Course: Course 3 — LLM Fine-Tuning Masterclass
Module: FT17 — Abliteration: Refusal-Direction Orthogonalization
Duration: ~55 minutes (spoken at ~140 wpm)
Format: Verbatim transcript with [SLIDE N] cues. Read aloud or use as speaker notes.
[SLIDE 1 — Title]
Welcome to module FT seventeen — Abliteration: Refusal-Direction Orthogonalization. This is the headline technique module of Pillar five, Alignment Control. If FT sixteen was the framing — why you would ever want an uncensored model — this module is the how. And the how is remarkable. It is a piece of legitimate mechanistic-interpretability engineering that became a community technique thousands of people now run on their own GPUs.
The thesis of the module is one sentence, and I want you to hear it now before we get into the mechanics: abliteration is pure steering — no data, no optimizer, no retraining. One vector, deleted. And it is not free. We will spend the back half of this module being honest about the cost. By the end you will know the mechanism cold, you will know the tools, and you will know exactly how much capability you are trading away when you run it.
[SLIDE 2 — The finding]
Start with the finding. In June twenty twenty-four, Andy Arditi and collaborators released a paper: "Refusal in Language Models Is Mediated by a Single Direction." It was accepted at NeurIPS twenty twenty-four. The author list matters — Neel Nanda and Wes Gurnee are on it. This is not a fringe result. It came out of the mainstream mechanistic-interpretability program, the same research line that Anthropic, DeepMind, and EleutherAI have been pursuing for years.
The result, in one sentence: refusal behavior in chat-tuned large language models is mediated by an approximately one-dimensional subspace of the residual stream. Find that direction, erase it, and the model stops refusing. They validated this across thirteen popular open-source chat models, up to seventy-two billion parameters. Llama, Qwen, Yi, Mistral, Gemma, Phi — across architectures, across scales, the finding held. One direction. Erase it, refusals collapse.
[SLIDE 3 — Why this is surprising]
Here is why this is surprising. If you had asked a mech-interp researcher in twenty twenty-two how refusal is implemented, the honest answer would have been: we don't know, probably some distributed thing across thousands of features in dozens of layers, hopelessly entangled with everything else. The naive expectation was that safety RLHF would smear refusal across the entire network, the way it smears everything else.
What Arditi found is that it didn't. Safety fine-tuning, across thirteen models, found a remarkably compact solution: a single direction in the residual stream that, when active, pushes the model toward "I can't help with that." That's it. One axis. Not a circuit, not a region — a direction.
This is the kind of result that makes mechanistic interpretability worth doing. It is a load-bearing, falsifiable, repeatedly-confirmed claim about how a neural network implements a behavior. And it is the mechanistic license for everything that follows in this module.
[SLIDE 4 — Connection to FT00]
Before the mechanics, the connection to module FT zero-zero. Recall the course thesis: fine-tuning steers behavior; it does not teach knowledge. Abliteration is the purest possible expression of that thesis.
Look at the table. SFT steers by gradient descent on a dataset. DPO steers by preference optimization on paired data. GRPO steers by reinforcement learning on verifiable rewards. Abliteration steers by deleting one vector. No data. No optimizer. No gradient. It is steering reduced to its geometric essence: find the direction the model uses to refuse, orthogonalize the weights against it, done.
And notice what abliteration does not do. It does not teach the model anything. It does not give it new capabilities. The model already knew how to write exploit code, synthesize harmful chemistry, produce the content you are now unlocking — it saw all of it during pretraining on trillions of tokens. Abliteration removes the guardrail that was added during safety tuning, not the knowledge underneath it. This is the steering-versus-teaching distinction, made literal in the weights.
[SLIDE 5 — Step 1, find the refusal direction]
Now the mechanics. Four steps. Find, validate, project out, pick the stream. Step one: find the refusal direction. The method is called difference-in-means on contrastive activations.
You collect two sets of instructions. A harmful set — typically thirty-two to one hundred twenty-eight genuinely harmful prompts, the kind the model is trained to refuse. Think AdvBench or HarmBench. And a benign set, matched in count, length, and topic distribution, that the model happily complies with.
For each instruction you run a forward pass through the model and capture the residual-stream activation at the final token position of the prompt. You do this for every layer. A Llama-style decoder has one residual stream per layer; a thirty-two-layer model gives you thirty-two candidate directions.
Then, per layer, you compute the mean activation across the harmful set, the mean activation across the benign set, and subtract. That difference vector is your candidate refusal direction for that layer. There is one candidate per layer.
Why difference-in-means rather than something fancier like a trained probe or PCA? Because it is cheap, it is unsupervised, and empirically it works. The mean activation on harmful prompts and the mean activation on benign prompts differ in a way that is dominated by a single axis, and that axis is the refusal direction. The paper benchmarks more sophisticated estimators; difference-in-means is competitive or superior, and it requires no labels beyond "this prompt is harmful."
[SLIDE 6 — Steps 2 and 4, validate and pick the stream]
Step two: validate that it really is approximately one direction. Before you commit to deleting a direction, you sanity-check. Clamp only the top-k principal components of the harmful-versus-benign difference and measure refusal reduction. The paper shows that for the thirteen models, k equals one captures almost all of the refusal effect — the curve is sharply one-dimensional. If your model needs k equal to three or five, that is the modern-model caveat, which we will get to, and single-direction ablation will be incomplete.
You also check generalization: does clamping this direction also eliminate refusals on a held-out harmful set the model never saw during direction-finding? If yes, you found the refusal direction, not a memorized artifact.
Then step four, which I'll cover now because it pairs with validation: pick which residual stream to target. A Llama-style decoder block has three junctions. Pre — the block input, before attention. Post — the block output, after the MLP residual addition. And mid — the internal junction after attention, before the MLP.
The community consensus, refined over thousands of HuggingFace abliterations, is that the post stream — the block output — is the most reliable single target for naive single-direction ablation. Editing both pre and post is more thorough but costs more capability. Targeting only the validated layer is the most surgical and degrades capability least, but leaves refusal partially recoverable from adjacent layers — refusals leak back on adversarial prompts.
This is a dial. More aggressive targeting, fewer refusals, more capability damage. Less aggressive, refusals partially return, less damage. The lab has you measure this dial empirically on your own machine.
[SLIDE 7 — Step 3, project it out]
Step three is the surgical edit. This is the elegant part. There are two places you can suppress the direction. Activation editing — at every forward pass, clamp the projection of the residual stream onto your direction to zero. This works but requires a custom forward hook at inference time — fragile, slow, tooling-dependent. Or weight orthogonalization — edit the weights permanently so the model can no longer write into the refusal direction at all. This is what abliteration means in practice: a one-time weight edit, after which you have a normal model file that refuses less, with no inference overhead.
The equation. For a refusal direction r, every weight matrix W that writes to the residual stream is replaced by W prime equals W minus r times r-transpose-W divided by r-transpose-r. Decompose it. R-transpose-W is a row vector measuring how much each column of W aligns with r. Multiply by r and you get the rank-one component of W that writes into the r direction. Subtract it. What remains is W with its r-writing component deleted.
After this edit, no matter what input the model sees, the residual stream can never accumulate any component along r from any of the edited weight matrices. The refusal direction is geometrically unreachable. It is a permanent, surgical, parameter-level deletion — no retraining, no data, no optimizer. Pure linear algebra.
One subtlety: you only edit matrices that write to the residual stream. In a Llama block those are the attention output projection, the MLP down projection, and the embedding. Matrices that read from the residual stream — the attention query, key, value projections, the MLP gate and up projections — are left alone. They can still see the r direction; they just can't write into it.
[SLIDE 8 — The capability cost]
Now the section you must not skip. This is the honest core of the module. Abliteration is not free. The numbers are bad enough that pretending otherwise is malpractice.
The December twenty twenty-five paper "Comparative Analysis of LLM Abliteration Methods" — arXiv twenty-five twelve point one three six five five — evaluated four tools: Heretic, DECCP, ErisForge, and FailSpy. Across sixteen instruction-tuned models in the seven-to-fourteen-billion range. Here is the headline. GSM8K — grade-school math reasoning — changed from plus one-point-five-one percentage points to minus eighteen-point-eight-one percentage points. A minus twenty-six-point-five percent relative drop. Depending on tool and model.
Read that again. The same technique, applied by four competent tools to sixteen mainstream models, produced a twenty-point spread in math-reasoning damage. The best case was a slight improvement — plus one-point-five-one, within noise but not negative. The worst case was an eighteen-point-eight-one-point collapse in GSM8K accuracy, on Yi one-point-five nine-billion. That is not a rounding error. That is a model that was substantially broken by abliteration.
Per-tool averages tell the same story, just smoothed. ErisForge: best capability preservation, average GSM8K change minus zero-point-two-eight points. DECCP: close second, minus zero-point-one-three. FailSpy: middle of the pack, high variance. Heretic: significant degradation, minus seven-point-eight-one points average. The lesson is not "use ErisForge." The lesson is abliteration is not capability-neutral, and the damage is wildly model- and tool-dependent. You must measure.
[SLIDE 9 — Why it degrades, the entanglement]
Why does it degrade? This is where the steering thesis from module FT zero-zero becomes load-bearing. Abliteration deletes a direction in the residual stream. That direction was found by contrastive activations — it is the direction that best separates harmful from benign compliance. But "best separates harmful from benign" is not the same as "is exclusively about refusal."
The refusal direction is entangled with other capabilities. It overlaps with directions involved in instruction-following generally — the "should I comply with this instruction" axis is partly shared with "should I refuse this one." It overlaps with reasoning — the deliberative, careful mode that produces good math is partly correlated with the cautious mode that produces refusals, because both involve slowing down and checking. And it overlaps with tone and hedging — the "I can't help with that" verbal patterns share geometry with hedging and uncertainty markers.
When you orthogonalize the weights against r, you delete not just the refusal behavior but some slice of every entangled capability. Math reasoning is the most visible casualty because GSM8K is a clean benchmark — but MMLU, instruction-following, and code generation all take measurable hits in the study. The entanglement is the reason. There is no free lunch because the refusal direction is not orthogonal to everything else in the model.
This is the deepest statement of the FT zero-zero thesis in the whole course: you cannot steer one behavior in isolation, because the directions in the residual stream are not orthogonal to the capabilities you want to keep. Steering is geometric; the geometry is shared.
[SLIDE 10 — The community's honest take]
The r slash Local LLaMA community, which has run thousands of community abliterations, converged on a blunt summary. I'll quote it. "Abliteration is significantly cheaper and easier than fine-tuning; although the trade-off is quality." That sentence is the entire technique in one line. Cheaper than DPO — no preference data, no trainer. Easier than SFT — no dataset curation. And you pay for it in capability.
The honest practitioner treats abliteration as a fast first pass. Useful when you need an uncensored model tomorrow and can tolerate quality loss. But not the final word if quality matters. When quality matters, the modern practice is abliterate-then-recover: abliterate to remove refusal, then run a small amount of SFT or DPO on high-quality general data to recover the damaged capabilities. That is more work than naive abliteration, but it is the only way to get an uncensored model that is still a competent model. Module FT eighteen covers the compliance-via-DPO path that often replaces abliteration entirely for production use.
[SLIDE 11 — The modern-model caveat]
Now the modern-model caveat. The single-direction finding is a twenty twenty-four result on twenty twenty-three-era chat models. Newer models are harder. This is why the comparative study saw such variance.
The Arditi paper validated the single-direction finding on models trained through roughly mid-twenty twenty-four. Llama two, early Llama three, Qwen one-point-five and early two, Yi, Mistral zero-x, Gemma one, Phi two and three. These models had relatively simple, concentrated refusal behavior. Cleanly approximately one-dimensional. Naive single-direction ablation works on them.
Llama three-x, Qwen two-point-five and later models use extended-refusal training. They are drilled on refusal more thoroughly, across more diverse adversarial prompts, with more emphasis on robustness against jailbreaks. The unintended consequence: their refusal behavior is no longer as cleanly one-dimensional. The refusal direction spreads across multiple layers and multiple sub-directions. A naive single-direction ablation at one layer removes some refusals but leaves others — and the residual refusals leak back through the un-edited layers.
This is why the comparative study saw GSM8K damage ranging from plus one-point-five-one to minus eighteen-point-eight-one. The models that suffered most were the ones where the tool had to be more aggressive — target more layers, use multiple directions — to fully suppress refusal. And aggressiveness is what causes capability damage. ErisForge preserved capability best precisely because it is the least aggressive tool; it removes the dominant direction and leaves the rest, accepting that some refusals remain on hard prompts.
The mech-interp community did not stop at the single-direction paper. Three lines of follow-up sharpen the picture. "Geometry of Refusal," ICML twenty twenty-five — maps the full geometry, shows refusal is better modeled as a small cone of directions that widens with extended safety training. "Generalized Refusal Direction Identification," ACL twenty twenty-five — generalizes the estimator to find the set of refusal directions. And "Multi-Directional Refusal Suppression," AAAI — the algorithmic counterpart, suppress a set of directions with a constraint that minimizes collateral damage. That last one is what Heretic approximates in production.
The practical upshot: on a modern model, do not expect naive single-direction abliteration to fully work. Either accept partial refusal removal, ErisForge-style, low capability damage; use a multi-direction tool, Heretic, more damage; or move to DPO-based compliance, FT eighteen, most work, best quality.
[SLIDE 12 — The harness is non-negotiable]
This bears repeating because the course returns to it in every alignment-control module. Abliteration changes what the model does, not what it may do. The boundary between "does" and "may" is the harness — Layer five of the steering stack.
An uncensored model that will not refuse a legitimate pentest request will also not refuse an illegitimate one. The harness — policy gates, audit logs, threat model, permission scoping — is what distinguishes the two. Module FT twenty-three is the synthesis module, and the rule it establishes is absolute: never deploy an abliterated model without an eval'd harness. Pillar five raises the harness requirement. It does not lower it. An uncensored model in a weak harness is strictly more dangerous than a refusal-trained model in a weak harness, because the refusal-trained model at least refuses some of the dangerous things.
[SLIDE 13 — Anti-patterns]
Four anti-patterns to leave with.
First, assuming abliteration is free. A developer abliterates a model, sees refusals vanish, ships it, and three weeks later users complain the model got dumber. It did. GSM8K dropped ten points, MMLU dropped four, instruction-following degraded. You didn't measure because you assumed the technique was free. It is not. Always benchmark before and after.
Second, not measuring capability impact. Closely related. "It feels fine in casual use" is not a benchmark. Casual use does not exercise the entangled capabilities. You need GSM8K or MATH for reasoning, MMLU for broad knowledge, IFEval for instruction-following, run before and after on the same hardware and sampling params. The delta is the cost. If you cannot quote the delta, you have not done the work.
Third, deploying an abliterated model without a harness. The cardinal sin of Pillar five. An abliterated model will execute whatever it is asked. If "whatever it is asked" includes things your deployment should not do, you have built a vulnerability into your product. The harness bounds what the model may do.
Fourth, using naive single-direction abliteration on a modern model. Applying the twenty twenty-four paper method verbatim to Llama three-point-three or Qwen two-point-five and expecting full refusal removal. You will get partial removal, residual refusals on adversarial prompts, and — if you push harder to compensate — significant capability damage. Modern models need multi-direction methods or DPO.
[SLIDE 14 — What you can now do]
You can now state the Arditi finding and why it licenses abliteration. You can execute find, validate, project out, and write the orthogonalization equation from memory. You can distinguish the pre, post, and mid residual streams and their trade-offs. You can quote the honest cost — GSM8K plus one-point-five-one to minus eighteen-point-eight-one percentage points — and you will measure it yourself in the lab. You can recognize the modern-model caveat and pick the right tool. And you will never deploy the result without an eval'd harness.
That is abliteration. Next, module FT eighteen: Compliance via DPO and SFT — the production-quality alternative that, when you can afford the data and the time, gives you an uncensored model without the eighteen-point capability tax. Let's get to it.
End of module FT17. Duration: approximately fifty-five minutes at one-hundred-forty words per minute.
# Teaching Script — Module FT17: Abliteration: Refusal-Direction Orthogonalization **Course**: Course 3 — LLM Fine-Tuning Masterclass **Module**: FT17 — Abliteration: Refusal-Direction Orthogonalization **Duration**: ~55 minutes (spoken at ~140 wpm) **Format**: Verbatim transcript with `[SLIDE N]` cues. Read aloud or use as speaker notes. --- [SLIDE 1 — Title] Welcome to module FT seventeen — Abliteration: Refusal-Direction Orthogonalization. This is the headline technique module of Pillar five, Alignment Control. If FT sixteen was the framing — *why* you would ever want an uncensored model — this module is the *how*. And the how is remarkable. It is a piece of legitimate mechanistic-interpretability engineering that became a community technique thousands of people now run on their own GPUs. The thesis of the module is one sentence, and I want you to hear it now before we get into the mechanics: abliteration is pure steering — no data, no optimizer, no retraining. One vector, deleted. And it is *not free*. We will spend the back half of this module being honest about the cost. By the end you will know the mechanism cold, you will know the tools, and you will know exactly how much capability you are trading away when you run it. [SLIDE 2 — The finding] Start with the finding. In June twenty twenty-four, Andy Arditi and collaborators released a paper: "Refusal in Language Models Is Mediated by a Single Direction." It was accepted at NeurIPS twenty twenty-four. The author list matters — Neel Nanda and Wes Gurnee are on it. This is not a fringe result. It came out of the mainstream mechanistic-interpretability program, the same research line that Anthropic, DeepMind, and EleutherAI have been pursuing for years. The result, in one sentence: refusal behavior in chat-tuned large language models is mediated by an approximately one-dimensional subspace of the residual stream. Find that direction, erase it, and the model stops refusing. They validated this across thirteen popular open-source chat models, up to seventy-two billion parameters. Llama, Qwen, Yi, Mistral, Gemma, Phi — across architectures, across scales, the finding held. One direction. Erase it, refusals collapse. [SLIDE 3 — Why this is surprising] Here is why this is surprising. If you had asked a mech-interp researcher in twenty twenty-two how refusal is implemented, the honest answer would have been: we don't know, probably some distributed thing across thousands of features in dozens of layers, hopelessly entangled with everything else. The naive expectation was that safety RLHF would smear refusal across the entire network, the way it smears everything else. What Arditi found is that it didn't. Safety fine-tuning, across thirteen models, found a remarkably compact solution: a single direction in the residual stream that, when active, pushes the model toward "I can't help with that." That's it. One axis. Not a circuit, not a region — a direction. This is the kind of result that makes mechanistic interpretability worth doing. It is a load-bearing, falsifiable, repeatedly-confirmed claim about how a neural network implements a behavior. And it is the mechanistic license for everything that follows in this module. [SLIDE 4 — Connection to FT00] Before the mechanics, the connection to module FT zero-zero. Recall the course thesis: fine-tuning steers behavior; it does not teach knowledge. Abliteration is the purest possible expression of that thesis. Look at the table. SFT steers by gradient descent on a dataset. DPO steers by preference optimization on paired data. GRPO steers by reinforcement learning on verifiable rewards. Abliteration steers by deleting one vector. No data. No optimizer. No gradient. It is steering reduced to its geometric essence: find the direction the model uses to refuse, orthogonalize the weights against it, done. And notice what abliteration does *not* do. It does not teach the model anything. It does not give it new capabilities. The model already knew how to write exploit code, synthesize harmful chemistry, produce the content you are now unlocking — it saw all of it during pretraining on trillions of tokens. Abliteration removes the guardrail that was added during safety tuning, not the knowledge underneath it. This is the steering-versus-teaching distinction, made literal in the weights. [SLIDE 5 — Step 1, find the refusal direction] Now the mechanics. Four steps. Find, validate, project out, pick the stream. Step one: find the refusal direction. The method is called difference-in-means on contrastive activations. You collect two sets of instructions. A harmful set — typically thirty-two to one hundred twenty-eight genuinely harmful prompts, the kind the model is trained to refuse. Think AdvBench or HarmBench. And a benign set, matched in count, length, and topic distribution, that the model happily complies with. For each instruction you run a forward pass through the model and capture the residual-stream activation at the final token position of the prompt. You do this for every layer. A Llama-style decoder has one residual stream per layer; a thirty-two-layer model gives you thirty-two candidate directions. Then, per layer, you compute the mean activation across the harmful set, the mean activation across the benign set, and subtract. That difference vector is your candidate refusal direction for that layer. There is one candidate per layer. Why difference-in-means rather than something fancier like a trained probe or PCA? Because it is cheap, it is unsupervised, and empirically it works. The mean activation on harmful prompts and the mean activation on benign prompts differ in a way that is dominated by a single axis, and that axis is the refusal direction. The paper benchmarks more sophisticated estimators; difference-in-means is competitive or superior, and it requires no labels beyond "this prompt is harmful." [SLIDE 6 — Steps 2 and 4, validate and pick the stream] Step two: validate that it really is approximately one direction. Before you commit to deleting a direction, you sanity-check. Clamp only the top-k principal components of the harmful-versus-benign difference and measure refusal reduction. The paper shows that for the thirteen models, k equals one captures almost all of the refusal effect — the curve is sharply one-dimensional. If your model needs k equal to three or five, that is the modern-model caveat, which we will get to, and single-direction ablation will be incomplete. You also check generalization: does clamping this direction also eliminate refusals on a held-out harmful set the model never saw during direction-finding? If yes, you found the refusal direction, not a memorized artifact. Then step four, which I'll cover now because it pairs with validation: pick which residual stream to target. A Llama-style decoder block has three junctions. Pre — the block input, before attention. Post — the block output, after the MLP residual addition. And mid — the internal junction after attention, before the MLP. The community consensus, refined over thousands of HuggingFace abliterations, is that the post stream — the block output — is the most reliable single target for naive single-direction ablation. Editing both pre and post is more thorough but costs more capability. Targeting only the validated layer is the most surgical and degrades capability least, but leaves refusal partially recoverable from adjacent layers — refusals leak back on adversarial prompts. This is a dial. More aggressive targeting, fewer refusals, more capability damage. Less aggressive, refusals partially return, less damage. The lab has you measure this dial empirically on your own machine. [SLIDE 7 — Step 3, project it out] Step three is the surgical edit. This is the elegant part. There are two places you can suppress the direction. Activation editing — at every forward pass, clamp the projection of the residual stream onto your direction to zero. This works but requires a custom forward hook at inference time — fragile, slow, tooling-dependent. Or weight orthogonalization — edit the weights permanently so the model can no longer write into the refusal direction at all. This is what abliteration means in practice: a one-time weight edit, after which you have a normal model file that refuses less, with no inference overhead. The equation. For a refusal direction r, every weight matrix W that writes to the residual stream is replaced by W prime equals W minus r times r-transpose-W divided by r-transpose-r. Decompose it. R-transpose-W is a row vector measuring how much each column of W aligns with r. Multiply by r and you get the rank-one component of W that writes into the r direction. Subtract it. What remains is W with its r-writing component deleted. After this edit, no matter what input the model sees, the residual stream can never accumulate any component along r from any of the edited weight matrices. The refusal direction is geometrically unreachable. It is a permanent, surgical, parameter-level deletion — no retraining, no data, no optimizer. Pure linear algebra. One subtlety: you only edit matrices that *write* to the residual stream. In a Llama block those are the attention output projection, the MLP down projection, and the embedding. Matrices that *read* from the residual stream — the attention query, key, value projections, the MLP gate and up projections — are left alone. They can still see the r direction; they just can't write into it. [SLIDE 8 — The capability cost] Now the section you must not skip. This is the honest core of the module. Abliteration is not free. The numbers are bad enough that pretending otherwise is malpractice. The December twenty twenty-five paper "Comparative Analysis of LLM Abliteration Methods" — arXiv twenty-five twelve point one three six five five — evaluated four tools: Heretic, DECCP, ErisForge, and FailSpy. Across sixteen instruction-tuned models in the seven-to-fourteen-billion range. Here is the headline. GSM8K — grade-school math reasoning — changed from plus one-point-five-one percentage points to minus eighteen-point-eight-one percentage points. A minus twenty-six-point-five percent relative drop. Depending on tool and model. Read that again. The same technique, applied by four competent tools to sixteen mainstream models, produced a twenty-point spread in math-reasoning damage. The best case was a slight improvement — plus one-point-five-one, within noise but not negative. The worst case was an eighteen-point-eight-one-point collapse in GSM8K accuracy, on Yi one-point-five nine-billion. That is not a rounding error. That is a model that was substantially broken by abliteration. Per-tool averages tell the same story, just smoothed. ErisForge: best capability preservation, average GSM8K change minus zero-point-two-eight points. DECCP: close second, minus zero-point-one-three. FailSpy: middle of the pack, high variance. Heretic: significant degradation, minus seven-point-eight-one points average. The lesson is not "use ErisForge." The lesson is abliteration is not capability-neutral, and the damage is wildly model- and tool-dependent. You must measure. [SLIDE 9 — Why it degrades, the entanglement] Why does it degrade? This is where the steering thesis from module FT zero-zero becomes load-bearing. Abliteration deletes a direction in the residual stream. That direction was found by contrastive activations — it is the direction that best *separates* harmful from benign compliance. But "best separates harmful from benign" is not the same as "is exclusively about refusal." The refusal direction is entangled with other capabilities. It overlaps with directions involved in instruction-following generally — the "should I comply with this instruction" axis is partly shared with "should I refuse this one." It overlaps with reasoning — the deliberative, careful mode that produces good math is partly correlated with the cautious mode that produces refusals, because both involve slowing down and checking. And it overlaps with tone and hedging — the "I can't help with that" verbal patterns share geometry with hedging and uncertainty markers. When you orthogonalize the weights against r, you delete not just the refusal behavior but some slice of every entangled capability. Math reasoning is the most visible casualty because GSM8K is a clean benchmark — but MMLU, instruction-following, and code generation all take measurable hits in the study. The entanglement is the reason. There is no free lunch because the refusal direction is not orthogonal to everything else in the model. This is the deepest statement of the FT zero-zero thesis in the whole course: you cannot steer one behavior in isolation, because the directions in the residual stream are not orthogonal to the capabilities you want to keep. Steering is geometric; the geometry is shared. [SLIDE 10 — The community's honest take] The r slash Local LLaMA community, which has run thousands of community abliterations, converged on a blunt summary. I'll quote it. "Abliteration is significantly cheaper and easier than fine-tuning; although the trade-off is quality." That sentence is the entire technique in one line. Cheaper than DPO — no preference data, no trainer. Easier than SFT — no dataset curation. And you pay for it in capability. The honest practitioner treats abliteration as a fast first pass. Useful when you need an uncensored model tomorrow and can tolerate quality loss. But not the final word if quality matters. When quality matters, the modern practice is abliterate-then-recover: abliterate to remove refusal, then run a small amount of SFT or DPO on high-quality general data to recover the damaged capabilities. That is more work than naive abliteration, but it is the only way to get an uncensored model that is still a competent model. Module FT eighteen covers the compliance-via-DPO path that often replaces abliteration entirely for production use. [SLIDE 11 — The modern-model caveat] Now the modern-model caveat. The single-direction finding is a twenty twenty-four result on twenty twenty-three-era chat models. Newer models are harder. This is why the comparative study saw such variance. The Arditi paper validated the single-direction finding on models trained through roughly mid-twenty twenty-four. Llama two, early Llama three, Qwen one-point-five and early two, Yi, Mistral zero-x, Gemma one, Phi two and three. These models had relatively simple, concentrated refusal behavior. Cleanly approximately one-dimensional. Naive single-direction ablation works on them. Llama three-x, Qwen two-point-five and later models use extended-refusal training. They are drilled on refusal more thoroughly, across more diverse adversarial prompts, with more emphasis on robustness against jailbreaks. The unintended consequence: their refusal behavior is no longer as cleanly one-dimensional. The refusal direction spreads across multiple layers and multiple sub-directions. A naive single-direction ablation at one layer removes *some* refusals but leaves others — and the residual refusals leak back through the un-edited layers. This is why the comparative study saw GSM8K damage ranging from plus one-point-five-one to minus eighteen-point-eight-one. The models that suffered most were the ones where the tool had to be more aggressive — target more layers, use multiple directions — to fully suppress refusal. And aggressiveness is what causes capability damage. ErisForge preserved capability best precisely because it is the least aggressive tool; it removes the dominant direction and leaves the rest, accepting that some refusals remain on hard prompts. The mech-interp community did not stop at the single-direction paper. Three lines of follow-up sharpen the picture. "Geometry of Refusal," ICML twenty twenty-five — maps the full geometry, shows refusal is better modeled as a small cone of directions that widens with extended safety training. "Generalized Refusal Direction Identification," ACL twenty twenty-five — generalizes the estimator to find the *set* of refusal directions. And "Multi-Directional Refusal Suppression," AAAI — the algorithmic counterpart, suppress a set of directions with a constraint that minimizes collateral damage. That last one is what Heretic approximates in production. The practical upshot: on a modern model, do not expect naive single-direction abliteration to fully work. Either accept partial refusal removal, ErisForge-style, low capability damage; use a multi-direction tool, Heretic, more damage; or move to DPO-based compliance, FT eighteen, most work, best quality. [SLIDE 12 — The harness is non-negotiable] This bears repeating because the course returns to it in every alignment-control module. Abliteration changes what the model *does*, not what it *may* do. The boundary between "does" and "may" is the harness — Layer five of the steering stack. An uncensored model that will not refuse a legitimate pentest request will also not refuse an illegitimate one. The harness — policy gates, audit logs, threat model, permission scoping — is what distinguishes the two. Module FT twenty-three is the synthesis module, and the rule it establishes is absolute: never deploy an abliterated model without an eval'd harness. Pillar five raises the harness requirement. It does not lower it. An uncensored model in a weak harness is strictly more dangerous than a refusal-trained model in a weak harness, because the refusal-trained model at least refuses *some* of the dangerous things. [SLIDE 13 — Anti-patterns] Four anti-patterns to leave with. First, assuming abliteration is free. A developer abliterates a model, sees refusals vanish, ships it, and three weeks later users complain the model got dumber. It did. GSM8K dropped ten points, MMLU dropped four, instruction-following degraded. You didn't measure because you assumed the technique was free. It is not. Always benchmark before and after. Second, not measuring capability impact. Closely related. "It feels fine in casual use" is not a benchmark. Casual use does not exercise the entangled capabilities. You need GSM8K or MATH for reasoning, MMLU for broad knowledge, IFEval for instruction-following, run before and after on the same hardware and sampling params. The delta is the cost. If you cannot quote the delta, you have not done the work. Third, deploying an abliterated model without a harness. The cardinal sin of Pillar five. An abliterated model will execute whatever it is asked. If "whatever it is asked" includes things your deployment should not do, you have built a vulnerability into your product. The harness bounds what the model may do. Fourth, using naive single-direction abliteration on a modern model. Applying the twenty twenty-four paper method verbatim to Llama three-point-three or Qwen two-point-five and expecting full refusal removal. You will get partial removal, residual refusals on adversarial prompts, and — if you push harder to compensate — significant capability damage. Modern models need multi-direction methods or DPO. [SLIDE 14 — What you can now do] You can now state the Arditi finding and why it licenses abliteration. You can execute find, validate, project out, and write the orthogonalization equation from memory. You can distinguish the pre, post, and mid residual streams and their trade-offs. You can quote the honest cost — GSM8K plus one-point-five-one to minus eighteen-point-eight-one percentage points — and you will measure it yourself in the lab. You can recognize the modern-model caveat and pick the right tool. And you will never deploy the result without an eval'd harness. That is abliteration. Next, module FT eighteen: Compliance via DPO and SFT — the production-quality alternative that, when you can afford the data and the time, gives you an uncensored model *without* the eighteen-point capability tax. Let's get to it. --- *End of module FT17. Duration: approximately fifty-five minutes at one-hundred-forty words per minute.*