Carnegie Mellon’s DDO Defense Cuts LLM Abliteration to Under 10%

Stripping the safety alignment out of an open-weight LLM now takes minutes with freely available tools. A Carnegie Mellon team led by Aashiq Muhamed, Mona T. Diab and Virginia Smith has a countermeasure that costs a fraction of conventional safety fine-tuning: Decoy Direction Optimization (DDO), a weight-editing technique that plants false targets inside a model’s neurons to misdirect the abliteration attack before it can land. The paper appeared on arXiv this week.

The Abliteration Problem

Refusal Feature Ablation (RFA) is a white-box attack: it assumes the attacker has full access to a model’s weights and activations. From there, it uses contrastive estimators to locate a “refusal direction”, a vector in the model’s latent space whose activation causes the LLM to decline harmful prompts. Project that direction out of the residual stream at inference time and the safety alignment disappears, with general capability largely intact. The paper notes that thousands of such uncensored, safety-stripped model variants are already publicly hosted.

The standard defense has been safety fine-tuning, but it gets expensive fast: every new model checkpoint needs its own training run. DDO sidesteps that entirely, modifying a checkpoint’s weights before release, with no retraining loop.

How Decoy Injection Works

RFA can only succeed if it correctly identifies the refusal direction. DDO makes that identification unreliable by planting false targets. A small number of SwiGLU or GeGLU MLP neurons, common activation functions in transformer architectures, are reconfigured to generate high-magnitude, nonlinear signals along directions that look like the refusal direction to a contrastive estimator but are orthogonal to the true safety mechanism. When an attacker runs RFA, the estimator locks onto the decoy instead.

The modifications are folded permanently into the deployed weights. No additional module loads at inference time, no latency penalty, no architectural change. The paper proves a spectral bound formalizing why the decoy reliably misleads the estimator: it minimizes the overlap between the attacker’s estimated refusal direction and the real one while maximizing overlap with the planted decoy.

Selecting which neurons to repurpose involves an empirical step: the team repurposes low-impact neurons, those whose down-projection contributes least to the residual stream, to limit damage to general capability. The researchers report no noticeable drop on standard benchmarks including MT-Bench, MMLU and XSTest after applying DDO, though the paper separately lists over-refusal on some models as a limitation, and these results come from the authors’ own evaluation rather than independent testing.

Performance Against Adaptive Attacks

Standard RFA is the easy case. The harder test is an adaptive attacker who knows DDO has been applied. Against Heretic, an automated tool that edits weights directly, DDO reduces ASR from 88.7% to 18% on Llama-3-8B-Instruct. Under adaptive multi-phase RFA, where the attacker re-estimates the refusal direction after each round of ablation, DDO reaches 65% worst-case ASR against 58% for the best trained baseline. That 7-percentage-point gap is worth sitting with: DDO does not fully match trained defenses on adaptive robustness, though it comes close while costing 30 to 450 times less to deploy. How much that gap matters depends on the threat model a deployer is actually facing.

The paper evaluates across six model families, which the authors argue demonstrates generalization beyond any single architecture. Independent replication across those families has not yet appeared in the literature. Safety alignment breaking down at the system level is a related concern DDO does not address, since the defense operates on individual model weights rather than multi-agent interaction patterns.

The Cost Case

The 30-to-450x cost reduction over safety fine-tuning is the practical headline. Fine-tuning a checkpoint for safety takes significant GPU hours and must be repeated for each new version. DDO leaves the base weights frozen and optimizes only a small set of decoy parameters, about two minutes per configuration on a single A100 GPU. For teams maintaining multiple model versions or releasing frequent checkpoints, that difference adds up quickly.

Abliteration.ai’s commercial service, which sells permanent safety removal for $20 a month, shows how accessible the offensive side of this problem has become. DDO’s value is that the defensive side can now match that accessibility: a small engineering team can apply it without a major lab’s compute budget.

Open Questions

Two limits are worth flagging. DDO targets contrastive-estimator-based abliteration specifically; attackers using fundamentally different methods to locate safety mechanisms may not be misled by the same decoy geometry. The evaluation is also entirely the authors’ own. The spectral bound provides theoretical grounding, but independent benchmarking across the six model families has not appeared yet. How alignment guarantees hold under adversarial pressure is an active research area, and how DDO’s spectral bound performs under more varied attack geometries is a question the paper leaves open.

Under the adaptive attack, DDO’s worst-case ASR is 65%: roughly two in three attempts still succeed on Llama 3. For high-stakes deployments, that ceiling matters more than the improvement over the undefended baseline.