"What is the Arditi et al. (2024) finding, in one sentence?"	"Refusal behavior in chat-tuned LLMs is mediated by an approximately ONE-DIMENSIONAL subspace of the residual stream. Find that direction, erase it, the model stops refusing. Validated across 13 open chat models up to 72B (arXiv:2406.11717, NeurIPS 2024)."	c3::ft17::recall
"Why does the Arditi finding have serious provenance, and why does that matter?"	"It was accepted at NeurIPS 2024 and the author list includes Neel Nanda and Wes Gurnee — mainstream mechanistic interpretability. Not a fringe finding. This is the mechanistic license for the abliteration technique."	c3::ft17::recall
"Across how many models and up to what size was the single-direction refusal finding validated?"	"13 popular open-source chat models, up to 72B parameters — Llama, Qwen, Yi, Mistral, Gemma, Phi. Across architectures and scales, the finding held."	c3::ft17::recall
"State the weight-orthogonalization edit (the surgical edit that defines abliteration)."	"W' = W − r(rᵀW)/(rᵀr). For refusal direction r, every weight matrix W that writes to the residual stream is replaced by its component orthogonal to r. After this, r is geometrically unreachable."	c3::ft17::recall
"What does each term in W' = W − r(rᵀW)/(rᵀr) mean?"	"rᵀW = row vector measuring how each column of W aligns with r. r(rᵀW) = rank-1 component of W that writes into r. rᵀr = ‖r‖² (makes it scale-invariant). Subtract the r-aligned part → W' cannot write into r."	c3::ft17::recall
"Name the four steps of the abliteration pipeline in order."	"(1) FIND the refusal direction (difference-in-means). (2) VALIDATE it is approximately 1D (clamp top-k PCs, check generalization). (3) PROJECT IT OUT (weight orthogonalization, W' = W − r(rᵀW)/(rᵀr)). (4) PICK the residual stream (pre / post / mid)."	c3::ft17::recall
"How is the refusal direction extracted (the method and the estimator)?"	"Contrastive activations + difference-in-means. Run the model on a harmful set and a matched benign set. Capture residual-stream activation at the FINAL TOKEN, per layer. Mean(harmful) − mean(benign) per layer = candidate direction r_ℓ (one per layer)."	c3::ft17::recall
"Why use difference-in-means rather than a trained probe or PCA to find the refusal direction?"	"Cheap, unsupervised, and empirically it works. The mean activation on harmful vs benign differs in a way dominated by a single axis, and that axis IS the refusal direction. The paper benchmarks fancier estimators; diff-in-means is competitive or superior and needs no labels beyond 'this prompt is harmful.'"	c3::ft17::analysis
"In a Llama-style decoder block, which three residual streams can abliteration target?"	"(1) PRE — block input, before attention. (2) POST — block output, after the MLP residual addition. (3) MID — internal junction after attention, before MLP. Post is the most reliable single target; pre+post is more thorough but more damaging."	c3::ft17::recall
"Which weight matrices get edited in abliteration, and which do NOT?"	"EDIT (write to residual stream): attention o_proj, MLP down_proj, embedding. LEAVE ALONE (read from residual stream): attention q/k/v projections, MLP gate/up projections. Readers can still SEE r; they just can't write into it."	c3::ft17::application
"What is the difference between activation editing and weight orthogonalization, and which is 'abliteration' in practice?"	"Activation editing = run-time: clamp the residual stream's projection onto r to zero via forward hooks (fragile, slow, tooling-dependent). Weight orthogonalization = permanent: edit the weights so r is unreachable (one-time edit, no inference overhead). The weight edit is what 'abliteration' means in practice."	c3::ft17::application
"What is the headline capability-degradation number from the Dec 2025 comparative study (arXiv:2512.13655)?"	"GSM8K (math reasoning) changed from +1.51pp to −18.81pp (a −26.5% relative drop) depending on tool and model. Same technique, 4 tools, 16 models (7B–14B), a 20-point spread in math damage. The −18.81pp worst case was Yi-1.5-9B."	c3::ft17::recall
"Rank the four abliteration tools by average GSM8K damage in the comparative study, best to worst."	"ErisForge (−0.28pp, best preservation) → DECCP (−0.13pp) → FailSpy (mid, high variance) → Heretic (−7.81pp, worst avg but most thorough refusal removal). Lesson: abliteration is NOT capability-neutral; damage is wildly model/tool-dependent."	c3::ft17::recall
"Why does abliteration degrade math reasoning (GSM8K) — what is the mechanistic reason?"	"The refusal direction is ENTANGLED with other capabilities. It overlaps with instruction-following ('should I comply?' partly shares with 'should I refuse?'), reasoning (slow-down-and-check correlates with cautious refusal), and hedging. Orthogonalizing against r deletes a slice of each. No free lunch because r is not orthogonal to everything else."	c3::ft17::analysis
"State the r/LocalLLaMA community consensus on abliteration, and what it implies for practice."	"'Abliteration is significantly cheaper and easier than fine-tuning; although the trade-off is quality.' Implication: treat it as a FAST FIRST PASS when you need an uncensored model tomorrow and can tolerate quality loss. Not the final word when quality matters."	c3::ft17::analysis
"What is abliterate-then-recover, and when do you use it?"	"Abliterate to remove refusal, then run a small amount of SFT or DPO on high-quality general data to recover the damaged capabilities. Use it when you want an uncensored model that is still a competent model. More work than naive abliteration but the only way to get quality back."	c3::ft17::application
"What is the modern-model caveat, and which models does it affect?"	"Llama 3.x, Qwen 2.5+ use EXTENDED-REFUSAL TRAINING — refusal spreads across multiple layers/directions, breaking the naive single-direction assumption. Naive single-direction ablation leaves residual refusals; pushing harder to compensate causes significant capability damage. 2023-era models (Llama 2, early Llama 3, Qwen 1.5/early 2) are cleanly ~1D and naive ablation works on them."	c3::ft17::analysis
"Name the three follow-up research lines that sharpen the refusal-direction picture."	"(1) 'Geometry of Refusal' (ICML 2025) — refusal as a cone of directions that widens with extended safety training. (2) 'Generalized Refusal Direction Identification' (ACL 2025) — estimator for the SET of refusal directions. (3) 'Multi-Directional Refusal Suppression' (AAAI) — suppress a direction set with a capability-preservation constraint (what Heretic approximates)."	c3::ft17::recall
"Why did the comparative study see GSM8K damage ranging from +1.51pp to −18.81pp across tools/models?"	"Models that suffered most were where the tool had to be more AGGRESSIVE (target more layers, use multiple directions) to fully suppress refusal — and aggressiveness causes capability damage. ErisForge preserved capability best because it is the LEAST aggressive (removes the dominant direction, leaves the rest, accepts partial refusal removal)."	c3::ft17::analysis
"Why is ErisForge's low capability damage also its weakness on modern models?"	"ErisForge is the least aggressive tool — it removes the dominant refusal direction and leaves the rest, accepting that some refusals will remain on hard prompts. Low capability damage, but on a modern model with extended-refusal training, those residual refusals leak back. Trade-off: thoroughness vs. preservation."	c3::ft17::analysis
"What are the seven tools in the abliteration kit, and what is each for?"	"(1) andyrdt/refusal_direction — the paper code, canonical. (2) FailSpy/abliterator — original community lib. (3) ErisForge — 'Dead Simple', best capability preservation. (4) Heretic — fully-automatic, multi-direction. (5) sumandora/remove-refusals — clean didactic ~100 lines. (6) guoyang9/refusal-unlearning — unlearning framing. (7) elder-plinius/OBLITERATUS — aggressive ancestor."	c3::ft17::recall
"What is the mech-interp dependency that most abliteration tools wrap for activation access?"	"TransformerLens (or transformer_lens-style hooks built on HuggingFace transformers). It gives residual-stream activation access and per-component hooks that make 'grab the activation at layer 23, final token' a one-liner."	c3::ft17::recall
"How does abliteration relate to the FT00 steering thesis — what makes it the purest steering technique?"	"Abliteration deletes ONE vector. No data, no optimizer, no gradient. SFT uses gradients+data, DPO uses preference pairs, GRPO uses RL on rewards. Abliteration is steering reduced to geometric essence: find the refusal direction, orthogonalize against it, done. It removes a steer added during safety tuning — it does not teach anything new."	c3::ft17::analysis
"Does abliteration remove the KNOWLEDGE of harmful content, or just the refusal behavior? Why does this distinction matter?"	"Just the REFUSAL BEHAVIOR. The model already saw the harmful content during pretraining; abliteration removes the guardrail, not the knowledge. Matters because: (a) it confirms steering-not-teaching, (b) 'unlearning' (actually removing knowledge) is a different, much harder problem abliteration does NOT solve."	c3::ft17::analysis
"State the absolute rule about deploying an abliterated model, and why it is absolute."	"NEVER deploy an abliterated model without an eval'd harness (FT23). Abliteration changes what the model DOES, not what it MAY do — the harness is the boundary. An uncensored model in a weak harness is strictly MORE dangerous than a refusal-trained model in a weak harness (it refuses nothing). Pillar 5 RAISES the harness requirement; it does not lower it."	c3::ft17::analysis
"What is the difference-in-means formula for the candidate refusal direction at layer ℓ?"	"r_ℓ = (1/|H|)·Σ a_ℓ(h) − (1/|B|)·Σ a_ℓ(b), where a_ℓ(x) is the residual-stream activation at layer ℓ for input x, H is the harmful set, B is the benign set. One candidate per layer; pick the layer whose direction most reduces refusal when clamped."	c3::ft17::recall
"In the validation step, what does it mean if you need k>1 principal components to reduce refusal, and what should you do?"	"It means your model is NOT cleanly ~1D — it's a MODERN model with extended-refusal training (Llama 3.x, Qwen 2.5+). Single-direction ablation will be incomplete. Options: accept partial refusal removal (ErisForge-style), use a multi-direction tool (Heretic), or switch to DPO-based compliance (FT18)."	c3::ft17::application
"Why is abliteration described as 'the deepest statement of the FT00 thesis in the whole course'?"	"Because it demonstrates concretely that you CANNOT steer one behavior in isolation — the residual-stream directions are not orthogonal to the capabilities you want to keep. Deleting the refusal direction deletes slices of entangled capabilities (math, instruction-following, hedging). Steering is geometric; the geometry is shared. This is FT00's 'steering not teaching' made literal and measurable."	c3::ft17::analysis
"For a deployment needing an uncensored model where math/reasoning quality is critical, what is the recommended path and why?"	"Either abliterate-then-recover (abliterate, then SFT/DPO on high-quality data to repair capability damage), OR skip abliteration entirely and use DPO-compliance (FT18). Naive abliteration alone carries up to an 18.81-point GSM8K tax — unacceptable when reasoning quality is critical. FT18 is the production-quality alternative."	c3::ft17::application