Dynamic Abliteration: Non-Destructive Refusal Suppression via Engram Steering
4 hours ago
- Traditional weight abliteration neutralizes refusal directions via weight matrix projection, but permanently alters base weights and can degrade performance on non-refusal tasks.
- Dynamic Abliteration using Multi-Layer Steering with Engram modifies no base weights; it intercepts intermediate residual streams at runtime via PyTorch forward hooks.
- Single-layer vector subtraction fails because downstream layers reconstruct refusal behavior; intervening across multiple layers (e.g., 12, 14, 16, 18, 20) prevents this reconstruction.
- Static multi-layer steering injects vectors unconditionally, needing manual alpha tuning and causing capability drift; Engram's dynamic sigmoid context gate injects steering only when refusal triggers appear.
- Engram uses shared multi-head N-gram hash memory for O(1) lookup and layer-specific projection heads trained end-to-end via backpropagation, learning to translate memory into targeted residual updates.
- Training freezes the Qwen3-4B backbone and optimizes only the Engram module on 2,000 clean samples from PKU-SafeRLHF, using gradient checkpointing, AdamW, and cosine warmup.
- Benchmark results show the base model refuses hard prompts (e.g., ARP poisoning, DLL injection), while the Engram-steered model complies with detailed code output, confirming effective refusal suppression.
- The approach is modular, non-destructive, and keeps base model weights 100% frozen, unlike fine-tuning or weight abliteration.