A new defense makes it harder to strip the safety refusals out of open-weight AI models with just a handful of prompts.
The attack it targets, called abliteration, works by finding a model's internal refusal direction and deleting it from the weights, using only a small set of contrastive prompts and no retraining. Researchers built a countermeasure, AMRA, that edits the model's residual-stream matrices to obscure that same signal, swapping refusal-related activations for random decoys and adjusting downstream layers so the model still behaves normally otherwise. Tested on Llama-3-8B, AMRA raised post-attack refusal scores by 2.16 points over an undefended model while costing less than 0.5 percentage points on the MMLU benchmark. On Gemma-2-9B the gain was bigger, 14.70 points, but it came at a steeper cost to the model's general capability.
Abliteration is popular precisely because it is cheap: no retraining, no fine-tuning data, just a few dozen prompts and some linear algebra to turn a safety-tuned model into an uncensored one anyone can redistribute. Most existing defenses only try to catch the bad outputs afterward. This one instead tries to make the refusal direction itself harder to find in the first place, attacking the extraction step rather than its results.
The catch is the usual one in AI safety work: the defense that works best, on Gemma, also costs the most in usefulness, so this looks like a trade-off to manage rather than a fix that ends the arms race.