00 // The Series
Everything else on this site attacks models through the context window: prompts, injected instructions, poisoned data. This series attacks the weights. Abliteration is the cleanest example there is — a surgical, one-time edit that strips a model's refusal behavior without a single step of training. Understanding it teaches you two things at once: how safety alignment actually works inside a transformer, and why it's brittle.
If your entire guardrail reduces to one vector in activation space, that's not just an attack surface — it's the same lesson prompt injection teaches, one layer deeper. The research project that coined the technique framed it exactly that way: current safety fine-tuning is brittle.
01 // The Guides
The Complete n00b's Guide to Abliteration
The mental model, no terminal required. Residual streams, the refusal direction, difference-in-means, and the two cuts: inference-time directional ablation vs permanent weight orthogonalization. What breaks, what survives, why the single-direction story is only mostly true.
PART 2 · HANDS-ONAbliterate Your First Small Model
The doing-it guide. Two honest paths: the two-command easy way and the by-hand manual way that shows where every trap lives. Qwen2.5 or Qwen3, both eval axes, no skipped steps — plus the defender's side of the table.
02 // Sources
The series is built on the primary research and write-ups, not secondhand summaries:
- Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (NeurIPS 2024)
- mlabonne, Uncensor any LLM with abliteration (Hugging Face blog)
- FailSpy, abliterator (GitHub)
- Caleb Fahlgren, How Abliteration Works
- grimjim, Norm-Preserving Biprojected Abliteration (Hugging Face blog)
- Nous Research, llm-abliteration (GitHub)