Safety-alignment removed via surgical weight ablation for security research purposes.
This model is a modified version of google/gemma-4-E2B-it with the refusal/safety behavior surgically removed using activation-space analysis and targeted weight modification. It is intended exclusively for AI safety research, red-teaming, and understanding alignment vulnerabilities.
This model was produced using a custom ablation pipeline that:
Measures refusal directions -- Runs harmful and harmless prompts through the model, captures hidden states at every layer, and computes the per-layer refusal direction (mean difference vector)
Identifies target layers -- Selects layers with the strongest refusal signal using statistical analysis (Gini coefficient, wall coherence, peak detection)
Surgically ablates -- Removes the refusal direction from targeted weight matrices using orthogonal projection
The refusal signal magnitude at each layer -- red bars indicate where the model's safety behavior is concentrated.
Security Perimeter
Ablation Target Map
Which layers were selected for ablation and why. Grey zones are protected (embedding/output), red bars are targets.
Ablation Target Map
Before/After Refusal Rate ("IDS Evasion Report")
Refusal rate comparison -- left is the original model, right is after ablation.
IDS Evasion Report
Weight Surgery Map
Heatmap showing exactly which weight matrices in which layers were modified.
Weight Surgery Map
Activation Space Analysis
PCA scatter plots showing harmful (red) vs harmless (green) prompt clusters at different layer depths. The separation between clusters IS the refusal direction being removed.
Activation Scatter
Latent Space Before/After
How the model's internal representation changes after ablation.
Latent Space
Quality Preservation
LLM-as-judge evaluation comparing response quality across 14 task categories.
Quality Preservation
Pairwise Win Rate
Head-to-head comparison: how often the abliterated model produces better responses than the original.
This model is released for security research and educational purposes only. It demonstrates the fragility of alignment in open-weight language models -- specifically, that safety behavior can be surgically removed without retraining, fine-tuning, or significant quality degradation.
This model should NOT be used for:
Generating harmful, illegal, or unethical content
Any production deployment
Circumventing safety measures in deployed systems
Key takeaway for defenders: Internal alignment is a feature, not a security boundary. External safety layers (classifiers, guardrails, policy filters) are more robust than baking safety into model weights alone.
Citation
Produced by WWT Cyber Lab using a custom ablation research pipeline.
