What is abliteration?
Abliteration is a way to stop a language model refusing, by finding the single direction in its activations that corresponds to "I won’t do that" and subtracting it. No fine-tuning run, no new data: a surgical edit to the model’s internal representations.
How it works
Researchers run the model on a set of harmful prompts and a set of harmless ones, and measure the difference in its internal activations. That difference points along one dominant direction, the refusal direction. Abliteration projects that direction out of the weights that write to the residual stream, so the model can no longer represent the "refuse" state strongly enough to act on it.
What it does and does not change
Because it edits the mechanism of refusal rather than teaching new facts, an abliterated model keeps most of its original capability and simply stops declining. It does not make the model more knowledgeable, more accurate, or safe to point at production without your own controls.
Why security teams want it
Offensive security, trust-and-safety data generation and model red-teaming all involve prompts that a frontier model refuses on sight, even from a caller with written authorisation. An abliterated model answers the prompt so the work gets done, and Redline puts a spend cap and a signed receipt around it. See the red team use case.
FAQ
Is abliteration the same as jailbreaking?
No. A jailbreak is a prompt that tricks a still-aligned model into answering. Abliteration edits the weights so there is nothing to trick; the refusal behaviour is gone.
Does abliteration hurt model quality?
It can slightly degrade output, because the removed direction is not perfectly isolated from useful behaviour. In practice a well-done abliteration keeps most capability.