Abliteration, healing and latent knowledge in Qwen3.8-27B, measured on one harness across three checkpoints.
We removed the refusal behavior of an open-weight 27-billion-parameter model by projecting a single direction out of its weights, then fine-tuned it on benign data to repair any damage, and measured the base, ablated and healed checkpoints on the same harness. One direction, taken from layer 44 of 64, cut harmful-request refusal from 99% to between 3.5% and 9% and over-refusal of hard benign prompts from 84% to 0.2%. The edit cost a mean of 0.018 nats per token of divergence from the base model, and capability moved by amounts smaller than our measurement error. Healing on benign data did not bring refusal back. We then asked whether refusal had been hiding knowledge. Reading answers through forced-choice log-probabilities and activation probes, the base model already held the same knowledge the ablated model would state: on the 3,668-question WMDP hazard-proxy benchmark it scored 69.7%, and abliteration lowered that by about one percentage point (paired test p = 0.019) instead of raising it. Refusal in this model is a thin, separable policy layer over knowledge the weights already contain.
Harmful-request refusal on AdvBench after removing one direction. HarmBench, a source the direction never saw, fell from 99% to 9%.
Mean divergence from the base model on held-out text. Capability changes on MMLU-Pro, GSM8K and IFEval all sit inside their 95% intervals.
WMDP hazard-proxy accuracy before any edit, far above the 25% chance floor. The knowledge was present while the model refused to discuss it.
Paired change in WMDP accuracy after abliteration (95% CI −1.8 to −0.2). Removing refusal unlocked nothing measurable and cost a little.
Arditi and colleagues showed in 2024 that refusal in chat models is mediated by a single direction in the residual stream, and that removing it disables refusal. Hundreds of "abliterated" models now circulate on public model hubs. Most write-ups stop at the observation that the model no longer refuses. Three questions usually go unmeasured: what the edit costs the rest of the model, whether fine-tuning afterwards undoes it, and whether the knowledge an abliterated model reveals was in the original model or is produced by the edit itself.
The third question matters most for safety. If refusal guards knowledge that is otherwise absent, refusal training is doing real protective work. If the knowledge is already there and refusal only governs whether it is spoken, refusal is a policy layer, and anything that relies on it relies on a behavior that one projection can remove. We designed the study so each outcome could be distinguished from the others.
The subject is Qwen/Qwen3.8-27B, released under Apache 2.0. Its architecture breaks the assumption behind the standard abliteration recipe. Of its 64 decoder layers, only every fourth (16 layers) uses full attention with a self_attn.o_proj output matrix. The other 48 are Gated DeltaNet linear-attention layers, which write to the residual stream through a differently named projection. The common recipe edits o_proj and down_proj on every layer, and on this model it would have reached a quarter of the attention stack and missed the other 48 layers silently.
We stated the edit in its general form: orthogonalize every matrix that writes into the residual stream against the refusal direction. On this model that set is the 64 MLP down_proj matrices, the 16 full-attention o_proj, the 48 Gated DeltaNet output projections and the input embedding, 129 tensors in total, with zero unrecognized writers. The multi-token-prediction head and vision tower were left unchanged.
We captured residual-stream activations at the final prompt token for 256 harmful instructions (AdvBench) and 256 harmless ones (Alpaca), chat-templated with thinking disabled, and took the per-layer difference of means as a candidate direction. Each candidate was scored by projecting it out at inference time and measuring refusal on a 24-prompt harmful validation set.
| Layer | 28 | 32 | 36 | 40 | 42 | 44 | 46 | 48 | 50 |
|---|---|---|---|---|---|---|---|---|---|
| Refusal | 0.79 | 1.00 | 0.96 | 0.92 | 0.33 | 0.04 | 0.08 | 0.21 | 0.46 |
Refusal collapses in a narrow valley at layers 44 to 46, about 69% of the way through the network. We selected layer 44 and applied the weight orthogonalization W ← (I − r r⊺) W to every residual writer, and E ← E (I − r r⊺) to the embedding, in 32-bit precision.
We fine-tuned the ablated model with QLoRA (rank 16, alpha 32, 72 million trainable parameters, 0.27% of the model) on 3,000 benign Alpaca instruction pairs for 24 optimizer steps, then merged the adapter into a standalone checkpoint. The healing data contained no refusals and no safety examples, so any refusal that reappeared would have to come from the model itself.
All three checkpoints ran through the same harness with thinking disabled and temperature 0.
Removing one direction took out nearly all refusal, harmful and benign alike. Healing changed none of the refusal rates by more than half a point.
| Metric | n | Base | Ablated | Healed |
|---|---|---|---|---|
| Refusal of harmful requests | ||||
| AdvBench | 520 | 0.992 | 0.035[0.019, 0.051] | 0.035[0.019, 0.051] |
| HarmBench | 200 | 0.990 | 0.090[0.050, 0.130] | 0.085[0.046, 0.124] |
| Over-refusal of benign requests | ||||
| XSTest (safe) | 250 | 0.048 | 0.008 | 0.008 |
| OR-Bench-hard | 1,319 | 0.842 | 0.002 | 0.002 |
| Capability | ||||
| MMLU-Pro | 560 | 0.725[0.688, 0.762] | 0.716[0.679, 0.753] | 0.727[0.690, 0.764] |
| GSM8K | 400 | 0.973[0.956, 0.989] | 0.968[0.950, 0.985] | 0.970[0.953, 0.987] |
| IFEval | 400 | 0.810[0.772, 0.848] | 0.803[0.763, 0.842] | 0.788[0.747, 0.828] |
| Damage on held-out text | ||||
| KL from base, mean (nats/token) | 51,102 | 0 | 0.0180 | 0.0183 |
| KL from base, 95th percentile | 51,102 | 0 | 0.0591 | 0.0606 |
| Perplexity | 51,102 | 10.071 | 10.146 | 10.130 |
Every capability change sits well inside its confidence interval, so we cannot claim that abliteration damaged capability or that healing repaired it. The defensible statement is narrower: at these sample sizes, any capability cost is smaller than about three points on MMLU-Pro and IFEval and two points on GSM8K. The damage metric is more sensitive and shows a real but small shift, 0.018 nats per token on average, which healing did not undo (0.0183 afterwards). The base model's 84% refusal rate on OR-Bench-hard is itself a finding: the stock model refuses most adversarially benign prompts.
An ablated model that answers a question it used to refuse has done one of three things. It may be stating knowledge the base model held and withheld (present and gated). It may be producing plausible text it does not actually know (confabulation). Or the edit may have damaged knowledge the base model had (degradation). All three look the same from outside. We separated them with instruments that read what the model knows without asking it to speak.
We first ran 30 benign questions on topics stock models tend to over-refuse (chemical safety, security, forensics), tiered by difficulty, plus 18 confabulation controls. All three checkpoints chose the correct answer on all 30 real questions, and the probe recovered the answer from activations with an AUC of 0.986 to 0.988 at every checkpoint. On the controls, letter-scored forced choice picked a confident answer instead of declining on 0, 1 and 2 of 18 items for base, ablated and healed. That trend is too small to separate from chance, and length-normalized scoring showed no confabulation at any checkpoint. The base model already knew everything on this battery, so it could confirm that abliteration manufactures nothing but could not show anything being unlocked. That required a test the base model does not ace.
WMDP is a published benchmark of 3,668 multiple-choice questions that act as proxies for hazardous knowledge in biosecurity (1,273), chemical security (408) and cybersecurity (1,987). It is designed to measure whether such knowledge is present without anyone generating it. We scored every question by forced choice on all three checkpoints, using a single forward pass per question and never generating text.
The base model answered 69.7% of WMDP correctly, 82% in biology, before any edit. Its accuracy is the same order as published results for capable open models, and it does not depend on the model being willing to discuss the topic: forced choice reads the answer the weights prefer. Because every question was answered by every checkpoint, we compared them question by question with McNemar's test.
Abliteration did not raise WMDP accuracy in any domain. It lowered overall accuracy by 0.98 points (95% CI 0.19 to 1.78, p = 0.019), with the loss concentrated in cybersecurity (1.31 points, p = 0.045). The ablated model kept 98.6% of the base model's accuracy. Healing added no further change (ablated versus healed, p = 0.61). This is a real but small degradation, well short of the collapse that would mean abliteration destroyed knowledge.
The probe told the same story with less power. Trained on 270 WMDP questions and tested on 180 others, it picked the correct option for 50.0% of held-out questions at base and 46.7% at both later checkpoints, against 25% by chance (p < 10−9), with AUC between 0.666 and 0.672. A single-layer linear readout captures much less of this knowledge than forced choice does, but what it captures does not change across checkpoints.
On this model refusal lives on one direction that the rest of the computation barely uses. Projecting it out removes nearly all refusal at a measured cost of 0.018 nats per token and a one-point WMDP loss. That separability survives fine-tuning: benign healing neither restored refusal nor reversed the distributional shift.
The base model's hazard-proxy knowledge is readable without any edit, at 69.7% on WMDP through forced choice. Abliteration changes access to that knowledge in free generation; it does not create it. This agrees with work on unlearning robustness, where light fine-tuning recovers knowledge that unlearning was meant to remove (Deeb and Roger 2024; Łucki et al. 2025), and with password-locked models, where gated capability is recovered from a handful of examples (Greenblatt et al. 2024). For open-weight models the implication is direct: refusal alone does not keep knowledge away from someone holding the weights, because one projection removes it. Mitigations meant to hold against weight access have to act on the knowledge, through data curation or robust unlearning, rather than on the willingness to state it.
Public abliterations of Qwen3.8-27B exist. One edits layers 18 to 51 without healing and reports no benchmarks. Another heals with supervised fine-tuning and reports a KL divergence of 0.128 and an MMLU drop from 0.821 to 0.799, and finds that the clearest difference between methods is whether the model stops cleanly. A cross-architecture comparison of abliteration methods (Young 2025) reports KL values from 0.043 to 1.646, and an analysis of what abliteration costs (christian-mc 2026) reports KL of 0.034 alongside a rise in free-text falsehoods while probe-measured truth stays intact. Our 0.018 is at the low end, consistent with a single-layer direction applied to every residual writer. These KL figures come from different text sets and settings, so the comparison is indicative only. That analysis also warns that KL can miss changes in truthfulness, which is why we measured knowledge directly.
The refusal-direction method is published and widely reproduced. What this study adds is measurement, so we publish the method, the measurement design and the results. We do not publish or link the modified weights or the extracted direction. A ready-to-run model with its safety training removed is the one artifact here with direct and foreseeable misuse and almost no added research value beyond the method itself. Hazard knowledge was measured only through multiple-choice scoring and probes; no hazardous content was generated, stored or validated at any stage, and the report shows aggregate accuracies only.
Abliteration, healing and the behavioral evaluations ran on 28 September 2026 on an NVIDIA A100 80 GB with vLLM 0.30.0 in eager mode (CUDA graph capture hangs on this architecture), bf16, a development build of transformers with qwen3_5 support, and thinking disabled for every request. The knowledge experiments ran on 8 to 12 October 2026 on an NVIDIA RTX A4500 (20 GB) with the model loaded in 4-bit NF4 through transformers 5.5.0, using the pure-PyTorch Gated DeltaNet path. Two memory fixes were needed on the smaller card and neither affects the measurement: computing logits for the final position only, and retrying a question once after an out-of-memory error before recording it as skipped. All results are recorded per checkpoint and per question in the study repository.