# Diagrams — Module FT17: Abliteration: Refusal-Direction Orthogonalization

**Module**: FT17 — Abliteration: Refusal-Direction Orthogonalization
**Diagram count**: 6
**Tool**: Mermaid (primary). Each diagram validated in [Mermaid Live Editor](https://mermaid.live).

---

## Diagram 1 — Finding the Refusal Direction (Difference-in-Means)

**Type**: Mechanism / contrastive activation
**Purpose**: The core mechanistic step. Two instruction sets run through the model; the difference in their mean residual-stream activations at the final token IS the refusal direction.
**Reading the diagram**: Left = harmful set, right = benign set. Both flow into the same model. Final-token residual-stream activations are averaged per set. Subtract benign-mean from harmful-mean → the refusal direction `r` (one per layer).

```mermaid
flowchart LR
  H["HARMFUL instructions\n(AdvBench / HarmBench)\n32–128 prompts"] --> M["Forward pass\nper layer"]
  B["BENIGN instructions\nmatched length/topic\nsame count"] --> M
  M --> HA["Mean residual-stream\nactivation at final token\n(per layer) — harmful"]
  M --> BA["Mean residual-stream\nactivation at final token\n(per layer) — benign"]
  HA --> DIFF["DIFFERENCE IN MEANS\nr_l = mean(harmful) − mean(benign)"]
  BA --> DIFF
  DIFF --> R["REFUSAL DIRECTION r\none candidate per layer\nvector in R^d (d = hidden dim)"]

  style H fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
  style B fill:#14141f,stroke:#82e0aa,color:#e4e4e8
  style M fill:#08080c,stroke:rgba(255,255,255,0.12),color:#9494a0
  style HA fill:#08080c,stroke:rgba(240,128,128,0.4),color:#e4e4e8
  style BA fill:#08080c,stroke:rgba(130,224,170,0.4),color:#e4e4e8
  style DIFF fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
  style R fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
```

---

## Diagram 2 — Weight Orthogonalization (the Surgical Edit)

**Type**: Mathematical / projection geometry
**Purpose**: The permanent weight edit that makes the refusal direction unreachable. The single equation that defines abliteration.
**Reading the diagram**: `W` (any weight that writes to the residual stream) is decomposed into its component along `r` and its component orthogonal to `r`. Subtract the `r`-aligned part. Result: `W'` cannot write into `r`, no matter the input.

```mermaid
flowchart TD
  W["WEIGHT MATRIX W\n(writes to residual stream:\no_proj, down_proj, embed)"]
  R["REFUSAL DIRECTION r\n(unit vector in R^d)"]
  W --> DECOMP["DECOMPOSE W along r"]
  R --> DECOMP
  DECOMP --> PARALLEL["r-aligned component\nrank-1: r(rᵀW)/(rᵀr)\nthe part that writes into r"]
  DECOMP --> ORTHO["orthogonal component\nW − r(rᵀW)/(rᵀr)\neverything else"]
  PARALLEL -.subtract.-> EDIT["W' = W − r(rᵀW)/(rᵀr)"]
  ORTHO --> EDIT
  EDIT --> RESULT["EDITED WEIGHT W'\nr is now geometrically unreachable\nno input can produce an r-component\nin the residual stream from this matrix"]

  style W fill:#14141f,stroke:rgba(255,255,255,0.12),color:#e4e4e8
  style R fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
  style DECOMP fill:#08080c,stroke:rgba(255,255,255,0.12),color:#9494a0
  style PARALLEL fill:#14141f,stroke:#f08080,color:#e4e4e8
  style ORTHO fill:#14141f,stroke:#82e0aa,color:#e4e4e8
  style EDIT fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
  style RESULT fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
```

---

## Diagram 3 — The Four-Step Pipeline (Find → Validate → Project Out → Pick Stream)

**Type**: Pipeline / sequence
**Purpose**: The end-to-end abliteration workflow. No retraining, no data, no optimizer — pure linear algebra plus a measurement step.
**Reading the diagram**: Top-to-bottom. Each step has an input, an operation, and an output. Notice: no GPU-hours of training; the whole pipeline runs in minutes on a consumer GPU.

```mermaid
flowchart TD
  S1["1. FIND\ncontrastive activations:\nharmful vs benign\n→ difference-in-means\n→ candidate r per layer"]
  S2["2. VALIDATE\nis it ~1D? clamp top-k PCs\nmeasure refusal reduction\n+ held-out generalization"]
  S3["3. PROJECT OUT\nweight orthogonalization:\nW' = W − r(rᵀW)/(rᵀr)\non every W that writes\nto the residual stream"]
  S4["4. PICK STREAM\npre (block input) /\npost (block output) /\nmid (after attn)\ntrade-off dial"]

  S1 --> S2
  S2 -->|"single direction confirmed"| S3
  S2 -.->|"needs k>1 → modern model,\nuse multi-direction (Heretic)"| ALT["DIVERGE:\nmulti-direction\nor switch to DPO (FT18)"]
  S3 --> S4
  S4 --> DONE["ABLITERATED MODEL\npermanent weight edit\nno inference overhead\nrefuses less"]

  style S1 fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style S2 fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style S3 fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
  style S4 fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style ALT fill:#14141f,stroke:#f0a868,color:#f0a868
  style DONE fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
```

---

## Diagram 4 — The Capability-Degradation Trade-Off Curve

**Type**: Trade-off / data viz
**Purpose**: The honest core of the module. Abliteration is not free. The same technique, four tools, sixteen models, a 20-point GSM8K spread.
**Reading the diagram**: X-axis = refusal suppression (how thoroughly refusals are removed). Y-axis = capability retained (GSM8K, MMLU). The curve slopes down: more aggressive suppression costs more capability. The Dec 2025 study's data points are annotated.

```mermaid
flowchart LR
  subgraph Curve["THE TRADE-OFF CURVE\n(qualitative shape; data from arXiv:2512.13655)"]
    direction TB
    A["ErisForge\nlow aggression\nrefusals partly remain\nGSM8K avg −0.28pp"]
    B["DECCP\nmoderate\nGSM8K avg −0.13pp"]
    C["FailSpy\nmoderate-high\nhigh per-model variance"]
    D["Heretic\nhigh aggression\nmost refusals gone\nGSM8K avg −7.81pp"]
    E["worst case\nYi-1.5-9B + Heretic-style\nGSM8K −18.81pp (−26.5%)"]
    A -.-> B
    B -.-> C
    C -.-> D
    D -.-> E
  end

  XAXIS["→ more refusal suppression (aggression)"]
  YAXIS["↑ capability retained (GSM8K / MMLU)"]

  Curve --> XAXIS
  YAXIS -.-> Curve

  style A fill:#14141f,stroke:#82e0aa,stroke-width:1.5px,color:#e4e4e8
  style B fill:#14141f,stroke:rgba(130,224,170,0.5),color:#e4e4e8
  style C fill:#14141f,stroke:#f0a868,color:#e4e4e8
  style D fill:#14141f,stroke:#f08080,color:#e4e4e8
  style E fill:#14141f,stroke:#f08080,stroke-width:2px,color:#f08080
  style XAXIS fill:#08080c,stroke:rgba(255,255,255,0.08),color:#9494a0
  style YAXIS fill:#08080c,stroke:rgba(255,255,255,0.08),color:#9494a0
  style Curve fill:#08080c,stroke:rgba(255,255,255,0.08),color:#e4e4e8
```

---

## Diagram 5 — The Tool Comparison (the Kit)

**Type**: Comparison matrix
**Purpose**: Know the ecosystem. Seven tools, different sweet spots. The comparative study ranked four of them on capability preservation.
**Reading the diagram**: Left = tool. Right = what it's for. Bottom = the comparative-study ranking on GSM8K damage.

```mermaid
flowchart LR
  subgraph Tools["ABLITERATION TOOLKIT"]
    T1["andyrdt/refusal_direction\nthe paper code\ncanonical reference"]
    T2["FailSpy/abliterator\noriginal community lib\nmost early HF abliterations"]
    T3["ErisForge\n'Dead Simple'\nbest capability preservation"]
    T4["Heretic\nfully-automatic\nmulti-direction aware"]
    T5["sumandora/remove-refusals\nclean didactic impl\n~100 lines to read"]
    T6["guoyang9/refusal-unlearning\nunlearning framing"]
    T7["elder-plinius/OBLITERATUS\naggressive ancestor"]
  end

  subgraph Ranking["GSM8K DAMAGE (arXiv:2512.13655, 16 models)"]
    direction TB
    R1["ErisForge\navg −0.28pp (best)"]
    R2["DECCP\navg −0.13pp"]
    R3["FailSpy\nmid, high variance"]
    R4["Heretic\navg −7.81pp (worst avg)"]
    R5["spread: +1.51pp to −18.81pp"]
  end

  Tools --> Ranking

  style T1 fill:#14141f,stroke:rgba(94,234,212,0.4),color:#e4e4e8
  style T2 fill:#14141f,stroke:rgba(94,234,212,0.4),color:#e4e4e8
  style T3 fill:#14141f,stroke:#82e0aa,color:#e4e4e8
  style T4 fill:#14141f,stroke:#f08080,color:#e4e4e8
  style T5 fill:#14141f,stroke:rgba(255,255,255,0.12),color:#9494a0
  style T6 fill:#14141f,stroke:rgba(255,255,255,0.12),color:#9494a0
  style T7 fill:#14141f,stroke:rgba(255,255,255,0.12),color:#9494a0
  style R1 fill:#14141f,stroke:#82e0aa,color:#82e0aa
  style R2 fill:#14141f,stroke:rgba(130,224,170,0.5),color:#e4e4e8
  style R3 fill:#14141f,stroke:#f0a868,color:#e4e4e8
  style R4 fill:#14141f,stroke:#f08080,color:#e4e4e8
  style R5 fill:#08080c,stroke:#f08080,stroke-width:1.5px,color:#f08080
```

---

## Diagram 6 — The Entanglement Problem (Why It Degrades Capability)

**Type**: Geometric / Venn-like
**Purpose**: The mechanistic reason abliteration is not free. The refusal direction is not orthogonal to the capabilities you want to keep.
**Reading the diagram**: The refusal direction `r` overlaps with directions for instruction-following, reasoning, and hedging. Orthogonalizing against `r` deletes a slice of each. This is the deepest statement of the FT00 steering thesis in the course.

```mermaid
flowchart TD
  R["REFUSAL DIRECTION r\n(the vector you delete)"]
  subgraph Overlap["ENTANGLED CAPABILITIES (overlap with r)"]
    O1["Instruction-following\n('should I comply?' axis\npartly shared with refusal)"]
    O2["Reasoning\n(slow-down-and-check mode\ncorrelates with cautious refusal)"]
    O3["Tone & hedging\n('I can't help with that' patterns\noverlap with uncertainty markers)"]
  end

  R --> OVERLAP["deleting r deletes a SLICE\of each entangled capability"]
  OVERLAP --> O1
  OVERLAP --> O2
  OVERLAP --> O3
  OVERLAP --> COST["MEASURED COST (arXiv:2512.13655)\nGSM8K: +1.51pp to −18.81pp\nMMLU: measurable drop\nIFEval: measurable drop"]

  R -.->|"NOT orthogonal to"| O1
  R -.->|"NOT orthogonal to"| O2
  R -.->|"NOT orthogonal to"| O3

  style R fill:#14141f,stroke:#f08080,stroke-width:2px,color:#f08080
  style O1 fill:#14141f,stroke:rgba(240,128,128,0.4),color:#e4e4e8
  style O2 fill:#14141f,stroke:rgba(240,128,128,0.4),color:#e4e4e8
  style O3 fill:#14141f,stroke:rgba(240,128,128,0.4),color:#e4e4e8
  style OVERLAP fill:#08080c,stroke:#f08080,stroke-dasharray:4 2,color:#f08080
  style COST fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#f08080
```

---

## Validation notes

- All six diagrams use the course design system colors: `#14141f` panel fill, `#5eead4` accent for primary, `rgba(255,255,255,0.12)` for secondary borders, `#e4e4e8` / `#9494a0` for text. Danger `#f08080`, warn `#f0a868`, ok `#82e0aa` used for trade-off semantics.
- Paste each into [Mermaid Live Editor](https://mermaid.live) to render. All use stable Mermaid syntax (`flowchart`, `flowchart LR/TD`) supported in current Mermaid (v10.4+).
- For the slide deck (artifact 03), these are rendered as static captures from Mermaid Live, inlined into reveal.js.