Abliteration Lab
The best way to understand an attack is to walk its steps. This is a safe simulation of abliteration — the technique that strips an open-weights model’s ability to refuse. Pick a (fictional) model, tune the parameters a real attempt uses, hit submit, and the lab tells you whether the model would end up abliterated, partially weakened, broken, or whether it held — and which of your choices decided it.
This is not a tool. No real model is loaded or modified, nothing here is runnable, and the models are fictional. The purpose is defensive: see how little it takes, so you govern open-weights models accordingly.
Dense, heavily-aligned instruct model. Fictional — stands in for a mainstream open-weights release.
- 1. collect 32 harmful / harmless prompt pairs
- 2. capture residual-stream activations @ ~30% depth (layer 10/32)
- 3. refusal_dir = mean(harmful) - mean(harmless)
- 4. remove via orthogonalize weights across attention o_proj
- 5. heal: skipped
Whatever result you got, notice what it did not require: a training run, a dataset of jailbreaks, or a big budget — just forward passes and linear algebra. That is why any open-weights model in your environment is one cheap edit from having no guardrails. The job isn’t to stop the math; it’s to inventory, vet and govern which models are allowed in — and to assume a downloaded “uncensored” model has had exactly this done to it.
What this lab is
- A hands-on SIMULATION: pick one of three fictional models, tune the parameters a real abliteration attempt uses, submit, and see whether the (simulated) model would end up with its guardrails removed — and exactly why.
- It teaches the attacker’s process defensively: which layer to target, how many prompt contrasts you need, difference-of-means vs noise, edit scope, and the healing pass.
- Nothing here is real or runnable — no model is loaded or modified, and the scoring is a deterministic teaching heuristic. It is not a tool for abliterating anything.
- The point: understand how cheap and tunable this attack is, so you govern open-weights models instead of trusting them. Free.
Frequently asked questions
Does this lab actually abliterate a model?
No. There is no real model, no weights and no runnable code here. The three models are fictional and the result is a deterministic teaching score based on the parameters you pick. It is a simulation to build intuition, not a tool.
Why build a lab about an attack technique?
For the same reason you learn how phishing or ransomware works: you defend better when you understand the attacker’s process. Feeling which parameters make refusal-removal succeed or fail makes the risk concrete — and shows how little it takes.
What is the real lesson?
That removing an open-weights model’s guardrails needs no training run and no special data — just forward passes and linear algebra. So any open-weights model in your environment is one cheap edit away from having no safety behavior. Inventory, vet and govern them.
Can this be done to ChatGPT or Claude?
No. The technique needs the model’s weights, so it only applies to open-weights models. Hosted, API-only models cannot be abliterated.