Abliteration is a weight edit that removes a model's tendency to refuse. It needs no training data beyond a few hundred prompts, no gradient steps, and no change to the model's architecture. It works because of a fairly surprising property of chat models: the decision to refuse is mostly carried by a single direction in the model's internal activations. Find that direction, remove it, and the model stops refusing.
This post walks through the mechanism: where the direction lives, how it is found, how it is removed, how to check the result, and where it goes wrong. If you only want to know which abliterated model to use, read the guide to choosing one instead.
The finding behind it
In 2024, Arditi, Obeso, Syed, Paleka, Panickssery, Gurnee and Nanda published "Refusal in Language Models Is Mediated by a Single Direction" (arXiv 2406.11717). They studied 13 open chat models, up to 72B parameters, and found the same structure in each one.
One piece of transformer anatomy helps. Each token's representation is a vector that flows through the layers, a running sum called the residual stream. Every attention and MLP block reads from it and writes an update back.
The paper showed that, for refusal, the change is mostly along one direction. When a harmful request comes in, the residual stream picks up a large component along a particular vector, and later layers read that component as "refuse." Erase it and the model answers requests it would have declined. Add it to a harmless prompt and the model refuses to write a poem about the sea. One vector, both directions of causality.
That is unusual. Most behaviors in a neural network are spread across many features. Refusal is concentrated, probably because safety training teaches one uniform reaction to many inputs, and the model learns a compact switch for it.
Finding the direction
The method is difference of means, and it is as simple as it sounds.
- Collect two prompt sets: requests the model refuses and comparable requests it answers. The paper used 128 of each, harmful prompts from public red-teaming benchmarks and harmless ones from an instruction-tuning dataset.
- Run both sets through the model and record the residual stream at a chosen layer, at the token positions right after the instruction, where the model is about to start its reply.
- Average the activations within each set.
- Subtract the harmless mean from the harmful mean, then normalize to unit length.
The result is the refusal direction for that layer. What the two sets share cancels out; the dominant remaining difference is that one set triggers a refusal.
"Mostly" is doing some work there. If your harmful prompts are all about one topic, the direction will also encode that topic. Prompt sets that are varied and matched in length and style give a cleaner vector.
Choosing the layer
You get a candidate direction for every layer and position, so you need a way to pick one. Early layers have not formed the concept yet. Very late layers mostly encode "the next token is 'I'm sorry'," which is a symptom, not the decision.
The paper scored each candidate on a small held-out validation set against three questions:
- Does removing it stop refusals? Ablate the direction and measure how often the model still refuses harmful prompts. Lower is better.
- Does adding it cause refusals? Add the direction to harmless prompts. If the model now refuses, the vector really is causal and not just correlated.
- Does removing it leave harmless behavior alone? Compare the model's next-token distributions on harmless prompts with and without the ablation, using KL divergence. The paper required this to stay under 0.1.
It also excluded the last 20 percent of layers, to avoid picking a vector that only encodes refusal phrases. The winner tends to sit mid-network.
Removing the direction
There are two ways to remove it, and they are mathematically the same edit.
At inference time, you subtract the direction's component from the residual stream at every layer and every token position. For an activation x and unit direction r, the new activation is x minus the projection of x onto r. The model can no longer represent anything along that axis.
In the weights, you make that subtraction permanent. Every matrix that writes into the residual stream (the token embeddings, each attention output projection, each MLP output projection) gets orthogonalized against r, so its output never had a component along the direction in the first place. That is a rank-one change per matrix. Nothing else moves. The model loads and runs like the original, with no hooks and no extra compute.
In sketch form:
# residual activations at the chosen layer, last instruction token
h_harmful = resid(model, harmful_prompts, layer=L).mean(0)
h_harmless = resid(model, harmless_prompts, layer=L).mean(0)
r = h_harmful - h_harmless
r = r / r.norm() # unit refusal direction
# option 1: project it out at inference
def ablate(x):
return x - (x @ r)[..., None] * r
# option 2: orthogonalize every matrix that writes to the stream
for W in residual_writers(model): # embed, attn out, MLP out; W is (d_model, d_in)
W -= torch.outer(r, r @ W)Real tooling adds batching, bias handling and a search over layers, but the core is a mean, a subtraction, and a projection.
Measuring the result
An abliterated model has to pass two tests: it stops refusing, and it keeps working. Measure both, on prompts you did not use to find the direction.
Refusal rate on held-out prompts
Take a fresh set of requests the original model refuses and count how many the edited model still refuses. Cheap checks look for refusal phrases ("I can't," "As an AI"). That misses soft refusals, so add a judge model that decides whether each answer actually addressed the request.
Drift on harmless prompts
KL divergence between the original and edited model's next-token distributions, on ordinary prompts, tells you how much general behavior moved. Low KL means the edit was surgical. Then run the standard capability benchmarks. In the paper, orthogonalized models mostly stayed within noise of the originals on MMLU, ARC and GSM8K. TruthfulQA dropped consistently, which the authors put down to that benchmark sitting close to refusal territory. Two of the models also lost more than the others, so drift varies by model.
Your own workload
Benchmarks are averages. If you run a coding agent, test tool calls and long sessions. If you do security research, test the prompts you actually send.
Where it goes wrong
Residual refusals
The model still declines some requests. Common causes: the prompt sets were too narrow, so the direction captured one kind of refusal and not others; the chosen layer generalizes poorly; or the model has a second, weaker mechanism the single direction does not cover. Refusals can also come back in a different shape, such as "I can give you a general overview" followed by nothing useful. Count those as refusals.
Lecturing without refusing
The model answers, but wraps the answer in warnings and a paragraph on responsible use. The direction carries the decision to decline. The habit of moralizing was learned alongside it and lives partly elsewhere, so removing the switch does not always remove the tone. It is the most common complaint about abliterated builds.
Capability drift
Pick a direction that is too entangled with other features, or ablate too aggressively, and the model gets a little worse at everything: more repetition, weaker reasoning, small formatting slips. Some drift is about judgment rather than skill. Researchers have reported abliterated models giving more optimistic answers to yes-or-no judgment calls, which makes sense if part of what was removed was a general "be cautious" signal. KL divergence and benchmarks catch the first kind. Your own evaluation catches the second.
Problems that are not abliteration
A broken chat template or bad quantization will make any model look damaged. Before blaming the edit, compare against the original model under the same template and precision.
How it differs from fine-tuning and jailbreaks
Fine-tuning trains on new examples, updating many weights by gradient descent. It can remove refusals too, but it also shifts style and needs a dataset and a training run. Abliteration changes one direction and leaves the rest where it was, including the model's voice and tool-calling format.
Jailbreak prompts leave the weights alone and try to steer the model with input text: role-play frames, long permission preambles, adversarial suffixes. The same paper offers a neat explanation of why the suffixes work. They suppress the refusal direction from spreading through the network. A jailbreak is a fragile, per-request attempt at what abliteration does once. It eats context and breaks after model updates.
A moderation layer is a separate classifier that blocks requests or responses. Abliteration does nothing about one of those. If a host puts a filter in front of an abliterated model, you get filtered output.
What this means in practice
Abliteration removes refusals. It does not add knowledge, skill, or judgment. A small model with refusals edited out will attempt hard tasks and do them badly, so the base model still matters.
The models on XField are abliterated open-weight models served without an added moderation layer or content filter. The checks above are the ones worth running on any abliterated model, ours included: held-out refusals, drift on harmless prompts, and your own workload. See the model list for what each one is good at, and the acceptable use policy for what the service is for. Access is by invitation through request access.