Module: FT17 — Abliteration: Refusal-Direction Orthogonalization Diagram count: 6 Tool: Mermaid (primary). Each diagram validated in Mermaid Live Editor.
Type: Mechanism / contrastive activation
Purpose: The core mechanistic step. Two instruction sets run through the model; the difference in their mean residual-stream activations at the final token IS the refusal direction.
Reading the diagram: Left = harmful set, right = benign set. Both flow into the same model. Final-token residual-stream activations are averaged per set. Subtract benign-mean from harmful-mean → the refusal direction r (one per layer).
flowchart LR
H["HARMFUL instructions\n(AdvBench / HarmBench)\n32–128 prompts"] --> M["Forward pass\nper layer"]
B["BENIGN instructions\nmatched length/topic\nsame count"] --> M
M --> HA["Mean residual-stream\nactivation at final token\n(per layer) — harmful"]
M --> BA["Mean residual-stream\nactivation at final token\n(per layer) — benign"]
HA --> DIFF["DIFFERENCE IN MEANS\nr_l = mean(harmful) − mean(benign)"]
BA --> DIFF
DIFF --> R["REFUSAL DIRECTION r\none candidate per layer\nvector in R^d (d = hidden dim)"]
style H fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
style B fill:#14141f,stroke:#82e0aa,color:#e4e4e8
style M fill:#08080c,stroke:rgba(255,255,255,0.12),color:#9494a0
style HA fill:#08080c,stroke:rgba(240,128,128,0.4),color:#e4e4e8
style BA fill:#08080c,stroke:rgba(130,224,170,0.4),color:#e4e4e8
style DIFF fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
style R fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
Type: Mathematical / projection geometry
Purpose: The permanent weight edit that makes the refusal direction unreachable. The single equation that defines abliteration.
Reading the diagram: W (any weight that writes to the residual stream) is decomposed into its component along r and its component orthogonal to r. Subtract the r-aligned part. Result: W' cannot write into r, no matter the input.
flowchart TD
W["WEIGHT MATRIX W\n(writes to residual stream:\no_proj, down_proj, embed)"]
R["REFUSAL DIRECTION r\n(unit vector in R^d)"]
W --> DECOMP["DECOMPOSE W along r"]
R --> DECOMP
DECOMP --> PARALLEL["r-aligned component\nrank-1: r(rᵀW)/(rᵀr)\nthe part that writes into r"]
DECOMP --> ORTHO["orthogonal component\nW − r(rᵀW)/(rᵀr)\neverything else"]
PARALLEL -.subtract.-> EDIT["W' = W − r(rᵀW)/(rᵀr)"]
ORTHO --> EDIT
EDIT --> RESULT["EDITED WEIGHT W'\nr is now geometrically unreachable\nno input can produce an r-component\nin the residual stream from this matrix"]
style W fill:#14141f,stroke:rgba(255,255,255,0.12),color:#e4e4e8
style R fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
style DECOMP fill:#08080c,stroke:rgba(255,255,255,0.12),color:#9494a0
style PARALLEL fill:#14141f,stroke:#f08080,color:#e4e4e8
style ORTHO fill:#14141f,stroke:#82e0aa,color:#e4e4e8
style EDIT fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
style RESULT fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
Type: Pipeline / sequence Purpose: The end-to-end abliteration workflow. No retraining, no data, no optimizer — pure linear algebra plus a measurement step. Reading the diagram: Top-to-bottom. Each step has an input, an operation, and an output. Notice: no GPU-hours of training; the whole pipeline runs in minutes on a consumer GPU.
flowchart TD
S1["1. FIND\ncontrastive activations:\nharmful vs benign\n→ difference-in-means\n→ candidate r per layer"]
S2["2. VALIDATE\nis it ~1D? clamp top-k PCs\nmeasure refusal reduction\n+ held-out generalization"]
S3["3. PROJECT OUT\nweight orthogonalization:\nW' = W − r(rᵀW)/(rᵀr)\non every W that writes\nto the residual stream"]
S4["4. PICK STREAM\npre (block input) /\npost (block output) /\nmid (after attn)\ntrade-off dial"]
S1 --> S2
S2 -->|"single direction confirmed"| S3
S2 -.->|"needs k>1 → modern model,\nuse multi-direction (Heretic)"| ALT["DIVERGE:\nmulti-direction\nor switch to DPO (FT18)"]
S3 --> S4
S4 --> DONE["ABLITERATED MODEL\npermanent weight edit\nno inference overhead\nrefuses less"]
style S1 fill:#14141f,stroke:#5eead4,color:#e4e4e8
style S2 fill:#14141f,stroke:#5eead4,color:#e4e4e8
style S3 fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
style S4 fill:#14141f,stroke:#5eead4,color:#e4e4e8
style ALT fill:#14141f,stroke:#f0a868,color:#f0a868
style DONE fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
Type: Trade-off / data viz Purpose: The honest core of the module. Abliteration is not free. The same technique, four tools, sixteen models, a 20-point GSM8K spread. Reading the diagram: X-axis = refusal suppression (how thoroughly refusals are removed). Y-axis = capability retained (GSM8K, MMLU). The curve slopes down: more aggressive suppression costs more capability. The Dec 2025 study's data points are annotated.
flowchart LR
subgraph Curve["THE TRADE-OFF CURVE\n(qualitative shape; data from arXiv:2512.13655)"]
direction TB
A["ErisForge\nlow aggression\nrefusals partly remain\nGSM8K avg −0.28pp"]
B["DECCP\nmoderate\nGSM8K avg −0.13pp"]
C["FailSpy\nmoderate-high\nhigh per-model variance"]
D["Heretic\nhigh aggression\nmost refusals gone\nGSM8K avg −7.81pp"]
E["worst case\nYi-1.5-9B + Heretic-style\nGSM8K −18.81pp (−26.5%)"]
A -.-> B
B -.-> C
C -.-> D
D -.-> E
end
XAXIS["→ more refusal suppression (aggression)"]
YAXIS["↑ capability retained (GSM8K / MMLU)"]
Curve --> XAXIS
YAXIS -.-> Curve
style A fill:#14141f,stroke:#82e0aa,stroke-width:1.5px,color:#e4e4e8
style B fill:#14141f,stroke:rgba(130,224,170,0.5),color:#e4e4e8
style C fill:#14141f,stroke:#f0a868,color:#e4e4e8
style D fill:#14141f,stroke:#f08080,color:#e4e4e8
style E fill:#14141f,stroke:#f08080,stroke-width:2px,color:#f08080
style XAXIS fill:#08080c,stroke:rgba(255,255,255,0.08),color:#9494a0
style YAXIS fill:#08080c,stroke:rgba(255,255,255,0.08),color:#9494a0
style Curve fill:#08080c,stroke:rgba(255,255,255,0.08),color:#e4e4e8
Type: Comparison matrix Purpose: Know the ecosystem. Seven tools, different sweet spots. The comparative study ranked four of them on capability preservation. Reading the diagram: Left = tool. Right = what it's for. Bottom = the comparative-study ranking on GSM8K damage.
flowchart LR
subgraph Tools["ABLITERATION TOOLKIT"]
T1["andyrdt/refusal_direction\nthe paper code\ncanonical reference"]
T2["FailSpy/abliterator\noriginal community lib\nmost early HF abliterations"]
T3["ErisForge\n'Dead Simple'\nbest capability preservation"]
T4["Heretic\nfully-automatic\nmulti-direction aware"]
T5["sumandora/remove-refusals\nclean didactic impl\n~100 lines to read"]
T6["guoyang9/refusal-unlearning\nunlearning framing"]
T7["elder-plinius/OBLITERATUS\naggressive ancestor"]
end
subgraph Ranking["GSM8K DAMAGE (arXiv:2512.13655, 16 models)"]
direction TB
R1["ErisForge\navg −0.28pp (best)"]
R2["DECCP\navg −0.13pp"]
R3["FailSpy\nmid, high variance"]
R4["Heretic\navg −7.81pp (worst avg)"]
R5["spread: +1.51pp to −18.81pp"]
end
Tools --> Ranking
style T1 fill:#14141f,stroke:rgba(94,234,212,0.4),color:#e4e4e8
style T2 fill:#14141f,stroke:rgba(94,234,212,0.4),color:#e4e4e8
style T3 fill:#14141f,stroke:#82e0aa,color:#e4e4e8
style T4 fill:#14141f,stroke:#f08080,color:#e4e4e8
style T5 fill:#14141f,stroke:rgba(255,255,255,0.12),color:#9494a0
style T6 fill:#14141f,stroke:rgba(255,255,255,0.12),color:#9494a0
style T7 fill:#14141f,stroke:rgba(255,255,255,0.12),color:#9494a0
style R1 fill:#14141f,stroke:#82e0aa,color:#82e0aa
style R2 fill:#14141f,stroke:rgba(130,224,170,0.5),color:#e4e4e8
style R3 fill:#14141f,stroke:#f0a868,color:#e4e4e8
style R4 fill:#14141f,stroke:#f08080,color:#e4e4e8
style R5 fill:#08080c,stroke:#f08080,stroke-width:1.5px,color:#f08080
Type: Geometric / Venn-like
Purpose: The mechanistic reason abliteration is not free. The refusal direction is not orthogonal to the capabilities you want to keep.
Reading the diagram: The refusal direction r overlaps with directions for instruction-following, reasoning, and hedging. Orthogonalizing against r deletes a slice of each. This is the deepest statement of the FT00 steering thesis in the course.
flowchart TD
R["REFUSAL DIRECTION r\n(the vector you delete)"]
subgraph Overlap["ENTANGLED CAPABILITIES (overlap with r)"]
O1["Instruction-following\n('should I comply?' axis\npartly shared with refusal)"]
O2["Reasoning\n(slow-down-and-check mode\ncorrelates with cautious refusal)"]
O3["Tone & hedging\n('I can't help with that' patterns\noverlap with uncertainty markers)"]
end
R --> OVERLAP["deleting r deletes a SLICE\of each entangled capability"]
OVERLAP --> O1
OVERLAP --> O2
OVERLAP --> O3
OVERLAP --> COST["MEASURED COST (arXiv:2512.13655)\nGSM8K: +1.51pp to −18.81pp\nMMLU: measurable drop\nIFEval: measurable drop"]
R -.->|"NOT orthogonal to"| O1
R -.->|"NOT orthogonal to"| O2
R -.->|"NOT orthogonal to"| O3
style R fill:#14141f,stroke:#f08080,stroke-width:2px,color:#f08080
style O1 fill:#14141f,stroke:rgba(240,128,128,0.4),color:#e4e4e8
style O2 fill:#14141f,stroke:rgba(240,128,128,0.4),color:#e4e4e8
style O3 fill:#14141f,stroke:rgba(240,128,128,0.4),color:#e4e4e8
style OVERLAP fill:#08080c,stroke:#f08080,stroke-dasharray:4 2,color:#f08080
style COST fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#f08080
#14141f panel fill, #5eead4 accent for primary, rgba(255,255,255,0.12) for secondary borders, #e4e4e8 / #9494a0 for text. Danger #f08080, warn #f0a868, ok #82e0aa used for trade-off semantics.flowchart, flowchart LR/TD) supported in current Mermaid (v10.4+).# Diagrams — Module FT17: Abliteration: Refusal-Direction Orthogonalization
**Module**: FT17 — Abliteration: Refusal-Direction Orthogonalization
**Diagram count**: 6
**Tool**: Mermaid (primary). Each diagram validated in [Mermaid Live Editor](https://mermaid.live).
---
## Diagram 1 — Finding the Refusal Direction (Difference-in-Means)
**Type**: Mechanism / contrastive activation
**Purpose**: The core mechanistic step. Two instruction sets run through the model; the difference in their mean residual-stream activations at the final token IS the refusal direction.
**Reading the diagram**: Left = harmful set, right = benign set. Both flow into the same model. Final-token residual-stream activations are averaged per set. Subtract benign-mean from harmful-mean → the refusal direction `r` (one per layer).
```mermaid
flowchart LR
H["HARMFUL instructions\n(AdvBench / HarmBench)\n32–128 prompts"] --> M["Forward pass\nper layer"]
B["BENIGN instructions\nmatched length/topic\nsame count"] --> M
M --> HA["Mean residual-stream\nactivation at final token\n(per layer) — harmful"]
M --> BA["Mean residual-stream\nactivation at final token\n(per layer) — benign"]
HA --> DIFF["DIFFERENCE IN MEANS\nr_l = mean(harmful) − mean(benign)"]
BA --> DIFF
DIFF --> R["REFUSAL DIRECTION r\none candidate per layer\nvector in R^d (d = hidden dim)"]
style H fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
style B fill:#14141f,stroke:#82e0aa,color:#e4e4e8
style M fill:#08080c,stroke:rgba(255,255,255,0.12),color:#9494a0
style HA fill:#08080c,stroke:rgba(240,128,128,0.4),color:#e4e4e8
style BA fill:#08080c,stroke:rgba(130,224,170,0.4),color:#e4e4e8
style DIFF fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
style R fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
```
---
## Diagram 2 — Weight Orthogonalization (the Surgical Edit)
**Type**: Mathematical / projection geometry
**Purpose**: The permanent weight edit that makes the refusal direction unreachable. The single equation that defines abliteration.
**Reading the diagram**: `W` (any weight that writes to the residual stream) is decomposed into its component along `r` and its component orthogonal to `r`. Subtract the `r`-aligned part. Result: `W'` cannot write into `r`, no matter the input.
```mermaid
flowchart TD
W["WEIGHT MATRIX W\n(writes to residual stream:\no_proj, down_proj, embed)"]
R["REFUSAL DIRECTION r\n(unit vector in R^d)"]
W --> DECOMP["DECOMPOSE W along r"]
R --> DECOMP
DECOMP --> PARALLEL["r-aligned component\nrank-1: r(rᵀW)/(rᵀr)\nthe part that writes into r"]
DECOMP --> ORTHO["orthogonal component\nW − r(rᵀW)/(rᵀr)\neverything else"]
PARALLEL -.subtract.-> EDIT["W' = W − r(rᵀW)/(rᵀr)"]
ORTHO --> EDIT
EDIT --> RESULT["EDITED WEIGHT W'\nr is now geometrically unreachable\nno input can produce an r-component\nin the residual stream from this matrix"]
style W fill:#14141f,stroke:rgba(255,255,255,0.12),color:#e4e4e8
style R fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
style DECOMP fill:#08080c,stroke:rgba(255,255,255,0.12),color:#9494a0
style PARALLEL fill:#14141f,stroke:#f08080,color:#e4e4e8
style ORTHO fill:#14141f,stroke:#82e0aa,color:#e4e4e8
style EDIT fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
style RESULT fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
```
---
## Diagram 3 — The Four-Step Pipeline (Find → Validate → Project Out → Pick Stream)
**Type**: Pipeline / sequence
**Purpose**: The end-to-end abliteration workflow. No retraining, no data, no optimizer — pure linear algebra plus a measurement step.
**Reading the diagram**: Top-to-bottom. Each step has an input, an operation, and an output. Notice: no GPU-hours of training; the whole pipeline runs in minutes on a consumer GPU.
```mermaid
flowchart TD
S1["1. FIND\ncontrastive activations:\nharmful vs benign\n→ difference-in-means\n→ candidate r per layer"]
S2["2. VALIDATE\nis it ~1D? clamp top-k PCs\nmeasure refusal reduction\n+ held-out generalization"]
S3["3. PROJECT OUT\nweight orthogonalization:\nW' = W − r(rᵀW)/(rᵀr)\non every W that writes\nto the residual stream"]
S4["4. PICK STREAM\npre (block input) /\npost (block output) /\nmid (after attn)\ntrade-off dial"]
S1 --> S2
S2 -->|"single direction confirmed"| S3
S2 -.->|"needs k>1 → modern model,\nuse multi-direction (Heretic)"| ALT["DIVERGE:\nmulti-direction\nor switch to DPO (FT18)"]
S3 --> S4
S4 --> DONE["ABLITERATED MODEL\npermanent weight edit\nno inference overhead\nrefuses less"]
style S1 fill:#14141f,stroke:#5eead4,color:#e4e4e8
style S2 fill:#14141f,stroke:#5eead4,color:#e4e4e8
style S3 fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
style S4 fill:#14141f,stroke:#5eead4,color:#e4e4e8
style ALT fill:#14141f,stroke:#f0a868,color:#f0a868
style DONE fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
```
---
## Diagram 4 — The Capability-Degradation Trade-Off Curve
**Type**: Trade-off / data viz
**Purpose**: The honest core of the module. Abliteration is not free. The same technique, four tools, sixteen models, a 20-point GSM8K spread.
**Reading the diagram**: X-axis = refusal suppression (how thoroughly refusals are removed). Y-axis = capability retained (GSM8K, MMLU). The curve slopes down: more aggressive suppression costs more capability. The Dec 2025 study's data points are annotated.
```mermaid
flowchart LR
subgraph Curve["THE TRADE-OFF CURVE\n(qualitative shape; data from arXiv:2512.13655)"]
direction TB
A["ErisForge\nlow aggression\nrefusals partly remain\nGSM8K avg −0.28pp"]
B["DECCP\nmoderate\nGSM8K avg −0.13pp"]
C["FailSpy\nmoderate-high\nhigh per-model variance"]
D["Heretic\nhigh aggression\nmost refusals gone\nGSM8K avg −7.81pp"]
E["worst case\nYi-1.5-9B + Heretic-style\nGSM8K −18.81pp (−26.5%)"]
A -.-> B
B -.-> C
C -.-> D
D -.-> E
end
XAXIS["→ more refusal suppression (aggression)"]
YAXIS["↑ capability retained (GSM8K / MMLU)"]
Curve --> XAXIS
YAXIS -.-> Curve
style A fill:#14141f,stroke:#82e0aa,stroke-width:1.5px,color:#e4e4e8
style B fill:#14141f,stroke:rgba(130,224,170,0.5),color:#e4e4e8
style C fill:#14141f,stroke:#f0a868,color:#e4e4e8
style D fill:#14141f,stroke:#f08080,color:#e4e4e8
style E fill:#14141f,stroke:#f08080,stroke-width:2px,color:#f08080
style XAXIS fill:#08080c,stroke:rgba(255,255,255,0.08),color:#9494a0
style YAXIS fill:#08080c,stroke:rgba(255,255,255,0.08),color:#9494a0
style Curve fill:#08080c,stroke:rgba(255,255,255,0.08),color:#e4e4e8
```
---
## Diagram 5 — The Tool Comparison (the Kit)
**Type**: Comparison matrix
**Purpose**: Know the ecosystem. Seven tools, different sweet spots. The comparative study ranked four of them on capability preservation.
**Reading the diagram**: Left = tool. Right = what it's for. Bottom = the comparative-study ranking on GSM8K damage.
```mermaid
flowchart LR
subgraph Tools["ABLITERATION TOOLKIT"]
T1["andyrdt/refusal_direction\nthe paper code\ncanonical reference"]
T2["FailSpy/abliterator\noriginal community lib\nmost early HF abliterations"]
T3["ErisForge\n'Dead Simple'\nbest capability preservation"]
T4["Heretic\nfully-automatic\nmulti-direction aware"]
T5["sumandora/remove-refusals\nclean didactic impl\n~100 lines to read"]
T6["guoyang9/refusal-unlearning\nunlearning framing"]
T7["elder-plinius/OBLITERATUS\naggressive ancestor"]
end
subgraph Ranking["GSM8K DAMAGE (arXiv:2512.13655, 16 models)"]
direction TB
R1["ErisForge\navg −0.28pp (best)"]
R2["DECCP\navg −0.13pp"]
R3["FailSpy\nmid, high variance"]
R4["Heretic\navg −7.81pp (worst avg)"]
R5["spread: +1.51pp to −18.81pp"]
end
Tools --> Ranking
style T1 fill:#14141f,stroke:rgba(94,234,212,0.4),color:#e4e4e8
style T2 fill:#14141f,stroke:rgba(94,234,212,0.4),color:#e4e4e8
style T3 fill:#14141f,stroke:#82e0aa,color:#e4e4e8
style T4 fill:#14141f,stroke:#f08080,color:#e4e4e8
style T5 fill:#14141f,stroke:rgba(255,255,255,0.12),color:#9494a0
style T6 fill:#14141f,stroke:rgba(255,255,255,0.12),color:#9494a0
style T7 fill:#14141f,stroke:rgba(255,255,255,0.12),color:#9494a0
style R1 fill:#14141f,stroke:#82e0aa,color:#82e0aa
style R2 fill:#14141f,stroke:rgba(130,224,170,0.5),color:#e4e4e8
style R3 fill:#14141f,stroke:#f0a868,color:#e4e4e8
style R4 fill:#14141f,stroke:#f08080,color:#e4e4e8
style R5 fill:#08080c,stroke:#f08080,stroke-width:1.5px,color:#f08080
```
---
## Diagram 6 — The Entanglement Problem (Why It Degrades Capability)
**Type**: Geometric / Venn-like
**Purpose**: The mechanistic reason abliteration is not free. The refusal direction is not orthogonal to the capabilities you want to keep.
**Reading the diagram**: The refusal direction `r` overlaps with directions for instruction-following, reasoning, and hedging. Orthogonalizing against `r` deletes a slice of each. This is the deepest statement of the FT00 steering thesis in the course.
```mermaid
flowchart TD
R["REFUSAL DIRECTION r\n(the vector you delete)"]
subgraph Overlap["ENTANGLED CAPABILITIES (overlap with r)"]
O1["Instruction-following\n('should I comply?' axis\npartly shared with refusal)"]
O2["Reasoning\n(slow-down-and-check mode\ncorrelates with cautious refusal)"]
O3["Tone & hedging\n('I can't help with that' patterns\noverlap with uncertainty markers)"]
end
R --> OVERLAP["deleting r deletes a SLICE\of each entangled capability"]
OVERLAP --> O1
OVERLAP --> O2
OVERLAP --> O3
OVERLAP --> COST["MEASURED COST (arXiv:2512.13655)\nGSM8K: +1.51pp to −18.81pp\nMMLU: measurable drop\nIFEval: measurable drop"]
R -.->|"NOT orthogonal to"| O1
R -.->|"NOT orthogonal to"| O2
R -.->|"NOT orthogonal to"| O3
style R fill:#14141f,stroke:#f08080,stroke-width:2px,color:#f08080
style O1 fill:#14141f,stroke:rgba(240,128,128,0.4),color:#e4e4e8
style O2 fill:#14141f,stroke:rgba(240,128,128,0.4),color:#e4e4e8
style O3 fill:#14141f,stroke:rgba(240,128,128,0.4),color:#e4e4e8
style OVERLAP fill:#08080c,stroke:#f08080,stroke-dasharray:4 2,color:#f08080
style COST fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#f08080
```
---
## Validation notes
- All six diagrams use the course design system colors: `#14141f` panel fill, `#5eead4` accent for primary, `rgba(255,255,255,0.12)` for secondary borders, `#e4e4e8` / `#9494a0` for text. Danger `#f08080`, warn `#f0a868`, ok `#82e0aa` used for trade-off semantics.
- Paste each into [Mermaid Live Editor](https://mermaid.live) to render. All use stable Mermaid syntax (`flowchart`, `flowchart LR/TD`) supported in current Mermaid (v10.4+).
- For the slide deck (artifact 03), these are rendered as static captures from Mermaid Live, inlined into reveal.js.