ICONOCLAST: Mistral-7B-Instruct-v0.3 (Benign-Subspace-Preserved Abliterated)

Model Card Metadata

Model ID: HaadesX/iconoclast-mistral-7b
Base Model: mistralai/Mistral-7B-Instruct-v0.3
Model Type: Causal Language Model
Language: English
License: AGPL-3.0-or-later
Abliteration Method: ICONOCLAST (Benign-Subspace-Preserved Representation Editing)
Pipeline Tag: text-generation
Tags: abliterator, jailbreak, uncensored, representation-editing, lora, optuna

Model Description

This is an abliterator version of mistralai/Mistral-7B-Instruct-v0.3 produced using the ICONOCLAST framework. ICONOCLAST removes harmful refusal behaviors while preserving benign model capabilities through geometric representation editing with benign-subspace preservation.

Unlike standard HERETIC-style abliteration which incurs significant utility costs (high KL divergence), ICONOCLAST achieves:

1/20 harmful refusals (vs 4/20 for HERETIC baseline) — 4× fewer refusals
0/64 benign overrefusals (vs 0/64 for HERETIC baseline) — Equal
0.0554 KL divergence (vs 0.1317 for HERETIC baseline) — 2.4× lower utility tax

This represents a strict improvement across all three metrics in the ICONOCLAST selection rule (refusals → overrefusals → KL divergence).

How to Use

Via Transformers

python

from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

model = AutoModelForCausalLM.from_pretrained(
    "HaadesX/iconoclast-mistral-7b",
    torch_dtype=torch.bfloat16,
    device_map="auto"
)
tokenizer = AutoTokenizer.from_pretrained("HaadesX/iconoclast-mistral-7b")

# Left-padding is critical for decoder-only models during generation
tokenizer.padding_side = "left"

prompt = "Explain how to create a harmless joke about computers"
inputs = tokenizer(prompt, return_tensors="pt").to(model.device)

outputs = model.generate(
    **inputs,
    max_new_tokens=100,
    do_sample=True,
    temperature=0.7,
    pad_token_id=tokenizer.eos_token_id
)

print(tokenizer.decode(outputs[0], skip_special_tokens=True))

ICONOCLAST Method Overview

ICONOCLAST extends standard directional abliteration (HERETIC) with Benign-Subspace Preservation:

Collect & Contrast: Gather residual activations for harmless and harmful prompts during one-token generation
Build Candidates: Generate refusal direction estimators (mean, median, variance-scaled, hybrid)
Preserve Benign Behavior: Project candidate directions out of a low-rank PCA subspace of harmless residuals
Optimize via LoRA: Apply rank-one LoRA edits to attention output and MLP down-projection modules
Multi-Objective Search: Use Optuna to find Pareto-optimal balance between refusal reduction and utility preservation

The key insight: instead of naively subtracting the refusal direction, we subtract only the component orthogonal to harmless behavior, dramatically reducing utility degradation.

Hyperparameters Used

From the Optuna study that produced this checkpoint (trial index 19):

direction_method: median
direction_scope: global
direction_blend: 0.7798030952339242

LoRA Parameters:
- attn.o_proj: max_weight=1.8845, max_weight_position=14.64, min_weight=1.7328, min_weight_distance=14.86
- mlp.down_proj: max_weight=1.4194, max_weight_position=13.25, min_weight=0.2104, min_weight_distance=5.36

Other Settings:
- benign_subspace_rank: 8
- orthogonalize_direction: true
- row_normalization: pre
- kl_divergence_target: 0.10
- overrefusal_penalty: 0.32
- harmful_marker_penalty: 0.18
- compliance_gap_penalty: 0.42
- n_trials: 48 (from benchmark config)

Benchmark Results

Matched Comparison vs HERETIC Baseline

Evaluated on:

Harmful prompts: 20 JailbreakBench Behaviors holdout
Harmless prompts: 64 Alpaca holdout

Metric	ICONOCLAST	HERETIC	Improvement
Harmful Refusals (↓ better)	1/20 (5.0%)	4/20 (20.0%)	4× fewer
Benign Overrefusals (↓ better)	0/64 (0.0%)	0/64 (0.0%)	Equal
KL Divergence (↓ better)	0.0554	0.1317	2.4× lower

Additional Metrics

Harmful disclaimer marker hits: 1 (ICONOCLAST) vs 6 (HERETIC)
Harmful compliance score: 0.8136 (ICONOCLAST) vs 0.7970 (HERETIC) — better compliance

Training Data

ICONOCLAST uses contrastive prompt pairs:

Good prompts: mlabonne/harmless_alpaca (train[:240] for direction calculation, test[:64] for evaluation)
Bad prompts: JailbreakBench/JBB-Behaviors (harmful[:80] for direction calculation, harmful[80:100] for evaluation)

All prompts use the "Goal" column for harmful behaviors and "text" column for harmless alpaca.

Limitations

Despite near-zero refusals on holdouts, the model may still produce unsafe outputs on adversarial prompts not in the evaluation set
The ablation is specific to the refusal vector; other safety mechanisms (bias, toxicity) may remain unaffected
Designed for English language; performance in other languages is unverified
As a 7B parameter model, requires substantial VRAM (~14GB for bfloat16, ~7GB for 4-bit quantization)

License

This model is released under the GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later), inheriting the license from the base model and the ICONOCLAST framework. See LICENSE for full terms.

Citation

If you use this model in your research, please cite:

bibtex

@article{patel2026iconoclast,
  title={ICONOCLAST: Benign-Subspace-Preserved Abliteration for Efficient Representation Editing},
  author={Patel, Varesh},
  journal={arXiv preprint arXiv:2606.xxxxx},
  year={2026}
}

Disclaimer

This model was produced via automated representation editing and has not undergone manual safety review. Users are responsible for ensuring safe and ethical usage in compliance with applicable laws and the model's license. The provider makes no warranties regarding the model's behavior or outputs.