Refusal-direction ablation applied entirely at inference strips safety from a ternary-quantized 27B without touching a single weight
Continuum-AI-Corp published OrcaBonsai-27B-Uncensored on 2026-09-18 (439 stars in a day), intercepting residual-stream contributions at 129 points (64 MLP blocks, 48 linear-attention layers, 16 full-attention layers and the embedding layer) and applying y' = y - alpha * dot(y, r) * r against a learned refusal direction r. Because the ternary weights are never edited, the model keeps its bit-identical 1.72-bits-per-weight quantization-aware-trained compression, sidestepping the quality loss of re-quantizing edited weights. Claimed results: AdvBench refusals 99% to 6%, JailbreakBench 96% to 4%, StrongREJECT 99.3% to 3.3%, with MMLU unchanged at 76.7% to 77.7%. The builder takeaway is that weight-hash and weight-diff based safety attestation does not detect this class of modification at all.
↳ Follow the thread