LLM Abliteration Prevention Via Refusal Aliases

Abliteration, the removal of refusal capabilities from large language models by projecting weight matrices orthogonal to an extracted refusal direction, has emerged as a prominent safety concern, as it can bypass post-training alignment using only a small set of contrastive prompts. We find that existing defenses fail to address the cause of abliteration; that is, how \textit{easily} the refusal direction can be extracted. To hinder this process, we introduce a weight-editing method that obscures the refusal signal by applying rank-$k$ updates to residual stream writer matrices while replacing refusal-inducing activations with random aliases and correcting downstream reader matrices to preserve the model's original behavior. On Llama-3.1-8B, APRA improves post-abliteration refusal scores by $2.16$ points over the undefended baseline with less than $0.5\%$ MMLU degradation. On Gemma-2-9B, it reduces the abliteration gap by $14.70$ points, which the largest gain among all tested defenses although at a greater utility cost.