title: An Embarrassingly Simple Defense Against LLM Abliteration Attacks
summary: Large language models (LLMs) are typically aligned to comply with safety
  guidelines by refusing harmful instructions. A recent attack, termed
  abliteration, isolates and suppresses the single latent direction most
  responsible for refusal behavior, enabling the model to generate unethical
  content. We propose a defense that modifies how models generate refusals. We
  construct an extended-refusal dataset that contains harmful prompts with a full
  response that justifies the reason for refusal. We then fine-tune
  Llama-2-7B-Chat and Qwen2.5-Instruct (1.5B and 3B parameters) on our
  extended-refusal dataset, and evaluate the resulting systems on a set of
  harmful prompts. In our experiments, extended-refusal models maintain high
  refusal rates, dropping at most by 10%, whereas baseline models' refusal rates
  drop by 70-80% after abliteration. A broad evaluation of safety and utility
  shows that extended-refusal fine-tuning neutralizes the abliteration attack
  while preserving general performance.
paper_authors._id: 68357c8ef0b7aba41a858b61
paper_authors.name: Harethah Abu Shairah
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-05-27T12:45:40.779Z
paper_authors._id: 65f6eff66396309f02a18dab
paper_authors.avatarUrl: /avatars/3b315ecbe2815859ca7fb16d277740c8.svg
paper_authors.fullname: Harethah Abu Shairah
paper_authors.type: user
paper_authors.user: HarethahMo
paper_authors._id: 68357c8ef0b7aba41a858b62
paper_authors.name: Hasan Abed Al Kader Hammoud
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-05-27T12:45:54.956Z
paper_authors._id: 642b51385bf2355d02a23d15
paper_authors.avatarUrl: /avatars/87985347643b2647555f2453fa4d94fb.svg
paper_authors.fullname: Hasan Abed Al Kader Hammoud
paper_authors.type: user
paper_authors.user: hammh0a
paper_authors._id: 68357c8ef0b7aba41a858b63
paper_authors.name: Bernard Ghanem
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-05-27T12:46:01.582Z
paper_authors._id: 6808bf97ffadd78ec71cb721
paper_authors.avatarUrl: /avatars/9adca3142c06b8f69889fcbe85fa374d.svg
paper_authors.fullname: Bernard Ghanem
paper_authors.type: user
paper_authors.user: bernardghanem
paper_authors._id: 68357c8ef0b7aba41a858b64
paper_authors.name: George Turkiyyah
paper_title: An Embarrassingly Simple Defense Against LLM Abliteration Attacks
paper_summary: Large language models (LLMs) are typically aligned to comply with safety
  guidelines by refusing harmful instructions. A recent attack, termed
  abliteration, isolates and suppresses the single latent direction most
  responsible for refusal behavior, enabling the model to generate unethical
  content. We propose a defense that modifies how models generate refusals. We
  construct an extended-refusal dataset that contains harmful prompts with a full
  response that justifies the reason for refusal. We then fine-tune
  Llama-2-7B-Chat and Qwen2.5-Instruct (1.5B and 3B parameters) on our
  extended-refusal dataset, and evaluate the resulting systems on a set of
  harmful prompts. In our experiments, extended-refusal models maintain high
  refusal rates, dropping at most by 10%, whereas baseline models' refusal rates
  drop by 70-80% after abliteration. A broad evaluation of safety and utility
  shows that extended-refusal fine-tuning neutralizes the abliteration attack
  while preserving general performance.
paper_ai_summary: Modifying models to generate justified refusals through fine-tuning on an extended-refusal dataset mitigates ablation attacks while maintaining high refusal rates and general performance.
paper_ai_keywords: large language models LLMs ablation latent direction refusal behavior extended-refusal dataset Llama-2-7B-Chat Qwen2.5-Instruct parameter-efficient fine-tuning