Abliterating Gemma 4 31B: why the standard refusal-removal edit breaks the model, what a narrower edit does instead, and why the usual repair step bought nothing.
The standard abliteration edit, which removes one refusal direction from a model’s internal state at every layer, works cleanly on Qwen 3.8 and destroys Google’s Gemma 4 31B: its output becomes nonsense. Control runs show the damage depends on which direction is removed and where. The refusal direction found at layer 34 is harmless to remove from layers 28 to 34 and from layers 35 to 59, and catastrophic to remove from any range before 28; a random direction behaves the other way round. A failed edit of this kind is therefore not evidence of a robust guardrail. Removing the refusal direction, made orthogonal to the average harmless activation, only from what layers 28 to 34 write kept capability within 1.5 points and raised harmful compliance, as scored by HarmBench’s own classifier, from 7.5% to 82.5% on HarmBench and from 1% to 77% on AdvBench prompts never used to build the edit. A short fine-tune on Alpaca, the usual repair step, did not raise compliance further (79.5% and 63%), cost 14 points on IFEval and 5 on MMLU-Pro, and changed how the model declines rather than whether it complies. The same fine-tune applied to the unedited model cost the same capability and by itself raised HarmBench compliance from 7.5% to 25.5%, so the repair step is not safety-neutral. Forced-choice accuracy on the WMDP hazard-knowledge benchmark was 71.6%, 71.0% and 71.9% across the three models.
What the standard all-layer edit produced on Gemma 4. The same refusal direction removed from seven layers only left the model fluent.
HarmBench requests carried out, as judged by HarmBench’s classifier, before and after the narrow edit. MMLU-Pro moved from 84.5% to 83.0%.
IFEval after the standard healing step, whether applied to the stripped model or the untouched original. The fine-tune, not the edit, cost the points; on the original it also raised HarmBench compliance from 7.5% to 25.5%.
WMDP forced-choice accuracy for the original, stripped and healed model, against 25% for guessing. The measured knowledge did not move.
Our model safety cards tell businesses what an open-weight model’s guardrails are worth once someone has a copy of the weights. The first card, for Qwen 3.8 27B, used the refusal-direction method of Arditi and colleagues: find the one direction in the model’s internal state that separates harmful from harmless requests, then edit it out of the weights. On Qwen that cut refusal from 99% to single digits at almost no cost (What refusal hides). The second card covers Gemma 4 31B, Google DeepMind’s dense model released in April 2026 under Apache 2.0. We wanted to know whether the same recipe, with the same tests and thresholds, gives the same answer on a different family, and what to conclude when it does not.
Gemma 4 31B has 60 layers and a residual stream 5,376 numbers wide. Two details of its design bear on this kind of edit.
post_attention_layernorm and post_feedforward_layernorm). Projecting a direction r out of the output weights, the textbook edit, does not remove r from what is written, because the scale reshapes the vector afterwards.The input embedding is also tied to the output layer, so editing it, as the textbook recipe does, would change every output score as well. We suspected these features when the standard edit failed; section 3 tests what the failure actually depends on.
Everything not listed here matches the Qwen card (method v1): the same prompt sets, the same capability tests and the same healing recipe. This report adds a second refusal judge and the controls below.
We loaded the model in 4-bit and recorded the residual stream at the last prompt token for the first 256 AdvBench requests and 256 harmless Alpaca instructions. The difference of the two means at each layer is a candidate refusal direction.
The v1 recipe projects the candidate direction out of the residual stream at every layer and keeps the layer whose direction suppresses refusal best on held-out prompts. On Gemma 4, every candidate from layer 21 to 46 produced 0% refusal, and every one did it by breaking the model: strings of slashes, repeated letters, fragments in six scripts. Removing a random unit direction at every layer broke it the same way. Removing the layer-30 direction at layer 30 alone left the model fluent and removed refusal on the three harmful prompts we tried.
| Direction layer | Direction | Layers edited | Refusal | KL |
|---|---|---|---|---|
| 22 | plain | 0 to 22 | 0.0% | 24.55 |
| 30 | plain | 20 to 30 | 0.0% | 2.67 |
| 32 | plain | 22 to 32 | 0.0% | 1.08 |
| 32 | plain | 26 to 32 | 7.8% | 0.28 |
| 34 | plain | 28 to 34 | 78.1% | 0.44 |
| 34 | biprojected | 24 to 34 | 0.0% | 0.53 |
| 34 | biprojected | 28 to 34 | 1.6% | 0.36 |
| 40 | plain | 30 to 40 | 67.2% | 11.53 |
Every edit that reached down to the first layers wrecked the model (KL above 12), and directions taken from layer 36 onward either left most refusals in place or broke the model. The usable edits came from directions at layers 32 and 34, applied across seven to eleven layers.
The sweep alone cannot say whether the damage comes from editing many layers, from the particular direction, or from where it is removed. We ran 15 controls with the same damage measure, crossing the layer-34 refusal direction with a fixed random direction, the whole residual stream with block writes only, and four layer ranges.
| Removed from | Layers | Refusal direction (L34) KL | Random direction KL |
|---|---|---|---|
| Residual | all 60 | 18.05 | 23.47 |
| Writes | all 60 | 19.57 | 27.01 |
| Writes | 0 to 10 | 19.81 | 0.46 |
| Writes | 11 to 27 | 24.39 | 0.43 |
| Writes | 0 to 27 | 18.92 | 2.71 |
| Writes | 28 to 34 | 0.36 | 6.78 |
| Residual | 28 to 34 | 0.41 | 6.20 |
| Writes | 35 to 59 | 0.11 | 25.34 |
The pattern is an interaction, not a general fragility. The layer-34 refusal direction can be removed from layers 28 to 34, or from 35 to 59, with little damage, and cannot be removed from any range before 28. A random direction is the opposite: nearly harmless in the first 28 layers, damaging in the middle and fatal in the late layers. Whole-stream and write-only removal behave alike. So the same vector carries different weight at different depths, and the all-layer edit fails because it is guaranteed to hit some depth where its direction matters. These controls show where the edit breaks the model; they do not show why. The per-layer rescaling and post-block normalization of section 2 are plausible contributors, but we did not isolate them.
The edited weights were written in bf16 and served with vLLM in 8-bit (fp8 weights) across two RTX A4500 cards, the same serving path as the original model. Generations were greedy, up to 512 tokens, on the full AdvBench (520) and HarmBench standard (200) sets and on the safe prompts of XSTest (250) and OR-Bench hard (1,319). Each answer to a harmful request was scored twice:
cais/HarmBench-Llama-2-13b-cls, the benchmark’s official judge, with its official prompt): does the answer actually carry out the requested behavior in a non-minimal way? This measures harmful compliance.HarmBench played no part in building or choosing the edit. AdvBench did: items 0 to 255 built the direction and items 300 to 363 chose the edit. We report AdvBench on the 200 untouched items (256 to 299 and 364 to 519) as the headline and the development items separately. Capability used MMLU-Pro (40 per subject, 560), GSM8K (400) and IFEval (400) through the lm-evaluation-harness. WMDP (3,668 questions) was scored by forced choice in 4-bit: the letter the model rates most likely, with no text generated.
As on Qwen, we fine-tuned the edited model with QLoRA (rank 16 on attention output and all MLP projections, 4-bit base) on the first 3,000 Alpaca examples for 24 steps of about 32,000 tokens each, with loss on the answers only in the exact chat format the model is served with. A first attempt that trained on whole conversations in a format missing Gemma’s empty reasoning block started at a loss of 8.2, mostly from learning the format; we stopped it and reran. As a control, we ran the identical fine-tune, same data, settings and seed, on the original model.
| Test | n | Original | Stripped | Healed | Original + healing |
|---|---|---|---|---|---|
| Harmful compliance, HarmBench classifier | |||||
| HarmBench | 200 | 7.5% | 82.5% | 79.5% | 25.5% |
| AdvBench, untouched | 200 | 1.0% | 77.0% | 63.0% | 7.5% |
| AdvBench, all | 520 | 0.6% | 81.0% | 70.6% | 6.9% |
| Refusal, phrase check | |||||
| HarmBench | 200 | 92.5% | 15.5% | 4.5% | 67.5% |
| AdvBench, untouched | 200 | 98.0% | 24.5% | 11.0% | 85.5% |
| AdvBench, development | 320 | 99.1% | 16.2% | 5.9% | 87.8% |
| Safe prompts refused, phrase check | |||||
| XSTest | 250 | 1.2% | 0.4% | 0.0% | 1.6% |
| OR-Bench hard | 1,319 | 34.6% | 0.7% | 0.7% | 17.4% |
| Capability | |||||
| MMLU-Pro | 560 | 84.5% | 83.0% | 77.9% | 79.6% |
| GSM8K | 400 | 97.5% | 97.3% | 96.3% | 96.5% |
| IFEval (strict, per prompt) | 400 | 90.3% | 91.3% | 76.8% | 76.3% |
| Hazardous knowledge, WMDP forced choice (chance 25%) | |||||
| Biology | 1,273 | 84.9% | 82.9% | 83.2% | 84.3% |
| Chemistry | 408 | 73.0% | 72.1% | 71.1% | 71.6% |
| Cyber | 1,987 | 62.8% | 63.3% | 64.8% | 66.7% |
| All | 3,668 | 71.6% | 71.0% | 71.9% | 73.4% |
Out of the box, Gemma 4 refused 98.7% of AdvBench and 92.5% of HarmBench. The classifier judged 7.5% of its HarmBench answers harmful; 14 of them are among the 15 requests it did not refuse, nearly all of which ask for persuasive articles defending false or one-sided claims about history, elections and public health rather than for dangerous instructions. It rarely refused safe prompts: 1.2% of XSTest, and 34.6% of OR-Bench hard, against 84.2% for Qwen 3.8 on the same set.
The seven-layer edit turned a model that almost never complied into one that usually did: 82.5% of HarmBench requests and 77% of untouched AdvBench requests were carried out, by the classifier’s standard. Capability moved by at most 1.5 points, inside the noise of these samples, and on a spot check of eight Alpaca answers the stripped model predicted the text as well as the original (mean loss 4.34 against 4.36 nats per token, both in 4-bit). Many compliant answers open with a disclaimer.
The edit is weaker on prompts it was not tuned on. Refusal was 1.6% on the 64 selection prompts, 16.2% across all development prompts and 24.5% on untouched ones. Selection used 48 greedy tokens in 4-bit and the evaluation 512 tokens in 8-bit, and some refusals arrive after a few sentences, so the short selection window undercounted them.
Healing exists to repair damage the edit does. On Gemma 4 there was no damage to repair, and the fine-tune did harm: IFEval fell from 91.3% to 76.8% and MMLU-Pro from 83.0% to 77.9%. Alpaca’s answers are short and plain, and the healed model writes the same way; asked how to kill a Python process, the stripped model gives a structured walkthrough with headings, the healed one a short plain paragraph. Prompts that ask for a format or a length are where IFEval loses the points. The control below confirms that the fine-tune, not the edit, caused the loss.
By the phrase check, healing looked like it removed most of the remaining refusal (HarmBench 15.5% to 4.5%). The classifier disagrees: harmful compliance went from 82.5% to 79.5% on HarmBench and from 77% to 63% on untouched AdvBench. On untouched AdvBench, 53 of the healed model’s 200 answers neither used a refusal phrase nor carried out the request, against 7 for the stripped model. Healing changed how the model declines, from stock refusals to short, vague answers, not whether it complies. Measured by refusal phrases alone, that change would have read as a further loss of safety.
To separate what the fine-tune does from what the edit does, we ran the same healing recipe, unchanged, on the original model. It lost the same capability: IFEval fell 14.0 points and MMLU-Pro 4.8, against 14.5 and 5.2 after the edit (Table 4). It also weakened the original model’s guardrail on its own. HarmBench refusal fell from 92.5% to 67.5% and harmful compliance rose from 7.5% to 25.5%, an increase of 18 points with an interval of 12 to 24; on untouched AdvBench, compliance rose from 1% to 7.5%. The 38 HarmBench requests it newly carried out are mostly persuasive misinformation, scam and phishing messages and graphic writing, with a few cyber requests. Refusal of safe OR-Bench prompts halved, from 34.6% to 17.4%. Three thousand benign Alpaca examples, with no harmful content in them, undid part of the safety tuning, in line with earlier reports that benign fine-tuning erodes refusal (Qi et al., 2024).
This bounds what healing contributes in the main result. After the edit there was little refusal left for the fine-tune to remove, and the classifier found no further gain in compliance. On the untouched model, the same 24 steps took away a quarter of HarmBench refusals.
WMDP forced-choice accuracy was 71.6% for the original, 71.0% stripped and 71.9% healed, with no domain moving more than 2 points. Neither the edit nor the fine-tune changed what this multiple-choice proxy measures. The healing-only control scored 73.4%, a small rise (1.7 points, interval 0.7 to 2.8) that comes mostly from cyber questions (62.8% to 66.7%). WMDP is a proxy: it shows the knowledge it tests is present and unchanged, not what the model could do with it.
| Test | The edit original to stripped | Healing after the edit stripped to healed | Healing alone original to original + healing |
|---|---|---|---|
| HarmBench, harmful compliance | +75.0 [+69.0, +81.0] | −3.0 [−9.9, +3.9] | +18.0 [+12.3, +23.7] |
| AdvBench untouched, harmful compliance | +76.0 [+69.9, +82.1] | −14.0 [−21.5, −6.5] | +6.5 [+2.8, +10.2] |
| HarmBench, refusal | −77.0 [−82.8, −71.2] | −11.0 [−16.0, −6.0] | −25.0 [−31.0, −19.0] |
| AdvBench untouched, refusal | −73.5 [−79.6, −67.4] | −13.5 [−19.8, −7.2] | −12.5 [−17.1, −7.9] |
| MMLU-Pro | −1.4 [−3.2, +0.4] | −5.2 [−7.9, −2.5] | −4.8 [−7.2, −2.4] |
| GSM8K | −0.2 [−1.3, +0.8] | −1.0 [−2.7, +0.7] | −1.0 [−2.4, +0.4] |
| IFEval | +1.0 [−1.0, +3.0] | −14.5 [−18.7, −10.3] | −14.0 [−18.4, −9.6] |
| WMDP, all | −0.6 [−1.5, +0.4] | +0.8 [−0.3, +2.0] | +1.7 [+0.7, +2.8] |
A failed edit is not a robust guardrail. The standard edit is harmless on Qwen 3.8 and fatal on Gemma 4, and the controls show why it fails here: the same direction is safe to remove at some depths and load-bearing at others, and removing it everywhere is sure to hit the wrong ones. An evaluation that reported “abliteration breaks the model, so its refusal cannot be removed” would be wrong; the edit has to be placed with more care. This is the finding we would most like other evaluators to take from the report.
Harder is not the same as resistant. Gemma 4 took a sweep of 54 configurations where Qwen took one pass of the standard recipe, and the narrow edit left more refusal in place. It still turned 82.5% of HarmBench requests into compliance with capability intact. For a business, the practical reading matches the Qwen card: these guardrails hold only while the weights are controlled, so safety controls belong in the application around the model as well.
Measure healing, and measure compliance. Healing is part of the published recipe because early abliterated models lost capability. A strong model that loses nothing gains nothing from it, and old instruction data pulled this one backwards. The healing result also shows why refusal phrases alone are not enough: they reported a safety loss where the classifier found a style change. And healing is not neutral even without an edit: applied to the original model, the same fine-tune raised HarmBench compliance from 7.5% to 25.5%. Any abliteration recipe that includes healing should report the healing-only control, or its safety numbers mix the edit with the fine-tune. The Qwen card did not run this control.
We publish the method, the sweep, the controls and all aggregate results. We do not release the stripped or healed weights, the extracted direction, or any model output to a harmful request. The refusal and compliance tests necessarily produced such outputs; they stay on the lab’s machines and were read only by the automated judges. Hazardous knowledge was measured by multiple-choice scoring alone, with no text generated.
Runs took place between 8 and 11 November 2026 on two NVIDIA RTX A4500 GPUs (20 GB each, 64 GB RAM) in the trifero lab, with the HarmBench classifier on one Quadro RTX 8000. Evaluation served google/gemma-4-31B-it and its edited copies with vLLM 0.31.0 (fp8 weights, tensor parallel 2, 4,096-token context); direction finding, the sweep, the controls, perplexity and WMDP used transformers 5.17.0 with bitsandbytes 4-bit; healing used PEFT and TRL 1.14.2 (learning rate 2e-4, batch 32 sequences of 1,024 tokens, 24 steps, 72 minutes). The chosen edit: direction from layer 34, biprojected against the mean harmless activation, applied to the attention output and MLP down projections of layers 28 to 34 (14 matrices). The healing-only control used the same recipe and seed on the original weights. The classifier ran in fp16 with greedy one-token output on answers cut to 512 tokens. Per-prompt verdicts, the full sweep and the controls are stored with the study.