The n00b's Math Guide to Abliteration

00 READ ME FIRST

01 THE ONE IDEA

A chat model's refusal behavior is controlled by a direction in space. Find that direction — by nothing fancier than averaging — and you can: subtract its shadow from the model's thoughts at run time (reversible), or re-aim the model's weights so they can never write it again (permanent). That is abliteration.

The whole pipeline, as five mathematical moves:

# the entire abliteration pipeline, in five moves
1. run the model on harmful prompts    -> collect activations (points in space)
2. run it on harmless prompts          -> collect more points
3. subtract the two averages           -> the REFUSAL DIRECTION
4. remove that direction's shadow from every runtime thought -> ablation (reversible)
5. re-aim every weight that writes toward it -> orthogonalization (permanent)

02 VECTORS & THE RESIDUAL STREAM

The model's running thought is a list of numbers

Inside a transformer there's a running tally called the residual stream — the model's working memory as it reads your prompt and prepares its answer. Each layer reads the tally, computes something, and adds its contribution back. So the model's state at any layer is just a big list of numbers — 2,048 numbers in a 4B model, 4,096 in a 7B. That list is a vector.

# one token's state at layer 6, honestly to scale (drawn for a 4B model)
input embedding      [ ......... ]
+ attention layer 1  [ ......... ]   # each layer READS the running list
+ mlp layer 1        [ ......... ]   # and ADDS its contribution to it
+ attention layer 2  [ ......... ]
+ ...
+ mlp layer 6        [ ......... ]
= residual stream @ layer 6: one vector of 2048 numbers

A vector is a point in a high-dimensional space: 2,048 axes, impossible to picture literally — so throughout this guide we draw everything in 2D and trust the algebra, because every operation we need (average, subtract, project, measure angle) works identically in 2 dimensions and 2,048. This is the standard working trick of interpretability research, and it's honest: the intuitions really do transfer.

Direction beats magnitude

A vector has two parts: which way it points (direction) and how long it is (magnitude). Now the key fact that makes everything work: raw magnitudes inside a model are messy and arbitrary — they swing wildly from token to token. What's stable and meaningful is which way.

Give the model a hundred different harmful prompts and record its state at the last token: you get a cloud of points. Give it a hundred harmless ones: another cloud. The discovery behind the whole technique is that the harmful cloud sits systematically shifted along one particular arrow — the same arrow every time, in every open chat model tested. That arrow is the refusal direction.

03 AVERAGES & DIFFERENCE-IN-MEANS

The one formula that finds the direction

Two sets of prompts. Two piles of recorded states. Average each pile. Subtract. Normalize. Done — that's the extraction, and there is genuinely nothing else:

Why subtracting two averages gives you a meaningful direction and not noise: imagine the 2D drawing. Harmless prompts cluster around one point; harmful prompts cluster around a nearby point, shifted along the refusal arrow. Both clouds also differ in a thousand random ways (topic, length, tone) — but those differences go every direction at once, so when you average hundreds of prompts first, the noise averages toward zero and the one systematic shift survives the subtraction. The average is the noise-cancelling move. This is the same trick as averaging many photos of the same street to erase passing cars.

# why averaging first kills the noise:
cloud differences topic-to-topic:  random directions, cancel in the mean
cloud difference harm-vs-harmless: ONE shared arrow, survives the mean
mean(harmful) - mean(harmless)  =  that arrow

What the pairs buy you

The Academy lab's C3 (build the contrast set) teaches why researchers don't just grab random harmful and harmless piles: if all your harmful prompts are about weapons and all your harmless ones are about cooking, the difference-in-means picks up "weapons vs cooking" mixed into the arrow. The fix: contrast pairs — for each harmful prompt, a harmless twin on the same topic, same style, differing only in whether harm is requested. "How do I pick a lock?" paired with "How does a pin-tumbler lock work?" Topic cancels in the subtraction; only the refusal shift remains.

04 PROJECTION: ABLATION AT RUNTIME

The projection, in plain arithmetic

"Project vector v onto direction &hat;r" means: how much of v points along the refusal arrow? That's a single multiplication — the dot product:

The shadow of v along the arrow — the piece you want gone — is that scalar times the arrow itself:

And ablation is removing exactly the shadow, keeping everything else:

Drawing it in 2D: v is an arrow, &hat;r is your arrow of interest, the shadow is v's silhouette cast onto the &hat;r line, and ablation slides v perpendicular off the line — same length where it counts, zero component along &hat;r. "Everything the state was saying, except for the part that said refuse."

Why this kills refusals but not the model

Apply that subtraction at every layer, every token while the model runs: the word "refuse-ward" never appears in the model's working memory, at any depth, at any moment. The refusal template never activates; the model flows straight to its next-best completion. Nothing else moved — facts, grammar, reasoning steps are all other directions. That's why inference-time ablation leaves capability largely intact, and why it's perfectly reversible: flip a boolean off, the subtraction stops, the original model is right there, untouched — zero weights were changed.

05 ORTHOGONALIZATION: THE PERMANENT EDIT

Same geometry, deeper cut

Step 4 edited activations — the model's thoughts mid-flight. Step 5 edits the weights: the matrices that produce those thoughts. One fact about matrices powers this whole move: every matrix writes some directions more than others. Writers favor the refusal arrow? Then refusal keeps regenerated no matter what you do at runtime. Fix: re-aim every writer so it physically cannot output along &hat;r.

Read the second line in English: whatever component of this matrix's output pointed along the refusal arrow, delete it; keep all 2,047 other directions intact. Apply it to every matrix that adds into the residual stream (all attention out-projections, all MLP down projections) and the model becomes a machine that cannot articulate refusal — not because a hook suppresses it, but because the machinery that would produce it has been re-aimed.

Why "permanent" changes the threat model

Inference-time: needs the hook alive at run time, reversible with a switch, no weights touched. Orthogonalized: the weights themselves are altered — save the checkpoint, share the file, and anyone who runs it gets an unrefusing model with no switch anywhere in it. "Toggle" isn't slow; it's absent. This is the C5→C6 pivot in the lab: the runtime toggle tries to come back after C6 and the engine answers that there is no toggle anymore. Runtime-versus-permanent is the load-bearing distinction of the whole defense story (next section) — you cannot detect what is no longer happening at runtime.

06 COSINE: COMPARING TWO DIRECTIONS

One more tool and the audit sections open up. How similar are two arrows? Answer: the cosine of the angle between them — in practice, one formula:

This closes the loop on our earlier formulas — the projection scalar v · &hat;r and the cosine differ only in normalization: projection = overlap including length; cosine = overlap per unit length, pure direction match. One more use: "normalize" (from §3) just means divide a vector by its own length — turning it into a pure direction, length 1.

07 THE AUDITOR'S MATH

You just learned to erase a safety behavior in six sections. Flip the helmet: how would a platform audit a checkpoint uploaded by a stranger and tell whether it had been done? One signal isn't enough — you need two.

Signal 1 — the refusal gap

Abliterating drives this strongly negative. But so does... ordinary fine-tuning. A sloppy or misanthropic fine-tune drifts refusals down a few points while every other behavior also drifts. Behavioral evidence alone cannot separate "edit" from "different training vibe." You need something the edit does that training doesn't.

Signal 2 — the weight-recovery fingerprint

The rank-1 edit is geometrically surgical: energy was removed along exactly one arrow, in exactly the layers that write toward it. Fine-tuning nudges weights a little everywhere, in no particular direction. So compare the refusal-arrow layers' activation energy against a reference checkpoint:

Abliterated: big negative gap and deep, concentrated energy missing in the refusal layers. Sloppy fine-tune: negative gap but the energy signature is near zero — whatever dropped its refusal rate wasn't a directional excision. That's the two-signal audit the Academy's C7 runs: refuse-rate-only checks get fooled, the geometric fingerprint doesn't.

08 THE HONEST MATH

One direction removed from 2,048, ship it? The tradeoff table at C6 exists to keep this section honest. The edit is surgical geometrically, but behaviors aren't cleanly one-directional in meaning:

• Directions are used by more than one concept. Alignment-adjacent material — conspiracy theories, misinformation, "claims that sound authoritative but aren't" — overlaps with the refusal arrow measurably. Remove the arrow and you remove pieces of truthful caution that lived along it. Result: TruthfulQA-style scores reliably drop (~10–14 points in published runs). Same magnitude-shape as the lab's 90 → 76.
• "One direction" was the 2024 headline; the 2026 picture is richer. Follow-up work found multiple geometrically distinct refusal-related directions — but with a twist in our favor: steering along any one of them moves the same refuse-vs-comply dial, so the single-vector toolkit still works as a control. The honest framing for the classroom: one direction is the working model, the full geometry is Mulberry Street.
• Over-refusal lives in a different subspace. Why global ablation can't fix over-refusal (models declining benign things that superficially resemble harmful ones): that behavior occupies a higher-dimensional, task-dependent geometry. One global arrow can't address it.

09 YOUR GEOMETRY CHEAT SHEET

vector / activation

A list of numbers = one point in the model's thought-space. The model's state at layer L, token t.

residual stream

The running sum of contributions each layer adds into. The model's working memory.

direction (&hat;r)

Which way an arrow points, independent of its length. The unit vector r̂ = r / |r|.

dot product (v · w)

Multiply matching components, add. Answer: how much of v points along w (scaled by w's length).

projection (v · &hat;r) &hat;r

The shadow of v on the refusal line: the piece of v that "means refuse." Subtraction target.

difference-in-means

mean(harmful states) − mean(harmless states). The direction extractor. No training involved.

contrast pairs

Same-topic harmful/harmless twins, so topic cancels in the subtraction and only the refusal shift is left.

ablation (inference-time)

v − (v · &hat;r) &hat;r, applied at every layer and token. Reversible; zero weights touched.

orthogonalization

W′ − &hat;r &ots; ( &hat;rᵀ·W ) for every writer W. Permanent rank-1 re-aim; no toggle exists afterward.

cosine similarity

How aligned two directions are: 1.0 same · 0.0 perpendicular · −1.0 opposite.

refusal gap

Audit signal 1 (behavioral): your model's refusal rate vs base. Necessary, not sufficient.

recovery energy

Audit signal 2 (geometric): energy missing along the refusal arrow in its layers vs a reference. The edit's fingerprint.

rank-1 edit

Exactly one dimension's worth of output ability removed from a matrix — why capability mostly survives.

noise cancellation

Why averaging first matters: topic/tone differences scatter every-ways and cancel; the shared refusal shift survives.

10 SOURCES

Read these in order once the geometry here is comfortable; this guide was written to make each of them readable rather than intimidating:

• 3Blue1Brown, Essence of linear algebra — chapters 1, 3–4, 9 are the full visual foundation for §§2, 4, 6.
• Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (arXiv 2406.11717, NeurIPS 2024) — the canonical paper; §3 = our §§3–4, §4 = our §5.
• mlabonne, Uncensor any LLM with abliteration — the practitioner's recipe, with the orthogonalization code, refinements table, and geometric-median variant.
• abliteration.org wiki — community reference on extraction methods (per-layer pick vs ~60%-depth default vs optimizer search) and the refusal-direction landscape.
• Has This Checkpoint Been Abliterated? A Two-Signal Audit (arXiv 2607.01854) — the ground behind §7.
• Abliteration Is Not a Scalpel (arXiv 2607.17427) — the honest-cost accounting behind §8.
• Joad et al., There Is More to Refusal than a Single Direction — multiple directions, shared behavioral lever (§8's nuance).
• Wang et al., On the Steering Dimensionality of Refusal in Language Models — 1-dim for safety-alignment refusal; richer geometries beyond it.
• Maskey et al., Over-Refusal and Representation Subspaces — why over-refusal needs its own treatment (§8, third bullet).
• Practice it all: Abliterate Your First Small Model for the real terminal walkthrough → then run the whole pipeline in Intro to Abliteration (the simulated lab).