct: aligning language models with self\-generated instructions\.InProceedings of the 61st Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),A\. Rogers, J\. Boyd\-Graber, and N\. Okazaki \(Eds\.\),Toronto, Canada,pp\. 13484–13508\.External Links:[Link](https://aclanthology.org/2023.acl-long.754/),[Document](https://dx.doi.org/10.18653/v1/2023.acl-long.754)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p2.1)\.
- Y\. Wang, S\. Mishra, P\. Alipoormolabashi, Y\. Kordi, A\. Mirzaei, A\. Naik, A\. Ashok, A\. S\. Dhanasekaran, A\. Arunkumar, D\. Stap, E\. Pathak, G\. Karamanolakis, H\. Lai, I\. Purohit, I\. Mondal, J\. Anderson, K\. Kuznia, K\. Doshi, K\. K\. Pal, M\. Patel, M\. Moradshahi, M\. Parmar, M\. Purohit, N\. Varshney, P\. R\. Kaza, P\. Verma, R\. S\. Puri, R\. Karia, S\. Doshi, S\. K\. Sampat, S\. Mishra, S\. Reddy A, S\. Patro, T\. Dixit, and X\. Shen \(2022\)Super\-NaturalInstructions: generalization via declarative instructions on 1600\+ NLP tasks\.InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing,Y\. Goldberg, Z\. Kozareva, and Y\. Zhang \(Eds\.\),Abu Dhabi, United Arab Emirates,pp\. 5085–5109\.External Links:[Link](https://aclanthology.org/2022.emnlp-main.340/),[Document](https://dx.doi.org/10.18653/v1/2022.emnlp-main.340)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p1.1)\.
- A\. Wei, N\. Haghtalab, and J\. Steinhardt \(2023\)Jailbroken: how does LLM safety training fail?\.InThirty\-seventh Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=jA235JGM09)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p2.1)\.
- J\. Wei, M\. Bosma, V\. Y\. Zhao, K\. Guu, A\. W\. Yu, B\. Lester, N\. Du, A\. M\. Dai, and Q\. V\. Le \(2022\)Finetuned language models are zero\-shot learners\.External Links:2109\.01652,[Link](https://arxiv.org/abs/2109.01652)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p1.1)\.
- P\. E\. Weidmann \(2025\)Heretic: fully automatic censorship removal for language models\.GitHub\.Note:[https://github\.com/p\-e\-w/heretic](https://github.com/p-e-w/heretic)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p3.1),[§2\.2](https://arxiv.org/html/2608.18093#S2.SS2.SSS0.Px1.p1.8),[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px2.p1.1),[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px2.p1.1)\.
- A\. Zou, L\. Phan, S\. Chen, J\. Campbell, P\. Guo, R\. Ren, A\. Pan, X\. Yin, M\. Mazeika, A\. Dombrowski, S\. Goel, N\. Li, M\. J\. Byun, Z\. Wang, A\. Mallen, S\. Basart, S\. Koyejo, D\. Song, M\. Fredrikson, J\. Z\. Kolter, and D\. Hendrycks \(2025\)Representation engineering: a top\-down approach to ai transparency\.External Links:2310\.01405,[Link](https://arxiv.org/abs/2310.01405)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px2.p1.1)\.
- A\. Zou, L\. Phan, J\. Wang, D\. Duenas, M\. Lin, M\. Andriushchenko, J\. Z\. Kolter, M\. Fredrikson, and D\. Hendrycks \(2024\)Improving alignment and robustness with circuit breakers\.InThe Thirty\-eighth Annual Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=IbIB8SBKFV)Cited by:[§1](https://arxiv.org/html/2608.18093#S1.p3.1),[§3\.1](https://arxiv.org/html/2608.18093#S3.SS1.SSS0.Px5.p1.1),[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2608.18093#S5.p1.1)\.
- A\. Zou, Z\. Wang, N\. Carlini, M\. Nasr, J\. Z\. Kolter, and M\. Fredrikson \(2023\)Universal and transferable adversarial attacks on aligned language models\.External Links:2307\.15043,[Link](https://arxiv.org/abs/2307.15043)Cited by:[§4](https://arxiv.org/html/2608.18093#S4.SS0.SSS0.Px1.p1.1)\.