Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration
DDO aims to mislead refusal-ablation attacks by planting a decoy signal instead of retraining the model.
The paper frames Refusal Feature Ablation as an attack that finds and removes a linear refusal direction while mostly preserving model capability. Decoy Direction Optimization adds a high-magnitude nonlinear signal in MLP neurons so the attacker’s estimator locks onto a harmless orthogonal feature. The authors report under 10% attack success across six model families under standard RFA, and a reduction in Heretic weight-level attack success from 88.7% to 18%. They say the method is post-hoc, needs no base-model finetuning, and costs 30 to 450 times less per configuration than trained defenses. HF Daily Papers' note
The paper frames Refusal Feature Ablation as an attack that finds and removes a linear refusal direction while mostly preserving model capability. Decoy Direction Optimization adds a high-magnitude nonlinear signal in MLP neurons so the attacker’s estimator locks onto a harmless orthogonal feature. The authors report under 10% attack success across six model families under standard RFA, and a reduction in Heretic weight-level attack success from 88.7% to 18%. They say the method is post-hoc, needs no base-model finetuning, and costs 30 to 450 times less per configuration than trained defenses. HF Daily Papers' note
score 5