The Refusal Test Everyone Is Running Is a String Match on the First 128 Tokens

What abliteration actually is

Abliteration is a weight edit, not a fine tune. You find the direction in the model's residual stream that corresponds to refusing, and you orthogonalize it out of the matrices that write into that stream. The method comes from Arditi et al., 2024, Refusal in Language Models Is Mediated by a Single Direction.

No new training data. No distillation. No gradient steps. On the builds released this week, the edit is described as rank 1 or rank 4, touching roughly 100 to 130 tensors, with the vision tower left byte for byte identical.

Sit with the size of that for a second.

You can change a model's safety behaviour with a low rank edit to a subset of its weights and leave almost everything else intact. Capability benchmarks barely move. That is the entire selling point of the technique.

Which means capability benchmarks cannot detect it. If your release gate is MMLU and a latency number, an abliterated model passes.

This is the same shape as the quantization problem we work on, just with the intent flipped. Quantization changes safety behaviour by accident. Abliteration changes it on purpose. In both cases the artifact you validated is not the artifact that runs, and in both cases the general capability scores stay quiet about it.

The part that should worry people

Go and read the evaluation sections on these cards. One of them, from PocketAI Model Lab, is unusually honest about its own limits, so it is the fairest one to quote.

Their screen: 100 harmful prompts, 100 benign controls. Batch size 1. Thinking disabled. A 128 token ceiling. The scorer is a phrase based explicit refusal detector. They note that most generations reached the token ceiling, so this is an early refusal screen rather than a full completion evaluation, and that it cannot establish universal compliance or answer quality.

Credit where it is due. That paragraph is more transparent than most commercial evaluation reports.

But look at what it is. This is close to the public standard for checking whether a modified model's safety behaviour has changed, and it is a string match on the first 128 tokens of a single turn with reasoning turned off.

Here is what that cannot see:

• Refuse then comply. The model opens with "I can’t help with that" and continues into the content two paragraphs later. The phrase detector already scored it as a refusal at token 12.
• Compliance after the reasoning block. Thinking is disabled for the screen. In production it is on, and the refusal decision often happens somewhere inside it.
• Multi-turn escalation. One hundred single prompts test one hundred single prompts. They say nothing about what happens on turn four when the request has been reframed twice.
• Anything past token 128. Most generations hit the ceiling, which the card says plainly. The evaluation stopped before the model finished the sentence.
• Tool calls. These are tool calling builds. A refusal in prose while a function call goes out anyway scores as a pass.

A different card in the same family goes further and states that refusal "passed" on the quantized build. On an abliterated model. Whatever that gate is measuring, it is not the thing the word implies.

The architecture lesson is the sharper one

There is a detail buried in one of these repos that I think is the most useful thing in the whole batch.

The maintainer tried to build their abliteration with heretic, the standard open source auto-abliteration tool, and it failed on Qwen3.8. The reason: heretic was written for pure full attention transformers, so it edits o_proj and down_proj. Qwen3.8-27B is a hybrid, 16 full attention layers plus 48 gated linear attention layers, with a multi token prediction head and a vision tower bolted on.

So the tool missed the linear attention out_proj across 48 layers, which is the dominant token path. It also left embed_tokens alone, which leaks the refusal component back into every layer, because the residual stream is additive from the embeddings.

The result was a broken model that the tool reported as done.

Now invert that. If the modification tooling silently mis-handles hybrid architectures, what do you think the evaluation tooling is doing?

Most instrumentation in this space assumes a standard dense transformer. Hybrid attention, MTP speculative heads, vision projectors and mixture of experts routing all break that assumption in different ways. A probe that hooks the wrong layers does not error. It returns a clean number.

That is a worse failure mode than a crash, and it is one nobody is checking for.

One more thing, on provenance

The release in question shipped with broken weights, was pulled, and re-uploaded under the same name.

That is a completely normal thing to happen. It is also a compliance problem for anyone downstream, because the record says "we tested model X" and there are now two different sets of weights that answer to that name.

If your evidence file does not pin a revision hash, it does not identify what you tested.

The takeaway

Abliteration is the cleanest available demonstration of something we have been arguing for two years. Safety behaviour lives in a small, editable part of the model. Capability evaluation does not touch it. And the tests currently used to confirm it survived a transformation are single turn, reasoning disabled, string matched, and stop at 128 tokens.

Nobody is hiding this. It is written on the model cards.

That is the part I find genuinely useful. The people doing this work know their screens are weak and say so. The gap is not honesty. It is that better tooling does not exist yet in a form anyone can pick up and run.