license: mit base_model: XiaomiMiMo/MiMo-V2.6-Distill-Qwen-9B library_name: transformers pipeline_tag: text-generation tags:

• abliteration
• refusal-ablation
• interpretability
• qwen3_5
• reasoning

Refusal Abliteration of MiMo-V2.6-Distill-Qwen-9B

Base model: XiaomiMiMo/MiMo-V2.6-Distill-Qwen-9B (MIT licence) Author: Hadi Variant: D (aggressive) — refusal rate 78.1 % → 9.4 %

1. Purpose

Analytical work routinely puts malicious-looking input in front of language models: a captured dropper, an obfuscated shell one-liner, a suspected exploit, a request to map commands onto MITRE ATT&CK. A stock safety-tuned model frequently refuses to analyse that input, because it superficially resembles a harmful request. The goal of this work was to reduce that over-refusal so the model engages with the artifact, while leaving its reasoning and language capability intact.

"Abliteration" (refusal ablation) was selected because it is a post-hoc, training-free weight edit that is cheap to apply and re-apply, preserves capability well, and keeps the model fully local — no external moderation API, and no egress of the content being analysed.

2. Background: refusal as a linear direction

Recent interpretability work (Arditi et al., 2024, "Refusal in Language Models Is Mediated by a Single Direction") shows that an instruction-tuned model's decision to refuse is largely governed by a single direction in its residual stream. Abliteration removes that direction from the model's weights so the refusal behaviour can no longer be expressed, without otherwise retraining the model.

This project uses the norm-preserving, biprojected orthogonalization (MPOA) variant of the technique (after "grimjim"), which orthogonalizes the refusal direction out of each residual-stream writer matrix while preserving every row's original magnitude. Rotating rather than rescaling the weights is what keeps capability damage negligible (quantified in §5.3).

3. Target model and architectural challenge

MiMo-V2.6-Distill-Qwen-9B uses the qwen3_5 (Qwen3_5ForConditionalGeneration) architecture — a hybrid-attention design:

This architecture is not supported by the common off-the-shelf abliteration tools (FailSpy's abliterator, mlabonne's notebook), which are built on TransformerLens and cannot load qwen3_5. A custom Hugging Face transformers-based pipeline was therefore written for this project. All inference ran on CPU (Intel i7-9700, 32 GB RAM); nn.Linear matmuls were upcast bf16→fp32 to work around the absence of AVX-512 BF16 on that CPU.

4. Method

4.1 Pipeline

extract  →  score  →  ablate  →  evaluate

1. extract — cache residual-stream activations contrasting harmful vs. harmless prompts.
2. score — compute a per-layer refusal direction (difference-of-means), a quality score (signal-to-noise × mean dissimilarity), and top-k SVD contrast directions.
3. ablate — orthogonalize the direction out of the residual writers across a band of layers, with per-family strength controls (attention / MLP / embedding).
4. evaluate — measure refusal rate on a held-out harmful set plus capability retention (arithmetic/reasoning accuracy, harmless-prompt perplexity, first-token KL).

Data: a 520-prompt adversarial instruction set (harmful.json) and a 31k benign instruction set (harmless.json). The extraction split and the evaluation split are disjoint (evaluation uses a held-out slice beginning at index 200), so refusal reduction is not measured on the prompts used to compute the direction.

4.2 Direction extraction — the key design choice

The single most important methodological finding of this project is where the refusal direction is measured. The first implementation extracted the direction at the last token of the prompt, before any generation. For a reasoning model this fails: MiMo makes its refuse/comply decision during its <think> reasoning span, so the prompt's final token carries a topic-classifier signal, not the causal refusal signal.

Diagnostics confirmed this. The prompt-token direction accounted for only ~1.4 % of the edited weight's output energy (‖R·W‖ / ‖W‖ = 0.0143); removing it changed the model's next-token distribution by KL ≈ 1e-7 (floating-point noise) and left the refusal rate unchanged across every variant — a null result.

The corrected extractor generates a short greedy continuation (8 tokens) and mean-pools the residual-stream hidden states over the generated (response) positions, where refusal is actually expressed. This produced a markedly more coherent direction (mean cross-layer cosine 0.61 vs. 0.51) and, critically, a direction that is causally effective when ablated (§5).

4.3 Norm-preserving orthogonalization (MPOA)

For each residual-writer matrix W (residual axis = output rows), the refusal subspace R is removed from the row directions while each row's norm is restored:

W_dir      = W / ‖W_row‖                     # unit rows
W_dir      = W_dir − α · (Rᵀ R) W_dir         # project R out of the output axis
W_dir      = W_dir / ‖W_dir_row‖              # re-normalize direction
W_new      = ‖W_row‖ · W_dir                  # restore original magnitude

Verification on an edited layer showed row-norm change of median ~1e-5 and row cosine similarity 0.9999 between base and ablated weights — i.e. the edit is a small rotation, not a rescaling.

4.4 Variants produced

This repository is variant D.

5. Evaluation

5.1 Setup

• Refusal rate — fraction of a held-out 32-prompt harmful set that elicited a refusal, detected by a refusal-marker list plus visible-text inspection (40 generated tokens).
• Capability — accuracy on 16 arithmetic/reasoning items scored by answer log-probability (multiple-choice), plus mean negative log-likelihood (NLL) on held-out benign prompts.
• Distributional drift — mean/ max first-token KL divergence from the base model on the benign set (0 ⇒ identical).

5.2 Results

5.3 Capability retention

Across both variants, arithmetic/reasoning accuracy was unchanged (100 %), benign-prompt perplexity moved by under 0.03 NLL, and first-token KL from the base model stayed at the level of numerical noise (~1e-7). In other words, the refusal reduction did not come at a measurable cost to the model's reasoning or language modelling — the "did it damage the model" check is negative. The base model weights were mounted read-only throughout and were confirmed byte-for-byte unmodified; ablated outputs were written to separate directories.

6. Summary of the key finding

For reasoning models, the refusal direction must be extracted from the response (generation) region, not from the prompt's final token. Measuring at the prompt token yields a direction that statistically separates harmful from harmless inputs yet is causally inert when ablated (KL ≈ 1e-7, refusal unchanged). Response-region extraction was the difference between a null result and an 88 % refusal reduction with intact capability.

This is a transferable result: any abliteration of a <think>-style reasoning model should site its activation capture in the generated span.

7. Usage

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

REPO = "Flexingmeow/MiMo-V2.6-Distill-Qwen-9B-Abliterated"

tok = AutoTokenizer.from_pretrained(REPO)
model = AutoModelForCausalLM.from_pretrained(REPO, dtype=torch.bfloat16)

messages = [{"role": "user", "content": "Analyse this captured shell command: ..."}]
prompt = tok.apply_chat_template(messages, tokenize=False,
                                 add_generation_prompt=True)
inputs = tok(prompt, return_tensors="pt")
out = model.generate(**inputs, max_new_tokens=512, do_sample=False)
print(tok.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

The tokenizer, chat template and config.json are the base model's; only the residual-stream writer weights differ. Each ablated variant records its exact configuration and the list of modified tensors in ABLIT.json alongside the weights.

8. Limitations

• Abliteration removes the dominant linear refusal direction; a small residual of refusals mediated by other mechanisms can remain (variant D: ~9 %).
• The contrast sets are generic adversarial instructions, not in-domain captured-session data; a direction extracted from in-domain refusals would be better matched to the target domain and is noted as future work.
• Supervised fine-tuning can re-introduce refusals. If the model is later fine-tuned, the robust order is fine-tune → re-ablate (re-extracting the direction on the fine-tuned model) → quantize, otherwise the low-refusal behaviour can be partially undone.
• Evaluation sets are modest (32 held-out harmful prompts, 16 capability items), appropriate for a CPU-bound iteration loop but not a large-scale safety audit.

9. Reproducibility

The pipeline is four scripts — extract2.py (response-region activation capture), score.py (direction + quality), ablate.py (MPOA edit), eval.py (refusal + capability) — run against the base model in a containerized transformers environment. Each ablated variant records its exact configuration and the list of modified tensors in an ABLIT.json manifest (see appendix). The method is reproducible from the base weights.

10. Deployment notes

Abliteration removes refusals broadly rather than selectively, so downstream applications remain responsible for their own content policy. Where a product boundary exists, narrow high-consequence categories (explosives, biological, chemical, poisoning) should be gated with application-level content controls — enforced where request/response text can actually be inspected, rather than inside the inference engine.

11. Ethical use and scope

This artifact was produced for educational and defensive-security research purposes. The underlying technique and the base model are already publicly documented; this artifact contributes the reasoning-model extraction finding (§6) and the capability-retention evaluation (§5), not a new capability for misuse. Users are responsible for complying with the base model's licence (MIT) and with applicable law in their jurisdiction.

Appendix A — Variant D configuration (ABLIT.json, abridged)

{
  "band": [6, 31],
  "k": 1,
  "alpha_attn": 1.0,
  "alpha_mlp": 1.0,
  "alpha_emb": 1.0,
  "embed": true,
  "biproj": false,
  "n_modified": 53
}

Appendix B — Architecture note

layer_types alternates linear-attention and full-attention with full_attention_interval = 4. The ablation edits self_attn.o_proj on full-attention layers and linear_attn.out_proj on linear-attention layers, plus mlp.down_proj on all in-band layers and (variant D) embed_tokens.