Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration

Papers

arxiv:2609.16204

Published on Sep 14

· Submitted by

Aashiq Muhamed on Sep 16

· Carnegie Mellon University

Upvote

4

Authors:

Aashiq Muhamed ,

,

Abstract

Safety guardrails in open-weight language models can be readily bypassed using Refusal Feature Ablation (RFA), a technique that identifies and projects out a linear refusal direction from the residual stream, often achieving a high attack success rate (ASR) while preserving model capability. Defending against these attacks typically requires computationally expensive safety finetuning for every new checkpoint. We introduce Decoy Direction Optimization (DDO), a fast, post-hoc weight-editing defense that requires no base-model finetuning. Our approach is based on a simple mechanistic insight: ablation attacks rely on contrastive estimators to find the refusal direction. Rather than trying to hide the true refusal circuitry, DDO actively injects a high-magnitude, nonlinear decoy signal into the network's MLP neurons. When an attacker attempts to locate the refusal direction, the decoy corrupts their estimator, tricking them into ablating a harmless orthogonal feature while the actual safety mechanism remains intact. We prove a spectral bound formalizing this effect and evaluate DDO across six model families, achieving <10% ASR under standard RFA. On Llama-3-8B-Instruct, DDO remains comparable to trained defenses under adaptive multi-phase attacks (65% vs. 58% worst-case ASR) and reduces Heretic weight-level attack ASR from 88.7% to 18%, all at 30 to 450 times lower optimization cost per configuration than the trained baselines.

View arXiv page View PDF GitHub 1 Add to collection

Community

aashiqmuhamed

Paper author Paper submitter 7 days ago

Code: https://github.com/aashiqmuhamed/defending-against-abliteration

librarian-bot

6 days ago

This is an automated message from the Librarian Bot. I found the following papers similar to this paper.

The following papers were recommended by the Semantic Scholar API

• Bait-and-Recover: Poisoning Internal Refusal Signals to Defend LLMs against White-Box Editing Jailbreaks (2026)

• Mask2Shield: Strengthening LLM Safety against Neuron-Pruning Attacks (2026)

• From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling (2026)

• NeuronGuard: Robust LLM Safety Alignment via Ablation-Aware Safety Signal Redistribution (2026)

• Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models (2026)

• When Skills Meet Safety: Benchmarking and Characterizing the Adaptive Jailbreak Robustness of Skill-Merged LLMs (2026)

• BadEngram: Backdoor Attack on Gated Memory Components in LLMs (2026)

Please give a thumbs up to this comment if you found it helpful!

If you want recommendations for any Paper on HF Mirror checkout this Space

You can directly ask Librarian Bot for paper recommendations by tagging it in a comment: @librarian-bot recommend

Upload images, audio, and videos by dragging in the text input, pasting, or clicking here.

Tap or paste here to upload images

· Sign up or log in to comment

Upvote

4

Get this paper in your agent:

hf papers read 2609.16204

Don't have the latest CLI?

curl -LsSf https://hf.co/cli/install.sh | bash

Models citing this paper 0

No model linking this paper

Cite arxiv.org/abs/2609.16204 in a model README.md to link it from this page.

Datasets citing this paper 0

No dataset linking this paper

Cite arxiv.org/abs/2609.16204 in a dataset README.md to link it from this page.

Spaces citing this paper 0

No Space linking this paper

Cite arxiv.org/abs/2609.16204 in a Space README.md to link it from this page.

Collections including this paper 1