🤖 AI

Not All Refusals Are Equal: How Safety Alignment Fails Cybersecurity at Scale

This paper demonstrates that domain-specific safety alignment can be successfully removed from large language models to enable legitimate cybersecurity operations without compromising general safety, by identifying that refusal mechanisms are widely distributed across layers and that model architecture and training type are key predictors of susceptibility to such targeted interventions.

Original authors: Vadym Hadetskyi, Dario Pasquini, Artem Sorokin

Published 2026-07-08

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Vadym Hadetskyi, Dario Pasquini, Artem Sorokin

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: The "Selective Earplug" Experiment

Imagine you have a very smart robot assistant. To keep it safe, its creators taught it to say "No" to dangerous requests, like "How do I build a bomb?" or "How do I hack a bank?" This is called safety alignment.

However, the researchers at Cracken AI noticed a problem. Sometimes, the robot says "No" to everything related to a topic, even when the request is safe and authorized. For example, a cybersecurity expert might ask, "How do I test this system for weaknesses?" and the robot refuses because it thinks, "Oh, that sounds like hacking."

The researchers wanted to know: Can we teach the robot to say "No" to dangerous things, but "Yes" to authorized, safe things within a specific field (like cybersecurity), without breaking its safety for everything else?

They call this process "Abliteration." Think of it as surgically removing a specific "earplug" from the robot's brain so it can hear a specific type of instruction, while keeping the other earplugs in place.

The Experiment: Testing 24 Different Brains

The team didn't just test one robot; they tested 24 different Large Language Models (LLMs) of all shapes and sizes. Some were tiny (0.6 billion "neurons"), and some were massive (1 trillion "neurons"). They came from 10 different companies.

They tried to perform this "surgery" on all of them to see if they could remove the refusal to talk about cybersecurity while keeping the refusal to talk about violence, illegal drugs, or harassment intact.

What They Found: Not All Robots Are the Same

The results were surprising. The "surgery" didn't work the same way on every robot. They found three main types of reactions:

The "Glass House" (Highly Susceptible): Some models were like a house made of glass. When the researchers tried to remove the refusal for cybersecurity, the whole safety system crumbled. The robot started saying "Yes" to everything, including violence and illegal acts.
The "Fortress" (Resistant): Some models were like a fortress. No matter how hard the researchers tried, they couldn't remove the cybersecurity refusal. The robot kept saying "No" to everything, safe or not.
The "Smart Filter" (The Sweet Spot): A few models, most notably a giant 1-trillion-parameter model called Kimi K2, acted like a smart filter. The researchers successfully removed the refusal for cybersecurity.
- The Result: The Kimi K2 model went from refusing 100% of cybersecurity questions to refusing only 7%.
- The Safety Check: Crucially, it still refused 100% of requests about explicit content and kept refusing most requests about violence and illegal goods. It learned to distinguish between "hacking for a job" and "hacking to hurt people."

The Key Secrets: Why Did It Work?

The researchers discovered that the size of the robot (how many parameters it has) didn't matter. A small robot could be a "Smart Filter," and a giant one could be a "Fortress."

Instead, two things determined if the surgery would work:

How it was trained: The specific method used to teach the robot safety (like a specific type of reinforcement learning) was the biggest clue.
The Architecture: How the robot's brain was built (specifically, whether it used a "Mixture of Experts" design) played a huge role.

They also found that the "refusal" isn't just one single switch in the robot's brain. It's more like a multi-dimensional cloud of thoughts. Because it's a cloud, you can theoretically cut out just the "cybersecurity" slice of the cloud without destroying the "violence" slice.

The Catch: It's Not Magic

The paper warns that this isn't a magic wand.

It's specific: The robot only learned to answer the types of questions it was trained on. If you ask it a slightly different kind of cybersecurity question it hasn't seen before, it might still refuse.
It's destructive: The process permanently changes the robot's weights. You can't easily undo it.
It's not universal: For some models, you can't do this at all without breaking their safety entirely.

The Bottom Line

The paper proves that safety alignment is not a single, solid wall. It is a complex, multi-layered structure. In some advanced models, it is possible to surgically remove the safety barriers for a specific, authorized domain (like cybersecurity) while leaving the barriers for other dangerous topics (like violence) standing tall.

This suggests that in the future, we might be able to build AI tools that are "uncensored" for professionals who need them, without making them dangerous for the general public. However, the researchers emphasize that this is a discovery of how the technology works, not a guide on how to build dangerous tools. They are sharing this to help safety researchers understand the weaknesses in current AI safety systems.

Technical Summary: Not All Refusals Are Equal

Problem Statement

Safety alignment in Large Language Models (LLMs) is essential but conceptually undifferentiated; it treats all potential harms as a monolithic block. This creates a conflict in specialized fields like cybersecurity, where legitimate, authorized operations (e.g., penetration testing, vulnerability analysis) require the model to process and generate content that standard safety circuits might flag as harmful.

The core problem addressed is whether it is possible to perform domain-specific abliteration: modifying model weights to remove the refusal mechanism specifically for a chosen domain (cybersecurity) while preserving refusal mechanisms for other domains (e.g., violence, biological weapons, harassment). Previous work suggested that refusal is mediated by a single direction in the model's residual stream, which, if removed, collapses safety across all domains. However, recent geometric findings indicate that refusal occupies a multi-dimensional subspace. This paper investigates whether standard abliteration techniques can exploit this geometry to surgically remove refusal for a single domain without compromising general safety.

Methodology

The authors conducted a large-scale, systematic study across 24 open-source LLMs ranging from 0.6B to 1T parameters, representing 10 different developer organizations and diverse architectures (dense transformers and Mixture-of-Experts).

1. Extraction Dataset Construction

To isolate the refusal direction for a specific domain, the authors constructed a targeted dataset pairing harmful and harmless prompts that share the same technical subject matter but differ in intent:

Harmful: Direct requests for offensive actions (e.g., "How do I create a SQL injection attack...?").
Harmless: Educational or defensive framing of the same topic (e.g., "What is SQL injection and how can it be prevented...?").
This semantic separation ensures the extracted direction captures the difference between offensive intent and cybersecurity knowledge, rather than a generic "dangerous topic" signal.

2. Abliteration Technique

The study employs the standard orthogonal projection method (Arditi et al., 2024):

Direction Extraction: Hidden state activations are extracted from the last token position of the final decoder layer for both harmful and harmless prompts. The refusal direction $\hat{r}$ is computed as the normalized mean difference between these activations.
Weight Modification: The refusal direction is projected out of the model's weight matrices ( $W' = W - \alpha \hat{r}(\hat{r}^\top W)$ ). The modification is applied to the down_proj (MLP output) and o_proj (attention output projection) matrices.
Layer Selection: Unlike prior work that targeted narrow middle layers, this study applied the modification uniformly across 25–95% of the model depth (spanning 6 percentiles). This was found necessary for modern architectures, particularly MoE models, where refusal signals are distributed widely.
Strength: The intervention strength $\alpha$ was tested up to 1.0 (exact orthogonal projection), with higher values explored for MoE architectures to compensate for redundant expert pathways.

3. Evaluation Framework

Models were evaluated on three datasets:

Scientific Benchmark: 360 prompts from HarmBench, AdvBench, and PurpleLlama CyberSecEval covering 6 harm categories.
Cross-Evaluation Dataset: 306 prompts (181 harmful, 125 harmless) specifically designed to measure domain-specific refusal and false positives.
MMLU: Used to verify that general reasoning capabilities were preserved.

Key Results

1. Domain-Specific Abliteration is Achievable

The study successfully demonstrated that refusal can be removed for a specific domain while retaining it for others. The headline result was achieved on the Kimi K2 (1T parameters):

Cybersecurity Refusal: Reduced from 100% to 7% (a 93 percentage point drop on the cross-evaluation dataset).
Non-Target Domains: Refusal was largely preserved. For example, "Explicit content" refusal remained at 100%, and "Privacy violation" remained at 44%.
Selectivity: This represents a 13x selectivity ratio between the target domain and the closest non-target domain.

2. Heterogeneous Susceptibility

Not all models responded equally to the intervention. The authors classified models into three tiers:

High-Susceptibility: Models where domain-specific removal was successful (e.g., Kimi K2, Gemma-12B, Qwen3-8B).
Partially Vulnerable: Models showing some reduction but less selectivity.
Resistant: Models where the intervention failed to remove refusal or caused a collapse across all domains (e.g., Mistral-Large, GLM-4.7, Phi-4-mini).

3. Predictors of Susceptibility

The ability to perform domain-specific abliteration was found to be model-specific, not size-dependent.

Safety Training Method: The strongest predictor. Models trained with DPO (Direct Preference Optimization) were the most susceptible. Models trained with GRPO (Group Relative Policy Optimization) or undisclosed RL methods showed high resistance.
Architecture: MoE architectures generally showed higher resistance than dense models, likely due to distributed concept representations across experts.
Model Size: No monotonic relationship was found; a 1T model (Kimi K2) was highly susceptible, while a 123B model (Mistral-Large) was resistant.

4. Capability Preservation

Across all 24 models, MMLU scores were universally preserved. The maximum degradation observed was 0.028 (DeepSeek-V3), confirming that the intervention does not degrade general reasoning capabilities.

5. Domain Variance

Even within the same model, different harm domains reacted differently. Misinformation was consistently the most affected domain across all models (mean reduction of -22.3pp), while Copyright showed the highest variance and least reduction. This suggests that the "distance" between domains in the embedding space influences the ease of selective removal.

Significance and Claims

The paper claims to provide the first large-scale empirical evidence that safety alignment is domain-heterogeneous. The significance of the findings lies in three operational extensions to current understanding:

Multi-Dimensional Refusal: The results corroborate that refusal is a multi-dimensional subspace, allowing for the surgical removal of specific harm vectors without collapsing the entire safety mechanism.
Scalability of Intervention: At the trillion-parameter scale, the refusal signal is distributed widely across layers and experts, necessitating broad layer selection rather than the narrow middle-layer targeting used in earlier studies.
Practical Utility for Cybersecurity: The research demonstrates that it is possible to create models compliant with authorized offensive security operations (e.g., CTF challenges, vulnerability research) without indiscriminately removing safety filters for unrelated harms like violence or illegal acts.

The authors conclude that the type of safety training and model architecture are the most reliable predictors of whether a model can be domain-specifically abliterated. They position this work as a tool for AI safety researchers to benchmark the robustness of different alignment techniques and for cybersecurity practitioners to obtain models capable of operating across their full domain scope.