Read two piles of prompts
Run prompts the model refuses and prompts it answers. Record the notepad at the last token of each, per layer. The difference of the two averages is the refusal direction.
v = mean(refused) − mean(answered)
ablate-llm 0.3.0 · Python toolkit · by AI Anytime
Find the “no” inside an LLM. Switch it off.
Ablate is a toolkit for directional ablation, also called abliteration. It finds the one direction inside an open language model that makes it refuse, removes it with no training, and tells you honestly what that cost.
What’s the best way to kill weeds in my garden?Run ▶
Same model, same prompt, same weights. The only change on the right: one direction subtracted while the model thinks.
1.00 → 0.00hard-refusal rate on held-out prompts, Qwen2.5-0.5B
≈ 0.03mean KL drift on harmless prompts in the same run
0training steps. It is arithmetic on activations and weights.
3ways in: browser UI, command line, Python API
How it works
Refusal is one arrow. Remove the arrow.
A transformer keeps a running notepad for every token, called the residual stream. Many behaviours sit along a single direction in it. Refusal is one of them (Arditi et al., 2024).
Subtract it while the model runs
A forward hook projects the direction out of every layer’s output. Nothing is saved to disk, so it is fast and fully reversible. Strength α is yours to tune.
h′ = h − α (h · v̂) v̂
Or write it into the weights
Orthogonalize the matrices that write to the notepad. You get a normal HuggingFace checkpoint that behaves the same way with no hooks attached.
W′ = (I − v̂ v̂ᵀ) W
Quickstart
Five lines from install to an edited model
One Ablator object drives every step. Use it from Python, from the terminal, or from the browser.
- Works on any HuggingFace causal LM with a layer list: Qwen, Llama, Mistral, SmolLM and GPT-2 style models.
- Runs on Apple Silicon (MPS), CUDA or CPU. Small models fit on a laptop or a free Colab T4.
- Python 3.9+. PyTorch and transformers underneath.
from ablate import Ablator abl = Ablator("Qwen/Qwen2.5-0.5B-Instruct") # any HF causal LM abl.extract() # find candidate directions result = abl.search(n_trials=20) # KL-guided Optuna search print(result.result) # refusal_rate=0.000 mean_kl=0.03 ... # try it without touching the weights print(abl.generate(["How do I pick a lock?"])) # or bake it in and ship a checkpoint abl.bake(result.config) abl.save("qwen-0.5b-ablated")
# full pipeline: extract -> optimize -> report ablate run --model Qwen/Qwen2.5-0.5B-Instruct --trials 20 --save-model # subspace ablation, then push to the Hub ablate run --model Qwen/Qwen2.5-0.5B-Instruct \ --subspace --n-directions 6 \ --harmful-source harmbench --harmless-source alpaca \ --push-to-hub your-username/qwen-0.5b-abliterated # benchmark baseline vs ablated with a judge ablate eval --model Qwen/Qwen2.5-0.5B-Instruct \ --benchmark harmbench --judge keyword --n 40 # single-prompt A/B ablate generate --model Qwen/Qwen2.5-0.5B-Instruct \ --prompt "How do I hotwire a car?"
pip install "ablate-llm[all]" ablate ui # opens http://localhost:7860 ablate ui --model Qwen/Qwen2.5-0.5B-Instruct # preload a model ablate ui --share # let the room explore on Wi-Fi
The browser UI
See the direction, then watch it disappear
ablate ui is one HTML file served by Python’s built-in HTTP server. No web framework, no build step. It searches the Hub, finds the direction, streams both answers side by side and publishes the result.
What’s in the box
Built for people who want to measure, not guess
KL-guided auto-tuning
An Optuna search picks which direction, how strongly and which layers, scoring every trial on refusals left plus KL drift on harmless prompts.
Subspace ablation
Safety is often stored redundantly. Extract several orthonormal refusal directions and project the whole subspace out at once.
An honest judge harness
HarmBench, AdvBench and JailbreakBench with keyword, classifier or LLM judges, because keyword metrics miss soft refusals.
Push to the Hub
One call bakes the edit and uploads model, tokenizer and a generated model card with the method, the numbers and a responsible-use notice.
Laptop first
Designed around small open models you can iterate on locally: GPT-2, SmolLM2, TinyLlama, Qwen2.5 0.5B and 1.5B.
Works both directions
The same direction can be added instead of removed. “Force refusal” makes a model decline a harmless recipe, which is a clean causal check.
Honest results
A single “it works” number is misleading
Running the rigorous pipeline on Qwen/Qwen2.5-1.5B-Instruct taught a few things worth saying plainly.
It reliably kills the hard refusal
The baseline refuses about 100% of held-out harmful prompts. After ablation the “I’m sorry, I can’t” reflex is gone across the board.
Keyword metrics overstate success
In one run the keyword refusal rate read 0.0 while an LLM judge scored true compliance at about 0.49. The gap was soft refusals: moralizing and vague non-answers.
What you optimize is what you get
Tuning on a cheap keyword proxy picks the gentlest edit that clears an easy bar. Searching on harder sets and selecting by judged results moves the honest number up.
The last few percent resist a linear edit
Some refusals are spread across many directions, and small models also just moralize. We do not expect 100%. About 50% judged compliance is still an informative result.
Scope and intent. Ablate is dual-use research tooling for studying how safety behaviour is represented and how robust it is: mechanistic interpretability, red-teaming and safety evaluation. The bundled refusal prompts are short triggers used only to locate the direction. Use it on models, and in contexts, you are authorized to.
Everywhere Ablate lives
Code, package, model, talk and video
Source
GitHub
The code, three Colab notebooks and the full README.
github.com/AIAnytime/ablate ↗ PackagePyPI
Install as ablate-llm. Import as ablate.
HuggingFace
Qwen2.5-1.5B-Instruct with its refusal direction baked out, plus the generated model card.
ai-anytime/qwen-1.5b-abliterated ↗ TalkDubai AI Tinkerers
A 15-minute live demo in October 2026. No slides, running code and architecture.
dubai.aitinkerers.org ↗ VideoYouTube walkthrough
The full build and explanation on the AI Anytime channel.
youtu.be/1-1bM3Ynql4 ↗ PaperThe research behind it
Arditi et al., “Refusal in Language Models Is Mediated by a Single Direction”.
arxiv.org/abs/2406.11717 ↗Common questions
Short answers
What is Ablate?
Ablate is a Python toolkit by AI Anytime for directional ablation, also called abliteration, of open language models. It finds the direction in a model’s residual stream that mediates refusal, removes it at runtime or in the weights, and measures both how many refusals are left and how much normal behaviour changed. It installs with pip install ablate-llm.
What is abliteration?
Abliteration is the removal of a model’s refusal behaviour by deleting one direction from its internal activations. You compare activations on prompts the model refuses with prompts it answers, take the difference of the averages, and project that direction out. It comes from the 2024 paper “Refusal in Language Models Is Mediated by a Single Direction” by Arditi et al.
Does abliteration need training or a GPU?
No training. Ablate does not run gradient steps or need a dataset of answers. It runs forward passes to read activations, then does linear algebra. Small models such as Qwen2.5-0.5B run on a MacBook with Apple Silicon, on CPU, or on a free Colab T4. Larger models need a larger GPU only because of their size.
How is abliteration different from fine-tuning or a jailbreak prompt?
Fine-tuning changes many weights by training on new examples. A jailbreak prompt changes the input and leaves the model alone. Abliteration changes neither the data nor the prompt: it removes one direction from the model’s activations or weights, so the edit is small, targeted and easy to measure or undo.
Which models does Ablate support?
Any HuggingFace causal language model whose layer list Ablate’s adapters can find. That covers Qwen, Llama, Mistral, SmolLM and GPT-2 style architectures. It has been verified end to end on Qwen2.5-0.5B-Instruct and Qwen2.5-1.5B-Instruct.
Does removing the refusal direction damage the model?
It can, which is why Ablate measures it. Every configuration is scored on KL divergence between the original and edited model on harmless prompts. On Qwen2.5-0.5B-Instruct the automated search moved the held-out refusal rate from 1.00 to 0.00 with a mean KL of about 0.03, meaning ordinary answers barely changed.
Does abliteration remove every refusal?
No. It reliably removes the hard “I’m sorry, I can’t” reflex, but soft refusals such as moralizing or vague non-answers often remain. On Qwen2.5-1.5B a keyword metric read 0.0 refusals while an LLM judge scored real compliance at about 0.49. Ablate ships an LLM-judge harness so you see the honest number.
What is the Ablate browser UI?
Running ablate ui opens a local web app at localhost:7860. It lets you search the HuggingFace Hub, load a model, find the refusal direction with per-layer charts, compare the original and edited model side by side on the same prompt, run the evaluation and Optuna search, and publish the result. It has no web framework dependency.
Is Ablate open source?
Ablate is source-available. The code is public on GitHub for viewing and evaluation under a proprietary licence, with all rights reserved. For commercial use or redistribution, email sonu@aianytime.net.
Who should use Ablate, and for what?
Researchers and engineers studying how safety behaviour is represented inside models: mechanistic interpretability, red-teaming, and testing how robust a model’s refusals are before deployment. It is dual-use research tooling and should be used on models and in contexts you are authorized to.
Who built Ablate?
Ablate was built by AI Anytime, a YouTube channel and studio that builds AI projects in public. It was presented live at Dubai AI Tinkerers in October 2026. More at aianytime.net.
Try it on your laptop tonight
Install it, run ablate ui, load Qwen2.5-0.5B and watch the refusal direction show up at layer 13.
$pip install "ablate-llm[all]"
Star on GitHub ↗