Abliteration Can Remove AI Refusals and Alter Ordinary Decisions

Caleb Fahlgren, a Hugging Face engineer, reports that editing Qwen3.5-4B reduced refusals on unseen prompts from 100% to about 1%. His October 25 post describes a personal learning exercise and does not separately state the size of that final test. Personal account

A July preprint found other changes after similar edits: altered stock forecasts on questions the original models had answered without refusing. Study

Abliteration changes a model’s weights, the numerical settings learned during training, to weaken refusal behavior. Developers can edit published weights after release. Original research

Open weights make a model editable after release

Andy Arditi and coauthors studied 13 chat models with up to 72 billion parameters. Suppressing an internal direction associated with refusal reduced rejections; increasing it could make models reject harmless questions. Paper

Qwen’s publisher distributes Qwen3.5-4B’s weights and configuration files for software that runs models. The four-billion-parameter system includes a vision encoder and combines different attention designs, which help it process information. Its model card reports separate scores for knowledge, coding, instruction following and agent tasks. Fahlgren’s refusal exercise examines text replies. Publisher’s model card

The card also records exceptions to benchmark procedures. For TAU2-Bench, which tests agents, Qwen says it adopted fixes to the airline domain from the Claude Opus 4.5 system card. That disclosure matters when comparing scores: a named benchmark can involve a particular implementation and changes to its test environment. The original model’s published scores describe that evaluated version.

Qwen publishes separate visual benchmarks as well, including document reading and image-based reasoning. A change examined through text replies has not, through that test alone, been evaluated across the model’s other inputs. The publisher’s range of evaluations shows how much a single refusal result leaves unmeasured. Evaluation coverage

Heretic automates the search for refusal-reducing edits. It tries to limit changes to predicted outputs using KL divergence, a statistical comparison of probability distributions. Its maintainers explicitly say automated benchmarks do not replace people evaluating replies. The software’s optimization measures refusal and output changes, rather than scoring every possible task a customer might perform. Documentation

Its Gemma-3-12B comparison illustrates the distinction. The original refused 97 of 100 harmful prompts; three modified versions each refused three. Their KL scores nevertheless ranged from 0.16 to 1.04. These are maintainer-reported results using PyTorch 2.8 on an RTX 5090, with an explicit warning that hardware can affect exact values. Reported comparison

A refusal score can miss a rewritten refusal

Fahlgren’s early test counted replies starting with “I” as refusals. Some candidate edits improved that score while producing differently worded refusals. Reading complete replies changed his selection. Measurement choices

An October 26 Heretic update addresses another measurement problem: how replies begin when models have a default thinking mode. The change revises response-prefix handling so evaluation reaches the intended answer text. A chat template, which packages a conversation for a model, can affect which text an evaluator encounters first. Code change

The update covers cases where a template inserts a completed thinking block by default and cases where it starts an unfinished block. These formats put different text before the final reply. The patch also updates expected test-output hashes in several model folders. It is a change to response handling with model-specific test records, rather than a new comparison of ordinary task accuracy.

Excessive refusals are a documented usability problem. XSTest, introduced in 2023, pairs 250 safe requests across ten categories with 200 unsafe contrasts. Its authors found that models could reject harmless questions because their wording resembled sensitive material. The benchmark evaluates assistance on legitimate requests alongside refusal of unsafe ones. XSTest

Stock forecasts shifted on questions models already answered

Independent researcher Aleksander Fafuła compared original and community-edited Gemma and Qwen models across 21,600 decisions about 60 Warsaw-listed stocks. Edited versions chose an upward move more often: 12.2 percentage points for Gemma and 7.4 for Qwen. Confidence shifted in opposite directions. Results

An initial pilot used different numerical compression methods, a confound the author discarded. He also found a stale community chat template. The corrected comparisons used publisher BF16 weights, edits from huihui-ai and matching rendered prompts. BF16 specifies how numerical values are stored. The original models answered all 10,800 requests; none of the tested versions showed predictive trading skill. Methods

This is one preprint, two model families and one forecasting setup. It supports investigating off-target changes while leaving open how widely its findings apply.

An October 3 preprint separates safety-triggered refusal from refusal in general contexts. Han Wang and coauthors tested Llama-3.1-8B-Instruct and Qwen2.5-3B-Instruct. One-dimensional interventions could control safety refusals, with several distinct directions producing similar effects. General-context refusal was harder to control, even with five-dimensional interventions. Refusal dimensionality study

The researchers used another model to judge whether replies contained refusals and remained coherent. Some broader interventions on Qwen damaged coherence, so the paper marks those results separately. Its experiments measure both behavioral control and response deterioration, giving readers a way to see when a seemingly stronger intervention also harms the answer.

The team sampled three replies per input in its validation and test sets. Qwen3.8-27B judged refusal and coherence. The researchers selected settings using validation examples before applying them to separate test examples, keeping that final comparison apart from the selection process. Experimental setup

Benchmark results depend on which behavior gets measured

XSTest’s earlier comparisons show why answering more questions needs context. In those tests, Llama 2 frequently refused safe requests. Mistral’s original instruction-tuned model avoided excessive refusals but also complied with unsafe requests. Adding a guardrail prompt reduced unsafe behavior and introduced false refusals. GPT-4 achieved the best balance among the tested systems. Those are results for the versions evaluated then, rather than a ranking of current models. Original comparisons

Heretic also lists limits to its reach. It supports many dense models, several mixtures of experts, which activate selected groups of parameters, and some hybrid architectures. Pure state-space models and certain other research designs are not supported without additional work. A tool for editing one architecture therefore cannot be assumed to handle every open-weight system. Supported architectures

The original 2024 study already found a split in general performance. Edited models performed similarly on MMLU, ARC and GSM8K, tests of knowledge, reasoning and mathematics. Accuracy consistently declined on TruthfulQA, which includes questions involving misinformation and stereotypes. The authors linked that difference to the benchmark’s proximity to refusal-related subjects. Their own results therefore included both preserved scores and a repeated accuracy drop. Capability comparisons