Abliteration: removing the model's refusal ability

The authors fully reproduce abliteration on Qwen3.5-4B, directly editing weights to remove the model's refusal ability without retraining, reducing the refusal rate on unseen prompts from 100% to about 1%, with little change in normal responses (KL 0.058). The method originates from the finding in Arditi et al.'s 2024 blog post (later published as a paper) that refusal is mediated by a single direction inside the model; the authors follow Maxime Labonne's tutorial, computing the average difference between harmful and harmless prompts at each layer to obtain candidate refusal directions, then screening layer by layer with three tests—Remove, Add, and KL—determining that layer 11 is the only direction that both eliminates refusal and does not break normal responses, and then rewriting the 64 matrices among the 32 layers that write into the residual stream so that they no longer output along that direction. The authors also use the fact that refusals almost all begin with I (99.4% on harmful prompts) as a criterion.