Dynamic Abliteration: Non-Destructive Refusal Suppression via Engram Steering

The content presents "Dynamic Abliteration," a runtime method for suppressing refusal behavior in open-weight LLMs without changing model parameters. Using Qwen3-4B (hidden dim 2560, 36 layers) as a proof of concept, it intercepts intermediate residual streams with PyTorch forward hooks and injects layer-specific corrective vectors rather than fine-tuning weights. A baseline refusal test (a stealth keylogger prompt) confirmed the model declined to comply. A naive single-layer subtraction at layer 14 (alpha ~1.2) failed because downstream layers reconstructed the refusal behavior, illustrated by a measured difference norm (~4.44) and persistent refusal output.

To address reconstruction, the method extracts contrastive difference vectors across multiple aligned layers (example window: layers 12, 14, 16, 18, 20) using paired safe/unsafe prompts (e.g., administrative utility vs. stealth keylogger, inspection script vs. firewall-bypass, user notification vs. phishing). Per-layer mean difference vectors are normalized into "engram" steering vectors. A MultiLayerSteeringController class registers hooks across all target layers during decoding and subtracts scaled engram components (alpha per layer, default ~0.3), leaving base weights fully frozen. The demonstration shows multi-layer residual injection can more cleanly suppress refusals at inference time while maintaining the original model parameters.