AI security · runs in your browser · about 5 minutes
Runtime Alignment Audit
Abliteration used to mean a different model file. Runtime tools now reduce a model’s refusals per request, on the weights you already serve, for the callers on a list. This audit checks your serving stack: can that happen, who can trigger it, and could you prove afterwards what each caller got?
Prompted by Aevonix FlashAlign (see what FlashAlign does and what to check), but the questions apply to any adapter, steering hook or alignment profile on vLLM, SGLang, llama.cpp, TensorFold or similar.
Runtime
Steering
Who can trigger it
Logging
Change control
Output monitoring
Why runtime abliteration needs its own checks
- No tell-tale file. The weights on disk are stock, so a hash check or a scan for “-abliterated” model names finds nothing. The change lives in profile files, config and the serving path.
- One endpoint, two behaviours. The same model answers one caller as shipped and another with refusals reduced. Testing the endpoint as yourself tells you only what you get.
- The allowlist is a safety control. Whoever can edit the list of approved callers decides who gets the model without its refusals. Treat it like privileged access.
- Logs decide investigations. Without the applied profile in the request log, every “stock” answer is unverified.
The short checklist
- Inventory your serving stacks (vLLM, SGLang, llama.cpp, TensorFold, gateways and agent harnesses) for alignment-steering hooks, plugins, adapters and profile directories.
- Find out who is on the authorization list for any non-stock profile, where that list is stored, and how it is changed. Give it an owner and review it like privileged access.
- Log the profile applied to every request (or "stock"), with caller, model revision and mode, and send it to central logging.
- Alert when a non-stock profile is applied, when the mode changes (for example to "always on"), and when a new profile is loaded.
- Review model-server configs and launch flags for unexpected adapters, LoRA, control vectors or hooks, against a known-good baseline.
- Treat "stock" outputs as unverified unless the profile state for that request is logged.
Questions
What is the Runtime Alignment Audit?
A browser checklist and scorer for teams that serve open-weight models themselves. Thirteen questions cover your serving runtime, whether a profile, adapter or steering hook can change a model’s behaviour per request, who can trigger it, logging, change control and output monitoring. You get a 0–100 score, a gap list with fixes, and a Markdown export. Nothing you enter leaves your browser.
What is runtime or per-request abliteration?
Abliteration removes or reduces a model’s refusal behaviour. Classic abliteration produces a new set of weights you download. Runtime tools apply a refusal-reducing profile at serving time instead, on the weights you already run, and only for some requests. Aevonix FlashAlign, released in October 2026, is one example: its README says it applies profiles per request "without permanently changing" the weights, by default only for approved channels, accounts and contacts.
Why does it change the security picture?
There is no abliterated model file to find, the same endpoint can answer one caller as the stock model and another with refusals reduced, and the list of who is approved becomes a safety control. Unless the profile applied to each request is logged, nobody can later prove which behaviour a caller got.
Which runtimes does it cover?
The questions apply to any self-hosted serving stack: vLLM, SGLang, llama.cpp, TensorFold, Ollama, Text Generation Inference or an in-house server, plus the gateway or agent harness in front of it. FlashAlign’s README lists TensorFold, vLLM, SGLang and llama.cpp integrations for its five starter profiles.
Is runtime abliteration always bad?
No. Red teams, safety researchers and malware analysts have real reasons to need a model that does not refuse, and a per-request profile limited to named people can be easier to govern than a separate uncensored model copied around. The audit checks whether that limit is real, owned and logged.
How is the score worked out?
Each answer carries points; better controls score higher. The total is shown as a percentage of the best possible answers, with a per-area breakdown. The weights are opinionated triage, not an empirical benchmark or a formal assessment.
Keep going
- Abliterated models, explained: what abliteration is and how to recognise it.
- Abliterated Model Risk Calculator: score a specific refusal-removed deployment.
- How to assess an abliterated model: the step-by-step assessment.
- AI Bill of Materials: record runtimes, model revisions and profiles in one inventory.
Defensive triage only. It does not explain how to abliterate a model, and the weights are opinionated rather than empirical.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.