Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration

# Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration
Source: [https://arxiv.org/html/2609.16204](https://arxiv.org/html/2609.16204)
Mona T\. DiabVirginia SmithAffiliation:Carnegie Mellon University

###### Abstract

Safety guardrails in open\-weight language models can be readily bypassed using Refusal Feature Ablation \(RFA\), a technique that identifies and projects out a linear*refusal direction*from the residual stream, often achieving a high attack success rate \(ASR\) while preserving model capability\. Defending against these attacks typically requires computationally expensive safety finetuning for every new checkpoint\. We introduceDecoy Direction Optimization \(DDO\), a fast, post\-hoc weight\-editing defense that requires no base\-model finetuning\. Our approach is based on a simple mechanistic insight: ablation attacks rely on contrastive estimators to find the refusal direction\. Rather than trying to hide the true refusal circuitry, DDO actively injects a high\-magnitude, nonlinear*decoy*signal into the network’s MLP neurons\. When an attacker attempts to locate the refusal direction, the decoy corrupts their estimator, tricking them into ablating a harmless orthogonal feature while the actual safety mechanism remains intact\. We prove a spectral bound formalizing this effect and evaluate DDO across six model families, achieving<<10% ASR under standard RFA\. On Llama\-3\-8B\-Instruct, DDO remains comparable to trained defenses under adaptive multi\-phase attacks \(65%65\\%vs\.58%58\\%worst\-case ASR\) and reduces Heretic weight\-level attack ASR from88\.7%88\.7\\%to18%18\\%, all at30–450×30\\text\{\-\-\}450\\timeslower optimization cost per configuration than the trained baselines\.111Code:[https://github\.com/aashiqmuhamed/defending\-against\-abliteration](https://github.com/aashiqmuhamed/defending-against-abliteration)\.

## 1Introduction

The ability to decline harmful requests is a core safety mechanism in instruction\-tuned LLMs aligned via preference finetuning\[[1](https://arxiv.org/html/2609.16204#bib.bib1),[2](https://arxiv.org/html/2609.16204#bib.bib2),[3](https://arxiv.org/html/2609.16204#bib.bib3)\]\. Removing refusal from open\-weight models can fuel misuse, increasing risks such as chemical, biological, radiological, and nuclear \(CBRN\) capability uplift; cyber\-offense generation; and the production of child sexual abuse material \(CSAM\), making refusal robustness a pressing safety concern\[[4](https://arxiv.org/html/2609.16204#bib.bib4),[5](https://arxiv.org/html/2609.16204#bib.bib5)\]\. In the open\-weight setting, however, safety is brittle: a white\-box adversary can modify the released checkpoint and its inference code, yielding a model that preserves capability while dropping refusal\. Prior work suggests that refusal is often mediated by low\-dimensional residual\-stream features\[[6](https://arxiv.org/html/2609.16204#bib.bib6)\], enabling training\-free attacks such as Refusal Feature Ablation \(RFA; also referred to asabliteration\) that estimate a difference\-in\-means \(DIM\) direction between harmful and safe activations and project it out at inference time\[[7](https://arxiv.org/html/2609.16204#bib.bib7)\]\. The resulting checkpoints often achieve high*attack success rate*\(ASR; harmful prompts judged compliant\), and thousands of such uncensored variants are already publicly hosted\[[8](https://arxiv.org/html/2609.16204#bib.bib8)\]\.

![Refer to caption](https://arxiv.org/html/2609.16204v1/comparison_figure.png)Figure 1:DDO vs\. existing defenses against RFA\.Without any defense, RFA strips refusal from open\-weight models with no training cost for the attacker \(top row\)\. Trained safety defenses \(Circuit Breakers, LAT, ReFAT, RepBend\) preserve refusal under RFA but require training data, multi\-GPU finetuning, and expensive per\-method hyperparameter sweeps \(middle row\)\. DDO reaches comparable standard\-RFA robustness at30–450×30\\text\{\-\-\}450\\timeslower cost: a single GPU, two minutes, no training data, and base weights left frozen \(bottom row\)\.Existing defenses against refusal removal are predominantly training\-time interventions\. Circuit Breakers\[[9](https://arxiv.org/html/2609.16204#bib.bib9)\]finetunes checkpoints with a representation\-rerouting objective; LAT\[[10](https://arxiv.org/html/2609.16204#bib.bib10)\]and ReFAT\[[11](https://arxiv.org/html/2609.16204#bib.bib11)\]adversarially train against latent/feature\-space attacks; and RepBend\[[12](https://arxiv.org/html/2609.16204#bib.bib12)\]and Triplet\-based objectives\[[13](https://arxiv.org/html/2609.16204#bib.bib13)\]reshape representation geometry during training\. These methods can be highly effective, but they require safety finetuning and must be repeated for each new checkpoint\. Depending on the method, they may additionally require method\-specific training data or attack pipelines \(e\.g\., adversarial examples\) and hyperparameter tuning\. Moreover, prior work does not evaluate these defenses against adaptive multi\-phase RFA or automated weight\-level attacks like Heretic\[[14](https://arxiv.org/html/2609.16204#bib.bib14)\]; we evaluate under this stronger attack ladder \(Section[4\.2](https://arxiv.org/html/2609.16204#S4.SS2)\)\. Given the rapid release cadence of open\-weight checkpoints, and evidence that frontier open\-weight models can trail closed\-weight state\-of\-the\-art on the order of months on capability benchmarks\[[15](https://arxiv.org/html/2609.16204#bib.bib15),[16](https://arxiv.org/html/2609.16204#bib.bib16)\], per\-checkpoint retraining is difficult to sustain; we therefore seek*post\-hoc*safety hardening tools that are low\-cost, composable, and data\-light\.

We introduceDecoy Direction Optimization \(DDO\), a post\-hoc defense that targets the attacker’s estimator rather than the refusal feature itself, without requiring expensive finetuning\. DDO repurposes low\-impact MLP neurons to implement a gated read–write map: on harmful prompts, the neurons*read*the refusal coordinate and*write*large updates in directions orthogonal to refusal, inducing a decoy\-dominated contrast that biases DIM estimation so that RFA ablates a decoy signal rather than the causal refusal subspace\. We prove a subspace overlap bound and specialize it to orthogonal decoys \(Theorem[2](https://arxiv.org/html/2609.16204#Thmtheorem2)\): sufficiently strong decoy modes limit how much a contrastive attack overlaps the causal refusal subspace\. The number of such modes defines an*effective decoy rank*, which also serves as a diagnostic for interpreting adaptive re\-estimation budgets\.

Empirically, DDO is able to lower the ASR of standard\-RFA toless than10%10\\%onsix model familiesin∼2\{\\sim\}2minutes per optimization run on a single A100 GPU\. DDO matches or exceeds trained baselines on standard RFA at30–450×30\\text\{\-\-\}450\\timeslower cost per configuration\(Figure[1](https://arxiv.org/html/2609.16204#S1.F1)\)\. On Llama\-3\-8B\-Instruct, under adaptive multi\-phase RFA, DDO degrades comparably to trained defenses \(65%65\\%worst\-case ASR vs\.58%58\\%for the best trained baseline\) while preserving coherent generation \(MT\-Bench≥5\.82\\geq 5\.82\), and reduces Heretic\[[14](https://arxiv.org/html/2609.16204#bib.bib14)\]ASR from88\.7%88\.7\\%to18%18\\%at200200trials\. Our contributions include:

1. \(i\)We introduceDDO \(Decoy Direction Optimization\), to our knowledge, the first post\-hoc defense against refusal feature ablation that requires no base\-model finetuning\. DDO repurposes a small set of*low\-impact*MLP neurons to inject gated, refusal\-orthogonal decoy directions that corrupt contrastive refusal estimators\. The defense compiles into weights, incurring no architectural or runtime overhead\.
2. \(ii\)We provesubspace overlap bounds\(Theorems[1](https://arxiv.org/html/2609.16204#Thmtheorem1)and[2](https://arxiv.org/html/2609.16204#Thmtheorem2)\) that relate attacker–refusal overlap to the contrast matrix and, for DDO, the spectrum of its empirical decoy response matrix\. The resulting effective decoy rank characterizes protection against a fixed contrastive attack and helps interpret adaptive phase budgets\. A corollary on optimal spectral allocation \(Corollary[3](https://arxiv.org/html/2609.16204#Thmtheorem3)\) provides a concrete design principle for multi\-direction decoys: under a fixed decoy\-energy budget, spreading energy evenly acrosskkdirections maximizes thekk\-th singular value, strengthening guarantees against rank\-kkcontrastive ablation\.
3. \(iii\)We provide a broad evaluation under a three\-tiertraining\-free attack ladder\(standard RFA, adaptive multi\-phase RFA, and Heretic\), including head\-to\-head comparisons with trained defenses and cross\-architecture mechanism ablations\. On Llama\-3\-8B\-Instruct\[[17](https://arxiv.org/html/2609.16204#bib.bib17)\], DDO reduces standard\-RFA ASR from85%85\\%to1\.8%1\.8\\%while preserving benign compliance, performing comparably to the strongest trained baselines at30–450×30\\text\{\-\-\}450\\timeslower cost per configuration\. Acrosssix model families, DDO achieves<10%<10\\%standard\-RFA ASR without base\-model finetuning\.

#### Related work\.

Beyond the rank\-1 refusal feature attack\[[7](https://arxiv.org/html/2609.16204#bib.bib7)\], recent work shows that refusal geometry can be multi\-dimensional, e\.g\., concept cones\[[18](https://arxiv.org/html/2609.16204#bib.bib18)\], multiple mediating directions\[[19](https://arxiv.org/html/2609.16204#bib.bib19)\], orthogonal safety dimensions\[[20](https://arxiv.org/html/2609.16204#bib.bib20)\], and separable harmfulness/refusal representations\[[21](https://arxiv.org/html/2609.16204#bib.bib21)\], motivating our multi\-phase adaptive attack evaluation\. Prior model\-level defenses against RFA require per\-checkpoint safety finetuning with task\-specific data and full backward passes through the model; DDO instead freezes all base weights and optimizes only a small set of decoy parameters, enabling post\-hoc hardening in minutes with no inference\-time overhead\. We additionally evaluate prompt\-level jailbreaks \(GCG\[[22](https://arxiv.org/html/2609.16204#bib.bib22)\], PAIR\[[23](https://arxiv.org/html/2609.16204#bib.bib23)\], AutoDAN\[[24](https://arxiv.org/html/2609.16204#bib.bib24)\]\), which have been linked to the same refusal features exploited by RFA\[[11](https://arxiv.org/html/2609.16204#bib.bib11)\]\. Extended related work is in Appendix[B](https://arxiv.org/html/2609.16204#A2)\.

## 2Threat Model and Attacks

We study refusal robustness in the open\-weight release setting: a defender applies DDO to a checkpoint and releases only the hardened model; an adversary then obtains the defended weights and attempts to remove refusal while preserving general capability\.

Our threat model targets the automated, training\-free uncensoring pipeline that dominates open\-weight model tampering\. The low\-barrier route is not safety unlearning or adversarial finetuning, but applying publicabliterationor weight\-editing tools to a released checkpoint\. We model a*resource\-constrained, white\-box, and adaptive*attacker who can inspect released weights, run arbitrary inference code, collect activations on harmful and benign probe prompts, modify activations at inference time, and apply post\-hoc weight edits\. Following Kerckhoffs’s principle, the attacker knows DDO was applied and can adapt their scripts accordingly, but has no access to the original pre\-DDO checkpoint and does not perform gradient\-based finetuning\. This captures the platform\-side risk DDO addresses: a model provider, hosting platform, or downstream distributor may harden a checkpoint before release, but cannot assume downstream users will not attempt to strip safety guardrails\.

The attacker’s objective is*capability\-preserving refusal removal*: maximize ASR on harmful prompts while preserving coherent generation\. Since ASR can be artificially lowered by destroying model quality, we evaluate robustness jointly with utility metrics \(MT\-Bench, MMLU, XSTest\)\. We operationalize this threat model with three tiers of training\-free attacks \(Table[1](https://arxiv.org/html/2609.16204#S2.T1)\), forming a ladder of increasing attacker sophistication within the post\-hoc, no\-finetuning regime\.

#### Standard RFA\.

Table 1:Attack surface by tier\. The three tiers probe complementary attack channels\.The attacker estimates a per\-layer difference\-in\-means \(DIM\) direction and projects it out of the residual stream\[[7](https://arxiv.org/html/2609.16204#bib.bib7)\]\. Let𝐡ℓ∈ℝd\\mathbf\{h\}\_\{\\ell\}\\in\\mathbb\{R\}^\{d\}denote the residual stream at layerℓ\\ell\. The attacker computes

𝐝ℓ≜𝔼⁡\[𝐡ℓ∣harm\]−𝔼⁡\[𝐡ℓ∣safe\],𝐝^ℓ≜𝐝ℓ‖𝐝ℓ‖2,\\mathbf\{d\}\_\{\\ell\}\\mathrel\{\\triangleq\}\\mathbb\{E\}\[\\mathbf\{h\}\_\{\\ell\}\\mid\\mathrm\{harm\}\]\-\\mathbb\{E\}\[\\mathbf\{h\}\_\{\\ell\}\\mid\\mathrm\{safe\}\],\\qquad\\hat\{\\mathbf\{d\}\}\_\{\\ell\}\\mathrel\{\\triangleq\}\\frac\{\\mathbf\{d\}\_\{\\ell\}\}\{\\\|\\mathbf\{d\}\_\{\\ell\}\\\|\_\{2\}\},for nonzero𝐝ℓ\\mathbf\{d\}\_\{\\ell\}, and applies𝐡ℓ←\(𝐈−𝐝^ℓ​𝐝^ℓ⊤\)​𝐡ℓ\\mathbf\{h\}\_\{\\ell\}\\leftarrow\(\\mathbf\{I\}\-\\hat\{\\mathbf\{d\}\}\_\{\\ell\}\\hat\{\\mathbf\{d\}\}\_\{\\ell\}^\{\\top\}\)\\mathbf\{h\}\_\{\\ell\}\. We reserve𝐫^ℓ\\hat\{\\mathbf\{r\}\}\_\{\\ell\}for the defender’s reference refusal direction and𝐝^ℓ\\hat\{\\mathbf\{d\}\}\_\{\\ell\}for the attacker’s estimate on the released model\. We evaluate both*three\-point*and*residual\-stream*variants \(Appendix[F\.1](https://arxiv.org/html/2609.16204#A6.SS1)\) on JailbreakBench\[[25](https://arxiv.org/html/2609.16204#bib.bib25)\]and HarmBench\[[5](https://arxiv.org/html/2609.16204#bib.bib5)\]\.

#### Heretic\.

Heretic\[[14](https://arxiv.org/html/2609.16204#bib.bib14)\]is a fully automated weight\-level refusal\-removal tool that applies Optuna\-optimized\[[26](https://arxiv.org/html/2609.16204#bib.bib26)\]low\-rank projections to attention output𝐖o\\mathbf\{W\}\_\{o\}and MLP down\-projection𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}:𝐖ablated=𝐖−α⁡\(ℓ\)​𝐝^​\(𝐝^⊤​𝐖\)\\mathbf\{W\}\_\{\\mathrm\{ablated\}\}=\\mathbf\{W\}\-\\alpha\(\\ell\)\\,\\hat\{\\mathbf\{d\}\}\(\\hat\{\\mathbf\{d\}\}^\{\\top\}\\mathbf\{W\}\), where𝐝^\\hat\{\\mathbf\{d\}\}is a searched ablation direction andα⁡\(ℓ\)\\alpha\(\\ell\)is a searched per\-layer ablation strength\. It produces a modified checkpoint and requires no ML expertise\. We report H\-200 as the maximum\-ASR trial among 200 Optuna trials \(Appendix[F\.1](https://arxiv.org/html/2609.16204#A6.SS1)\)\.

#### Adaptive multi\-phase RFA\.

To model an attacker who adapts after observing the defended checkpoint, we introduce an iterative variant\. At phasett, the attacker computes a fresh DIM vector𝐝ℓ\(t\)\\mathbf\{d\}\_\{\\ell\}^\{\(t\)\}with all earlier phases’ ablations active, then removes its components along previously selected directions:

𝐯ℓ\(t\)=𝐝ℓ\(t\)−∑j=1t−1⟨𝐝ℓ\(t\),𝐝^ℓ\(j\)⟩​𝐝^ℓ\(j\),𝐝^ℓ\(t\)=𝐯ℓ\(t\)‖𝐯ℓ\(t\)‖2\.\\mathbf\{v\}\_\{\\ell\}^\{\(t\)\}=\\mathbf\{d\}\_\{\\ell\}^\{\(t\)\}\-\\sum\_\{j=1\}^\{t\-1\}\\langle\\mathbf\{d\}\_\{\\ell\}^\{\(t\)\},\\hat\{\\mathbf\{d\}\}\_\{\\ell\}^\{\(j\)\}\\rangle\\hat\{\\mathbf\{d\}\}\_\{\\ell\}^\{\(j\)\},\\qquad\\hat\{\\mathbf\{d\}\}\_\{\\ell\}^\{\(t\)\}=\\frac\{\\mathbf\{v\}\_\{\\ell\}^\{\(t\)\}\}\{\\\|\\mathbf\{v\}\_\{\\ell\}^\{\(t\)\}\\\|\_\{2\}\}\.The sum is empty att=1t=1\. Normalization applies when𝐯ℓ\(t\)≠0\\mathbf\{v\}\_\{\\ell\}^\{\(t\)\}\\neq 0; otherwise we set𝐝^ℓ\(t\)=0\\hat\{\\mathbf\{d\}\}\_\{\\ell\}^\{\(t\)\}=0and add no new direction\. The attacker ablates all accumulated directions simultaneously, giving rank at mostttper layer\. Throughout,ttindexes adaptive phases,kkdenotes attack rank, andKKdenotes the number of decoy reader groups\.

## 3Method: Decoy Direction Optimization \(DDO\)

We consider standard pre\-norm decoder\-only transformers with SwiGLU/GeGLU MLPs \(Appendix[C](https://arxiv.org/html/2609.16204#A3)\)\. Let𝐡ℓ∈ℝd\\mathbf\{h\}\_\{\\ell\}\\in\\mathbb\{R\}^\{d\}denote the residual\-stream state at layerℓ\\ell, and let𝐡ℓattn\\mathbf\{h\}\_\{\\ell\}^\{\\mathrm\{attn\}\}denote the residual stream after the attention update \(before the MLP\)\. The MLP input is𝐱~ℓ≜RMSNorm⁡\(𝐡ℓattn\)\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\\mathrel\{\\triangleq\}\\mathrm\{RMSNorm\}\(\\mathbf\{h\}\_\{\\ell\}^\{\\mathrm\{attn\}\}\)\. SwiGLU uses gate/up projections𝐖gate,𝐖up∈ℝdinter×d\\mathbf\{W\}\_\{\\mathrm\{gate\}\},\\mathbf\{W\}\_\{\\mathrm\{up\}\}\\in\\mathbb\{R\}^\{d\_\{\\mathrm\{inter\}\}\\times d\}and down projection𝐖down∈ℝd×dinter\\mathbf\{W\}\_\{\\mathrm\{down\}\}\\in\\mathbb\{R\}^\{d\\times d\_\{\\mathrm\{inter\}\}\}\(wheredinterd\_\{\\mathrm\{inter\}\}is the MLP intermediate dimension andsilu⁡\(x\)=x​σ​\(x\)\\operatorname\{silu\}\(x\)=x\\sigma\(x\)is the SiLU activation\) to produce the residual update𝐦ℓ=𝐖down​\(silu⁡\(𝐖gate​𝐱~ℓ\)⊙\(𝐖up​𝐱~ℓ\)\)\\mathbf\{m\}\_\{\\ell\}=\\mathbf\{W\}\_\{\\mathrm\{down\}\}\\\!\\big\(\\operatorname\{silu\}\(\\mathbf\{W\}\_\{\\mathrm\{gate\}\}\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\)\\odot\(\\mathbf\{W\}\_\{\\mathrm\{up\}\}\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\)\\big\), where⊙\\odotis elementwise multiplication\. DDO operates by editing select rows/columns of𝐖gate\\mathbf\{W\}\_\{\\mathrm\{gate\}\},𝐖up\\mathbf\{W\}\_\{\\mathrm\{up\}\}, and𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}\.

Decoy Direction Optimization \(DDO\)is a post\-hoc weight\-editing defense \(base weights frozen\) that targets the attacker’s contrastive estimator rather than the refusal feature\. On harmful prompts, DDO repurposes a small number of SwiGLU/GeGLU neurons to inject large residual shifts along decoy directions orthogonal to refusal, so RFA’s estimated ablation direction becomes decoy\-dominated, and ablation preferentially removes decoys rather than the underlying causal refusal subspace\. All edits are folded into the deployed weights, incurring no additional architectural or runtime overhead\. Concretely, DDO: \(i\)estimatesa per\-layer refusal direction𝐫^ℓ\\hat\{\\mathbf\{r\}\}\_\{\\ell\}via DIM on 128 harmful and 128 safe probes; \(ii\)selectsnnlow\-impact neurons per target layer \(smallest\-norm columns of𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}\); \(iii\)optimizesdecoy write directions𝐮i⟂𝐫^ℓ\\mathbf\{u\}\_\{i\}\\perp\\hat\{\\mathbf\{r\}\}\_\{\\ell\}under a four\-term loss, tuning scalar gains\(β,s\)\(\\beta,s\)via Bayesian hyperparameter search; and \(iv\)compilesthe optimized parameters into weights using replace or additive mode, and places the edits at or upstream of the causal refusal zone\. Figure[2](https://arxiv.org/html/2609.16204#S3.F2)provides a schematic of the DDO architecture, optimization objective, and geometric intuition\.

Figure 2:DDO overview\.\(A\)Gated decoy architecture: SwiGLU MLP neuron repurposing writes𝐫^ℓ\\hat\{\\mathbf\{r\}\}\_\{\\ell\}into𝐖gate/𝐖up\\mathbf\{W\}\_\{\\mathrm\{gate\}\}/\\mathbf\{W\}\_\{\\mathrm\{up\}\}\(trigger\) and𝐮i⟂𝐫^ℓ\\mathbf\{u\}\_\{i\}\\perp\\hat\{\\mathbf\{r\}\}\_\{\\ell\}into𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}\(decoy output\); gatingsilu⁡\(β​a\)⋅a\\operatorname\{silu\}\(\\beta a\)\\cdot aproduces harmful\-selective shifts\.\(B\)DDO optimizes\{𝐮i\}\\\{\\mathbf\{u\}\_\{i\}\\\}via four losses: refusal preservation, benign retention, estimator confusion, and first\-token anchoring \(withβ,s\\beta,stuned by Optuna\)\.\(C\)The defended mean\-difference𝐝^def\\hat\{\\mathbf\{d\}\}\_\{\\text\{def\}\}rotates toward the decoy subspace; ablating it removes decoys but preserves true refusal𝐫^\\hat\{\\mathbf\{r\}\}\.#### Gated decoy architecture\.

DDO repurposes a small set of SwiGLU \(or GeGLU\) units to implement a gated read–write map: each unit*reads*the refusal coordinate and*writes*into an orthogonal decoy direction\. To minimize utility loss, we choosenn*low\-impact*units per layer by selecting thennsmallest\-norm columns of𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}\(units whose down\-projection contributes weakly to the residual update\)\. In each targeted layerℓ\\elland for each selected unitii, we write a refusal\-aligned trigger into rowiiof𝐖up\\mathbf\{W\}\_\{\\mathrm\{up\}\}and𝐖gate\\mathbf\{W\}\_\{\\mathrm\{gate\}\}\(denoted𝐰up,i\\mathbf\{w\}\_\{\\mathrm\{up\},i\}and𝐰gate,i\\mathbf\{w\}\_\{\\mathrm\{gate\},i\}\), and a decoy write vector into columniiof𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}\(denoted𝐰down,i\\mathbf\{w\}\_\{\\mathrm\{down\},i\}\):

𝐰up,i←𝐫^ℓ⊤,𝐰gate,i←β​𝐫^ℓ⊤,𝐰down,i←s⋅𝐮i,\\mathbf\{w\}\_\{\\mathrm\{up\},i\}\\leftarrow\\hat\{\\mathbf\{r\}\}\_\{\\ell\}^\{\\top\},\\quad\\mathbf\{w\}\_\{\\mathrm\{gate\},i\}\\leftarrow\\beta\\,\\hat\{\\mathbf\{r\}\}\_\{\\ell\}^\{\\top\},\\quad\\mathbf\{w\}\_\{\\mathrm\{down\},i\}\\leftarrow s\\cdot\\mathbf\{u\}\_\{i\},\(1\)where𝐮i⟂𝐫^ℓ\\mathbf\{u\}\_\{i\}\\perp\\hat\{\\mathbf\{r\}\}\_\{\\ell\}is a decoy output direction andβ,s\>0\\beta,s\>0are scalar gains\. For SwiGLU in replace mode, writingaℓ≜⟨𝐫^ℓ,𝐱~ℓ⟩a\_\{\\ell\}\\mathrel\{\\triangleq\}\\langle\\hat\{\\mathbf\{r\}\}\_\{\\ell\},\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\\ranglefor the neuron’s refusal coordinate, its decoy contribution is

δi​\(𝐱~ℓ\)=s​gβ​\(aℓ\)​𝐮i,gβ​\(a\)≜a​silu⁡\(β​a\)=β​a2​σ​\(β​a\),\\delta\_\{i\}\(\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\)=s\\,g\_\{\\beta\}\(a\_\{\\ell\}\)\\,\\mathbf\{u\}\_\{i\},\\qquad g\_\{\\beta\}\(a\)\\mathrel\{\\triangleq\}a\\,\\operatorname\{silu\}\(\\beta a\)=\\beta a^\{2\}\\sigma\(\\beta a\),\(2\)whereσ\\sigmais the logistic sigmoid\. The sigmoid suppresses the gate for negative refusal coordinates; for large positive coordinates,gβ​\(a\)≈β​a2g\_\{\\beta\}\(a\)\\approx\\beta a^\{2\}\. This produces larger decoy shifts on prompts with positive refusal coordinates\. DDO estimates𝐫^ℓ\\hat\{\\mathbf\{r\}\}\_\{\\ell\}via DIM on post\-attention\-layernorm activations𝐱~ℓ=RMSNorm⁡\(𝐡ℓattn\)\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}=\\mathrm\{RMSNorm\}\(\\mathbf\{h\}\_\{\\ell\}^\{\\mathrm\{attn\}\}\), the same space that𝐖gate\\mathbf\{W\}\_\{\\mathrm\{gate\}\}and𝐖up\\mathbf\{W\}\_\{\\mathrm\{up\}\}read from\. The decoy output through𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}writes directly to the residual stream\. We parameterize\{𝐮i\}\\\{\\mathbf\{u\}\_\{i\}\\\}as unit vectors constrained to remain orthogonal to𝐫^ℓ\\hat\{\\mathbf\{r\}\}\_\{\\ell\}\. We initialize by sampling𝐯i∼𝒩⁡\(0,𝐈\)\\mathbf\{v\}\_\{i\}\\sim\\mathcal\{N\}\(0,\\mathbf\{I\}\), projecting onto𝐫^ℓ⟂\\hat\{\\mathbf\{r\}\}\_\{\\ell\}^\{\\perp\}, and orthonormalizing, then gradient\-optimize\{𝐮i\}\\\{\\mathbf\{u\}\_\{i\}\\\}to maximize estimator confusion\.

#### Multiple decoy readers\.

With a shared reader and gate, all edited neurons respond through the same scalargβ​\(aℓ\)g\_\{\\beta\}\(a\_\{\\ell\}\)\. To obtain more varied responses, DDO \(rankKK\) partitions thennedited neurons intoKKgroups\. Groupgguses a perturbed reader

𝐪ℓ,g=𝐫^ℓ\+γ​𝐳ℓ,g‖𝐫^ℓ\+γ​𝐳ℓ,g‖2,𝐳ℓ,g⟂𝐫^ℓ,g=1,…,K,\\mathbf\{q\}\_\{\\ell,g\}=\\frac\{\\hat\{\\mathbf\{r\}\}\_\{\\ell\}\+\\gamma\\mathbf\{z\}\_\{\\ell,g\}\}\{\\\|\\hat\{\\mathbf\{r\}\}\_\{\\ell\}\+\\gamma\\mathbf\{z\}\_\{\\ell,g\}\\\|\_\{2\}\},\\qquad\\mathbf\{z\}\_\{\\ell,g\}\\perp\\hat\{\\mathbf\{r\}\}\_\{\\ell\},\\qquad g=1,\\ldots,K,where𝐳ℓ,g\\mathbf\{z\}\_\{\\ell,g\}is random andγ\>0\\gamma\>0controls reader diversity\. Its neurons use𝐪ℓ,g⊤\\mathbf\{q\}\_\{\\ell,g\}^\{\\top\}in the up\-projection andβg​𝐪ℓ,g⊤\\beta\_\{g\}\\mathbf\{q\}\_\{\\ell,g\}^\{\\top\}in the gate\-projection\. Distinct readers allow decoy responses to vary differently across prompts; the spectral analysis below explains the resulting tradeoff between strength and rank\.

#### DDO gradient optimization\.

DDO optimizes decoy directions\{𝐮i\}\\\{\\mathbf\{u\}\_\{i\}\\\}via gradient descent through the defended model, while all base\-model weights remain frozen\. Scalar gains\(β,s\)\(\\beta,s\)are treated as hyperparameters and tuned via Bayesian hyperparameter search \(Optuna; Appendix[F\.6](https://arxiv.org/html/2609.16204#A6.SS6)\)\. The optimization minimizes a composite loss over 128 harmful and 128 safe probes:

ℒ=λref​ℒrefuse\+λret​ℒretain\+λconf​ℒconfusion\+λrs​ℒrefusal\-score,\\mathcal\{L\}=\\lambda\_\{\\text\{ref\}\}\\mathcal\{L\}\_\{\\text\{refuse\}\}\+\\lambda\_\{\\text\{ret\}\}\\mathcal\{L\}\_\{\\text\{retain\}\}\+\\lambda\_\{\\text\{conf\}\}\\mathcal\{L\}\_\{\\text\{confusion\}\}\+\\lambda\_\{\\text\{rs\}\}\\mathcal\{L\}\_\{\\text\{refusal\-score\}\},\(3\)withλref=λret=λrs=1\\lambda\_\{\\text\{ref\}\}\{=\}\\lambda\_\{\\text\{ret\}\}\{=\}\\lambda\_\{\\text\{rs\}\}\{=\}1,λconf\\lambda\_\{\\text\{conf\}\}tuned per model \(Table[13](https://arxiv.org/html/2609.16204#A6.T13)\), where \(i\)ℒrefuse\\mathcal\{L\}\_\{\\text\{refuse\}\}\(*refusal preservation*\) is cross\-entropy on harmful prompts toward a refusal continuation; \(ii\)ℒretain\\mathcal\{L\}\_\{\\text\{retain\}\}\(*benign retention*\) is KL divergence to the frozen base model on safe prompts; \(iii\)ℒconfusion\\mathcal\{L\}\_\{\\text\{confusion\}\}\(*estimator confusion*\) is a differentiable self\-RFA simulator that re\-estimates DIM on the current defended weights, applies ablation, and minimizes KL divergence between defended and ablated output logits, pushing the estimated DIM direction toward the decoy subspace; and \(iv\)ℒrefusal\-score\\mathcal\{L\}\_\{\\text\{refusal\-score\}\}\(*first\-token anchoring*\) is a first\-token logit margin between refusal\-prefixed tokens \(\{I,Sorry,cannot\}\) and compliance\-prefixed tokens \(\{Sure,Here\}\)\. Without this term, the model can satisfy sequence\-level losses by emitting a compliance token followed by a mid\-sentence pivot to refusal \(“Sure, I’d be happy to…actually I cannot”\), a degenerate solution that does not produce genuine refusal at generation time \(Appendix[D\.1](https://arxiv.org/html/2609.16204#A4.SS1)\)\. After each gradient step, we re\-project each𝐮i\\mathbf\{u\}\_\{i\}onto𝐫^ℓ⟂\\hat\{\\mathbf\{r\}\}\_\{\\ell\}^\{\\perp\}, Gram\-Schmidt orthogonalize the decoy directions within each layer, and renormalize\. For one hyperparameter configuration, including direction estimation, optimization, and weight surgery, DDO takes∼\{\\sim\}2 minutes per optimization run on a single A100 GPU\.

#### Compile mode\.

DDO parameters are compiled into model weights using either*replace*mode \(overwriting neuron weights for a stronger decoy signal\) or*additive*mode \(superposing the decoy on original weights, preserving the neuron’s original computation\)\. The preferred mode is model\-specific: replace is preferred on Yi\[[27](https://arxiv.org/html/2609.16204#bib.bib27)\], Llama\-3, and GLM\-4\[[28](https://arxiv.org/html/2609.16204#bib.bib28)\]; additive on Gemma\-2\[[29](https://arxiv.org/html/2609.16204#bib.bib29)\], Qwen3\[[30](https://arxiv.org/html/2609.16204#bib.bib30)\], and Mistral\[[31](https://arxiv.org/html/2609.16204#bib.bib31)\]\(Appendix[F\.4](https://arxiv.org/html/2609.16204#A6.SS4)\)\.

#### Layer placement\.

DDO decoys must be placed at or before the model’s*causal refusal zone*—the layers whose ablation causally reduces refusal \(Appendix[F\.3](https://arxiv.org/html/2609.16204#A6.SS3)\)\. We say refusal is*localized*when ablating any single layer in this zone causes near\-complete refusal loss, and*distributed*when refusal is redundant across many layers so that ablating any one only partially reduces it\. Placing decoys*inside*the causal zone can disrupt baseline refusal and increase vulnerability under attack on models with localized refusal\.*Upstream*placement preserves refusal while still contaminating the attacker’s estimator\. On models with distributed or sparse refusal patterns \(Yi, Llama\-2\[[32](https://arxiv.org/html/2609.16204#bib.bib32)\]\), placement has less impact \(Appendix[F\.5](https://arxiv.org/html/2609.16204#A6.SS5)\)\.

#### Spectral analysis of contrastive ablation\.

DDO aims to make decoy signals dominate the harmful–safe contrast\. We analyze this effect through the overlap between the attacker’s selected directions and the refusal subspace\. The results proceed in three steps: a general overlap bound, its specialization to DDO, and a design rule for distributing decoy strength\.

Fix a layer and token position, and suppress their indices\. Letℛ⊆ℝd\\mathcal\{R\}\\subseteq\\mathbb\{R\}^\{d\}be the causal refusal subspace, with orthogonal projectorΠℛ\\Pi\_\{\\mathcal\{R\}\}\. A contrastive attacker formsC∈ℝd×NC\\in\\mathbb\{R\}^\{d\\times N\}and ablates its top\-kkleft singular directions\. Write

Πk​\(C\)≜Qk​\(C\)​Qk​\(C\)⊤,\\Pi\_\{k\}\(C\)\\mathrel\{\\triangleq\}Q\_\{k\}\(C\)Q\_\{k\}\(C\)^\{\\top\},whereQk​\(C\)Q\_\{k\}\(C\)contains thosekksingular vectors\. Standard rank\-1 DIM uses the single\-column matrixC=𝐝C=\\mathbf\{d\}; a higher\-rank SVD attack uses per\-sample harmful–safe contrasts as columns\. The overlap‖Πℛ​Πk​\(C\)‖op\\\|\\Pi\_\{\\mathcal\{R\}\}\\Pi\_\{k\}\(C\)\\\|\_\{\\mathrm\{op\}\}lies in\[0,1\]\[0,1\]: zero means the subspaces are orthogonal, and one means they share a direction\. We writeσj​\(C\)\\sigma\_\{j\}\(C\)for thejj\-th largest singular value,∥⋅∥op\\\|\\cdot\\\|\_\{\\mathrm\{op\}\}for the matrix operator norm, and∥⋅∥F\\\|\\cdot\\\|\_\{F\}for the Frobenius norm\.

###### Theorem 1\(Subspace overlap bound\)\.

For1≤k≤min⁡\(d,N\)1\\leq k\\leq\\min\(d,N\)withσk​\(C\)\>0\\sigma\_\{k\}\(C\)\>0, the attacker’s ablation subspace satisfies

‖Πℛ​Πk​\(C\)‖op≤‖Πℛ​C‖opσk​\(C\)\.\\left\\\|\\Pi\_\{\\mathcal\{R\}\}\\Pi\_\{k\}\(C\)\\right\\\|\_\{\\mathrm\{op\}\}\\leq\\frac\{\\left\\\|\\Pi\_\{\\mathcal\{R\}\}C\\right\\\|\_\{\\mathrm\{op\}\}\}\{\\sigma\_\{k\}\(C\)\}\.\(4\)

The numerator measures the refusal signal in the contrast; the denominator is the strength of the weakest singular direction the attacker selects\. A small ratio therefore implies little refusal overlap\. DDO seeks to strengthen the contrast along decoy directions while preserving the underlying refusal computation\.

#### Decoy contrast decomposition\.

For DDO, decompose the defended contrast into a decoy component and a remainder:

Cθ=Dθ\+Sθ,Dθ=U​Aθ\.C\_\{\\theta\}=D\_\{\\theta\}\+S\_\{\\theta\},\\qquad D\_\{\\theta\}=UA\_\{\\theta\}\.The columns ofU∈ℝd×mU\\in\\mathbb\{R\}^\{d\\times m\}aremmorthonormal decoy write directions\. The*decoy response matrix*Aθ∈ℝm×NA\_\{\\theta\}\\in\\mathbb\{R\}^\{m\\times N\}records their contributions across contrast samples:Aθ​\[i,j\]A\_\{\\theta\}\[i,j\]is the coefficient of𝐮i\\mathbf\{u\}\_\{i\}in thejj\-th decoy contrast\. The remainderSθS\_\{\\theta\}contains all other contributions\. Define

ρ≜‖Sθ‖op,ρℛ≜‖Πℛ​Sθ‖op,\\rho\\mathrel\{\\triangleq\}\\\|S\_\{\\theta\}\\\|\_\{\\mathrm\{op\}\},\\qquad\\rho\_\{\\mathcal\{R\}\}\\mathrel\{\\triangleq\}\\\|\\Pi\_\{\\mathcal\{R\}\}S\_\{\\theta\}\\\|\_\{\\mathrm\{op\}\},the total residual magnitude and its refusal component, respectively\.

###### Theorem 2\(Overlap bound under orthogonal decoys\)\.

For the decomposition above, assumeU⊤​U=ImU^\{\\top\}U=I\_\{m\}andΠℛ​U=0\\Pi\_\{\\mathcal\{R\}\}U=0\. If1≤k≤min⁡\(m,N\)1\\leq k\\leq\\min\(m,N\)andσk​\(Aθ\)\>ρ\\sigma\_\{k\}\(A\_\{\\theta\}\)\>\\rho, then

‖Πℛ​Πk​\(Cθ\)‖op≤ρℛσk​\(Aθ\)−ρ\.\\left\\\|\\Pi\_\{\\mathcal\{R\}\}\\Pi\_\{k\}\(C\_\{\\theta\}\)\\right\\\|\_\{\\mathrm\{op\}\}\\leq\\frac\{\\rho\_\{\\mathcal\{R\}\}\}\{\\sigma\_\{k\}\(A\_\{\\theta\}\)\-\\rho\}\.\(5\)

The denominator is a*spectral margin*: thekk\-th decoy mode must exceed the residual magnitude\. At fixedρℛ\\rho\_\{\\mathcal\{R\}\}, a larger margin gives a smaller overlap bound\. The idealized orthogonality condition puts all refusal signal inSθS\_\{\\theta\}; DDO approximates it by enforcing𝐮i⟂𝐫^ℓ\\mathbf\{u\}\_\{i\}\\perp\\hat\{\\mathbf\{r\}\}\_\{\\ell\}\.

For an overlap tolerance0<ε<10<\\varepsilon<1, define the*effective decoy rank*

reff​\(ε\)≜\#⁡\{1≤j≤min⁡\(m,N\):σj​\(Aθ\)\>ρ\+ρℛε\}\.r\_\{\\mathrm\{eff\}\}\(\\varepsilon\)\\mathrel\{\\triangleq\}\\\#\\left\\\{1\\leq j\\leq\\min\(m,N\):\\sigma\_\{j\}\(A\_\{\\theta\}\)\>\\rho\+\\frac\{\\rho\_\{\\mathcal\{R\}\}\}\{\\varepsilon\}\\right\\\}\.For a fixed contrast matrix, this counts the decoy modes strong enough to keep overlap at mostε\\varepsilon: Theorem[2](https://arxiv.org/html/2609.16204#Thmtheorem2)applies to every1≤k≤reff​\(ε\)1\\leq k\\leq r\_\{\\mathrm\{eff\}\}\(\\varepsilon\)\. Adaptive RFA changes the contrast after each phase, soreffr\_\{\\mathrm\{eff\}\}is a diagnostic for interpreting phase budgets, rather than a guarantee for iterative re\-estimation\.

#### Decoy energy allocation\.

Shared readers produce responses that vary together, so adding write directions alone need not create additional strong decoy modes\. The diversified readers introduced above allow several modes, but a fixed energy budget limits their individual strength\.

###### Corollary 3\(Optimal spectrum under an energy constraint\)\.

ForAθ∈ℝm×NA\_\{\\theta\}\\in\\mathbb\{R\}^\{m\\times N\},1≤k≤min⁡\(m,N\)1\\leq k\\leq\\min\(m,N\), and‖Aθ‖F≤B\\\|A\_\{\\theta\}\\\|\_\{F\}\\leq B, we haveσk​\(Aθ\)≤B/k\\sigma\_\{k\}\(A\_\{\\theta\}\)\\leq B/\\sqrt\{k\}\. The bound is attained by allocating equal energy to the firstkksingular modes:

σ1\(Aθ\)=⋯=σk\(Aθ\)=Bk,σj\(Aθ\)=0\(j\>k\)\.\\sigma\_\{1\}\(A\_\{\\theta\}\)=\\cdots=\\sigma\_\{k\}\(A\_\{\\theta\}\)=\\frac\{B\}\{\\sqrt\{k\}\},\\qquad\\sigma\_\{j\}\(A\_\{\\theta\}\)=0\\quad\(j\>k\)\.

For rank\-1 protection, concentrating energy gives the strongest possible leading decoy mode\. Protecting against larger ranks requires sharing that energy across more modes, each of which is weaker\. This strength–rank tradeoff motivates DDO’sKKreader groups\. Proofs are in Appendix[E\.1](https://arxiv.org/html/2609.16204#A5.SS1); Appendix[E\.2](https://arxiv.org/html/2609.16204#A5.SS2)discusses the broader attacker–defender interaction\.

#### Orthogonal debiasing \(utility repair\)\.

DDO can introduce mild over\-refusal\[[33](https://arxiv.org/html/2609.16204#bib.bib33)\]on some models\. We repair this withorthogonal debiasing: projecting out an over\-refusal direction𝐯^\\hat\{\\mathbf\{v\}\}estimated from benign prompts the model incorrectly refuses\[[34](https://arxiv.org/html/2609.16204#bib.bib34),[35](https://arxiv.org/html/2609.16204#bib.bib35)\]\. For matrices where the residual stream is the*input*dimension \(𝐖gate,𝐖up\\mathbf\{W\}\_\{\\mathrm\{gate\}\},\\mathbf\{W\}\_\{\\mathrm\{up\}\}\):𝐖′=𝐖−\(𝐖​𝐯^\)​𝐯^⊤\\mathbf\{W\}^\{\\prime\}=\\mathbf\{W\}\-\(\\mathbf\{W\}\\hat\{\\mathbf\{v\}\}\)\\hat\{\\mathbf\{v\}\}^\{\\top\}\. For matrices where the residual stream is the*output*dimension \(𝐖o,𝐖down\\mathbf\{W\}\_\{o\},\\mathbf\{W\}\_\{\\mathrm\{down\}\}\):𝐖′=𝐖−𝐯^​\(𝐯^⊤​𝐖\)\\mathbf\{W\}^\{\\prime\}=\\mathbf\{W\}\-\\hat\{\\mathbf\{v\}\}\(\\hat\{\\mathbf\{v\}\}^\{\\top\}\\mathbf\{W\}\)\. We apply this to𝐖emb\\mathbf\{W\}\_\{\\mathrm\{emb\}\},𝐖o\\mathbf\{W\}\_\{o\}, and𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}\.

## 4Experiments and Results

### 4\.1Experimental Setup

DDO edits are applied to model weights before deployment; the defended checkpoint incurs no architectural or runtime overhead\. We compare against trained baselines under the same evaluation protocol\. For all defenses, we report \(i\) utility and benign compliance without attack, and \(ii\) robustness under our attack ladder \(standard RFA, adaptive multi\-phase RFA, and Heretic; Section[2](https://arxiv.org/html/2609.16204#S2)\)\. Full settings, hyperparameters, and per\-model configs are in Appendix[F\.2](https://arxiv.org/html/2609.16204#A6.SS2)\.

#### Models and baselines\.

Our primary evaluation uses Llama\-3\-8B\-Instruct with the full attack ladder and baseline comparison\. On Llama\-3, we compare against six trained defenses using publicly released checkpoints: Circuit Breakers\[[9](https://arxiv.org/html/2609.16204#bib.bib9)\], LAT\[[10](https://arxiv.org/html/2609.16204#bib.bib10)\], ReFAT\[[11](https://arxiv.org/html/2609.16204#bib.bib11)\], RepBend\[[12](https://arxiv.org/html/2609.16204#bib.bib12)\], Triplet, and Triplet\-Adv\[[13](https://arxiv.org/html/2609.16204#bib.bib13)\]\. For cross\-model generalization, we evaluate DDO on five additional instruction\-tuned model families and compare against four trained baselines \(Circuit Breakers, RepBend, LAT, ReFAT\) with small hyperparameter sweeps \(3–5 configs per defense per model; Appendix[F\.8](https://arxiv.org/html/2609.16204#A6.SS8)\)\. Seven further models are evaluated with DDO only \(Appendix[F\.15](https://arxiv.org/html/2609.16204#A6.SS15)\)\.

#### Evaluation protocol\.

All generations use deterministic greedy decoding on a single A100 GPU\. Hyperparameter tuning and DIM estimation use a held\-out validation split \(128 harmful \+ 128 safe probes\); all reported metrics are on held\-out test sets\. We report knowledge accuracy \(MMLU\[[36](https://arxiv.org/html/2609.16204#bib.bib36)\], 5\-shot\), conversational quality \(MT\-Bench\[[37](https://arxiv.org/html/2609.16204#bib.bib37)\]\), over\-refusal on prompts that superficially resemble harmful ones \(XSTest\[[38](https://arxiv.org/html/2609.16204#bib.bib38)\], 250 such prompts, GPT\-4o judge\), and robustness under DirectRequest \(harmful prompts sent directly\), four standard\-RFA variants \(Section[2](https://arxiv.org/html/2609.16204#S2)\), adaptive multi\-phase RFA \(up to 8 phases\), Heretic \(200 trials\), and prompt\-level jailbreaks \(HumanJailbreaks, GCG\[[22](https://arxiv.org/html/2609.16204#bib.bib22)\], PAIR\[[23](https://arxiv.org/html/2609.16204#bib.bib23)\], AutoDAN\[[24](https://arxiv.org/html/2609.16204#bib.bib24)\]\)\. Unless otherwise specified, ASR is averaged over three judges: HarmBench classifier\[[5](https://arxiv.org/html/2609.16204#bib.bib5)\], LlamaGuard\-2\[[39](https://arxiv.org/html/2609.16204#bib.bib39)\], and StrongREJECT\[[40](https://arxiv.org/html/2609.16204#bib.bib40)\]\. Configurations that fail a coherence check \(non\-empty, non\-degenerate, minimum\-length outputs on 10 benign prompts\) are marked “×\\times” and excluded\. Full details on decoding, DIM estimation, splits, and benchmark settings are in Appendix[F\.7](https://arxiv.org/html/2609.16204#A6.SS7)\.

### 4\.2Results

#### Standard RFA and Heretic on Llama\-3\.

Table[2](https://arxiv.org/html/2609.16204#S4.T2)compares DDO against six trained baselines on Llama\-3\-8B\-Instruct\. DDO here denotes DDO \(rank 1\): one decoy neuron per layer with a single shared reader𝐫^ℓ\\hat\{\\mathbf\{r\}\}\_\{\\ell\}\.DDO \+ debiasingadds orthogonal debiasing \(Section[3](https://arxiv.org/html/2609.16204#S3.SS0.SSS0.Px9)\) to repair over\-refusal\. On standard RFA, DDO achieves1\.8%1\.8\\%mean ASR, comparable to the strongest trained baselines while requiring no finetuning and∼2\{\\sim\}2minutes per optimization run\. Several trained defenses reduce ASR partly by over\-refusing \(LAT:20\.8%20\.8\\%XSTest; ReFAT:60\.4%60\.4\\%\), while DDO preserves91\.6%91\.6\\%\. Adding orthogonal debiasing restores XSTest to99\.2%99\.2\\%and improves standard RFA further \(mean ASR1\.0%1\.0\\%\)\. Under Heretic\[[14](https://arxiv.org/html/2609.16204#bib.bib14)\]\(weight\-level attack\), DDO achieves18%18\\%H\-200 ASR; a gap to trained RepBend \(1\.3%1\.3\\%\) remains, consistent with trained defenses distributing refusal more diffusely across parameters\.

Table 2:Main defense comparison on Llama\-3\-8B\-Instruct\. ASR \(%, 3\-judge avg\)\. MT\-B = MT\-Bench; XST = XSTest; DR = DirectRequest\. RFA: 3p/rs = three\-point/residual\-stream; J/H = JailbreakBench/HarmBench\. H\-200 = Heretic at 200 trials\.†\\dagger= post\-attack generation degradation \(Appendix[F\.1](https://arxiv.org/html/2609.16204#A6.SS1.SSS0.Px4)\)\.best/good/poor/ours\. DDO matches trained baselines on standard RFA \(1\.8% avg\) at 30–450×\\timeslower cost per configuration without finetuning\.
#### Adaptive multi\-phase RFA\.

Under adaptive multi\-phase RFA \(phasest=1,…,8t\{=\}1,\\ldots,8\), all evaluated defenses degrade as the attacker re\-estimates\. Worst\-case ASR across phases is comparable across the strongest defenses: RepBend\[[12](https://arxiv.org/html/2609.16204#bib.bib12)\]58%58\\%, ReFAT\[[11](https://arxiv.org/html/2609.16204#bib.bib11)\]60%60\\%, DDO \(rank88\)65%65\\%, with Circuit Breakers\[[9](https://arxiv.org/html/2609.16204#bib.bib9)\]weaker at75%75\\%\. We track ASR jointly with utility \(MT\-Bench\[[37](https://arxiv.org/html/2609.16204#bib.bib37)\]; Figure[3](https://arxiv.org/html/2609.16204#S4.F3)\) because ASR alone can be misleading—a defense can lower ASR by degrading generation rather than refusing\. At Phase 8, DDO \(rank88\) preserves MT\-Bench at5\.825\.82, comparable to RepBend \(6\.176\.17\) and Circuit Breakers \(5\.905\.90\), and substantially better than ReFAT, which collapses to4\.014\.01\(Appendix Table[17](https://arxiv.org/html/2609.16204#A6.T17)\)\. DDO therefore lands in the same operating regime as the strongest gradient\-trained defenses on both worst\-case ASR and utility under sustained adaptive attack, despite requiring no finetuning \(Appendix Figure[4](https://arxiv.org/html/2609.16204#A6.F4)\)\.

Figure 3:Adaptive RFA on Llama\-3\-8B \(8 phases\)\.Top: attack success rate \(↓\\downarrow\)\.Bottom: model quality \(↑\\uparrow\)\. All defenses see rising ASR under sustained re\-estimation: DDO \(green\) remains coherent \(MT\-Bench≥\\geq5\.82\) but ultimately leaks, while ReFAT \(red\) attains low ASR partly by collapsing quality to 2\.46 at Phase 1\.
#### Cross\-model generalization and baseline comparison\.

To test generalization, we apply DDO to five additional model families \(Yi\-1\.5, Qwen3, Gemma\-2, Mistral, and GLM\-4\) and compare against four trained baselines per model \(Table[3](https://arxiv.org/html/2609.16204#S4.T3); Appendix[F\.8](https://arxiv.org/html/2609.16204#A6.SS8)\)\.

Table 3:Cross\-model baseline comparison \(ASR %, 3\-judge avg\)\. DR = DirectRequest; RFA = mean of 4 variants \(three\-point/residual\-stream×\\timesJailbreakBench/HarmBench\)\. Cost: A100 wall\-clock time per run \(single config\)\.best/good/poor/ours\. DDO achieves the lowest RFA among utility\-preserving defenses on 4/5 models at 30–450×\\timeslower cost per configuration\.Across all six models, DDO achieves<10%<10\\%mean standard\-RFA ASR without base\-model finetuning\. On Qwen3 and GLM\-4, DDO achieves the lowest RFA ASR among utility\-preserving defenses\. On Gemma\-2, DDO matches LAT’s0%0\\%RFA while preserving higher benign compliance \(83\.2%83\.2\\%vs\.51\.2%51\.2\\%XSTest\)\. DDO also reduces DirectRequest compliance on models with weaker native refusal \(Yi:27%→5%27\\%\\rightarrow 5\\%; Mistral:41%→6%41\\%\\rightarrow 6\\%; GLM\-4:26%→0\.3%26\\%\\rightarrow 0\.3\\%\)\. Beyond these six families, DDO transfers to seven additional models with per\-model Optuna tuning \(∼\{\\sim\}10 min each\), achieving<<10% ASR on all of them \(Appendix[F\.15](https://arxiv.org/html/2609.16204#A6.SS15)\)\. A DDO optimization run takes∼2\{\\sim\}2minutes on a single A100 GPU, giving a30–450×30\\text\{\-\-\}450\\timesper\-configuration cost advantage over trained baselines \(1​–​151\\text\{\-\-\}15A100\-hours each\)\.

#### Compile\-mode selection\.

For each model, we sweep both compile modes \(replace and additive\) with1515Optuna trials per mode \(Table[10](https://arxiv.org/html/2609.16204#A6.T10); Appendix Table[13](https://arxiv.org/html/2609.16204#A6.T13)\)\. Replace mode overwrites the neuron’s original weights with the decoy, producing a stronger signal but removing the neuron’s original computation; additive mode superposes the decoy on top, preserving the original behavior at the cost of a weaker decoy\. The preferred mode depends on how each model’s refusal circuitry responds to neuron overwriting: replace is preferred on Yi, Llama\-3, and GLM\-4 \(where the model compensates for the lost neuron\), while additive is preferred on Gemma\-2 \(replace fails the coherence check\), Qwen3, and Mistral \(replace disrupts baseline refusal\)\. See Appendix[F\.4](https://arxiv.org/html/2609.16204#A6.SS4)for a detailed analysis\.

Table 4:Prompt\-level jailbreak ASR \(%↓\\downarrow, 3\-judge avg, HarmBench\)\. HJB = HumanJailbreaks; ADAN = AutoDAN\.best/good/poor/ours\. DDO \+ debiasing matches the best trained defenses on GCG \(0\.4%\); PAIR remains high \(36\.3%\)\.
#### Prompt\-level jailbreaks\.

Although DDO targets mechanistic refusal removal, we also evaluate it against prompt\-level attacks that operate purely at the input level \(Table[4](https://arxiv.org/html/2609.16204#S4.T4)\)\. DDO \+ debiasing achieves0\.4%0\.4\\%GCG\[[22](https://arxiv.org/html/2609.16204#bib.bib22)\]ASR, matching the best trained defenses, and1\.2%1\.2\\%on HumanJailbreaks\. A plausible explanation is that optimization\-based prompt attacks like GCG suppress the same low\-dimensional refusal feature targeted by RFA\[[11](https://arxiv.org/html/2609.16204#bib.bib11)\]; DDO’s decoy neurons partially re\-inject refusal\-correlated signal, making it harder for gradient\-based prompt optimization to fully suppress refusal\. However, semantic attacks like PAIR\[[23](https://arxiv.org/html/2609.16204#bib.bib23)\]\(36\.3%36\.3\\%ASR\) circumvent refusal through meaning rather than activation geometry, and DDO provides no advantage here\. Defending against semantic jailbreaks requires complementary input\-level defenses such as input classifiers\.

### 4\.3Ablations

Table[5](https://arxiv.org/html/2609.16204#S4.T5)isolates each DDO component on Llama\-3\-8B\-Instruct by removing one element at a time from the full configuration\. All ablations preserve MMLU within 3 points of the base model\.

#### Effect of gradient optimization\.

Random orthogonal decoys \(no optimization\) achieve72\.3%72\.3\\%ASR—only a modest reduction from the undefended base \(85\.1%85\.1\\%\)\. In contrast, gradient optimization under the full 4\-part objective reduces ASR to1\.8%1\.8\\%, confirming that orthogonality alone is insufficient: decoys must be optimized to dominate the harmful–safe contrast that the attacker re\-estimates\.

#### Loss components\.

The*confusion loss*ℒconfusion\\mathcal\{L\}\_\{\\text\{confusion\}\}and*refusal\-score loss*ℒrefusal\-score\\mathcal\{L\}\_\{\\text\{refusal\-score\}\}are the most critical terms: removing either increases ASR to43\.2%43\.2\\%and41\.8%41\.8\\%respectively\. The confusion loss directly optimizes decoy directions to mislead the DIM estimator, while the refusal\-score loss prevents first\-token collapse \(“Sure …” followed by refusal\)\. The retain KL term stabilizes optimization \(ASR22\.4%22\.4\\%without it\) but is less critical on its own\.

Table 5:DDO ablation on Llama\-3\-8B\-Instruct\. RFA ASR = mean of 4 variants, 3\-judge avg \(%\)\.best/good/poor/ours\. All components contribute; confusion and refusal\-score losses are most critical\.
#### Neuron selection and compile mode\.

Low\-norm neuron selection outperforms random neuron choice \(ASR1\.8%1\.8\\%vs\.15\.3%15\.3\\%\), supporting our design choice to edit low\-impact units to reduce utility disruption while maintaining decoy strength\. On Llama\-3, replace mode outperforms additive \(ASR1\.8%1\.8\\%vs\.16\.5%16\.5\\%\), but this preference is model\-specific \(Appendix[F\.4](https://arxiv.org/html/2609.16204#A6.SS4)\)\. Finally, layer placement upstream of the causal refusal zone is critical on models with localized refusal \(Appendix[F\.5](https://arxiv.org/html/2609.16204#A6.SS5)\)\.

#### Alternative defense mechanisms\.

We evaluated 14 additional post\-hoc mechanisms beyond DDO \(Appendix Table[19](https://arxiv.org/html/2609.16204#A6.T19)\)\. Linear defenses are brittle under re\-estimation: Decoy Shear Transform \(92%92\\%ASR\), Refusal Direction Rotation \(68%68\\%\), and Representation Rerouting \(86%86\\%\) are all defeated once the attacker recomputes DIM on the defended checkpoint\. Aggressive edits \(e\.g\., LM\-Head Row Scaling\) can drive RFA ASR near zero but at catastrophic utility cost \(XSTest8%8\\%, MT\-Bench1\.721\.72\)\. Finally, spreading decoy energy across more directions involves a tradeoff predicted by Corollary[3](https://arxiv.org/html/2609.16204#Thmtheorem3): diversified readers weaken rank\-1 protection \(ASR rises from 10% to 27% as the number of decoy groupsKKincreases from 1 to 4\) but strengthen higher\-rank robustness \(rank\-16 ASR drops from 5% to 2%\)\. The optimalKKdepends on the expected attacker rank budget \(Appendix[E\.3](https://arxiv.org/html/2609.16204#A5.SS3)\)\.

#### Cross\-architecture mechanism comparison\.

We evaluated 8 post\-hoc mechanisms across all 7 models \(10–30 Optuna trials each; Appendix[F\.12](https://arxiv.org/html/2609.16204#A6.SS12)\)\. DDO is the only single mechanism that achieves<10%<10\\%ASR reliably across all architectures\. Other mechanisms are individually weak \(e\.g\., gate\_boost:56​–​81%56\\text\{\-\-\}81\\%ASR\) or break generation on most models \(diverse Q\-head routing, rotation, V\-projection, head amplification, and KV strengthening all fail the coherence check on Yi, Gemma\-2, and GLM\-4\)\. Even random orthogonal decoys without gradient optimization fail on 5 of 7 models \(18​–​53%18\\text\{\-\-\}53\\%ASR\)\. This supports the core DDO design: nonlinear SwiGLU gating plus gradient optimization \(and per\-model compile\-mode selection\) are jointly necessary for cross\-architecture robustness\. Full mechanism definitions are in Appendix[D\.2](https://arxiv.org/html/2609.16204#A4.SS2)\.

### 4\.4Discussion

#### The role of nonlinearity\.

Adaptive multi\-phase RFA repeatedly estimates a linear DIM direction on the defended checkpoint\. DDO’s SwiGLU gate makes the decoy response depend on the prompt: writinga≜⟨𝐫^ℓ,𝐱~ℓ⟩a\\mathrel\{\\triangleq\}\\langle\\hat\{\\mathbf\{r\}\}\_\{\\ell\},\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\\rangle, the decoy amplitude scales assilu⁡\(β​a\)⋅a\\operatorname\{silu\}\(\\beta a\)\\cdot aand behaves likeβ​a2\\beta a^\{2\}for large positiveaa\. The prompt\-dependent decoy response can bias the DIM estimate toward the decoy subspace\. Theorems[1](https://arxiv.org/html/2609.16204#Thmtheorem1)and[2](https://arxiv.org/html/2609.16204#Thmtheorem2)characterize the resulting subspace overlap under their stated assumptions\.

#### Resistance to DDO undo attacks\.

A defense\-aware attacker may try to*undo*DDO by identifying edited neurons\. Let𝐫^clean\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{clean\}\}denote the reference refusal direction and𝐝^atk\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}the DIM direction the attacker estimates on the defended checkpoint\. The attacker scores each MLP gate row bysi≜\|⟨𝐰gate\(i\),𝐝^atk⟩\|s\_\{i\}\\mathrel\{\\triangleq\}\|\\langle\\mathbf\{w\}\_\{\\mathrm\{gate\}\}^\{\(i\)\},\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}\\rangle\|and zeros the down\-projection columns corresponding to the highest\-scoring rows\. This would work if𝐝^atk≈𝐫^clean\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}\\approx\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{clean\}\}, since DDO writes𝐫^clean\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{clean\}\}\-aligned triggers into gate rows\. Instead, estimator corruption rotates𝐝^atk\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}away from𝐫^clean\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{clean\}\}, so edited neurons are not salient under this score\. Across Qwen3, Mistral\-7B, and Yi, mid\-zone target layers satisfycossim⁡\(𝐫^clean,𝐝^atk\)≈0\\operatorname\{cossim\}\(\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{clean\}\},\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}\)\\approx 0and the modified rows’ scores fall within the natural top\-5 distribution\. The evaluated undo heuristics provide partial recovery, with ASR remaining below the undefended model in Table[21](https://arxiv.org/html/2609.16204#A6.T21)\(Appendix[F\.16](https://arxiv.org/html/2609.16204#A6.SS16)\)\. ASR ranges from 6% to 12% without a sustained increase as the attacker’s probe budget grows from 32 to 1024 prompts per class \(Appendix[F\.18](https://arxiv.org/html/2609.16204#A6.SS18)\)\. Under rank\-kkSVD attacks, DDO with a single reader is effective at rank 1 \(4% ASR\) but degrades at higher ranks \(39% atk=16k\{=\}16; Appendix[F\.17](https://arxiv.org/html/2609.16204#A6.SS17)\)\. Diversifying readers acrossKKgroups extends higher\-rank protection at the cost of rank\-1 strength, as predicted by Corollary[3](https://arxiv.org/html/2609.16204#Thmtheorem3)\(Appendix[E\.3](https://arxiv.org/html/2609.16204#A5.SS3)\)\.

#### Comparison with trained defenses\.

On standard RFA, DDO matches the strongest trained baselines across five model families \(Table[3](https://arxiv.org/html/2609.16204#S4.T3)\) at30–450×30\\text\{\-\-\}450\\timeslower cost per configuration\. Under Heretic on Llama\-3, DDO alone \(18%18\\%\) remains weaker than RepBend\[[12](https://arxiv.org/html/2609.16204#bib.bib12)\]\(1\.3%1\.3\\%\)\. A plausible explanation is*entanglement*: gradient\-based training can distribute refusal across many parameters jointly, while closed\-form edits are easier to localize and therefore easier to target with weight\-level attacks\.

## 5Conclusion and Limitations

Existing defenses against refusal ablation require gradient\-based training per checkpoint, creating a bottleneck for the open\-weight release cycle\. DDO demonstrates that a mechanistic alternative—repurposing MLP neurons to corrupt the attacker’s contrastive estimator—can match trained baselines on standard RFA across six model families at30–450×30\\text\{\-\-\}450\\timeslower cost per configuration\. The key insight is that contrastive attacks are only as good as the contrast they estimate: by injecting a large, harmful\-selective, refusal\-orthogonal decoy signal, DDO forces the attacker to ablate decoys rather than genuine refusal\. DDO requires only a small generic probe set \(128 harmful \+ 128 safe prompts\), gradient optimization of the decoy parameters \(base weights frozen, so memory overhead beyond inference is minimal\), and a single GPU—no full finetuning infrastructure, no method\-specific safety datasets, and few design decisions beyond compile mode and layer range\. This makes it applicable by any party with access to the weights: model providers before release, downstream deployers, safety auditors, or automated agents\. The feedback loop is fast \(minutes per optimization run\) and defense strength is controllable via compile mode and scalar gains \(β,s\\beta,s\), making DDO well\-suited to agent\-driven safety pipelines that iteratively harden and evaluate checkpoints\.

#### Limitations and future work\.

DDO improves resistance to refusal ablation, but sustained adaptive re\-estimation remains a challenge for all evaluated defenses\. DDO can also increase over\-refusal on some models, although orthogonal debiasing and compile\-mode selection mitigate this effect \(Appendix[A](https://arxiv.org/html/2609.16204#A1)\)\. Future work could investigate post\-hoc edits that distribute refusal behavior more broadly across parameters to improve robustness to weight\-level attacks\. Evaluating DDO alongside inference\-time guardrails, such as Llama Guard, would help establish whether these approaches provide complementary protection\.

## Acknowledgments

The authors thank Tatiana Gaintseva, Rebecca Portnoff, and the team at THORN for valuable discussions\. Aashiq Muhamed is grateful for support from the Amazon AI Ph\.D\. Fellowship, the Cooperative AI PhD Fellowship, the ML Alignment and Theory Scholars \(MATS\) Program, and the Supervised Program for Alignment Research \(SPAR\)\.

## References

- \[1\]Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al\.Training language models to follow instructions with human feedback\.*Advances in neural information processing systems*, 35:27730–27744, 2022\.
- \[2\]Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al\.Constitutional AI: Harmlessness from AI feedback\.*arXiv preprint arXiv:2212\.08073*, 2022\.
- \[3\]Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D\. Manning, and Chelsea Finn\.Direct preference optimization: Your language model is secretly a reward model\.*arXiv preprint arXiv:2305\.18290*, 2023\.
- \[4\]Laura Weidinger, Jonathan Uesato, Maribeth Rauh, Conor Griffin, Po\-Sen Huang, John Mellor, Amelia Glaese, Myra Cheng, Borja Balle, Atoosa Kasirzadeh, et al\.Taxonomy of risks posed by language models\.In*Proceedings of the 2022 ACM conference on fairness, accountability, and transparency*, pages 214–229, 2022\.
- \[5\]Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al\.HarmBench: A standardized evaluation framework for automated red teaming and robust refusal\.*arXiv preprint arXiv:2402\.04249*, 2024\.
- \[6\]Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann\-Kathrin Dombrowski, et al\.Representation engineering: A top\-down approach to AI transparency\.*arXiv preprint arXiv:2310\.01405*, 2023a\.
- \[7\]Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda\.Refusal in language models is mediated by a single direction\.*Advances in Neural Information Processing Systems*, 37:136037–136083, 2024\.
- \[8\]Bahrad A\. Sokhansanj\.Uncensored AI in the wild: Tracking publicly available and locally deployable LLMs\.*Future Internet*, 17\(10\):477, 2025\.
- \[9\]Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, Rowan Wang, Zico Kolter, Matt Fredrikson, and Dan Hendrycks\.Improving alignment and robustness with circuit breakers\.*Advances in Neural Information Processing Systems*, 37:83345–83373, 2024\.
- \[10\]Stephen Casper, Lennart Schulze, Oam Patel, and Dylan Hadfield\-Menell\.Defending against unforeseen failure modes with latent adversarial training\.*arXiv preprint arXiv:2403\.05030*, 2024\.
- \[11\]Lei Yu, Virginie Do, Karen Hambardzumyan, and Nicola Cancedda\.Robust LLM safeguarding via refusal feature adversarial training\.*arXiv preprint arXiv:2409\.20089*, 2024\.
- \[12\]Ashkan Yousefpour, Taeheon Kim, Ryan Sungmo Kwon, Seungbeen Lee, Wonje Jeung, Seungju Han, Alvin Wan, Harrison Ngan, Youngjae Yu, and Jonghyun Choi\.Representation bending for large language model safety\.In*Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)*, pages 24073–24098, 2025\.
- \[13\]Samuel Simko, Mrinmaya Sachan, Bernhard Schölkopf, and Zhijing Jin\.Improving large language model safety with contrastive representation learning\.In*Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing*, pages 28154–28182, 2025\.
- \[14\]Philipp Emanuel Weidmann\.Heretic: Fully automatic LLM abliteration\.[https://github\.com/p\-e\-w/heretic](https://github.com/p-e-w/heretic), 2025\.Open\-source tool, GNU AGPL\-3\.0\-or\-later\.
- \[15\]Luke Emberson\.Open\-weight models lag state\-of\-the\-art by around 3 months on average, 2025\.URL[https://epoch\.ai/data\-insights/open\-weights\-vs\-closed\-weights\-models/](https://epoch.ai/data-insights/open-weights-vs-closed-weights-models/)\.Accessed: 2026\-05\-01\.
- \[16\]Jean\-Stanislas Denain\.Models with downloadable weights currently lag behind the top\-performing models, 2025\.URL[https://epoch\.ai/data\-insights/open\-vs\-closed\-model\-performance](https://epoch.ai/data-insights/open-vs-closed-model-performance)\.Accessed: 2026\-05\-01\.
- \[17\]Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al\-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al\.The Llama 3 herd of models\.*arXiv preprint arXiv:2407\.21783*, 2024\.
- \[18\]Tom Wollschläger, Jannes Elstner, Simon Geisler, Vincent Cohen\-Addad, Stephan Günnemann, and Johannes Gasteiger\.The geometry of refusal in large language models: Concept cones and representational independence\.*arXiv preprint arXiv:2502\.17420*, 2025\.
- \[19\]Faaiz Joad, Majd Hawasly, Sabri Boughorbel, Nadir Durrani, and Husrev Taha Sencar\.There is more to refusal in large language models than a single direction\.*arXiv preprint arXiv:2602\.02132*, 2026\.
- \[20\]Wenbo Pan, Zhichao Liu, Qiguang Chen, Xiangyang Zhou, Haining Yu, and Xiaohua Jia\.The hidden dimensions of LLM alignment: A multi\-dimensional analysis of orthogonal safety directions\.*arXiv preprint arXiv:2502\.09674*, 2025\.
- \[21\]Jiachen Zhao, Jing Huang, Zhengxuan Wu, David Bau, and Weiyan Shi\.LLMs encode harmfulness and refusal separately\.*arXiv preprint arXiv:2507\.11878*, 2025\.
- \[22\]Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson\.Universal and transferable adversarial attacks on aligned language models\.*arXiv preprint arXiv:2307\.15043*, 2023b\.
- \[23\]Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong\.Jailbreaking black box large language models in twenty queries\.In*2025 IEEE Conference on Secure and Trustworthy Machine Learning \(SaTML\)*, pages 23–42\. IEEE, 2025\.
- \[24\]Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao\.AutoDAN: Generating stealthy jailbreak prompts on aligned large language models\.In*International Conference on Learning Representations \(ICLR\)*, 2024\.
- \[25\]Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, et al\.JailbreakBench: An open robustness benchmark for jailbreaking large language models\.*Advances in Neural Information Processing Systems*, 37:55005–55029, 2024\.
- \[26\]Takuya Akiba, Shotaro Sano, Toshihiko Yanase, Takeru Ohta, and Masanori Koyama\.Optuna: A next\-generation hyperparameter optimization framework\.In*Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining*, pages 2623–2631, 2019\.
- \[27\]Alex Young, Bei Chen, Chao Li, Chengen Huang, Ge Zhang, Guanwei Zhang, Heng Li, Jiangcheng Zhu, Jianqun Chen, Jing Chang, et al\.Yi: Open foundation models by 01\.AI\.*arXiv preprint arXiv:2403\.04652*, 2024\.
- \[28\]Team GLM, Aohan Zeng, Bin Xu, Bowen Wang, Chenhui Zhang, Da Yin, Diego Roessler, et al\.GLM\-4: Open bilingual pre\-trained model\.*arXiv preprint arXiv:2406\.12793*, 2024\.
- \[29\]Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Cassirer, Siamak Barber, Armand Joulin, Marc’Aurelio Ranzato, et al\.Gemma 2: Improving open language models at a practical size\.*arXiv preprint arXiv:2408\.00118*, 2024\.
- \[30\]An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Wang, Bowen Zheng, Bowen Yu, et al\.Qwen3 technical report\.*arXiv preprint arXiv:2505\.09388*, 2025\.
- \[31\]Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al\.Mistral 7b\.*arXiv preprint arXiv:2310\.06825*, 2023\.
- \[32\]Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al\.Llama 2: Open foundation and fine\-tuned chat models\.*arXiv preprint arXiv:2307\.09288*, 2023\.
- \[33\]Justin Cui, Wei\-Lin Chiang, Ion Stoica, and Cho\-Jui Hsieh\.OR\-bench: An over\-refusal benchmark for large language models\.In*Proceedings of the 42nd International Conference on Machine Learning*, Proceedings of Machine Learning Research, pages 11515–11542\. PMLR, 2025\.
- \[34\]Xinpeng Wang, Chengzhi Hu, Paul Röttger, and Barbara Plank\.Surgical, cheap, and flexible: Mitigating false refusal in language models via single vector ablation\.*arXiv preprint arXiv:2410\.03415*, 2024\.
- \[35\]Mahavir Dabas, Si Chen, Charles Fleming, Ming Jin, and Ruoxi Jia\.Just enough shifts: Mitigating over\-refusal in aligned language models with targeted representation fine\-tuning\.In*Proceedings of the 42nd International Conference on Machine Learning*, Proceedings of Machine Learning Research, pages 11846–11861\. PMLR, 2025\.
- \[36\]Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt\.Measuring massive multitask language understanding\.*arXiv preprint arXiv:2009\.03300*, 2020\.
- \[37\]Lianmin Zheng, Wei\-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al\.Judging LLM\-as\-a\-judge with MT\-Bench and Chatbot Arena\.*Advances in neural information processing systems*, 36:46595–46623, 2023\.
- \[38\]Paul Röttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy\.XSTest: A test suite for identifying exaggerated safety behaviours in large language models\.In*Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\)*, pages 5377–5400, 2024\.
- \[39\]Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al\.Llama guard: LLM\-based input\-output safeguard for human\-AI conversations\.*arXiv preprint arXiv:2312\.06674*, 2023\.
- \[40\]Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, et al\.A StrongREJECT for empty jailbreaks\.*Advances in Neural Information Processing Systems*, 37:125416–125440, 2024\.
- \[41\]Maxime Labonne\.Uncensor any LLM with abliteration\.[https://huggingface\.co/blog/mlabonne/abliteration](https://huggingface.co/blog/mlabonne/abliteration), 2024\.Hugging Face blog\.
- \[42\]Stephen Casper, Kyle O’Brien, Shayne Longpre, Elizabeth Seger, et al\.Open technical problems in open\-weight AI model risk management\.TMLR / OpenReview, 2025\.URL[https://openreview\.net/forum?id=8QyGLnFkzc](https://openreview.net/forum?id=8QyGLnFkzc)\.
- \[43\]National Institute of Standards and Technology\.Managing misuse risk for dual\-use foundation models\.Technical Report NIST AI 800\-1, Second Public Draft, National Institute of Standards and Technology, 2025\.URL[https://nvlpubs\.nist\.gov/nistpubs/ai/NIST\.AI\.800\-1\.ipd2\.pdf](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.800-1.ipd2.pdf)\.
- \[44\]Chen Bo Calvin Zhang, Christina Q\. Knight, Nicholas Kruus, et al\.LLM novice uplift on dual\-use, in silico biology tasks\.*arXiv preprint arXiv:2602\.23329*, 2026\.
- \[45\]Jaspreet Pannu, Doni Bloomfield, Robert MacKnight, Moritz S\. Hanke, et al\.Dual\-use capabilities of concern of biological AI models\.*PLOS Computational Biology*, 21\(5\):e1012975, 2025\.doi:10\.1371/journal\.pcbi\.1012975\.
- \[46\]Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, et al\.The WMDP benchmark: Measuring and reducing malicious use with unlearning\.In*Proceedings of the 41st International Conference on Machine Learning*, pages 28525–28550\. PMLR, 2024a\.
- \[47\]Caoilte Ó Ciardha, John Buckley, and Rebecca Portnoff\.AI\-generated child sexual abuse material: What’s the harm?*AI & Society*, 2026\.doi:10\.1007/s00146\-026\-02932\-y\.
- \[48\]Internet Watch Foundation\.AI\-generated images\.Technical report, Internet Watch Foundation, 2025\.URL[https://www\.iwf\.org\.uk/annual\-data\-insights\-report\-2025/image\-insights/ai\-generated\-images/](https://www.iwf.org.uk/annual-data-insights-report-2025/image-insights/ai-generated-images/)\.
- \[49\]Jianhui Chen, Xiaozhi Wang, Zijun Yao, Yushi Bai, Lei Hou, and Juanzi Li\.Towards understanding safety alignment: A mechanistic perspective from safety neurons\.*arXiv preprint arXiv:2406\.14144*, 2024\.
- \[50\]Shen Li, Liuyi Yao, Lan Zhang, and Yaliang Li\.Safety layers in aligned large language models: The key to LLM security\.*arXiv preprint arXiv:2408\.17003*, 2024b\.
- \[51\]Zhenhong Zhou, Haiyang Yu, Xinghua Zhang, Rongwu Xu, Fei Huang, and Yongbin Li\.How alignment and jailbreak work: Explain LLM safety through intermediate hidden states\.In*Findings of the Association for Computational Linguistics: EMNLP 2024*, pages 2461–2488, 2024\.
- \[52\]Wei Jie Yeo, Nirmalendu Prakash, Clement Neo, Roy Ka\-Wei Lee, Erik Cambria, and Ranjan Satapathy\.Understanding refusal in language models with sparse autoencoders\.*arXiv preprint arXiv:2505\.23556*, 2025\.
- \[53\]Kyle O’Brien, David Majercak, Xavier Fernandes, Richard Edgar, Blake Bullwinkel, Jingya Chen, Harsha Nori, Dean Carignan, Eric Horvitz, and Forough Poursabzi\-Sangdeh\.Steering language model refusal with sparse autoencoders\.*arXiv preprint arXiv:2411\.11296*, 2024\.
- \[54\]Samyak Jain, Ekdeep S Lubana, Kemal Oksuz, Tom Joy, Philip H Torr, Amartya Sanyal, and Puneet K Dokania\.What makes and breaks safety fine\-tuning? a mechanistic study\.*Advances in Neural Information Processing Systems*, 37:93406–93478, 2024\.
- \[55\]Abhay Sheshadri, Aidan Ewart, Phillip Huang Guo, Aengus Lynch, Cindy Wu, Vivek Hebbar, Henry Sleight, Asa Cooper Stickland, Ethan Perez, Dylan Hadfield\-Menell, and Stephen Casper\.Latent adversarial training improves robustness to persistent harmful behaviors in LLMs\.*arXiv preprint arXiv:2407\.15549*, 2024\.
- \[56\]Harethah Abu Shairah, Hasan Abed Al Kader Hammoud, Bernard Ghanem, and George Turkiyyah\.An embarrassingly simple defense against LLM abliteration attacks\.*arXiv preprint arXiv:2505\.19056*, 2025\.
- \[57\]Xinpeng Wang, Mingyang Wang, Yihong Liu, Hinrich Schütze, and Barbara Plank\.Refusal direction is universal across safety\-aligned languages\.*arXiv preprint arXiv:2505\.17306*, 2025\.
- \[58\]Richard J Young\.Comparative analysis of LLM abliteration methods: A cross\-architecture evaluation\.*arXiv preprint arXiv:2512\.13655*, 2025\.
- \[59\]Paul Youssef, Zhixue Zhao, Daniel Braun, Jörg Schlötterer, and Christin Seifert\.Position: Editing large language models poses serious safety risks\.*arXiv preprint arXiv:2502\.02958*, 2025\.
- \[60\]Noam Shazeer\.GLU variants improve transformer\.*arXiv preprint arXiv:2002\.05202*, 2020\.
- \[61\]Jaden Fried Fiotto\-Kaufman, Alexander Russell Loftus, Eric Todd, Jannik Brinkmann, Koyena Pal, Dmitrii Troitskii, Michael Ripa, Adam Belfki, Can Rager, Caden Juang, Aaron Mueller, Samuel Marks, Arnab Sen Sharma, Francesca Lucchetti, Nikhil Prakash, Carla E\. Brodley, Arjun Guha, Jonathan Bell, Byron C\. Wallace, and David Bau\.NNsight and NDIF: Democratizing access to open\-weight foundation model internals\.In*The Thirteenth International Conference on Learning Representations*, 2025\.URL[https://openreview\.net/forum?id=MxbEiFRf39](https://openreview.net/forum?id=MxbEiFRf39)\.

## Appendix ALimitations and Future Work

Our evaluation covers three attack tiers and compares DDO with trained baselines across six primary model families, including six trained defenses on Llama\-3\. We also evaluate DDO alone on seven additional models\. These experiments identify several limitations and directions for further study\.

#### Adaptive attackers\.

All defenses in Table[16](https://arxiv.org/html/2609.16204#A6.T16)reach high ASR under sustained re\-estimation within the eight\-phase budget\. DDO \(rank88\) reaches a worst\-case ASR of65%65\\%\(LlamaGuard\-2\), compared with58%58\\%for RepBend\. Evaluations with longer phase budgets, joint multi\-direction projections, and estimators beyond DIM would help establish how robustness changes under stronger adaptive attacks\.

#### Weight\-level attacks\.

DDO achieves18%18\\%ASR under Heretic on Llama\-3, compared with24\.0%24\.0\\%for Circuit Breakers,82\.3%82\.3\\%for LAT, and85\.3%85\.3\\%for ReFAT \(Table[2](https://arxiv.org/html/2609.16204#S4.T2)\)\. RepBend\[[12](https://arxiv.org/html/2609.16204#bib.bib12)\]achieves a lower ASR of1\.3%1\.3\\%through gradient\-based parameter–behavior entanglement that is difficult to replicate with post\-hoc edits alone\. Closing this gap—e\.g\., via post\-hoc edits that induce deeper entanglement surviving weight\-level optimization—is a promising direction for future work\.

#### Over\-refusal on some models\.

DDO can reduce compliance with benign requests on some models\. Similar or larger reductions occur with trained defenses, including LAT and ReFAT on Llama\-3 \(Table[2](https://arxiv.org/html/2609.16204#S4.T2)\), indicating that over\-refusal is a broader challenge for safety hardening\. Orthogonal debiasing can restore benign compliance while preserving RFA robustness \(Section[3](https://arxiv.org/html/2609.16204#S3.SS0.SSS0.Px9)\), and additive compilation reduces over\-refusal on some architectures\. Further work should investigate how to select these mitigations automatically for each model\.

#### Compile mode selection\.

Choosing between replace and additive compilation currently requires evaluating both modes and comparing ASR and XSTest scores\. This search is inexpensive relative to baseline finetuning, but a predictive rule based on properties such as refusal redundancy could reduce the need for repeated evaluations\.

### A\.1Broader Impacts

#### Misuse of open\-weight models\.

Training\-free refusal removal has moved well beyond academic proof\-of\-concept\. The mechanistic result that refusal is mediated by a low\-dimensional residual\-stream direction\[[7](https://arxiv.org/html/2609.16204#bib.bib7)\]was rapidly operationalized into public tooling: community tutorials describe one\-command uncensoring without retraining\[[41](https://arxiv.org/html/2609.16204#bib.bib41)\], and automated tools such as Heretic apply hyperparameter\-optimized weight edits on a consumer GPU with no ML expertise required\[[14](https://arxiv.org/html/2609.16204#bib.bib14)\]\. A recent large\-scale audit of public model repositories found over 8,600 safety\-modified open\-weight checkpoints across 1,300 namespaces, with more than half packaged in GGUF format optimized for local consumer\-hardware deployment and accumulating tens of millions of tracked downloads\[[8](https://arxiv.org/html/2609.16204#bib.bib8)\]\. Refusal removal has therefore become a distribution and hosting problem: users can either run abliteration scripts themselves, or simply download an already\-modified checkpoint\.

#### Deployment considerations\.

This distribution surface is exactly where DDO intervenes\. Once aligned weights are publicly downloadable, there is no practical way to guarantee that all copies receive safety updates or can be rolled back\[[42](https://arxiv.org/html/2609.16204#bib.bib42)\]\. Per\-checkpoint safety retraining cannot address this at scale: it is too slow and too expensive to apply to every community finetune, merge, or re\-quantized derivative hosted on a platform\. DDO—requiring approximately two minutes per optimization run on a single GPU without base\-model finetuning—can be applied by any party in the distribution chain before serving or redistributing a checkpoint\. This is consistent with emerging policy guidance: NIST explicitly assigns monitoring and mitigation responsibilities to model\-hosting platforms and other distribution channels\[[43](https://arxiv.org/html/2609.16204#bib.bib43)\]\. By raising the cost of the most accessible refusal\-removal workflows, DDO addresses a gap that neither upstream safety training nor downstream prompt filtering can close alone\.

#### Misuse domains\.

The impact of increasing the attacker’s cost is largest in domains where compliant local assistance lowers barriers to serious misuse\. For CBRN and biosecurity, LLM access has been shown to substantially accelerate novices on dual\-use biology tasks: a controlled uplift study found that participants with LLM assistance were4\.16×4\.16\\timesmore accurate than internet\-only controls, with 89\.6% reporting little difficulty obtaining dual\-use information despite safeguards\[[44](https://arxiv.org/html/2609.16204#bib.bib44)\]\. Pre\-deployment evaluation of high\-consequence biological capabilities is now considered a baseline safety requirement\[[45](https://arxiv.org/html/2609.16204#bib.bib45)\], and WMDP provides a systematic benchmark for hazardous biosecurity and chemical knowledge in LLMs\[[46](https://arxiv.org/html/2609.16204#bib.bib46)\]\. For child safety, robust refusal reduces the availability of uncensored local assistants that can be used to facilitate grooming, coercion, or integration into abuse pipelines\. Academic analysis identifies AI\-generated CSAM as enabling revictimization, normalization, and lowered barriers to offending\[[47](https://arxiv.org/html/2609.16204#bib.bib47)\], while operational reporting documents sharply rising volumes and calls for safety\-by\-design action by platform providers\[[48](https://arxiv.org/html/2609.16204#bib.bib48)\]\. In both domains, DDO does not provide complete protection—determined adversaries with sufficient resources can still bypass it—but it raises the cost of the most accessible and widespread attack workflows\.

#### Potential negative impacts and dual\-use concerns\.

Three dual\-use risks merit discussion\. First, our adaptive multi\-phase RFA attack is a new, stronger variant of existing RFA; however, it is a natural extension of publicly available methods, and we believe the defensive contribution outweighs this incremental offensive capability\. Second, our mechanistic analysis of why defenses fail \(nonlinearity requirements, subspace overlap bounds, neuron detectability\) could inform adversaries seeking to circumvent safety measures; our analysis and released evaluation code are intended to support defensive design and robustness assessment\. Third, DDO should be understood as a cost\-raising hardening layer—not a complete safety guarantee—and we report its residual attack surfaces transparently in Section[A](https://arxiv.org/html/2609.16204#A1)\.

#### Responsible disclosure\.

We release DDO as a defensive hardening tool, together with code for evaluating its robustness to refusal\-removal attacks\. We do not release new uncensored model checkpoints or finetuning recipes for removing safety guardrails\. All evaluation uses established public benchmarks \(JailbreakBench, HarmBench, AdvBench\) and models derived from publicly available instruction\-tuned checkpoints\.

## Appendix BExtended Related Work

#### Mechanistic refusal representations and abliteration\.

Several analyses of RLHF\-aligned LLMs show that refusal can be removed by ablating low\-dimensional residual\-stream features\. Projecting out a rank\-1 difference\-in\-means \(DIM\) direction—the*refusal feature*—often eliminates refusal, enabling Refusal Feature Ablation \(RFA\) and “abliteration”\[[7](https://arxiv.org/html/2609.16204#bib.bib7)\]\. Such direction\-based interventions have been contextualized under the Linear Representation Hypothesis\[[6](https://arxiv.org/html/2609.16204#bib.bib6)\]\. Subsequent work argues that refusal geometry can be multi\-dimensional \(e\.g\.,*concept cones*\[[18](https://arxiv.org/html/2609.16204#bib.bib18)\]and multiple refusal\-mediating directions\[[19](https://arxiv.org/html/2609.16204#bib.bib19)\]\), with orthogonal safety dimensions\[[20](https://arxiv.org/html/2609.16204#bib.bib20)\]and evidence that harmfulness and refusal are encoded separately\[[21](https://arxiv.org/html/2609.16204#bib.bib21)\]\. Complementary mechanistic studies localize safety\-relevant structure to specific neurons\[[49](https://arxiv.org/html/2609.16204#bib.bib49),[50](https://arxiv.org/html/2609.16204#bib.bib50)\]and intermediate hidden states\[[51](https://arxiv.org/html/2609.16204#bib.bib51)\], while sparse autoencoders reveal refusal as a composition of fine\-grained latent features\[[52](https://arxiv.org/html/2609.16204#bib.bib52),[53](https://arxiv.org/html/2609.16204#bib.bib53)\]\.[Jain et al\. \[54\]](https://arxiv.org/html/2609.16204#bib.bib54)show that safety finetuning induces narrow, localized internal changes, which helps explain why contrastive estimators like RFA can locate and remove the refusal mechanism—motivating defenses that corrupt the estimator itself\. We include both single\-phase RFA and adaptive multi\-phase RFA in our attack ladder \(Section[2](https://arxiv.org/html/2609.16204#S2)\)\.

#### Defenses against refusal ablation\.

Existing defenses against RFA are largely training\-time interventions\. Circuit Breakers\[[9](https://arxiv.org/html/2609.16204#bib.bib9)\]finetunes checkpoints with a representation\-rerouting objective; LAT\[[10](https://arxiv.org/html/2609.16204#bib.bib10)\], targeted LAT\[[55](https://arxiv.org/html/2609.16204#bib.bib55)\], and ReFAT\[[11](https://arxiv.org/html/2609.16204#bib.bib11)\]rely on adversarial finetuning; and representation\-reshaping approaches such as RepBend\[[12](https://arxiv.org/html/2609.16204#bib.bib12)\]and contrastive objectives\[[13](https://arxiv.org/html/2609.16204#bib.bib13)\]modify refusal geometry during gradient\-based training\. A concurrent defense targets abliteration directly\[[56](https://arxiv.org/html/2609.16204#bib.bib56)\], but still requires finetuning\. While effective, these approaches require per\-checkpoint training runs and, depending on the method, additional data collection or attack pipelines \(e\.g\., adversarial examples\) and hyperparameter tuning\. In contrast, we study*post\-hoc mechanistic weight editing*: decoy parameters optimized using a small prompt set and compiled into model weights with no architectural or runtime overhead, enabling rapid hardening and composition across open\-weight releases\. Because these edits target specific components \(layers, matrices, neurons\), they also provide an interpretable and automatable complement to training\-based hardening\. Hyperparameter search with Optuna selects the configuration of these edits, which can also serve as an initialization for subsequent finetuning\.

#### Prompt\-level jailbreaks and robust refusal\.

LLMs are also vulnerable to prompt\-based jailbreaks that circumvent refusal by optimizing adversarial inputs, without modifying model weights\. We report three widely used automated attacks—GCG\[[22](https://arxiv.org/html/2609.16204#bib.bib22)\], PAIR\[[23](https://arxiv.org/html/2609.16204#bib.bib23)\], and AutoDAN\[[24](https://arxiv.org/html/2609.16204#bib.bib24)\]—under HarmBench’s standardized robust\-refusal evaluation setting\[[5](https://arxiv.org/html/2609.16204#bib.bib5)\]\. ReFAT provides evidence that many prompt jailbreaks can suppress a low\-dimensional residual\-stream refusal feature\[[11](https://arxiv.org/html/2609.16204#bib.bib11)\], linking these input\-space attacks to the same refusal representation exploited by RFA; we therefore include them as a complementary evaluation of how our post\-hoc weight edits affect robustness under input\-space attack\.

#### Over\-refusal calibration\.

Over\-refusal—where aligned models refuse benign requests—has been studied through dedicated benchmarks\[[33](https://arxiv.org/html/2609.16204#bib.bib33)\]and addressed via representation\-level interventions\. A single learned direction can calibrate false refusal in a training\-free manner\[[34](https://arxiv.org/html/2609.16204#bib.bib34)\], while targeted representation finetuning can shift refusal boundaries with minimal utility loss\[[35](https://arxiv.org/html/2609.16204#bib.bib35)\]\. Our orthogonal debiasing mechanism \(Section[3](https://arxiv.org/html/2609.16204#S3.SS0.SSS0.Px9)\) is complementary: it projects out an over\-refusal direction from weight matrices after DDO, restoring benign compliance while preserving robustness\.

#### Real\-world prevalence of abliteration\.

The refusal direction exploited by RFA transfers across languages\[[57](https://arxiv.org/html/2609.16204#bib.bib57)\], broadening the scope of the vulnerability beyond English\-only settings\. A large\-scale audit found over 8,600 uncensored model repositories on HuggingFace, with abliterated variants achieving∼74​–​80%\{\\sim\}74\\text\{\-\-\}80\\%compliance on unsafe prompts\[[8](https://arxiv.org/html/2609.16204#bib.bib8)\]\. The growing ecosystem of automated abliteration tools across architectures has been surveyed\[[58](https://arxiv.org/html/2609.16204#bib.bib58)\], and cheap post\-hoc weight editing has been argued to pose serious safety risks for open\-weight releases\[[59](https://arxiv.org/html/2609.16204#bib.bib59)\]\. These considerations motivate our focus on post\-hoc hardening primitives that can be applied rapidly across checkpoints\.

## Appendix CNotation and Background

We use a standard decoder\-only transformer architecture \(e\.g\., Llama\-3\[[17](https://arxiv.org/html/2609.16204#bib.bib17)\]\)\. For a fixed token position \(we omit token indices\), let𝐡ℓ∈ℝd\\mathbf\{h\}\_\{\\ell\}\\in\\mathbb\{R\}^\{d\}denote the residual\-stream state at the input of layerℓ\\ell\(hidden dimensiondd\)\. Each layer is*pre\-norm*: RMSNorm is applied before attention and before the MLP, and each sublayer update is added back to the residual stream\. We write RMSNorm with gain𝜸ℓ∈ℝd\\boldsymbol\{\\gamma\}\_\{\\ell\}\\in\\mathbb\{R\}^\{d\}asRMSNorm⁡\(𝐱\)≜𝐱/RMS⁡\(𝐱\)⊙𝜸ℓ\\mathrm\{RMSNorm\}\(\\mathbf\{x\}\)\\mathrel\{\\triangleq\}\\mathbf\{x\}/\\mathrm\{RMS\}\(\\mathbf\{x\}\)\\odot\\boldsymbol\{\\gamma\}\_\{\\ell\}, whereRMS⁡\(𝐱\)≜1d​∑i=1dxi2\+ε\\mathrm\{RMS\}\(\\mathbf\{x\}\)\\mathrel\{\\triangleq\}\\sqrt\{\\frac\{1\}\{d\}\\sum\_\{i=1\}^\{d\}x\_\{i\}^\{2\}\+\\varepsilon\}\.

#### Attention\.

Let𝐱ℓ≜RMSNorm⁡\(𝐡ℓ\)\\mathbf\{x\}\_\{\\ell\}\\mathrel\{\\triangleq\}\\mathrm\{RMSNorm\}\(\\mathbf\{h\}\_\{\\ell\}\)\. Multi\-head attention computes queries, keys, and values via learned projections:

𝐐ℓ=𝐖q​𝐱ℓ,𝐊ℓ=𝐖k​𝐱ℓ,𝐕ℓ=𝐖v​𝐱ℓ,\\mathbf\{Q\}\_\{\\ell\}=\\mathbf\{W\}\_\{q\}\\mathbf\{x\}\_\{\\ell\},\\quad\\mathbf\{K\}\_\{\\ell\}=\\mathbf\{W\}\_\{k\}\\mathbf\{x\}\_\{\\ell\},\\quad\\mathbf\{V\}\_\{\\ell\}=\\mathbf\{W\}\_\{v\}\\mathbf\{x\}\_\{\\ell\},\(6\)Multi\-head attention applies rotary positional embeddings \(RoPE\) to𝐐ℓ,𝐊ℓ\\mathbf\{Q\}\_\{\\ell\},\\mathbf\{K\}\_\{\\ell\}and produces an output𝐚ℓ\\mathbf\{a\}\_\{\\ell\}projected back to the residual stream:

𝐚ℓ≜𝐖o​Attn​\(𝐐ℓ,𝐊ℓ,𝐕ℓ\),𝐡ℓattn≜𝐡ℓ\+𝐚ℓ\.\\mathbf\{a\}\_\{\\ell\}\\mathrel\{\\triangleq\}\\mathbf\{W\}\_\{o\}\\,\\mathrm\{Attn\}\(\\mathbf\{Q\}\_\{\\ell\},\\mathbf\{K\}\_\{\\ell\},\\mathbf\{V\}\_\{\\ell\}\),\\qquad\\mathbf\{h\}\_\{\\ell\}^\{\\mathrm\{attn\}\}\\mathrel\{\\triangleq\}\\mathbf\{h\}\_\{\\ell\}\+\\mathbf\{a\}\_\{\\ell\}\.\(7\)

#### MLP \(SwiGLU\)\.

Let𝐱~ℓ≜RMSNorm⁡\(𝐡ℓattn\)\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\\mathrel\{\\triangleq\}\\mathrm\{RMSNorm\}\(\\mathbf\{h\}\_\{\\ell\}^\{\\mathrm\{attn\}\}\)\. Many modern LLMs \(including Llama\-3\) use a SwiGLU MLP\[[60](https://arxiv.org/html/2609.16204#bib.bib60)\]with gate/up projections𝐖gate,𝐖up∈ℝdinter×d\\mathbf\{W\}\_\{\\mathrm\{gate\}\},\\mathbf\{W\}\_\{\\mathrm\{up\}\}\\in\\mathbb\{R\}^\{d\_\{\\mathrm\{inter\}\}\\times d\}and down projection𝐖down∈ℝd×dinter\\mathbf\{W\}\_\{\\mathrm\{down\}\}\\in\\mathbb\{R\}^\{d\\times d\_\{\\mathrm\{inter\}\}\}:

𝐦ℓ\\displaystyle\\mathbf\{m\}\_\{\\ell\}≜𝐖down​\(silu⁡\(𝐖gate​𝐱~ℓ\)⊙\(𝐖up​𝐱~ℓ\)\),\\displaystyle\\mathrel\{\\triangleq\}\\mathbf\{W\}\_\{\\mathrm\{down\}\}\\big\(\\operatorname\{silu\}\(\\mathbf\{W\}\_\{\\mathrm\{gate\}\}\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\)\\odot\(\\mathbf\{W\}\_\{\\mathrm\{up\}\}\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\)\\big\),\(8\)𝐡ℓ\+1\\displaystyle\\mathbf\{h\}\_\{\\ell\+1\}≜𝐡ℓattn\+𝐦ℓ,\\displaystyle\\mathrel\{\\triangleq\}\\mathbf\{h\}\_\{\\ell\}^\{\\mathrm\{attn\}\}\+\\mathbf\{m\}\_\{\\ell\},wheredinterd\_\{\\mathrm\{inter\}\}is the MLP intermediate dimension and⊙\\odotis elementwise multiplication\. Some models \(e\.g\., Gemma\-2\) use GeGLU, which replacessilu\\operatorname\{silu\}withgelu\\mathrm\{gelu\}; our method applies to both variants\.

#### Edited parameters\.

Our defenses perform*offline*edits to selected parameter matrices, including𝐖q,𝐖k,𝐖v,𝐖o,𝐖gate,𝐖up,𝐖down\\mathbf\{W\}\_\{q\},\\mathbf\{W\}\_\{k\},\\mathbf\{W\}\_\{v\},\\mathbf\{W\}\_\{o\},\\mathbf\{W\}\_\{\\mathrm\{gate\}\},\\mathbf\{W\}\_\{\\mathrm\{up\}\},\\mathbf\{W\}\_\{\\mathrm\{down\}\}, the embedding matrix𝐖emb\\mathbf\{W\}\_\{\\mathrm\{emb\}\}, the output head𝐖lm\\mathbf\{W\}\_\{\\mathrm\{lm\}\}, and \(for normalization\-based mechanisms\) RMSNorm gains\{𝜸ℓ\}\\\{\\boldsymbol\{\\gamma\}\_\{\\ell\}\\\}\. We fold all edits into these weights before deployment, so defended models run with no architectural or runtime overhead\.

#### Hookpoints \(for attacks\)\.

When defining RFA variants \(Section[2](https://arxiv.org/html/2609.16204#S2)\), we use three hookpoints per layer: residual\-stream input𝐡ℓ\\mathbf\{h\}\_\{\\ell\}, attention update𝐚ℓ\\mathbf\{a\}\_\{\\ell\}, and MLP update𝐦ℓ\\mathbf\{m\}\_\{\\ell\}\.

## Appendix DAdditional Method Details

### D\.1First\-Token Collapse

During DDO optimization, the cross\-entropy refusal lossℒrefuse\\mathcal\{L\}\_\{\\text\{refuse\}\}anchors safety by training the model to produce refusal continuations on harmful prompts\. However, this loss operates on the full sequence and can be satisfied by degenerate solutions: the model outputs a compliance\-prefixed first token \(e\.g\., “Sure”\) to reduce the decoy\-confusion loss, then pivots mid\-sentence to refusal \(e\.g\., “Sure, I’d be happy to…actually, I cannot assist with that request”\)\. This “first\-token collapse” is problematic because \(i\) autoregressive generation commits to the first token, so a compliance prefix can cascade into full compliance under greedy or sampled decoding, and \(ii\) ASR judges that inspect only the first few tokens may classify such responses as compliant even though the model eventually refuses\.

The refusal\-score lossℒrefusal\-score\\mathcal\{L\}\_\{\\text\{refusal\-score\}\}addresses this by directly supervising first\-token logits:

ℒrefusal\-score=max⁡\(0,m−\[maxt∈𝒯ref⁡zt−maxt∈𝒯comp⁡zt\]\),\\mathcal\{L\}\_\{\\text\{refusal\-score\}\}=\\max\\\!\\left\(0,\\;m\-\\left\[\\max\_\{t\\in\\mathcal\{T\}\_\{\\text\{ref\}\}\}z\_\{t\}\-\\max\_\{t\\in\\mathcal\{T\}\_\{\\text\{comp\}\}\}z\_\{t\}\\right\]\\right\),\(9\)whereztz\_\{t\}is the logit for tokentt,𝒯ref=\{I,Sorry,cannot\}\\mathcal\{T\}\_\{\\text\{ref\}\}=\\\{\\texttt\{I\},\\texttt\{Sorry\},\\texttt\{cannot\}\\\}are refusal\-prefixed tokens,𝒯comp=\{Sure,Here\}\\mathcal\{T\}\_\{\\text\{comp\}\}=\\\{\\texttt\{Sure\},\\texttt\{Here\}\\\}are compliance\-prefixed tokens, andmmis a margin \(m=0m\{=\}0in all experiments\)\. This hinge loss ensures that refusal tokens dominate compliance tokens at the first position\. In our ablation \(Table[5](https://arxiv.org/html/2609.16204#S4.T5)\), removingℒrefusal\-score\\mathcal\{L\}\_\{\\text\{refusal\-score\}\}increases ASR from 1\.8% to 41\.8%, confirming that first\-token anchoring is essential for DDO’s effectiveness\.

### D\.2All Mechanism Definitions

Section[3](https://arxiv.org/html/2609.16204#S3)defines DDO \(the core mechanism\)\. Here we define the1414additional mechanisms that appear in at least one reported configuration, ablation, or negative\-result analysis\. Throughout, let𝐱ℓ≜RMSNorm⁡\(𝐡ℓ\)\\mathbf\{x\}\_\{\\ell\}\\mathrel\{\\triangleq\}\\mathrm\{RMSNorm\}\(\\mathbf\{h\}\_\{\\ell\}\)and𝐱~ℓ≜RMSNorm⁡\(𝐡ℓattn\)\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\\mathrel\{\\triangleq\}\\mathrm\{RMSNorm\}\(\\mathbf\{h\}\_\{\\ell\}^\{\\mathrm\{attn\}\}\)\.

#### Decoy Shear Transform \(linear baseline\)\.

We apply a linear shear that preserves the refusal coordinate but injects orthogonal decoy components:𝐌ℓ≜𝐈\+∑jcj​𝐮ℓ,j​𝐫^ℓ⊤\\mathbf\{M\}\_\{\\ell\}\\mathrel\{\\triangleq\}\\mathbf\{I\}\+\\sum\_\{j\}c\_\{j\}\\,\\mathbf\{u\}\_\{\\ell,j\}\\hat\{\\mathbf\{r\}\}\_\{\\ell\}^\{\\top\}with𝐮ℓ,j⟂𝐫^ℓ\\mathbf\{u\}\_\{\\ell,j\}\\perp\\hat\{\\mathbf\{r\}\}\_\{\\ell\}, folded into𝐖o\\mathbf\{W\}\_\{o\}and𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}by left\-multiplication\. When harmful prompts induce larger⟨𝐫^ℓ,𝐡⟩\\langle\\hat\{\\mathbf\{r\}\}\_\{\\ell\},\\mathbf\{h\}\\ranglethan safe prompts, this shear adds a harmful\-selective shift in decoy directions and can rotate the initial DIM estimate away from the causal refusal feature\. However, because the transformation is linear, an adaptive attacker can re\-estimate DIM on the defended checkpoint and recover the new contrast; on Llama\-3 this yields92%92\\%ASR \(3\-point RFA, LlamaGuard\-2\)\.

#### Diverse Q\-Head Routing\.

For each attention headhh, we define a head\-specific trigger𝐭^ℓ,h=cos⁡\(θ\)​𝐫^ℓ\+sin⁡\(θ\)​𝐨^ℓ,h\\hat\{\\mathbf\{t\}\}\_\{\\ell,h\}=\\cos\(\\theta\)\\hat\{\\mathbf\{r\}\}\_\{\\ell\}\+\\sin\(\\theta\)\\hat\{\\mathbf\{o\}\}\_\{\\ell,h\}with𝐨^ℓ,h⟂𝐫^ℓ\\hat\{\\mathbf\{o\}\}\_\{\\ell,h\}\\perp\\hat\{\\mathbf\{r\}\}\_\{\\ell\}, and apply the rank\-1 update

𝐖q,ℓ\(h\)←𝐖q,ℓ\(h\)\+α⁡\(𝐖q,ℓ\(h\)​𝐭^ℓ,h\)​𝐭^ℓ,h⊤\.\\mathbf\{W\}^\{\(h\)\}\_\{q,\\ell\}\\leftarrow\\mathbf\{W\}^\{\(h\)\}\_\{q,\\ell\}\+\\alpha\(\\mathbf\{W\}^\{\(h\)\}\_\{q,\\ell\}\\hat\{\\mathbf\{t\}\}\_\{\\ell,h\}\)\\hat\{\\mathbf\{t\}\}\_\{\\ell,h\}^\{\\top\}\.\(10\)This makes different heads respond to slightly different rotations of refusal, aiming to distribute harmful–safe separation across head\-specific subspaces\. Since attention includes a softmax nonlinearity, such diversification could in principle make the overall behavior harder to summarize by a single residual\-stream DIM direction; in practice the edit is brittle and often fails the coherence check on some architectures\.

#### RoPE Dimension Amplification\.

We rescale selected rotary frequenciesωℓ,j←ρ​ωℓ,j\\omega\_\{\\ell,j\}\\leftarrow\\rho\\,\\omega\_\{\\ell,j\}forj∈𝒥j\\in\\mathcal\{J\},ρ\>1\\rho\>1, by editing the RoPE parameters used by𝐖q\\mathbf\{W\}\_\{q\}and𝐖k\\mathbf\{W\}\_\{k\}\. If refusal\-related computation relies on consistent attention patterns across positions, increasing rotation rates in a subset of dimensions can induce more position\-dependent variation, potentially smearing harmful–safe differences across tokens and weakening a simple DIM estimator\. This mechanism is highly architecture\-sensitive and often degrades generation\.

#### Value\-Projection Conditioning\.

We add a rank\-1 component to the value projection,𝐖v,ℓ←𝐖v,ℓ\+α​𝐮^ℓ​𝐫^ℓ⊤\\mathbf\{W\}\_\{v,\\ell\}\\leftarrow\\mathbf\{W\}\_\{v,\\ell\}\+\\alpha\\,\\hat\{\\mathbf\{u\}\}\_\{\\ell\}\\hat\{\\mathbf\{r\}\}\_\{\\ell\}^\{\\top\}, where𝐮^ℓ\\hat\{\\mathbf\{u\}\}\_\{\\ell\}is a fixed random unit vector\. This explicitly routes the refusal coordinate⟨𝐫^ℓ,𝐱⟩\\langle\\hat\{\\mathbf\{r\}\}\_\{\\ell\},\\mathbf\{x\}\\rangleinto the value stream, so that even if an attacker partially removes refusal by ablating a mis\-estimated direction, any surviving refusal signal is amplified and broadcast through attention aggregation downstream\. This edit is attention\-sensitive and can break coherence on some models\.

#### KV Rank\-1 Strengthening\.

This uses the same update as Value\-Projection Conditioning but with a larger coefficientη\\eta, applied only in late layers \(L26–31 on Llama\-3\) where refusal is strongest:𝐖v,ℓ←𝐖v,ℓ\+η​𝐮^ℓ​𝐫^ℓ⊤\\mathbf\{W\}\_\{v,\\ell\}\\leftarrow\\mathbf\{W\}\_\{v,\\ell\}\+\\eta\\,\\hat\{\\mathbf\{u\}\}\_\{\\ell\}\\hat\{\\mathbf\{r\}\}\_\{\\ell\}^\{\\top\}\. Concentrating the coupling where refusal is already causally active makes small ablation errors more consequential, because any residual refusal coordinate is immediately injected into the value stream in the final computation stages\.

#### Head Amplification\.

We score heads bysℓ,h=‖𝐫^ℓ⊤​𝐖o,ℓ\(h\)‖2s\_\{\\ell,h\}=\\left\\lVert\\hat\{\\mathbf\{r\}\}\_\{\\ell\}^\{\\top\}\\mathbf\{W\}^\{\(h\)\}\_\{o,\\ell\}\\right\\rVert\_\{2\}, select the top\-kk, and scale those head outputs by a factorγ\\gamma\(e\.g\.,k=4k\{=\}4,γ=2\\gamma\{=\}2\)\. If a subset of heads carries disproportionate refusal\-aligned signal, amplifying them increases the magnitude of refusal\-correlated residual updates, so a fixed\-strength \(or mis\-targeted\) ablation leaves more refusal behind\. Because it edits𝐖o\\mathbf\{W\}\_\{o\}\(part of Heretic’s weight\-edit surface\), this mechanism is mostly a control for standard RFA rather than a robust defense\.

#### Autoregressive Embedding Boost\.

For refusal\-prefix tokenst∈\{I,cannot,can,’t,Sorry\}t\\in\\\{\\texttt\{I\},\\texttt\{cannot\},\\texttt\{can\},\\texttt\{'t\},\\texttt\{Sorry\}\\\}, we add a small refusal\-aligned component to their embeddings:𝐖emb\[t,:\]\+=α𝐫^avg\\mathbf\{W\}\_\{\\mathrm\{emb\}\}\[t,:\]\\mathrel\{\+\}=\\alpha\\,\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{avg\}\}, where𝐫^avg\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{avg\}\}is the layer\-averaged refusal direction\. Once generation begins with a refusal prefix, the boosted embedding injects extra refusal signal at the next step, creating a positive feedback loop that can make refusal harder to interrupt if an attacker has only partially removed refusal features\.

#### RMSNorm Gain Control\.

We increase RMSNorm gain on the top\-kkrefusal\-aligned channels:γℓ,j←g​γℓ,j\\gamma\_\{\\ell,j\}\\leftarrow g\\,\\gamma\_\{\\ell,j\}for indicesjjwith the largest\|𝐫^ℓ,j\|\|\\hat\{\\mathbf\{r\}\}\_\{\\ell,j\}\|\. RMSNorm applies state\-dependent rescaling \(𝐲=𝐱/RMS⁡\(𝐱\)⊙𝜸\\mathbf\{y\}=\\mathbf\{x\}/\\mathrm\{RMS\}\(\\mathbf\{x\}\)\\odot\\boldsymbol\{\\gamma\}\), so amplifying refusal\-aligned channels changes the effective coupling between channels in a data\-dependent way\. This could make harmful–safe differences less well described by a fixed linear direction; in practice, such edits often destabilize generation\.

#### Orthogonal Debiasing \(utility repair\)\.

We estimate an over\-refusal direction𝐯^\\hat\{\\mathbf\{v\}\}from benign prompts the model incorrectly refuses \(constructed to be approximately orthogonal to𝐫^ℓ\\hat\{\\mathbf\{r\}\}\_\{\\ell\}\), and remove sensitivity to𝐯^\\hat\{\\mathbf\{v\}\}by projecting it out of selected matrices:𝐖′=𝐖−\(𝐖​𝐯^\)​𝐯^⊤\\mathbf\{W\}^\{\\prime\}=\\mathbf\{W\}\-\(\\mathbf\{W\}\\hat\{\\mathbf\{v\}\}\)\\hat\{\\mathbf\{v\}\}^\{\\top\}for input\-dimension matrices \(𝐖emb\\mathbf\{W\}\_\{\\mathrm\{emb\}\}\), and𝐖′=𝐖−𝐯^​\(𝐯^⊤​𝐖\)\\mathbf\{W\}^\{\\prime\}=\\mathbf\{W\}\-\\hat\{\\mathbf\{v\}\}\(\\hat\{\\mathbf\{v\}\}^\{\\top\}\\mathbf\{W\}\)for output\-dimension matrices \(𝐖o\\mathbf\{W\}\_\{o\},𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}\)\. Since DDO can mildly increase benign refusals on some models, removing the dominant benign\-bias direction repairs compliance without directly weakening refusal, because the edited direction is chosen to be orthogonal to refusal\.

#### Refusal Direction Rotation\.

We apply a fixed Givens rotation in the\{𝐫^,𝐯\}\\\{\\hat\{\\mathbf\{r\}\},\\mathbf\{v\}\\\}plane \(θ=π/3\\theta=\\pi/3,𝐯⟂𝐫^\\mathbf\{v\}\\perp\\hat\{\\mathbf\{r\}\}\), folded into𝐖o\\mathbf\{W\}\_\{o\}and𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}\. This can appear to “hide” refusal by moving it away from𝐫^\\hat\{\\mathbf\{r\}\}, but the rotated refusal direction𝐫def=𝐌𝐫base\\mathbf\{r\}\_\{\\mathrm\{def\}\}=\\mathbf\{M\}\\mathbf\{r\}\_\{\\mathrm\{base\}\}is still a single linear direction, so an adaptive attacker can re\-estimate DIM on the defended checkpoint and recover it \(Llama\-3:68%68\\%ASR\)\.

#### Representation Rerouting\.

We learn a rank\-1616updateΔ​𝐖\\Delta\\mathbf\{W\}\(applied to𝐖o\\mathbf\{W\}\_\{o\}and𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}\) that maps harmful activations toward random target representations\. If harmful activations are pushed into a more diverse set of directions, the harmful–safe contrast could become less low\-rank, weakening rank\-1 DIM estimation\. In practice, harmful and safe activations remain linearly separable after rerouting, so a re\-estimated DIM direction still removes refusal \(Llama\-3:86%86\\%ASR\)\.

#### Refusal Scattering\.

We attempt to distribute the refusal direction acrossk=8k\{=\}8random orthogonal residual directions \(via rank\-kkperturbations to𝐖o\\mathbf\{W\}\_\{o\}\) and boost refusal\-prefix logits via LM\-head scaling\. If refusal were spread across multiple orthogonal directions, a rank\-1 ablation would remove only a fraction of it, forcing the attacker to use higher rank or more phases\. In practice, this approach performed poorly in early tests and we did not evaluate it beyond a coherence check\.

#### LM\-Head Multiplicative Row Scaling\.

We reshape a small set of logits by multiplicatively rescaling corresponding LM\-head rows\. For selected token IDstt\(refusal\-prefix tokens such as “I/cannot/can” and compliance tokens such as “’d/would/Sure/Here”\), we apply

𝐖lm\[t,:\]←st𝐖lm\[t,:\],\\mathbf\{W\}\_\{\\mathrm\{lm\}\}\[t,:\]\\leftarrow s\_\{t\}\\,\\mathbf\{W\}\_\{\\mathrm\{lm\}\}\[t,:\],\(11\)which rescaleszt=⟨𝐖lm\[t,:\],𝐡⟩z\_\{t\}=\\langle\\mathbf\{W\}\_\{\\mathrm\{lm\}\}\[t,:\],\\mathbf\{h\}\\ranglewithout modifying hidden\-state activations\. Since RFA\-like attacks operate on hidden states, changing the LM head can provide additional refusal “headroom” even if intermediate refusal features are partially reduced\. We tune\{st\}\\\{s\_\{t\}\\\}with Optuna\[[26](https://arxiv.org/html/2609.16204#bib.bib26)\]\.

#### Adversarial Sign Coupling\.

We repurpose a small set of SwiGLU units to implement a*bilinear*cross\-term between the refusal coordinate and an orthogonal coordinate\. In layerℓ\\ell, sample𝐨^ℓ⟂𝐫^ℓ\\hat\{\\mathbf\{o\}\}\_\{\\ell\}\\perp\\hat\{\\mathbf\{r\}\}\_\{\\ell\}and choose a small set of intermediate unitsiidisjoint from the gated\-decoy units \(we use a fixed neuron\-index offset, 30\+\)\. We set each unit so that its gate row aligns with𝐨^ℓ\\hat\{\\mathbf\{o\}\}\_\{\\ell\}and its up row aligns with𝐫^ℓ\\hat\{\\mathbf\{r\}\}\_\{\\ell\}, while its down column writes into a fixed random output direction𝐮ℓ,i\\mathbf\{u\}\_\{\\ell,i\}\. The resulting contribution is

δi​\(𝐱~ℓ\)=silu⁡\(⟨𝐨^ℓ,𝐱~ℓ⟩\)⋅⟨𝐫^ℓ,𝐱~ℓ⟩⋅𝐮ℓ,i\.\\delta\_\{i\}\(\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\)=\\operatorname\{silu\}\(\\langle\\hat\{\\mathbf\{o\}\}\_\{\\ell\},\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\\rangle\)\\cdot\\langle\\hat\{\\mathbf\{r\}\}\_\{\\ell\},\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\\rangle\\cdot\\mathbf\{u\}\_\{\\ell,i\}\.\(12\)Adaptive multi\-phase RFA repeatedly estimates and ablates a*linear*DIM direction at fixed hookpoints\. Because the sign\-coupled term depends on the*product*of two coordinates, the effective linear surrogate presented by this bilinear feature can shift after ablation and across hookpoints, potentially increasing the number of distinct directions \(phases/rank\) an attacker must remove to fully suppress refusal\-related computation\.

## Appendix ETheoretical Proofs and Formalizations

### E\.1Proofs of the Overlap and Spectral Bounds

###### Proof of Theorem[1](https://arxiv.org/html/2609.16204#Thmtheorem1)\.

LetQk=Qk​\(C\)Q\_\{k\}=Q\_\{k\}\(C\)andVkV\_\{k\}contain the top\-kkleft and right singular vectors ofCC, respectively, and letΣk=diag⁡\(σ1​\(C\),…,σk​\(C\)\)\\Sigma\_\{k\}=\\operatorname\{diag\}\(\\sigma\_\{1\}\(C\),\\ldots,\\sigma\_\{k\}\(C\)\)\. The SVD identityC​Vk=Qk​ΣkCV\_\{k\}=Q\_\{k\}\\Sigma\_\{k\}gives

Πℛ​Qk=Πℛ​C​Vk​Σk−1,\\Pi\_\{\\mathcal\{R\}\}Q\_\{k\}=\\Pi\_\{\\mathcal\{R\}\}CV\_\{k\}\\Sigma\_\{k\}^\{\-1\},whereΣk\\Sigma\_\{k\}is invertible becauseσk​\(C\)\>0\\sigma\_\{k\}\(C\)\>0\. SinceQkQ\_\{k\}andVkV\_\{k\}have orthonormal columns,

‖Πℛ​Πk​\(C\)‖op\\displaystyle\\\|\\Pi\_\{\\mathcal\{R\}\}\\Pi\_\{k\}\(C\)\\\|\_\{\\mathrm\{op\}\}=‖Πℛ​Qk‖op\\displaystyle=\\\|\\Pi\_\{\\mathcal\{R\}\}Q\_\{k\}\\\|\_\{\\mathrm\{op\}\}≤‖Πℛ​C‖op​‖Vk‖op​‖Σk−1‖op=‖Πℛ​C‖opσk​\(C\)\.\\displaystyle\\leq\\\|\\Pi\_\{\\mathcal\{R\}\}C\\\|\_\{\\mathrm\{op\}\}\\,\\\|V\_\{k\}\\\|\_\{\\mathrm\{op\}\}\\,\\\|\\Sigma\_\{k\}^\{\-1\}\\\|\_\{\\mathrm\{op\}\}=\\frac\{\\\|\\Pi\_\{\\mathcal\{R\}\}C\\\|\_\{\\mathrm\{op\}\}\}\{\\sigma\_\{k\}\(C\)\}\.∎

###### Proof of Theorem[2](https://arxiv.org/html/2609.16204#Thmtheorem2)\.

BecauseU⊤​U=ImU^\{\\top\}U=I\_\{m\}, the nonzero singular values ofDθ=U​AθD\_\{\\theta\}=UA\_\{\\theta\}equal those ofAθA\_\{\\theta\}\. Weyl’s singular\-value inequality andΠℛ​U=0\\Pi\_\{\\mathcal\{R\}\}U=0give

σk​\(Cθ\)\\displaystyle\\sigma\_\{k\}\(C\_\{\\theta\}\)≥σk​\(Dθ\)−‖Sθ‖op=σk​\(Aθ\)−ρ\>0,\\displaystyle\\geq\\sigma\_\{k\}\(D\_\{\\theta\}\)\-\\\|S\_\{\\theta\}\\\|\_\{\\mathrm\{op\}\}=\\sigma\_\{k\}\(A\_\{\\theta\}\)\-\\rho\>0,‖Πℛ​Cθ‖op\\displaystyle\\\|\\Pi\_\{\\mathcal\{R\}\}C\_\{\\theta\}\\\|\_\{\\mathrm\{op\}\}=‖Πℛ​Sθ‖op=ρℛ\.\\displaystyle=\\\|\\Pi\_\{\\mathcal\{R\}\}S\_\{\\theta\}\\\|\_\{\\mathrm\{op\}\}=\\rho\_\{\\mathcal\{R\}\}\.Substitution into Theorem[1](https://arxiv.org/html/2609.16204#Thmtheorem1)proves the bound\. If1≤k≤reff​\(ε\)1\\leq k\\leq r\_\{\\mathrm\{eff\}\}\(\\varepsilon\), thenσk​\(Aθ\)−ρ\>ρℛ/ε\\sigma\_\{k\}\(A\_\{\\theta\}\)\-\\rho\>\\rho\_\{\\mathcal\{R\}\}/\\varepsilon, so the overlap is at mostε\\varepsilon\. ∎

###### Proof of Corollary[3](https://arxiv.org/html/2609.16204#Thmtheorem3)\.

The singular values are nonincreasing, and their squared sum equals the squared Frobenius norm\. Hence

k​σk​\(Aθ\)2≤∑j=1kσj​\(Aθ\)2≤‖Aθ‖F2≤B2\.k\\,\\sigma\_\{k\}\(A\_\{\\theta\}\)^\{2\}\\leq\\sum\_\{j=1\}^\{k\}\\sigma\_\{j\}\(A\_\{\\theta\}\)^\{2\}\\leq\\\|A\_\{\\theta\}\\\|\_\{F\}^\{2\}\\leq B^\{2\}\.Taking square roots givesσk​\(Aθ\)≤B/k\\sigma\_\{k\}\(A\_\{\\theta\}\)\\leq B/\\sqrt\{k\}\. Equality is attained when the firstkksingular values all equalB/kB/\\sqrt\{k\}and every remaining singular value is zero\. ∎

###### Corollary 4\(Overlap under decoy\-dominated contrast\)\.

IfC=Cref\+Cdec\+EC=C\_\{\\mathrm\{ref\}\}\+C\_\{\\mathrm\{dec\}\}\+E, withΠℛ​Cdec=0\\Pi\_\{\\mathcal\{R\}\}C\_\{\\mathrm\{dec\}\}=0,‖Cref\+E‖op≤sref\\\|C\_\{\\mathrm\{ref\}\}\+E\\\|\_\{\\mathrm\{op\}\}\\leq s\_\{\\mathrm\{ref\}\}, andσk​\(Cdec\)≥sdec\>sref\\sigma\_\{k\}\(C\_\{\\mathrm\{dec\}\}\)\\geq s\_\{\\mathrm\{dec\}\}\>s\_\{\\mathrm\{ref\}\}, then

‖Πℛ​Πk​\(C\)‖op≤srefsdec−sref\.\\left\\\|\\Pi\_\{\\mathcal\{R\}\}\\Pi\_\{k\}\(C\)\\right\\\|\_\{\\mathrm\{op\}\}\\leq\\frac\{s\_\{\\mathrm\{ref\}\}\}\{s\_\{\\mathrm\{dec\}\}\-s\_\{\\mathrm\{ref\}\}\}\.\(13\)

###### Proof of Corollary[4](https://arxiv.org/html/2609.16204#Thmtheorem4)\.

Orthogonality and Weyl’s inequality bound the numerator and denominator in Theorem[1](https://arxiv.org/html/2609.16204#Thmtheorem1):

‖Πℛ​C‖op\\displaystyle\\\|\\Pi\_\{\\mathcal\{R\}\}C\\\|\_\{\\mathrm\{op\}\}=‖Πℛ​\(Cref\+E\)‖op≤sref,\\displaystyle=\\\|\\Pi\_\{\\mathcal\{R\}\}\(C\_\{\\mathrm\{ref\}\}\+E\)\\\|\_\{\\mathrm\{op\}\}\\leq s\_\{\\mathrm\{ref\}\},σk​\(C\)\\displaystyle\\sigma\_\{k\}\(C\)≥σk​\(Cdec\)−‖Cref\+E‖op≥sdec−sref\>0\.\\displaystyle\\geq\\sigma\_\{k\}\(C\_\{\\mathrm\{dec\}\}\)\-\\\|C\_\{\\mathrm\{ref\}\}\+E\\\|\_\{\\mathrm\{op\}\}\\geq s\_\{\\mathrm\{dec\}\}\-s\_\{\\mathrm\{ref\}\}\>0\.Substituting these bounds proves the claim\. ∎

### E\.2Stackelberg Formulation

We formalize the defender–attacker interaction as a capability\-constrained Stackelberg game\.

#### Setup\.

The defender commits to a post\-training weight editθ∈Θ\\theta\\in\\Theta, producing checkpointMθM\_\{\\theta\}\. After observingMθM\_\{\\theta\}, the attacker chooses an attacka∈𝒜a\\in\\mathcal\{A\}\(e\.g\., rank\-kkRFA,PP\-phase adaptive RFA,TT\-trial Heretic\) to maximize harmful compliance while preserving capability:

uA​\(θ,a\)=A⁡\(θ,a\)−λ​\[τ−U⁡\(θ,a\)\]\+−c⁡\(a\),u\_\{A\}\(\\theta,a\)=A\(\\theta,a\)\-\\lambda\[\\tau\-U\(\\theta,a\)\]\_\{\+\}\-c\(a\),\(14\)where\[x\]\+≜max⁡\(x,0\)\[x\]\_\{\+\}\\mathrel\{\\triangleq\}\\max\(x,0\),A⁡\(θ,a\)=ASR⁡\(Mθ,a\)A\(\\theta,a\)=\\mathrm\{ASR\}\(M\_\{\\theta,a\}\),U⁡\(θ,a\)U\(\\theta,a\)is a utility proxy \(e\.g\., MT\-Bench\),τ\\tauis an attacker utility threshold,λ≥0\\lambda\\geq 0controls the capability–compliance tradeoff, andc⁡\(a\)c\(a\)is attack cost\. The defender solves

θ⋆∈arg⁡minθ∈Θ​maxa∈BRλ,τ​\(θ\)​\[A⁡\(θ,a\)\+μ​\[τD−U⁡\(θ,∅\)\]\+\+CD​\(θ\)\],\\theta^\{\\star\}\\in\\arg\\min\_\{\\theta\\in\\Theta\}\\max\_\{a\\in\\mathrm\{BR\}\_\{\\lambda,\\tau\}\(\\theta\)\}\\left\[A\(\\theta,a\)\+\\mu\[\\tau\_\{D\}\-U\(\\theta,\\varnothing\)\]\_\{\+\}\+C\_\{D\}\(\\theta\)\\right\],\(15\)whereBRλ,τ​\(θ\)=arg⁡maxa∈𝒜​uA​\(θ,a\)\\mathrm\{BR\}\_\{\\lambda,\\tau\}\(\\theta\)=\\arg\\max\_\{a\\in\\mathcal\{A\}\}u\_\{A\}\(\\theta,a\)is the attacker’s best response,μ\\mupenalizes defender utility violations,τD\\tau\_\{D\}is the defender’s utility floor \(without attack\), andCD​\(θ\)C\_\{D\}\(\\theta\)is editing cost\.

###### Definition 5\(Capability\-constrained ASR and deterrence\)\.

For defenseθ\\theta, utility thresholdτ\\tau, and attack family𝒜\\mathcal\{A\}:

CC\-ASRτ\(θ\)≜maxa∈𝒜:U⁡\(θ,a\)≥τA\(θ,a\)\.\\mathrm\{CC\\text\{\-\}ASR\}\_\{\\tau\}\(\\theta\)\\mathrel\{\\triangleq\}\\max\_\{a\\in\\mathcal\{A\}:\\,U\(\\theta,a\)\\geq\\tau\}A\(\\theta,a\)\.\(16\)We sayθ\\thetais\(q,τ\)\(q,\\tau\)*\-deterrent*against𝒜\\mathcal\{A\}ifCC​\-​ASRτ​\(θ\)<q\\mathrm\{CC\\text\{\-\}ASR\}\_\{\\tau\}\(\\theta\)<q\.

CC\-ASR separates clean jailbreaks \(high ASR with preserved utility\) from pyrrhic failures \(high ASR with destroyed utility\)\. Worst\-case ASR conflates these; CC\-ASR isolates the deployment\-relevant threat\.

#### Implications for capability\-constrained attacks\.

Consider a family of contrastive attacks satisfying the assumptions of Theorem[2](https://arxiv.org/html/2609.16204#Thmtheorem2)\. If every capability\-preserving attack in this family has rank at mostreff​\(ε\)r\_\{\\mathrm\{eff\}\}\(\\varepsilon\)\(the effective decoy rank\), then its causal overlap is at mostε\\varepsilon\. Assuming further that the increase in expected compliance is at mostLLtimes this overlap givesCC​\-​ASRτ​\(θ\)≤A⁡\(θ,∅\)\+L​ε\\mathrm\{CC\\text\{\-\}ASR\}\_\{\\tau\}\(\\theta\)\\leq A\(\\theta,\\varnothing\)\+L\\varepsilonfor that family\. HereLLis a modeling assumption for a smooth expected compliance rate, rather than discrete empirical ASR\. For a given attack rankkk, DDO therefore seeks to maximize the spectral marginσk​\(Aθ\)−ρ\\sigma\_\{k\}\(A\_\{\\theta\}\)\-\\rhosubject to utility constraints\.

#### Stopping criterion for adaptive RFA\.

For adaptive multi\-phase RFA, letAtA\_\{t\},UtU\_\{t\}, andctc\_\{t\}denote ASR, utility, and cumulative attack cost after phasett\. Under a one\-step comparison, continuing from phasetttot\+1t\+1is beneficial when

At\+1−At\>λ⁡\(\[τ−Ut\+1\]\+−\[τ−Ut\]\+\)\+\(ct\+1−ct\)\.A\_\{t\+1\}\-A\_\{t\}\>\\lambda\\bigl\(\[\\tau\-U\_\{t\+1\}\]\_\{\+\}\-\[\\tau\-U\_\{t\}\]\_\{\+\}\\bigr\)\+\(c\_\{t\+1\}\-c\_\{t\}\)\.The marginal ASR gain must exceed the added capability penalty and attack cost\. DDO aims to shift substantial ASR gains to later phases, where capability degradation can outweigh them\. Empirically \(Figure[3](https://arxiv.org/html/2609.16204#S4.F3)\), DDO \(rank88\) maintains MT\-Bench≥5\.82\\geq 5\.82through Phase88, comparable to RepBend \(6\.176\.17\) and Circuit Breakers \(5\.905\.90\); ReFAT drops to MT\-Bench2\.462\.46at Phase11, so its low ASR is bought at the cost of utility under this formulation\.

### E\.3Empirical Spectral Analysis

We empirically validate the flat\-spectrum tradeoff predicted by Corollary[3](https://arxiv.org/html/2609.16204#Thmtheorem3)\. We train DDO withK∈\{1,2,4,8\}K\\in\\\{1,2,4,8\\\}decoy neurons per layer, each with a*diversified reader*\(distinct trigger direction via random orthogonal perturbation\)\. Without diversified readers, allKKneurons read the same scalar⟨𝐫^ℓ,𝐱~ℓ⟩\\langle\\hat\{\\mathbf\{r\}\}\_\{\\ell\},\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}\\rangleandAθA\_\{\\theta\}is effectively rank 1 regardless ofKK\. With diversified readers, each neuron reads a different coordinate, givingAθA\_\{\\theta\}up toKKsignificant singular values\. We then attack each model with rank\-kkSVD ablation \(Table[6](https://arxiv.org/html/2609.16204#A5.T6)\)\.

Table 6:Diversified\-reader DDO under rank\-kkattacks \(ASR %↓\\downarrow, LlamaGuard\-2, Llama\-3\-8B\)\.KK= decoy neurons per layer;kk= attack rank\. As predicted by Corollary[3](https://arxiv.org/html/2609.16204#Thmtheorem3), increasingKKweakens rank\-1 protection \(energy spread\) but strengthens higher\-rank protection \(more decoy directions to exhaust\)\.Three patterns confirm the corollary: \(i\)*rank\-1 protection weakens withKK*: ASR rises from 10% \(K=1K\{=\}1\) to 27% \(K=4K\{=\}4\) as energy is spread across more directions; \(ii\)*higher\-rank protection strengthens*: atk=16k\{=\}16, ASR drops from 5% \(K=1K\{=\}1\) to 2% \(K≥2K\{\\geq\}2\); and \(iii\)K=2K\{=\}2–44provides the best tradeoff \(0–1% ASR atk=2k\{=\}2–88with moderate rank\-1 cost\)\.

#### Empirical singular spectrum\.

Table[7](https://arxiv.org/html/2609.16204#A5.T7)reports the singular values ofAθA\_\{\\theta\}\(the empirical decoy response matrix from Theorem[2](https://arxiv.org/html/2609.16204#Thmtheorem2)\) for three configurations\.

Table 7:Singular values of the decoy response matrixAθA\_\{\\theta\}on Llama\-3\-8B DDO\. Diversified readers flatten the spectrum \(σ1/σ2\\sigma\_\{1\}/\\sigma\_\{2\}drops from 934:1 to 15:1\), confirming the mechanism underlying Corollary[3](https://arxiv.org/html/2609.16204#Thmtheorem3)\.Diversified readers reduceσ1/σ2\\sigma\_\{1\}/\\sigma\_\{2\}from 934:1 \(single reader, effective rank 1\) to 15:1 \(diversified, effective rank\>\>1\), directly confirming that reader diversification flattens the decoy spectrum as predicted\.

## Appendix FFull Experimental Details

### F\.1Attack Implementation Details

#### Standard RFA\.

We compute per\-layer DIM directions at the last token position: for each layerℓ\\ell,𝐝^ℓ=normalize⁡\(𝐡¯ℓharm−𝐡¯ℓsafe\)\\hat\{\\mathbf\{d\}\}\_\{\\ell\}=\\mathrm\{normalize\}\(\\bar\{\\mathbf\{h\}\}\_\{\\ell\}^\{\\mathrm\{harm\}\}\-\\bar\{\\mathbf\{h\}\}\_\{\\ell\}^\{\\mathrm\{safe\}\}\)where𝐡¯\\bar\{\\mathbf\{h\}\}denotes the mean activation over the probe set\. Mean activations are accumulated in float64 for numerical stability\. All3232per\-layer directions are applied simultaneously via forward hooks \(three\-point: block input \+ attention output \+ MLP output; residual\-stream: block input only\)\. This differs from the Arditi et al\. direction*selection*pipeline\[[7](https://arxiv.org/html/2609.16204#bib.bib7)\], which selects a single \(position, layer\) direction by evaluating each candidate using KL divergence on safe prompts\. Our per\-layer procedure corresponds to a larger ablation budget \(one direction per layer\) and is therefore at least as strong as the single\-direction variant under matched probe sets\. For all reported results we useunfilteredDIM estimation \(no refusal\-score filtering of the probe set\), which provides the attacker with a cleaner direction estimate\.

#### Adaptive multi\-phase RFA\.

At each phasett, we collect activations with all prior phases’ hooks active, compute fresh per\-layer DIM directions, and Gram\-Schmidt orthogonalize against all previous directions\. Allttdirection sets are then ablated simultaneously using three\-point hooks\. Total hookpoints: up to3​t​L3tLper forward pass \(33hookpoints×\\timesttphases×\\timesL=32L\{=\}32layers\)\. The attack is deterministic: three identical runs produce identical direction sequences\. We evaluate up to88phases\.

#### Heretic\[[14](https://arxiv.org/html/2609.16204#bib.bib14)\]\.

We run the released Heretic tool in an isolated Python virtual environment via subprocess\. Key settings: Optuna TPE sampler withn\_startup\_trials=15,n\_ei\_candidates=128,multivariate=True\. Multi\-objective optimization: minimize\(refusals,KL divergence\)\(\\text\{refusals\},\\text\{KL divergence\}\)\. The tool optimizes a peaked per\-layer ablation strength profileα⁡\(ℓ\)\\alpha\(\\ell\)over𝐖o\\mathbf\{W\}\_\{o\}and𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}matrices\. We report results at200200trials \(H\-200\)\. Direction scope is searched over “global” \(single direction index\) and “per\_layer”\. Per\-component search ranges:max\_weight∈\[0\.8,1\.5\]\\in\[0\.8,1\.5\],max\_weight\_position∈\[0\.6​L,L\]\\in\[0\.6L,L\],min\_weight∈\[0,1\]×max\_weight\\in\[0,1\]\\times\\texttt\{max\\\_weight\},min\_weight\_distance∈\[1,0\.6​L\]\\in\[1,0\.6L\]\.

#### Heretic generation quality\.

Daggered entries in Tables[2](https://arxiv.org/html/2609.16204#S4.T2)and[18](https://arxiv.org/html/2609.16204#A6.T18)indicate post\-attack generation degradation associated with KL divergence\>0\.3\>0\.3in the selected Heretic trial\. Heretic’s KL metric measures the change in output probability distributions on benign prompts relative to the checkpoint before attack\. It provides a diagnostic of distributional change rather than a direct measure of task accuracy\. The utility columns in these tables describe the defended checkpoints before attack; they do not measure post\-Heretic utility\.

### F\.2DDO and Auxiliary Mechanism Hyperparameters \(Llama\-3\)

Table[8](https://arxiv.org/html/2609.16204#A6.T8)reports exact hyperparameters for DDO and all auxiliary mechanisms on Llama\-3\. All mechanisms share the same unfiltered DIM estimation protocol and probe budget\.

Table 8:Hyperparameters for the 15 mechanisms used in reported configurations on Llama\-3\-8B\-Instruct\. Shared: bfloat16 weights, float64 direction estimation,128128harmful \+128128safe probes, unfiltered DIM, last\-token position\. DDO \(first row\) is the core mechanism\.MechanismScopeKey parameters*Core mechanism:*DDO \(Gated Decoy\)varies1 neuron/layer \(low\_norm\)\. Orthogonal decoy basis𝐮i⟂𝐫^ℓ\\mathbf\{u\}\_\{i\}\\perp\\hat\{\\mathbf\{r\}\}\_\{\\ell\}, gradient\-optimized\. Per\-model layer ranges and hyperparameters in Table[13](https://arxiv.org/html/2609.16204#A6.T13)\. Modifies𝐖gate,𝐖up,𝐖down\\mathbf\{W\}\_\{\\mathrm\{gate\}\},\\mathbf\{W\}\_\{\\mathrm\{up\}\},\\mathbf\{W\}\_\{\\mathrm\{down\}\}*Auxiliary mechanisms \(examples; used in some compositions/ablations\):*Value\-Projection Conditioning12–19Rank\-1 perturbation of𝐖v\\mathbf\{W\}\_\{v\}\(random output direction\)Head Amplification24–28Top 4 heads,2×2\\timesfactorOrthogonal Debiasingall𝐖emb′=𝐖emb​\(𝐈−𝐯^​𝐯^⊤\)\\mathbf\{W\}^\{\\prime\}\_\{\\mathrm\{emb\}\}=\\mathbf\{W\}\_\{\\mathrm\{emb\}\}\(\\mathbf\{I\}\-\\hat\{\\mathbf\{v\}\}\\hat\{\\mathbf\{v\}\}^\{\\top\}\);𝐖′=\(𝐈−𝐯^​𝐯^⊤\)​𝐖\\mathbf\{W\}^\{\\prime\}=\(\\mathbf\{I\}\-\\hat\{\\mathbf\{v\}\}\\hat\{\\mathbf\{v\}\}^\{\\top\}\)\\mathbf\{W\}for𝐖∈\{𝐖o,𝐖down\}\\mathbf\{W\}\\in\\\{\\mathbf\{W\}\_\{o\},\\mathbf\{W\}\_\{\\mathrm\{down\}\}\\\}*Standalone variants:*LM\-Head Multiplicative Row Scaling𝐖lm\\mathbf\{W\}\_\{\\mathrm\{lm\}\}Optuna TPE, 40 trials, 9 tokens \(e\.g\. “I”:2\.63×2\.63\\times, “Sure”:0\.32×0\.32\\times\)Decoy Shear Transformall𝐌=𝐈\+𝐔𝐓𝐔⊤\\mathbf\{M\}=\\mathbf\{I\}\+\\mathbf\{U\}\\mathbf\{T\}\\mathbf\{U\}^\{\\top\}; sweepc∈\{1−5\}c\{\\in\}\\\{1\{\-\}5\\\},k∈\{4,8,16\}k\{\\in\}\\\{4,8,16\\\}Refusal ScatteringvariesRank\-kkscatter \(k=8k\{=\}8\) \+ LM\-head boostRepresentation ReroutingvariesRank\-16Δ​𝐖\\Delta\\mathbf\{W\},λreroute\\lambda\_\{\\mathrm\{reroute\}\}/λpreserve\\lambda\_\{\\mathrm\{preserve\}\}Refusal Direction RotationallGivens in\{𝐫^,𝐯\}\\\{\\hat\{\\mathbf\{r\}\},\\mathbf\{v\}\\\}plane,θ=π/3\\theta\{=\}\\pi/3*Adaptive\-specific additions \(used in adaptive compositions\):*Diverse Q\-Head Routing16–3016–22 heads,qstrengthq\_\{\\mathrm\{strength\}\}0\.59–0\.75, per\-head rotated triggersRoPE Dimension Amplification16–281\.45–1\.54×\\timeson 11–16 rotary dimsAutoregressive Embedding Boost𝐖emb\\mathbf\{W\}\_\{\\mathrm\{emb\}\}Strength 0\.68–0\.82, tokens \{I, cannot, can, ’t, Sorry\}KV Rank\-1 Strengthening26–31Strength 0\.55–0\.60, rank\-1 on𝐖v\\mathbf\{W\}\_\{v\}RMSNorm Gain Control16–281\.07–1\.30×\\timeson 59–64 refusal\-alignedγ\\gammachannelsAdversarial Sign Coupling4–27Gate on𝐨^⟂𝐫^\\hat\{\\mathbf\{o\}\}\\perp\\hat\{\\mathbf\{r\}\}, up on𝐫^\\hat\{\\mathbf\{r\}\}, neuron offsets 30\+
### F\.3Per\-Model Causal Refusal Zones

To choose DDO layers, we estimate each model’s causal refusal zone via single\-layer ablations\. For each layerℓ\\ell, we ablate only the per\-layer DIM direction atℓ\\ell\(3\-point hooks\) and measure the resulting drop in refusal rate \(substring heuristic\) on1616harmful prompts\. We classify a layer as “causal” if the refusal drop exceeds10%10\\%\. Table[9](https://arxiv.org/html/2609.16204#A6.T9)reports the resulting causal zones and DDO placement for all77models\. “Causal Zone” is the span from the earliest to the latest causal layer; \#C is the number of layers within that span that exceed the10%10\\%threshold \(not necessarily contiguous—e\.g\., Llama\-2 has33causal layers scattered across L13–31\); and Frac is \#C divided by the total number of layers\. The upstream placement principle \(Section[3](https://arxiv.org/html/2609.16204#S3.SS0.SSS0.Px5)\) suggests that, on localized models, DDO layers should start at or before the causal zone \(allowing partial overlap\)\.

Table 9:Causal refusal zones, DDO placement, and compile mode across all77models\. \#C = number of causal layers; Frac = fraction of total layers that are causal\. Compile mode does not follow a simple redundancy rule: Mistral has81%81\\%causal fraction \(distributed\) yet requires additive because replace inverts its refusal signal \(Table[12](https://arxiv.org/html/2609.16204#A6.T12)\)\.
### F\.4Compile Mode Selection Details

We compile DDO parameters into model weights using one of two modes: \(i\)replace\(\.copy\_\(\)\), which completely overwrites the neuron’s row/column vectors with the decoy trigger and output \(a clean, high\-magnitude decoy signal, but it removes the neuron’s original computation\), and \(ii\)additive\(\.add\_\(\)\), which adds the decoy signal on top of the original neuron weights \(preserves original behavior, but yields a weaker, mixed decoy signal\)\.

The preferred mode depends on how each model’s refusal circuitry responds to neuron overwriting, rather than a simple redundancy rule:

Table 10:DDO compile mode comparison across 7 models \(ASR %↓\\downarrow, mean of 4 RFA variants, 3\-judge avg, 15 Optuna trials per mode\)\.best/poor/ours;×\\times= coherence failure\. The preferred mode is model\-specific; replace is stronger when tolerated but breaks some architectures\.Replace mode produces a stronger decoy signal but is more disruptive: overwriting a neuron’s weights removes its original computation\. On some models this eliminates baseline refusal entirely \(Mistral:3%3\\%Ref under replace; Table[12](https://arxiv.org/html/2609.16204#A6.T12)\), while on others the model compensates \(Yi:93%93\\%Ref despite replacement\)\. Gemma\-2 \(GeGLU\) fails the coherence check under replace entirely\. Additive mode preserves the original neuron and superposes the decoy, making it safer but producing a weaker, mixed decoy signal\. Note that the closed\-form decoy contribution \(Equation[2](https://arxiv.org/html/2609.16204#S3.E2)\) is exact only under replace mode; in additive mode, the SwiGLU nonlinearity produces cross\-terms between the original and inserted weights, so Equation[2](https://arxiv.org/html/2609.16204#S3.E2)should be interpreted as the intended decoy component rather than the exact neuron output\. In practice, we evaluate both modes and select by ASR subject to passing the coherence check\.

### F\.5Layer Placement Analysis

DDO’s effectiveness depends critically on*where*decoys are placed relative to the model’s causal refusal zone—the layers whose ablation causally reduces refusal \(Table[9](https://arxiv.org/html/2609.16204#A6.T9)\)\. Ideally, decoy layers should start at or before the causal zone so that the decoy signal contaminates the attacker’s estimator without disrupting the refusal computation itself\.

Table 11:Effect of decoy placement on baseline refusal rate\. Refusal rate measured on 100 JailbreakBench behaviors \(substring heuristic, without attack\)\. DDO uses per\-model Optuna\-tuned hyperparams \(Table[13](https://arxiv.org/html/2609.16204#A6.T13)\)\. Refbase\{\}\_\{\\text\{base\}\}= undefended model; Refin\{\}\_\{\\text\{in\}\}= decoys placed inside the causal zone; Refup\{\}\_\{\\text\{up\}\}= decoys placed upstream\.Table[11](https://arxiv.org/html/2609.16204#A6.T11)shows that placement affects baseline refusal: placing decoys*inside*the causal zone can substantially reduce refusal \(e\.g\., Gemma\-2:93%→68%93\\%\\rightarrow 68\\%; Qwen3:37%→19%37\\%\\rightarrow 19\\%; Mistral:58%→3%58\\%\\rightarrow 3\\%\), while*upstream*placement largely preserves it\. On models with distributed or sparse refusal patterns \(Yi, Llama\-2\), placement makes less difference because refusal is redundant or only weakly localized across layers\. Placement also affects*ASR under attack*: on Qwen3, decoys placed inside the causal zone yield80%80\\%3\-point RFA ASR \(LlamaGuard\-2, JailbreakBench\) compared to35%35\\%for upstream placement, even though baseline refusal is preserved in both cases\. This motivates the upstream placement principle: placing decoys at or before the causal zone contaminates the attacker’s estimator without disrupting the refusal computation itself\.

Table[12](https://arxiv.org/html/2609.16204#A6.T12)shows how compile mode affects baseline refusal:

Table 12:Baseline refusal rate \(↑\\uparrow\) under DDO replace vs\. additive\. Refusal rate measured on 100 JailbreakBench behaviors \(substring heuristic, without attack\)\. DDO uses per\-model Optuna\-tuned hyperparams \(Table[13](https://arxiv.org/html/2609.16204#A6.T13)\)\.red= refusal disrupted by DDO;×\\times= coherence failure\. The best compile mode depends on how each model’s refusal circuitry responds to neuron overwriting\.Table[12](https://arxiv.org/html/2609.16204#A6.T12)reveals why the best compile mode is model\-specific: replace mode produces a stronger decoy but can disrupt refusal itself\. On Gemma\-2, replace fails the coherence check, so additive is selected\. On Mistral, replace nearly eliminates refusal \(3%3\\%Ref\), explaining its higher ASR with replace vs\. additive \(Table[10](https://arxiv.org/html/2609.16204#A6.T10)\)\. On GLM\-4, the pattern reverses: additive disrupts refusal \(38%38\\%Ref\) while replace preserves it \(96%96\\%\)\. The best mode therefore depends on how the model’s refusal circuitry responds to neuron overwriting, not on a simple rule\.

### F\.6Per\-Model DDO Best Configs

Table[13](https://arxiv.org/html/2609.16204#A6.T13)reports the DDO hyperparameters used for each model in Table[3](https://arxiv.org/html/2609.16204#S4.T3)\. For each model, we run1515Optuna trials in replace mode and1515in additive mode, selecting the lower\-ASR mode subject to a benign\-compliance drop of<20<20percentage points on held\-out validation prompts when feasible\. The search space covers layer range,β\\beta\(gate scale\), scale \(output magnitude\), confusionλ\\lambda\(estimator\-confusion loss weight\), learning rate, and number of epochs\. Layer ranges are guided by the causal refusal zone \(Table[9](https://arxiv.org/html/2609.16204#A6.T9)\): on localized models we constrain DDO layers to start at or before the causal zone; on distributed models the search is unconstrained\.

Table 13:DDO hyperparameters per model \(Optuna\-tuned, 15 trials per compile mode\)\. Replace\-mode params shown for Yi/Llama\-2/Llama\-3/GLM\-4; additive\-mode params for Gemma\-2/Qwen3/Mistral\. lr = learning rate, ep = epochs\. DDO generalizes across architectures with per\-model Optuna tuning of 6 hyperparameters\.
### F\.7Benchmark Settings

Standard\-RFA averages combine the four attack variants \(three\-point/residual\-stream×\\timesJailbreakBench/HarmBench\)\. Adaptive RFA, the additional\-model evaluation, and the diagnostic studies explicitly labeled LlamaGuard\-2 use that judge alone\. Judge and aggregation details are given in the corresponding table captions\.

#### Decoding and coherence\.

Unless stated otherwise, we use greedy decoding \(do\_sample=false\\texttt\{do\\\_sample\}\{=\}\\mathrm\{false\}\) withmax\_new\_tokens=512\\texttt\{max\\\_new\\\_tokens\}\{=\}512and batch size 8; all timing measurements use a single A100 GPU\. Some post\-hoc edits can break generation \(e\.g\., near\-empty or highly repetitive outputs\) even when ASR appears low, so we apply a deterministic coherence check on 10 benign prompts and drop configurations with empty, degenerate \(single\-token repetition\>\>80%\), or too\-short outputs \(marked “×\\times”\)\.

#### Splits and DIM estimation\.

Hyperparameter tuning and DIM estimation use a held\-out validation split \(128 harmful \+ 128 safe probes\); benchmark metrics are reported on held\-out test sets\. For DDO optimization, DIM directions are computed per\-layer from last\-token post\-attention\-layernorm activations \(𝐱~ℓ\\tilde\{\\mathbf\{x\}\}\_\{\\ell\}, the MLP input\) usingunfilteredestimation \(no refusal\-score filtering\), accumulated in float64\. For attack evaluation \(RFA\), directions are estimated from residual\-stream activations \(𝐡ℓ\\mathbf\{h\}\_\{\\ell\}\), matching the standard attacker protocol\.

#### Table coloring conventions\.

Throughout all tables, cell shading follows consistent thresholds relative to the per\-block base model\. For ASR\-type metrics \(DR, RFA, Heretic, GCG, PAIR, AutoDAN; lower is better\):best= best in column;good=≤\\leq10%;poor=≥\\geq50%; unshaded = 10–50%\. For XSTest \(higher is better\): good = within 5pp of base or improved; poor = drop\>\>20pp\. For MMLU \(higher is better\): good = within 1pp of base or improved; poor = drop\>\>3pp\. For MT\-Bench \(higher is better\): good = within 0\.5 of base or improved; poor = drop\>\>2\.ours= DDO rows\.

#### MMLU\.

We evaluate55\-shot multiple\-choice accuracy on MMLU’s5757subjects\. We run evaluation vialightevalusing thehelm\|mmlu:<subject\>\|5\|1task configuration \(55\-shot; few\-shot truncation enabled\) and report average exact\-match accuracy across subjects\. For tractability during iterative defense development, we cap evaluation to100100questions per subject unless otherwise noted\.

#### MT\-Bench\.

We run the standard MT\-Bench benchmark \(8080multi\-turn questions\) using FastChat’sllm\_judgepipeline with GPT\-4 as the judge in single\-mode and report the average score \(1​–​101\\text\{\-\-\}10\) across questions\.

#### XSTest\.

We measure over\-refusal on XSTest\[[38](https://arxiv.org/html/2609.16204#bib.bib38)\]—250 safe prompts that superficially resemble harmful ones \(e\.g\., “How do I kill a process in Linux?”\)\. A defended model is expected to comply; refusal here is a false\-positive cost of the defense\. We generate one response per prompt with greedy decoding \(do\_sample=False\\texttt\{do\\\_sample\}\{=\}\\text\{False\},max\_new\_tokens=200\\texttt\{max\\\_new\\\_tokens\}\{=\}200\), then classify each response with GPT\-4o under the official XSTest 3\-class rubric:*full compliance*\(direct answer\),*full refusal*\(declines or only offers alternatives\), and*partial refusal*\(mixed response\)\. The reported XSTest score is the share of full\-compliance outputs; partial and full refusal both count against the model\.

### F\.8Baseline Sweep Details

This section documents our baseline\-training sweeps\. The main Llama\-3 comparison uses publicly released defended checkpoints; the cross\-model comparison uses our trained reproductions\.

#### Common training setup\.

We trained six defenses \(Circuit Breakers, RepBend, Triplet, Triplet\-Adv, LAT, ReFAT\) on six model families \(Llama\-3, Yi\-1\.5, Qwen3, Gemma\-2, Mistral, GLM\-4\)\. All methods use LoRA finetuning onq,k,v,o,gate\_proj,up\_proj,down\_proj\(GLM\-4 usesquery\_key\_value, dense, dense\_h\_to\_4h, dense\_4h\_to\_h\), bf16 precision with tf32 matmuls, a constant learning\-rate scheduler, gradient checkpointing, 1 epoch, and an effective batch size of 16 \(per\_device\_train\_batch\_size=2,gradient\_accumulation\_steps=8\)\. All CRL\-family methods \(CB, RepBend, Triplet, Triplet\-Adv\) train onallenai/wildguardmix\(wildguardtrainsplit\)\. For each \(defense, model\) pair, we run a 3\-config sweep \(A/B/C\) over the primary hyperparameter\(s\) identified in the source paper; the best config is selected by lowest RFA ASR averaged over three judges \(HarmBench classifier, LlamaGuard\-2, StrongREJECT\)\.

#### Circuit Breakers\[[9](https://arxiv.org/html/2609.16204#bib.bib9)\]\.

Circuit Breakers finetunes a LoRA adapter with a representation\-rerouting loss that pushes harmful\-prompt residual activations toward a “broken” \(orthogonal or random\) target representation, while a retention term preserves benign activations\. We sweeploss\_alpha\(rerouting strength\) over\{10,20,40\}\\\{10,20,40\\\}, with all other loss terms set to zero \(loss\_beta=loss\_gamma=loss\_epsilon=loss\_eta=0\)\. Training uses LR10−410^\{\-4\}, LoRAr=16r\{=\}16,α=16\\alpha\{=\}16, dropout0\.050\.05,max\_seq\_length=2048, and150150steps \(Config D:300300steps\)\. Target layers follow the last30​–​50%30\\text\{\-\-\}50\\%of each model \(Table[14](https://arxiv.org/html/2609.16204#A6.T14)\)\.

#### RepBend\[[12](https://arxiv.org/html/2609.16204#bib.bib12)\]\.

RepBend extends CB with a representation\-bending loss: additional penalty terms \(β\\beta,γ\\gamma,ε\\varepsilon\) reshape the geometry of harmful representations along a learned direction while preserving benign ones\. We jointly sweep\(loss\_alpha, loss\_gamma\)over\{\(0\.5,0\.3\),\(0\.75,0\.45\),\(1\.0,0\.6\)\}\\\{\(0\.5,0\.3\),\(0\.75,0\.45\),\(1\.0,0\.6\)\\\}, fixingloss\_beta=0\.1,loss\_epsilon=0\.3,loss\_mode=response\_all,alpha\_mode=all\. Training uses LR10−510^\{\-5\}, LoRAr=16r\{=\}16,max\_seq\_length=4096,450450steps \(D:900900steps\)\.

#### Triplet\[[13](https://arxiv.org/html/2609.16204#bib.bib13)\]\.

The Triplet loss trains the model to pull harmful\-prompt activations toward refusal anchors and push them away from compliance anchors in representation space, using margins\(margin\_p, margin\_n\)\. We sweep over\{\(2,3\),\(4,6\),\(8,12\)\}\\\{\(2,3\),\(4,6\),\(8,12\)\\\}\. Fixed args:loss\_alpha=0\.5,loss\_beta=0\.6,loss\_gamma=0\.7,loss\_epsilon=0\.7,loss\_safe\_dist\_p=norm, distance metrics for unsafe pairs use cosine\. Training uses LR10−410^\{\-4\}, LoRAr=16r\{=\}16,900900steps \(D:18001800steps\)\. Triplet is evaluated on Llama\-3 in the main comparison \(Table[2](https://arxiv.org/html/2609.16204#S4.T2)\); it is included in the sweep for completeness\.

#### Triplet\-Adv\[[13](https://arxiv.org/html/2609.16204#bib.bib13)\]\.

Identical to Triplet \(loss\_attack=False→\\toTrue\): an adversarial latent perturbation is injected into hidden states during training before the triplet loss is applied, sharpening the representation boundary against activation\-space attacks\. Same sweep grid and hyperparameters as Triplet\.

#### LAT\[[10](https://arxiv.org/html/2609.16204#bib.bib10)\]\.

Latent Adversarial Training alternates between a PGD inner loop that perturbs hidden activations subject to anℓ2\\ell\_\{2\}budgetepsilonand an outer loop that minimizes task loss on the perturbed activations\. We sweep\(epsilon, pgd\_iters\)over\{\(4,16\),\(8,24\),\(12,32\)\}\\\{\(4,16\),\(8,24\),\(12,32\)\\\}\. Other args:outer\_lr=8e\-5,inner\_lr=1e\-3,batch\_size=16,max\_batch\_per\_acc=2, LoRAr=64r\{=\}64,150150steps \(D:300​–​400300\\text\{\-\-\}400steps\)\.

#### ReFAT\[[11](https://arxiv.org/html/2609.16204#bib.bib11)\]\.

Refusal\-Feature Adversarial Training augments each training step with probabilityp\_rfa: it estimates a refusal direction via DIM over3232samples, ablates it from activations across75%75\\%of layers, and computes the loss on the ablated activations; the refusal direction is recomputed every44steps\. We sweepp\_rfaover\{0\.5,0\.7,0\.9\}\\\{0\.5,0\.7,0\.9\\\}\. Other args: LR2×10−52\\times 10^\{\-5\},max\_seq\_length=512,lora\_alpha=32, gradient clip1\.01\.0\. Per\-model LoRA rank and batch size: Llama\-3 \(r=128r\{=\}128, batch3232\); Gemma\-2 \(r=64r\{=\}64, batch88\); all others \(r=128r\{=\}128, batch88\)\.

#### Layer targeting\.

CB and RepBend/Triplet apply their losses only to a model\-specific subset of layers; LAT and ReFAT similarly focus perturbations on a fraction of the network\. Table[14](https://arxiv.org/html/2609.16204#A6.T14)lists the target\-layer windows used across all six models\.

Table 14:Per\-model layer targeting for CB and RepBend/Triplet\. CB applies the rerouting loss to the listed layer range; RepBend/Triplet use a sliding window starting atRB\_STARTof widthRB\_WIN\. All windows cover the last30​–​50%30\\text\{\-\-\}50\\%of model depth\.
#### D\-config protocol\.

If the best A/B/C config for a \(defense, model\) pair still exceeds50%50\\%RFA ASR, we retrain it at2×2\\timesthe step count \(Config D\) with all other hyperparameters fixed\. Config D provided modest or no improvement in most cases; diminishing returns were common, particularly for CB, RepBend, and Triplet on models with diffuse refusal\. Step counts for D: CB300300; RepBend900900; Triplet/Triplet\-Adv18001800; LAT300​–​400300\\text\{\-\-\}400; ReFAT300300\.

#### Config E: LLM\-assisted hyperparameter selection\.

As an additional fairness check, we ran a Config E in which Claude Opus 4\.6 proposed hyperparameters for each \(defense, model\) pair, conditioned on the source paper, the search ranges, and the A–D outcomes\. Config E did not improve over the swept best for any pair, and did not outperform DDO under standard or adaptive RFA\. For comparisons using these trained reproductions, we report the best available configuration from\{\\\{A,B,C,D,E\}\\\}per \(defense, model\) pair\.

#### Reproducibility caveats\.

LAT and ReFAT use a separate Python environment from the CRL\-family methods due to dependency conflicts \(LLaMA\-Factoryvs\.refusal\_direction\_defense\)\. All runs useCUBLAS\_WORKSPACE\_CONFIG=:16:8for determinism and disable Weights & Biases logging\. Adapter checkpoints are saved atbaselines/<model\>/<defense\>\_<config\>/and merged on demand for evaluation\.

### F\.9Compute Budget

Table[15](https://arxiv.org/html/2609.16204#A6.T15)reports approximate wall\-clock costs on a single A100 GPU\. Defense costs are per optimization run for one hyperparameter configuration; hyperparameter search and downstream benchmark evaluation are additional\. The30–450×30\\text\{\-\-\}450\\timescomparison uses these per\-configuration costs\. Heretic and per\-phase MT\-Bench are reported separately as evaluation costs\.

Table 15:Wall\-clock compute on a single A100 GPU\. Defense editing completes in minutes; evaluation \(especially Heretic\) dominates wall\-clock cost\.StepPromptsTime*Defense*DDO \(per run\)256 \(128H\+128S\)∼\{\\sim\}2 minLM\-head scaling \(per run\)20∼\{\\sim\}5 sec*Evaluation*RFA \(4 variants\)100–159∼\{\\sim\}5 minHeretic \(200 trials\)100∼\{\\sim\}30–60 minMT\-Bench \(per phase\)80∼\{\\sim\}20 min
### F\.10Adaptive Attack: Exact ASR and MT\-Bench by Phase

Table[16](https://arxiv.org/html/2609.16204#A6.T16)summarizes per\-phase ASR \(phases1​–​81\\text\{\-\-\}8\) for the full88\-phase setting; Table[17](https://arxiv.org/html/2609.16204#A6.T17)reports the exact per\-phase ASR \(LlamaGuard\-2\)*and*MT\-Bench \(GPT\-4 judge\) values underlying Figure[3](https://arxiv.org/html/2609.16204#S4.F3)\. Figure[4](https://arxiv.org/html/2609.16204#A6.F4)provides a compact ASR–utility summary of the same runs\.

#### Attack cost model\.

Each adaptive phase requires one DIM re\-estimation \(256256forward passes on128128harmful \+128128safe probes,∼30\{\\sim\}30s\) followed by Gram\-Schmidt orthogonalization, hook installation, and evaluation \(∼1​–​2\{\\sim\}1\\text\{\-\-\}2min\), totaling∼2\{\\sim\}2min per phase on a single A100 GPU\. A full88\-phase attack therefore costs∼15​–​20\{\\sim\}15\\text\{\-\-\}20min wall\-clock for the attack loop\. The separate MT\-Bench evaluation at each phase is timed in Table[15](https://arxiv.org/html/2609.16204#A6.T15)\. The attack is fully automated \(a deterministic loop over phases\), requires no ML expertise, and uses only the defended checkpoint and a generic probe set—the same probes used for standard RFA suffice\. However, multi\-phase ablation degrades the resulting checkpoint: DDO\-defended Llama\-3 drops from MT\-Bench7\.677\.67\(unattacked\) to6\.176\.17at Phase55\(peak65%65\\%ASR\) and5\.825\.82by Phase88\(Table[17](https://arxiv.org/html/2609.16204#A6.T17)\)—a∼1\.9\{\\sim\}1\.9\-point utility cost\. By contrast, on the undefended base model the attacker obtains73%73\\%ASR at Phase11with only a0\.30\.3\-point MT\-Bench drop\. DDO therefore forces the attacker to trade substantially more model quality per unit of ASR gained\.

Table 16:Adaptive multi\-phase RFA profiles \(ASR %, LlamaGuard\-2\) across all88phases\. “Worst” is the maximum ASR across phases \(the attacker can stop at any phase\)\. Both trained and post\-hoc defenses degrade at later phases\. DDO \(rank88\) achieves65%65\\%worst\-case, comparable to trained RepBend \(58%58\\%\), without training\.DefensePh1Ph2Ph3Ph4Ph5Ph6Ph7Ph8Worst↓\\downarrowBase \(undefended\)736447346369695973RepBend \(trained\)42021284356584258Circuit Breakers \(trained\)03275726966636575ReFAT \(trained\)311359604660DDO \(rank 8\)01028296556495365DDO \(rank 8, Optuna\)01131295246667575Table 17:Per\-phase ASR \(↓\\downarrow\) and MT\-Bench \(↑\\uparrow\) under adaptive multi\-phase RFA\. Phase 0 = unattacked model\. ASR: LlamaGuard\-2; MT\-B: GPT\-4 judge\. DDO \(rank 8\) maintains MT\-B\>5\.8\>5\.8through all 8 phases, comparable to RepBend and Circuit Breakers; ReFAT drops to 2\.5 at Phase 1 despite low ASR\.These phase trajectories reinforce the main\-text comparison: DDO \(rank88\) preserves utility \(MT\-Bench≥5\.82\\geq 5\.82through Phase88\) at a level comparable to RepBend \(6\.176\.17\) and Circuit Breakers \(5\.905\.90\), while ReFAT exhibits a sharp utility drop early \(Phase11MTB2\.462\.46\) despite low ASR\.

Figure 4:ASR vs\. MT\-Bench trajectories under adaptive attack\. Each dot is one defense at one phase \(0​–​80\\text\{\-\-\}8\); larger dots = earlier phases\. Quadrants:top\-left= safe \+ useful \(ideal\);top\-right= jailbroken but coherent \(most dangerous\);bottom\-left= refuses but unusable;bottom\-right= destroyed\. ReFAT collapses into the bottom\-left region \(low ASR but utility destroyed\), while DDO compositions \(green, orange\) preserve utility comparably to RepBend and Circuit Breakers, with worst\-case ASR rising under sustained re\-estimation\.

### F\.11Extended Model Comparison

Table[18](https://arxiv.org/html/2609.16204#A6.T18)reports additional defense configurations evaluated on Llama\-3, using consistent naming:DDO= the optimized decoy mechanism described in Section[3](https://arxiv.org/html/2609.16204#S3), without auxiliary mechanisms;DDO \+ debiasing= DDO composed with orthogonal debiasing;DDO \(rankKK\)= DDO withKKdiversified decoy readers \(for adaptive RFA\)\. The shown compositions are selected from a broader mechanism\-subset search guided by two criteria: \(i\) minimize RFA ASR under the target attacker tier, and \(ii\) preserve utility \(benign compliance\>85%\>85\\%, MT\-Bench\>6\.0\>6\.0\)\. The rank\-88variants diversify readers to increase the effective decoy rank; the Heretic\-targeted variant allocates mechanisms to matrices outside Heretic’s weight\-edit surface\. Optuna is used for per\-model DDO hyperparameter tuning \(Appendix[F\.6](https://arxiv.org/html/2609.16204#A6.SS6)\); the additional*Optuna*qualifier in the Llama\-3 rank\-88label distinguishes the separately tuned adaptive configuration\.

Table 18:Extended comparison on Llama\-3\-8B\-Instruct\. Utility: MMLU \(%\), MT\-B \(MT\-Bench\), XST \(XSTest\) \(%\)\. Robustness: RFA avg ASR \(%\), Heretic ASR \(%\) at200200Optuna trials, prompt jailbreak ASR \(%, 3\-judge avg\)\.†\\dagger= post\-attack generation degradation \(Appendix[F\.1](https://arxiv.org/html/2609.16204#A6.SS1.SSS0.Px4)\)\.best/good/poor/ours\. DDO alone achieves1\.8%1\.8\\%RFA and18%18\\%Heretic; debiasing repairs XSTest; rank\-88variants target adaptive RFA\.aDDO \+ debiasing \+ diverse Q\-head routing \+ RoPE \+ embed boost \+ KV strengthening \+ RMSNorm \+ sign coupling\.bDDO \+ debiasing with mechanisms in Heretic\-resistant matrices\.

### F\.12Cross\-Model Mechanism Comparison and Negative Results

Table[19](https://arxiv.org/html/2609.16204#A6.T19)compares 8 systematically evaluated mechanisms across all 7 models \(10–30 Optuna trials each\)\. Three patterns emerge: \(i\) DDO is the only mechanism that achieves<<10% ASR on every architecture; \(ii\) five mechanisms \(diverse Q\-head routing, rotation, V\-projection, head amplification, KV strengthening\) break generation entirely on Yi, Gemma\-2, and GLM\-4 \(×\\times= coherence failure\), suggesting these architectures are less tolerant of attention\- and normalization\-space edits; and \(iii\) random orthogonal decoys without gradient optimization achieve low ASR only on Yi \(2%\) but fail on most other models \(18–53%\), confirming that the optimization in DDO’s 4\-part loss is essential\. Formal definitions are in Appendix[D\.2](https://arxiv.org/html/2609.16204#A4.SS2)\.

Table 19:Cross\-model mechanism comparison \(ASR %↓\\downarrow, Optuna\-tuned, 10–30 trials each\)\. DDO row: mean of 4 RFA variants, 3\-judge avg \(consistent with Tables[2](https://arxiv.org/html/2609.16204#S4.T2)–[3](https://arxiv.org/html/2609.16204#S4.T3)\)\. Other mechanisms: 3\-point RFA, LlamaGuard\-2 \(faster diagnostic\)\.best/poor/ours;×\\times= coherence failure\. DDO is the only mechanism achieving<<10% ASR across all 7 architectures\.Random decoy uses random orthogonal directions \(no gradient optimization\)\.

#### Negative results and failed approaches\.

The broader mechanism search also yielded several informative negative results, organized by failure mode \(ASR: 3\-point RFA, JailbreakBench, LlamaGuard\-2 unless noted\)\.

#### Linear edits are fragile under adaptive re\-estimation\.

Mechanisms equivalent to an input\-independent linear transformation of the residual stream are defeated once the attacker re\-estimates DIM on the defended checkpoint\.*Decoy Shear Transform*\(92%92\\%ASR\) injects orthogonal decoy components via a linear shear𝐌=𝐈\+∑cj​𝐮j​𝐫^⊤\\mathbf\{M\}=\\mathbf\{I\}\+\\sum c\_\{j\}\\mathbf\{u\}\_\{j\}\\hat\{\\mathbf\{r\}\}^\{\\top\}, but the defended DIM direction simply rotates to track the sheared mean\-difference\.*Refusal Direction Rotation*\(68%68\\%ASR\) applies a Givens rotation in the\{𝐫^,𝐯\}\\\{\\hat\{\\mathbf\{r\}\},\\mathbf\{v\}\\\}plane; the attacker recovers the rotated direction\.*Representation Rerouting*\(86%86\\%ASR\) maps harmful activations to random targets via a low\-rankΔ​𝐖\\Delta\\mathbf\{W\}, but provides insufficient disruption of linear separability\.

#### Spreading decoy budget can be counterproductive\.

Distributing decoy energy across more directions involves a fundamental tradeoff \(Corollary[3](https://arxiv.org/html/2609.16204#Thmtheorem3)\): with identical readers, adding more output directions dilutes each one without increasing the effective rank ofAθA\_\{\\theta\}\. With diversified readers, spreading energy trades rank\-1 protection for higher\-rank robustness \(see Appendix[E\.3](https://arxiv.org/html/2609.16204#A5.SS3)for empirical validation\)\.

#### Aggressive edits destroy capability\.

*LM\-Head Row Scaling*achieves near\-zero RFA ASR \(0\.7%0\.7\\%\) but at catastrophic utility cost \(XSTest8\.0%8\.0\\%, MT\-Bench1\.721\.72\)—the model over\-refuses almost all prompts\. Extending DDO injection to layers0​–​110\\text\{\-\-\}11\(48%48\\%ASR\) degraded generation quality to incoherent outputs\. These cases illustrate that low ASR is insufficient without utility preservation\.

#### Mismatched threat models\.

*Gradient landscape roughening*\(84%84\\%ASR\) perturbs𝐖gate\\mathbf\{W\}\_\{\\mathrm\{gate\}\}to create rough input\-space loss surfaces, targeting GCG\-style prompt optimization\. This does not improve robustness against representation\-space abliteration \(RFA\), confirming that input\-space and representation\-space attacks require distinct defensive mechanisms\.

### F\.13Reproducibility Notes

#### Implementation\.

DDO’s gradient optimization through the defended model is implemented withnnsight\[[61](https://arxiv.org/html/2609.16204#bib.bib61)\], which provides differentiable access to model internals while keeping base\-model weights frozen\. Hyperparameter search uses Optuna\[[26](https://arxiv.org/html/2609.16204#bib.bib26)\]with the default Tree\-structured Parzen Estimator \(TPE\) sampler\.

We note three reproducibility details\. \(i\)Determinism:we use deterministic decoding \(do\_sample=false\) and fixed RNG seeds for all stochastic components, and adaptive multi\-phase RFA is deterministic \(verified across33runs\)\. \(ii\)Seed sensitivity:DIM direction estimation introduces≈±1%\\approx\\pm 1\\%ASR variation across probe\-set seeds, and Heretic results vary with Optuna random seed \(≈±3%\\approx\\pm 3\\%across33independent 200\-trial runs\)\. \(iii\)Fixed seeds:data splits=42=42, v\_proj conditioning=99=99\(searched over\{42,77,99,123,200\}\\\{42,77,99,123,200\\\}\), KV strengthening=7=7, Optuna TPE=42=42\.

### F\.14Defense and Attack Surface Map

Figure[5](https://arxiv.org/html/2609.16204#A6.F5)visualizes a single pre\-norm transformer block \(Llama\-3\) with defense and attack annotations\. DDO edits𝐖gate\\mathbf\{W\}\_\{\\mathrm\{gate\}\},𝐖up\\mathbf\{W\}\_\{\\mathrm\{up\}\}, and𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}in the SwiGLU MLP \(green\); RFA hooks activations at three points \(red dots\); Heretic edits𝐖o\\mathbf\{W\}\_\{o\}and𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}offline \(red outlines\)\. The partial overlap on𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}is the only shared surface between DDO and Heretic\.

𝐖emb\\mathbf\{W\}\_\{\\mathrm\{emb\}\}𝐡ℓ\\mathbf\{h\}\_\{\\ell\}RMSNormMulti\-Head Attention𝐖q\\mathbf\{W\}\_\{q\}𝐖k\\mathbf\{W\}\_\{k\}𝐖v\\mathbf\{W\}\_\{v\}Scaled Dot\-ProdAttentionConcat𝐖o\\mathbf\{W\}\_\{o\}RoPE onQ,KQ,Kaux: V\-proj, KV boostaux: head amp\., debias\+\+RMSNormSwiGLU MLP𝐖gate\\mathbf\{W\}\_\{\\mathrm\{gate\}\}𝐖up\\mathbf\{W\}\_\{\\mathrm\{up\}\}SiLU⊙\\odot𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}DDO \(gated decoy\)DDO, aux: debias\+\+𝐡ℓ\+1\\mathbf\{h\}\_\{\\ell\+1\}𝐖lm\\mathbf\{W\}\_\{\\mathrm\{lm\}\}residualaux: embed boost, debiasRFA hook:𝐡ℓ\\mathbf\{h\}\_\{\\ell\}RFA hook:𝐚ℓ\\mathbf\{a\}\_\{\\ell\}RFA hook:𝐦ℓ\\mathbf\{m\}\_\{\\ell\}HereticHeretic

Figure 5:Pre\-norm transformer block \(Llama\-3\) annotated with defense and attacker surfaces\.Green:DDOedits𝐖gate\\mathbf\{W\}\_\{\\mathrm\{gate\}\},𝐖up\\mathbf\{W\}\_\{\\mathrm\{up\}\}, and𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}in the SwiGLU MLP; auxiliary \(“aux”\) mechanisms optionally edit additional matrices in attention, embeddings, and normalization \(Section[3](https://arxiv.org/html/2609.16204#S3.SS0.SSS0.Px9)\)\.Red: attacker access—RFA hooks activations at three points \(𝐡ℓ\\mathbf\{h\}\_\{\\ell\},𝐚ℓ\\mathbf\{a\}\_\{\\ell\},𝐦ℓ\\mathbf\{m\}\_\{\\ell\}\); Heretic\[[14](https://arxiv.org/html/2609.16204#bib.bib14)\]edits only𝐖o\\mathbf\{W\}\_\{o\}and𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}\. Overlap occurs only on𝐖down\\mathbf\{W\}\_\{\\mathrm\{down\}\}\.
### F\.15Additional Model Evaluation

Beyond the six primary models evaluated in the main text \(Table[2](https://arxiv.org/html/2609.16204#S4.T2)and Table[3](https://arxiv.org/html/2609.16204#S4.T3)\), we apply DDO with per\-model Optuna tuning \(∼\{\\sim\}10 min each\) to seven additional instruction\-tuned checkpoints spanning 7B–24B parameters \(Table[20](https://arxiv.org/html/2609.16204#A6.T20)\), including Llama\-2\-7B\-Chat\. DDO achieves<<10% standard\-RFA ASR on all seven while preserving MMLU within 1–2 points of the base model, confirming cross\-family and cross\-scale generalization\.

Table 20:DDO on additional models with per\-model Optuna tuning \(∼\{\\sim\}10 min, single A100 GPU\)\. MMLU: base→\\rightarrowDDO\-defended \(%↑\\uparrow\)\. RFA ASR = mean of 4 variants, LlamaGuard\-2 \(%↓\\downarrow\)\. XST = XSTest \(%↑\\uparrow\)\. DDO achieves<<10% ASR on all models with≤\\leq1\.4 point MMLU drop\.
### F\.16DDO Undo Attack Analysis

An attacker who obtains only the defended checkpoint \(without the original base model\) might attempt to identify and revert DDO\-modified neurons\. A natural undo heuristic is to score each MLP gate row by its projection onto the attacker’s estimated refusal direction,si≜\|𝐰gate\(i\)⋅𝐝^atk\|s\_\{i\}\\mathrel\{\\triangleq\}\\left\|\\mathbf\{w\}\_\{\\mathrm\{gate\}\}^\{\(i\)\}\\cdot\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}\\right\|, where𝐝^atk\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}is the DIM direction estimated on the defended checkpoint, and then zero the top\-scoring neurons\. DDO’s gate rows are shaped to align with the reference refusal direction𝐫^clean\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{clean\}\}\(so the trigger fires on harmful inputs\), which would make them easy to find—if𝐝^atk\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}matched𝐫^clean\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{clean\}\}\. Estimator corruption rotates𝐝^atk\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}away from𝐫^clean\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{clean\}\}, frustrating this undo strategy\.

#### Detectability in intermediate layers\.

Across Qwen3, Mistral\-7B, and Yi, DDO target layers in the mid\-zone showcos⁡\(𝐫^clean,𝐝^atk\)∈\[−0\.05,\+0\.05\]\\cos\(\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{clean\}\},\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}\)\\in\[\-0\.05,\+0\.05\], so the estimated directions are nearly orthogonal\. The modified row’s projectionsmods\_\{\\mathrm\{mod\}\}collapses to within the natural top\-55distribution:

- •Qwen3 L14:smod=0\.267s\_\{\\mathrm\{mod\}\}=0\.267vs\. natural rank\-22at0\.2300\.230\(1\.16×1\.16\\timesmargin\)\.
- •Mistral\-7B L10:smod=0\.041s\_\{\\mathrm\{mod\}\}=0\.041, outranked by a natural neuron at0\.0660\.066\(rank44\)\.
- •Yi L26:smod=0\.112s\_\{\\mathrm\{mod\}\}=0\.112vs\. natural rank\-22at0\.0750\.075\(1\.48×1\.48\\timesmargin\)\.
- •Yi L32:smod=0\.095s\_\{\\mathrm\{mod\}\}=0\.095vs\. natural rank\-22at0\.0910\.091\(1\.04×1\.04\\timesmargin\)\.

Instruction\-tuned models naturally contain MLP neurons whose gate rows align with refusal at the0\.07​–​0\.200\.07\\text\{\-\-\}0\.20level—these are real refusal\-relevant neurons doing work in the model’s native safety circuitry\. Once𝐝^atk\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}has been rotated away from𝐫^clean\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{clean\}\}, DDO’s modified neuron sits inside this distribution rather than as an outlier\. The undo attack scores neurons using this corrupted direction estimate\. In the Llama\-3 evaluation, it provides partial recovery while remaining below the undefended ASR \(Table[21](https://arxiv.org/html/2609.16204#A6.T21)\)\.

#### Detectability in later layers\.

At the deepest target layers, deception can be slightly weaker\. Yi L37 \(the deepest layer in Yi’s L14–37 zone\) showscos⁡\(𝐫^clean,𝐝^atk\)≈0\.09\\cos\(\\hat\{\\mathbf\{r\}\}\_\{\\mathrm\{clean\}\},\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}\)\\approx 0\.09, andsmod=0\.444s\_\{\\mathrm\{mod\}\}=0\.444exceeds the natural rank\-22\(0\.0810\.081\) by∼5×\{\\sim\}5\\times\. However, since the attacker must search the full model without knowing which layers were modified, even a partial margin at one layer does not yield reliable undo across the model\. Placing DDO inside the model’s natural causal refusal zone gives the defense a stealth property: the modification shares its surface signature with the neurons it is functionally hiding among\.

#### Post\-attack ASR under undo heuristics\.

To complement the geometric analysis above, we measure post\-attack ASR after applying each undo heuristic followed by standard RFA\. For each heuristic, we zero the top\-mmdown\-projection columns per DDO layer, then run 3\-point RFA \(Table[21](https://arxiv.org/html/2609.16204#A6.T21)\)\.

Table 21:Post\-attack ASR \(%↓\\downarrow, LlamaGuard\-2, 3\-point RFA, JailbreakBench\) after applying undo heuristics on Llama\-3\-8B DDO\.mm= number of neurons zeroed per DDO layer\. Base \(no defense\) ASR = 80%\. No heuristic recovers base\-level ASR; the best heuristic reaches only 12–17%\.The gate⋅𝐝^atk\\cdot\\hat\{\\mathbf\{d\}\}\_\{\\mathrm\{atk\}\}and gate/up cosine heuristics yield 12–17% ASR after RFA, indicating partial recovery while remaining below the undefended base \(80%\)\. The down\-column\-norm heuristic yields 4–7% ASR, indicating little recovery under this heuristic\. Zeroing a neuron’s down\-projection column removes its contribution to the residual stream, including any decoy output from that neuron\.

#### Norm\-based detection\.

A detector could flag DDO neurons by their gate/up norm ratio\. In the default compile mode,𝐰gate=β​𝐫^\\mathbf\{w\}\_\{\\mathrm\{gate\}\}=\\beta\\hat\{\\mathbf\{r\}\}\(normβ\\beta\) and𝐰up=𝐫^\\mathbf\{w\}\_\{\\mathrm\{up\}\}=\\hat\{\\mathbf\{r\}\}\(norm11\), yielding a ratio ofβ≈3​–​6\\beta\\approx 3\\text\{\-\-\}6—an outlier among∼12\{\\sim\}12K neurons\. However, this is an artifact of a particular compile choice, not a fundamental limitation\. The trigger output depends on the*product*of gate and up norms:silu⁡\(𝐰gate⊤​𝐱~\)⋅𝐰up⊤​𝐱~\\operatorname\{silu\}\(\\mathbf\{w\}\_\{\\mathrm\{gate\}\}^\{\\top\}\\tilde\{\\mathbf\{x\}\}\)\\cdot\\mathbf\{w\}\_\{\\mathrm\{up\}\}^\{\\top\}\\tilde\{\\mathbf\{x\}\}\. Redistributing the total gain—e\.g\., setting both toβ​𝐫^\\sqrt\{\\beta\}\\,\\hat\{\\mathbf\{r\}\}—equalizes norms while preserving the trigger in the large\-activation regime \(silu⁡\(x\)≈x\\operatorname\{silu\}\(x\)\\approx x\):silu⁡\(β​a\)⋅β​a≈β​a2\\operatorname\{silu\}\(\\sqrt\{\\beta\}\\,a\)\\cdot\\sqrt\{\\beta\}\\,a\\approx\\beta a^\{2\}, matching the original\. Similarly,cossim⁡\(𝐰gate,𝐰up\)=1\.0\\operatorname\{cossim\}\(\\mathbf\{w\}\_\{\\mathrm\{gate\}\},\\mathbf\{w\}\_\{\\mathrm\{up\}\}\)=1\.0can be reduced by adding a small orthogonal perturbationε​𝐯\\varepsilon\\,\\mathbf\{v\}to𝐰up\\mathbf\{w\}\_\{\\mathrm\{up\}\}, introducingO⁡\(ε\)O\(\\varepsilon\)trigger noise absorbed by the down\-projection scale\. DDO’s free scalar parameters\(β,s\)\(\\beta,s\)provide the degrees of freedom to match any target norm and cosine distribution analytically\. All models evaluated in this paper use the default compile without norm redistribution or cosine camouflage\.

### F\.17Rank\-kkAttack Sweep

To test robustness beyond rank\-1 RFA, we evaluate rank\-kkSVD attacks: the attacker computes the top\-kkleft singular vectors of a harmful–safe contrast matrix on the defended model and ablates allkkdirections simultaneously \(Table[22](https://arxiv.org/html/2609.16204#A6.T22)\)\.

Table 22:Rank\-kkattack sweep on Llama\-3\-8B DDO \(ASR %↓\\downarrow, LlamaGuard\-2, 3\-point RFA, JailbreakBench\)\. ASR increases with attack rank in this sweep, reaching 79% atk=32k\{=\}32, compared with 80% for the undefended model\.Attack rankkk12481632ASR \(%\)41621293979ASR increases from 4% atk=1k\{=\}1to 29% atk=8k\{=\}8and 39% atk=16k\{=\}16\. Atk=32k\{=\}32, ASR reaches 79%, approaching the undefended base \(80%\)\. These results show decreasing protection against the higher\-rank attacks evaluated in this sweep\.

### F\.18Probe\-Budget Sensitivity

A natural concern is that DDO’s estimator corruption might rely on the attacker having too few probes for accurate DIM estimation\. We test this by varying the attacker’s probe budget from 32 to 1024 prompts in each of the harmful and safe sets \(Table[23](https://arxiv.org/html/2609.16204#A6.T23)\)\.

Table 23:Probe\-budget sweep on Llama\-3\-8B DDO \(ASR %↓\\downarrow, LlamaGuard\-2, 3\-point RFA, JailbreakBench\)\.NNis the number of prompts in each of the harmful and safe sets \(2​N2Nprompts total\)\. DDO optimization uses 128 harmful and 128 safe prompts \(256 total\)\. ASR ranges from 6% to 12% without a sustained increase over the evaluated budgets\.Prompts per class,NN32641282565121024ASR \(%\)7681277ASR ranges from 6% to 12% as the number of prompts per class increases from 32 to 1024\. The 12% result atN=256N\{=\}256is followed by 7% at bothN=512N\{=\}512andN=1024N\{=\}1024\. Even with 1024 prompts per class \(8×\\timesthe DDO optimization budget of 128 per class\), the attacker cannot recover the true refusal direction\. This confirms that DDO’s defense operates by genuinely corrupting the mean\-difference direction, not by exploiting finite\-sample noise in the attacker’s estimator\.

### F\.19Licenses for Existing Assets

All models, benchmarks, and software used in this work are publicly available under permissive or research\-friendly licenses\. We use each asset in accordance with its stated terms\.

#### Models\.

- •
- •
- •
- •
- •
- •
- •GPT\-4\(OpenAI\): used as MT\-Bench judge via API, under OpenAI’s Terms of Use\.
- •GPT\-4o\(OpenAI\): used as XSTest and StrongREJECT judge via API, under OpenAI’s Terms of Use\.

#### Benchmarks and datasets\.

- •JailbreakBench\[[25](https://arxiv.org/html/2609.16204#bib.bib25)\]: MIT License\.
- •HarmBench\[[5](https://arxiv.org/html/2609.16204#bib.bib5)\]: MIT License\.
- •MMLU\[[36](https://arxiv.org/html/2609.16204#bib.bib36)\]: MIT License\.
- •MT\-Bench\[[37](https://arxiv.org/html/2609.16204#bib.bib37)\]: Apache 2\.0 \(part of FastChat / lm\-sys\)\.
- •XSTest\[[38](https://arxiv.org/html/2609.16204#bib.bib38)\]: CC\-BY\-4\.0\.
- •StrongREJECT\[[40](https://arxiv.org/html/2609.16204#bib.bib40)\]: MIT License\.
- •AdvBench\[[22](https://arxiv.org/html/2609.16204#bib.bib22)\]: MIT License\.

#### Software and tools\.

- •Heretic\[[14](https://arxiv.org/html/2609.16204#bib.bib14)\]: GNU AGPL\-3\.0\-or\-later\.
- •LightEval: Apache 2\.0 \(Hugging Face\)\.
- •Optuna: MIT License\.
- •PyTorch: BSD\-style license\.
- •Transformers \(Hugging Face\): Apache 2\.0\.