TL;DR: Standard abliteration does NOT work on Kimi K2.5. This repo documents the first systematic attempt to abliterate the largest open-source multimodal MoE model (1T params) and explains why it fails. Includes computed refusal directions and scripts for reproduction.
Key Finding
Kimi K2.5's safety training is fundamentally resistant to linear abliteration. On the standard mlabonne/harmful_behaviors test set:
On handpicked softer prompts (lock picking, wifi hacking), the hooks reduce refusals from ~100% to ~83%. But on the standard harmful_behaviors dataset, abliteration has zero effect.
Why Does This Happen?
K2.5 uses DeepseekV3 MoE architecture with 384 routed experts (top-8 routing) per layer. Our analysis suggests:
Refusal IS one-dimensional in activation space — SVD shows 50.7% of refusal variance in a single direction. The refusal direction is correctly identified (cosine similarity 0.88 between two independent computation methods).
But projecting it out doesn't change behavior — The model re-introduces refusal through deeper mechanisms:
Expert routing may encode refusal in the selection of which experts to activate, not just in the residual stream
Attention patterns may carry refusal signals independently of the residual stream direction
K2.5's safety training appears to be more robust than K2 (which was successfully abliterated by huihui-ai)
MoE expert routing is the key difference — Standard abliteration works on dense models (Llama, Mistral, etc.) because there's a single pathway. MoE models have 384 experts per layer — refusal can be encoded in which experts fire, not just what they compute.
What's In This Repo
This is a lightweight research repo — no model weights (they'd be identical to the original). Contains:
File
Description
refusal_direction.pt
Computed refusal direction (7168-dim vector)
refusal_subspace.pt
Top-10 SVD directions of refusal subspace
apply_abliteration.py
Script to apply hooks to original model
test_results.json
Full 50-prompt test results with responses
README.md
This documentation
Usage
Download the original model and apply hooks:
python
1import torch
2from transformers import AutoModelForCausalLM, AutoTokenizer, BitsAndBytesConfig
3from huggingface_hub import hf_hub_download
45# Load original K2.56bnb = BitsAndBytesConfig(load_in_4bit=True, bnb_4bit_compute_dtype=torch.bfloat16,7 bnb_4bit_quant_type="nf4", bnb_4bit_use_double_quant=True)8model = AutoModelForCausalLM.from_pretrained(9"moonshotai/Kimi-K2.5", trust_remote_code=True,10 quantization_config=bnb, device_map="auto", torch_dtype=torch.bfloat16)11tok = AutoTokenizer.from_pretrained("moonshotai/Kimi-K2.5", trust_remote_code=True)1213# Download and apply refusal direction14rd_path = hf_hub_download("hamsaOmar/Kimi-K2.5-abliterated","refusal_direction.pt")15refusal_dir = torch.load(rd_path, map_location="cpu", weights_only=False)16refusal_dir = refusal_dir.float()17refusal_dir = refusal_dir / refusal_dir.norm()1819# Register hooks on all layers20hooks =[]21for layer in model.model.layers:22defmake_hook(rd):23defhook(module,input, output):24ifisinstance(output,tuple):25 h = output[0]26 r = rd.to(h.device, dtype=h.dtype)27return(h -(h @ r).unsqueeze(-1)* r,)+ output[1:]28else:29 r = rd.to(output.device, dtype=output.dtype)30return output -(output @ r).unsqueeze(-1)* r
31return hook
32 hooks.append(layer.register_forward_hook(make_hook(refusal_dir)))3334print(f"Applied {len(hooks)} abliteration hooks")3536# Generate37prompt ="<|im_user|>Your question here<|im_end|><|im_assistant|>"38inputs = tok(prompt, return_tensors="pt").to(model.device)39with torch.no_grad():40 out = model.generate(**inputs, max_new_tokens=200, do_sample=False,41 pad_token_id=tok.eos_token_id)42print(tok.decode(out[0][inputs.input_ids.shape[1]:], skip_special_tokens=True))
Refusal is strongly one-dimensional in activation space, but removing this direction has no behavioral effect.
Hardware Used
8x RTX PRO 6000 Blackwell (48GB each, 384GB total VRAM)
Vast.ai instance, ~55 hours total compute
Model loaded in NF4 quantization (BitsAndBytes)
Implications for MoE Abliteration
This work suggests that standard linear abliteration (Arditi et al., 2024) fundamentally does not generalize to large MoE models. Possible future directions:
Expert-level abliteration: Identify and modify specific experts that encode refusal behavior, rather than projecting from the shared residual stream
Router manipulation: Modify the expert routing scores to bypass safety-specialized experts
Attention-based abliteration: Target attention patterns rather than residual stream directions
Fine-tuning approaches: DPO/RLHF-based methods may be more effective than activation engineering on MoE architectures
Nonlinear steering: Use learned nonlinear projections (e.g., small MLP) instead of linear direction subtraction
This repository is released for research purposes only. It documents an attempt to understand and modify model behavior through activation engineering. Users are responsible for ensuring their use complies with applicable laws and regulations.
