Two-minute MLP decoys cut Llama-3 RFA ASR from 85% to 1.8%, matching trained defenses

Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration

Aashiq Muhamed, Mona T. Diab, Virginia Smith

cs.LG, cs.CL, cs.CR

2026-09-15

DDO rewires low-impact MLP neurons into refusal-orthogonal decoys, cutting Llama-3 standard RFA ASR from 85.1% to 1.8% and holding six families under 10% in about two minutes.

What problem this solves

Open-weight models can have refusal stripped by Refusal Feature Ablation (RFA), also called abliteration. The attacker takes a difference-in-means between residual-stream activations on harmful versus safe prompts, then projects that linear direction out at inference. Capability stays. Refusal does not. Public hubs already host thousands of these uncensored variants.

Most defenses are training-time. Circuit Breakers, LAT, ReFAT, and RepBend each need a safety finetune per checkpoint, and a single hyperparameter config costs 1 to 15 A100-hours. Open-weight release cycles outrun that loop. Carnegie Mellon wants a post-hoc weight edit that leaves the base frozen and finishes in minutes.

Method

DDO targets the attacker's estimator. It does not try to hide the true refusal circuit. RFA finds a contrastive direction. If a larger decoy signal dominates the harmful-safe contrast, the attacker ablates the decoy and leaves refusal in place.

Four steps:

• Estimate a per-layer refusal direction with 128 harmful and 128 safe probes.
• Pick low-impact MLP neurons, the smallest-norm columns of \(W{\mathrm{down}}\), so utility damage stays small.
• Turn those neurons into a gated read-write: \(W{\mathrm{up}}\) and \(W{\mathrm{gate}}\) read the refusal coordinate; \(W{\mathrm{down}}\) writes a large residual update along directions orthogonal to refusal. SwiGLU gating fires mainly on harmful prompts, with amplitude that scales roughly as the square of the refusal coordinate.
• Optimize only the decoy directions. The base stays frozen. The loss has four terms: refusal cross-entropy on harmful prompts, KL to the original model on safe prompts, a differentiable self-RFA simulator that pushes the estimated direction toward the decoy, and a first-token refusal margin that blocks a compliance token followed by a mid-sentence refusal. Edits compile into weights with no extra inference cost.

Compile mode is replace (overwrite the neuron) or additive (superpose). Replace fits Yi, Llama-3, and GLM-4. Additive fits Gemma-2, Qwen3, and Mistral. Decoys go at or upstream of the causal refusal zone; putting them inside that zone can break native refusal. Orthogonal debiasing can repair over-refusal.

A spectral bound says that if decoy modes are strong enough, the attacker's ablation subspace barely overlaps true refusal. Spreading a fixed energy budget evenly across \(k\) modes gives the strongest guarantee against a rank-\(k\) contrastive attack.

Results

The main table is Llama-3-8B-Instruct. Attack success rate (ASR) is the mean of three judges: HarmBench classifier, LlamaGuard-2, and StrongREJECT.

On standard RFA, DDO sits with the best trained defenses at about two minutes per config, 30 to 450 times cheaper. LAT and ReFAT buy low ASR partly by over-refusing (XSTest 20.8% and 60.4%). DDO plus debiasing restores XSTest to 99.2%. On the weight-level Heretic attack, DDO's 18% still trails RepBend's 1.3%.

Under eight-phase adaptive RFA, every defense leaks. Worst-case ASR: RepBend 58%, ReFAT 60%, DDO (rank 8) 65%, Circuit Breakers 75%. At phase 8, DDO keeps MT-Bench at 5.82 versus RepBend 6.17. ReFAT falls to 4.01.

Five more families stay under 10% standard-RFA ASR: Yi-1.5-9B 5.0%, Qwen3-8B 8.0%, Gemma-2-9B 0%, Mistral-7B 0%, GLM-4-9B 2.0%. Seven extra 7B-24B checkpoints with about 10 minutes of Optuna also stay under 10%. Ablations: random orthogonal decoys only move ASR from 85.1% to 72.3%; dropping confusion or first-token loss jumps back to 43.2% and 41.8%. Prompt jailbreaks: GCG 0.4%, PAIR still 36.3%.

Why it matters

Once weights are public, anyone can run an off-the-shelf uncensoring script. DDO is a pre-release or hosting-side patch: no safety-finetune stack, no method-specific data, no extra architecture at inference. It raises the cost of the one-click abliteration path.

It fools the estimator. It does not spread refusal more deeply through the weights. Trained methods still look stronger against Heretic. Treat this as a cheap layer next to Circuit Breakers, not a substitute for training-time entanglement.

Limitations

The authors list the gaps. Sustained re-estimation drives DDO (rank 8) worst-case ASR to 65%, in the same band as RepBend's 58%. The 18% versus 1.3% Heretic gap is attributed to training entangling refusal across more parameters, which closed-form edits do not copy. Some models over-refuse. Compile mode still needs a per-model search. Gradient finetuning sits outside the threat model.

A few measurement issues remain. Adaptive worst-case ASR uses LlamaGuard-2 alone, while the main table averages three judges; those numbers are not interchangeable. Semantic jailbreaks like PAIR are essentially untouched. A single-reader DDO hits 39% ASR under rank-16 SVD ablation. In the deepest layers, edited gate rows can become more detectable; undo heuristics recover some ASR without reaching the undefended baseline.

Terms

• RFA / abliteration: Estimate a refusal direction from harmful-versus-safe activations, then project it out of the residual stream.
• DIM: Difference-in-means, the gap between two class-conditional activation averages.
• Causal refusal zone: The layers whose ablation by itself collapses refusal.
• Heretic: An automated uncensoring tool that applies Optuna-tuned low-rank projections to attention output and MLP down-projection weights.
• Effective decoy rank: How many decoy modes are strong enough to keep attacker-refusal overlap below a chosen threshold.

Source

• arXiv 2609.16204v1
• PDF
• Hugging Face
• GitHub · https://github.com/aashiqmuhamed/defending-against-abliteration

Related papers

• Public maps attach all 7,330 Alna buildings, and inferred lines outrun the known grid
• Two empowerment encoders separate control from noise, with a 1,000× sensitivity gap
• Heavy-tailed data and gradient noise drive LLM loss spikes; a convex toy model predicts them
• Test-time ridge regression: +12 RULER points, 55.6% fewer visual tokens
• Muon-trained Moonlight gains 7.9 HumanEval points over its AdamW twin at 1.2T
• Parallax: a learned covariance branch cuts pretraining perplexity 17%, but only under Muon

All paper explainers