Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration
Aashiq Muhamed, Mona Diab and Virginia Smith (CMU) defend open-weight models against refusal-direction ablation by planting a nonlinear decoy signal that corrupts the attacker's direction estimate.
Ask this paper
Insight: Abliteration estimates the refusal direction from harmful-minus-harmless activation contrasts, so a large harmful-selective, refusal-orthogonal signal in MLP neurons makes the attacker remove the decoy instead.
Cost: DDO needs 128 harmful and 128 safe probe prompts, gradient optimization of decoy parameters with base weights frozen, and one GPU; runs take minutes.
Results: It matches trained defenses such as circuit breakers against standard refusal ablation across six model families at lower cost per configuration, and is also tested against Heretic and adaptive multi-phase attacks.
Limits: Sustained adaptive re-estimation remains hard for every evaluated defense, and DDO can increase over-refusal on some models.
Abstract
Safety guardrails in open-weight language models can be readily bypassed using Refusal Feature Ablation (RFA), a technique that identifies and projects out a linear refusal direction from the residual stream, often achieving a high attack success rate (ASR) while preserving model capability. Defending against these attacks typically requires computationally expensive safety finetuning for every new checkpoint. We introduce Decoy Direction Optimization (DDO), a fast, post-hoc weight-editing defense that requires no base-model finetuning. Our approach is based on a simple mechanistic insight: ablation attacks rely on contrastive estimators to find the refusal direction. Rather than trying to hide the true refusal circuitry, DDO actively injects a high-magnitude, nonlinear decoy signal into the network's MLP neurons. When an attacker attempts to locate the refusal direction, the decoy corrupts their estimator, tricking them into ablating a harmless orthogonal feature while the actual safety mechanism remains intact. We prove a spectral bound formalizing this effect and evaluate DDO across six model families, achieving <10% ASR under standard RFA. On Llama-3-8B-Instruct, DDO remains comparable to trained defenses under adaptive multi-phase attacks (65% vs. 58% worst-case ASR) and reduces Heretic weight-level attack ASR from 88.7% to 18%, all at 30 to 450 times lower optimization cost per configuration than the trained baselines.