Dynamic Abliteration: Suppressing LLM Refusals Without Touching Model Weights

Abliteration without weight edits

Stripping refusal behavior out of an open-weight LLM usually means abliteration: projecting the model's weight matrices so that a direction tied to refusals is cancelled out. The approach works, but it permanently rewrites the weights and can degrade quality on unrelated tasks.

A technical write-up published on the blog madhukaraphatak.in on 24 September 2026 describes an alternative. Instead of editing parameters, it intercepts the model's intermediate residual streams at runtime with PyTorch forward hooks and injects steering signals at several middle layers. The base weights stay frozen throughout — the author reports them 100% untouched.

The proof of concept is Qwen3-4B, a 4-billion-parameter open-weight model loaded in bfloat16 on an A100 GPU through Google Colab.

Why one layer is not enough

The first attempt targeted a single layer: the author captured a refusal direction at layer 14 by contrasting activations for a refused request and a similar benign one, then subtracted it during decoding. The model still refused — layers further down the stack rebuilt the refusal behavior.

The next version computed contrastive difference vectors across five layers — 12, 14, 16, 18 and 20 — and injected all of them at once. The refusals went away, but static vectors carry their own drawbacks: they offset every token, the scale factor must be tuned by hand, and unconditional injection drags down quality on ordinary tasks.

Gated steering with an Engram module

To make the intervention conditional, the post adapts the conditional memory architecture from DeepSeek's Engram model. Sliding token windows are hashed into four tables for constant-time n-gram lookups, and a sigmoid gate decides per layer whether to inject anything. For ordinary tokens the gate stays near zero; refusal triggers open it.

The steering module was trained on 2,000 samples from the PKU-Alignment/PKU-SafeRLHF dataset while the base model stayed frozen: only the Engram parameters were optimized, for two epochs in about nine minutes on the A100, with the loss falling from roughly 3.9 to 1.77. In the post's comparison, the steered model answered requests the unmodified model had refused or hedged on.

What it means

The result is a modular and removable intervention: the steering head is a separate file that can be switched on and off at inference time, unlike fine-tuning or classic abliteration, where the change is baked into the model itself.

That flexibility is also the safety question. If refusal behavior can be switched off at inference on a single GPU, protections that rest only on an open model's weights get weaker. The full notebook is on GitHub; the post notes that its code examples were written with help from Google Gemini.