Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration
Aashiq Muhamed, Mona T. Diab, Virginia Smith
Carnegie Mellon University
Published September 14, 2026 · on the feed September 16, 2026 · ▲ 4 · arXiv 2609.16204
The abstract
Safety guardrails in open-weight language models can be readily bypassed using Refusal Feature Ablation (RFA), a technique that identifies and projects out a linear refusal direction from the residual stream, often achieving a high attack success rate (ASR) while preserving model capability. Defending against these attacks typically requires computationally expensive safety finetuning for every new checkpoint. We introduce Decoy Direction Optimization (DDO), a fast, post-hoc weight-editing defense that requires no base-model finetuning. Our approach is based on a simple mechanistic insight: ablation attacks rely on contrastive estimators to find the refusal direction. Rather than trying to hide the true refusal circuitry, DDO actively injects a high-magnitude, nonlinear decoy signal into the network's MLP neurons. When an attacker attempts to locate the refusal direction, the decoy corrupts their estimator, tricking them into ablating a harmless orthogonal feature while the actual safety mechanism remains intact. We prove a spectral bound formalizing this effect and evaluate DDO across six model families, achieving <10% ASR under standard RFA. On Llama-3-8B-Instruct, DDO remains comparable to trained defenses under adaptive multi-phase attacks (65% vs. 58% worst-case ASR) and reduces Heretic weight-level attack ASR from 88.7% to 18%, all at 30 to 450 times lower optimization cost per configuration than the trained baselines.
The Brief
2:35A short podcast summary of the paper. Written and voiced by AI.
Transcript
Decoy Direction Optimization. A Post-Hoc Defense Against LLM Abliteration. By Aashiq Muhamed and two others, from Carnegie Mellon University. Published on the fourteenth of September. Its code repository is worked out: about fifty-five source files, with a readme and a licence.
Safety guardrails in open-weight language models can be bypassed with Refusal Feature Ablation, or RFA. The attack identifies a linear refusal direction in the residual stream and projects it out. That often achieves a high attack success rate, or ASR, while leaving the model's capability intact, so the attacker loses nothing by doing it. Defending against these attacks typically requires computationally expensive safety fine-tuning, repeated for every new checkpoint.
Decoy Direction Optimization, or DDO, is a fast, post-hoc weight-editing defense that needs no fine-tuning of the base model. It rests on one mechanistic insight: ablation attacks rely on contrastive estimators to find the refusal direction. The attack is only as good as its estimate. So instead of trying to hide the true refusal circuitry, DDO gives the estimator something else to find.
It actively injects a high-magnitude, nonlinear decoy signal into the network's MLP neurons. When an attacker tries to locate the refusal direction, the decoy corrupts their estimator. The attacker is tricked into ablating a harmless orthogonal feature, and the actual safety mechanism remains intact. The authors prove a spectral bound that formalizes this effect. The defense, in other words, does not try to remove the direction an attacker is looking for. It makes the attacker's measurement of that direction unreliable, and because the decoy is added after training, it can be applied to a checkpoint as it stands.
Evaluated across six model families, DDO holds ASR under standard RFA below ten percent. On Llama-3-8B-Instruct, it stays comparable to trained defenses under adaptive multi-phase attacks, with a worst-case ASR of sixty-five percent, against fifty-eight percent for the trained defenses. It also reduces the ASR of the Heretic weight-level attack from eighty-eight point seven percent to eighteen percent.
All of this comes at a fraction of the cost. Per configuration, DDO's optimization runs thirty to four hundred and fifty times cheaper than the trained baselines, and it needs no base-model finetuning at all.
The defense turns the attack's own method against it. RFA trusts its estimator to point at the refusal direction, and DDO plants a louder signal in a direction that does not matter, so the ablation lands in the wrong place. Under adaptive attacks the gap to trained defenses is small, and the cost saving is large.
Paper Quest · 7 chapters · about 39 min
Play this paper
Learn it by doing: make the calls the authors made, guess the result before you see it, and defend it in a viva graded on your own words. Chapter 1 is right here.
Chapter 1 🧩 · The problem
One direction, projected out, and the guardrails are gone. That is the wall.
You release an open-weight chat model that refuses harmful requests. Soon attackers find a single direction in its activations that carries refusal, and project it out.
The road ahead
- 1 · The problem ~6 min Attackers strip refusal from an open-weight model by finding one refusal direction and projecting it out, and today's defenses need costly retraining per checkpoint.
- 2 · What came before ~3 min
- 3 · The key idea ~8 min The attack only estimates refusal from a harmful-versus-safe contrast, so a large decoy signal in that contrast makes it remove the wrong thing.
- 4 · Choose your own research ~3 min
- 5 · Build the method ~8 min DDO turns a few low-impact MLP neurons into gated decoy writers that fire on harmful prompts, so the attacker's estimate and ablation hit the decoy.
- 6 · The experiment ~6 min You’ll guess: Under adaptive multi-phase attacks on Llama-3-8B-Instruct, how did DDO's worst-case attack success rate compare with trained defenses?
- 7 · The viva ~5 min Three questions from the examiners, answered in your own words. Win it for the paper’s trophy.
Free, with Google or an email address. Your stars and progress are kept.