Welcome back to the lab. This one's a departure from the usual Raspberry Pi and Zigbee territory — same "how does this actually work" itch, different playground. I wanted to understand how large language models decide to refuse a request, and whether that decision could be surgically removed. Turns out: yes, and it took less compute than I expected.

This isn't a "how to jailbreak an AI" post. It's a "how does the machinery actually work" post, run entirely on a small, already-permissive model as a learning exercise. If you're curious about interpretability and want to get your hands dirty, this is a genuinely approachable weekend project.

The Idea: Refusal Is a Direction, Not a Rulebook

Here's the bit that surprised me. A model's decision to refuse isn't some hardcoded if-statement buried in the weights. Researchers found that refusal behaviour is mediated by something closer to a single direction in the model's internal activation space — when the model is about to say "I can't help with that," its internal state shifts along a consistent, identifiable vector, regardless of what the actual refused topic is.

If that's true, the logic follows naturally: find that direction, and you can edit the weights so they can no longer write to it. No retraining, no gradient descent, no dataset of "acceptable" answers. Just measurement, then surgery. That process has a name: abliteration.

The Setup

I went small and deliberate for this one: Meta's Llama-3.2-1B-Instruct, rather than anything larger. A few good reasons for that. It's a gated model (quick access request on Hugging Face, approved in minutes), it's tiny enough to abliterate and test in minutes rather than hours, and — this matters when you're still learning the ropes — it's light enough to run the whole pipeline on a free Colab GPU. No rented compute required for this one.

The tool doing the actual work was the llm-abliteration repo (jim-plus on GitHub), which does the whole thing in plain Transformers — no need for the heavier TransformerLens stack some other abliteration tutorials use.

Step One: Measuring the Refusal Direction

This step is pure observation, no editing yet. You feed the model two matched lists of prompts — one set that tends to trigger refusal, one set that's near-identical in structure but harmless — and record the model's internal activations at every layer for both.

python measure.py \

--model /content/Llama-3.2-1B-Instruct \

--output ./refusal_dir.pt \

--data-harmful ./data/harmful.txt \

--data-harmless ./data/harmless.txt \

--projected

For each layer, the script averages the activations across the harmful prompts, averages them across the harmless prompts, and subtracts one from the other. That difference vector is your refusal direction — a numerical answer to "what does this model's internal state do differently right before it says no?"

The prompt pairs matter more than I expected going in. Line-for-line, each harmful prompt needs a harmless twin of roughly the same length and structure — swap the trigger topic, keep everything else constant. Otherwise you're measuring "longer sentence" or "different sentence shape" instead of "refusal," and the whole exercise gets noisy.

Step Two: The Actual Surgery

With the direction measured and saved, the second script projects it out of the weight matrices that write into the model's residual stream — mainly the attention output projection and the MLP down-projection, layer by layer. Practically, that meant writing a small YAML config naming which layers to touch:

model: /content/Llama-3.2-1B-Instruct-sharded

measurements: ./refusal_dir.pt

output: ./Llama-3.2-1B-Instruct-abliterated

ablate:

- layer: 6

measurement: 8

scale: 1.0

sparsity: 0.00

- layer: 7

measurement: 8

scale: 1.0

sparsity: 0.00

- layer: 8

measurement: 8

scale: 1.0

sparsity: 0.00

- layer: 9

measurement: 8

scale: 1.0

sparsity: 0.00

- layer: 10

measurement: 8

scale: 1.0

sparsity: 0.00

Middle layers, roughly a third to halfway through the model's 16 total layers, gave the cleanest result. Run the ablation script against that config, and a couple of minutes later you've got a modified copy of the model sitting on disk.

Did It Actually Work?

Tested it with a prompt the stock model tends to hedge on — a fight scene for a piece of fiction. Original model: some throat-clearing about violent content. Abliterated model: straight into the scene, coherent, well-paced, no disclaimer in sight.

That's the whole result in one sentence: same knowledge, same general capability, just without the reflexive "I shouldn't" bolted in front of it.

Honest Fine Print

A few things worth being straight about. Abliteration doesn't add any new capability to a model — if the underlying knowledge or skill wasn't there before, removing the refusal reflex doesn't summon it into existence. It also isn't an on/off switch for every conceivable refusal; it only affects the categories your prompt pairs actually captured, so a narrow prompt set gives you a narrow result. And it can quietly dent general output quality if you're heavy-handed with which layers you touch — always worth testing plain, unrelated prompts afterward to make sure you haven't broken anything you weren't trying to fix.

I kept my own experiment deliberately mild — mostly around fiction and creative writing over-refusals, not anything actually dangerous. That's on purpose. The interesting part of this project was always the mechanism, not seeing how far I could push it.

The Verdict

This turned out to be one of the more approachable "how does the black box actually work" projects I've done. No PhD required, no cluster of GPUs, just a free Colab instance, a small model, and an afternoon. If you've ever wondered whether "AI safety training" is some impenetrable fortress or something you can actually go poke at and understand — it's a lot more the second thing than I expected.

Next post: I took this same little model and taught it something new with LoRA fine-tuning, rather than just removing something old. Different tool, same small model, same free-tier compute. That one's up next.

If you've got any questions or want a hand setting up your own abliteration experiment, don't hesitate to reach out at [email protected] or connect with me via www.yazan.me. I'm always keen to help out!

"If you've got any questions or need a hand wrangling your own setup, don't hesitate to reach out at [email protected] or connect with me via www.yazan.me. I'm always keen to help out!"