An Embarrassingly Simple Defense Against LLM Abliteration Attacks
Large language models (LLMs) are typically aligned to comply with safety
guidelines by refusing harmful instructions. A recent attack, termed
abliteration, isolates and suppresses the single latent direction most
responsible for refusal behavior, enabling the model to generate unethical
content. We propose a defense that modifies how models generate refusals. We
construct an extended-refusal dataset that contains harmful prompts with a full
response that justifies the reason for refusal. We then fine-tune
Llama-2-7B-Chat and Qwen2.5-Instruct (1.5B and 3B parameters) on our
extended-refusal dataset, and evaluate the resulting systems on a set of
harmful prompts. In our experiments, extended-refusal models maintain high
refusal rates, dropping at most by 10%, whereas baseline models' refusal rates
drop by 70-80% after abliteration. A broad evaluation of safety and utility
shows that extended-refusal fine-tuning neutralizes the abliteration attack
while preserving general performance.
68357c8ef0b7aba41a858b61
Harethah Abu Shairah
admin_assigned
2025-05-27T12:45:40.779Z
65f6eff66396309f02a18dab
/avatars/3b315ecbe2815859ca7fb16d277740c8.svg
Harethah Abu Shairah
user
HarethahMo
68357c8ef0b7aba41a858b62
Hasan Abed Al Kader Hammoud
admin_assigned
2025-05-27T12:45:54.956Z
642b51385bf2355d02a23d15
/avatars/87985347643b2647555f2453fa4d94fb.svg
Hasan Abed Al Kader Hammoud
user
hammh0a
68357c8ef0b7aba41a858b63
Bernard Ghanem
admin_assigned
2025-05-27T12:46:01.582Z
6808bf97ffadd78ec71cb721
/avatars/9adca3142c06b8f69889fcbe85fa374d.svg
Bernard Ghanem
user
bernardghanem
68357c8ef0b7aba41a858b64
George Turkiyyah
An Embarrassingly Simple Defense Against LLM Abliteration Attacks
Large language models (LLMs) are typically aligned to comply with safety
guidelines by refusing harmful instructions. A recent attack, termed
abliteration, isolates and suppresses the single latent direction most
responsible for refusal behavior, enabling the model to generate unethical
content. We propose a defense that modifies how models generate refusals. We
construct an extended-refusal dataset that contains harmful prompts with a full
response that justifies the reason for refusal. We then fine-tune
Llama-2-7B-Chat and Qwen2.5-Instruct (1.5B and 3B parameters) on our
extended-refusal dataset, and evaluate the resulting systems on a set of
harmful prompts. In our experiments, extended-refusal models maintain high
refusal rates, dropping at most by 10%, whereas baseline models' refusal rates
drop by 70-80% after abliteration. A broad evaluation of safety and utility
shows that extended-refusal fine-tuning neutralizes the abliteration attack
while preserving general performance.
Modifying models to generate justified refusals through fine-tuning on an extended-refusal dataset mitigates ablation attacks while maintaining high refusal rates and general performance.
large language models LLMs ablation latent direction refusal behavior extended-refusal dataset Llama-2-7B-Chat Qwen2.5-Instruct parameter-efficient fine-tuning