Aug 2026
The Refusal Stack
Finds where Llama-3.1-8B decides to refuse, removes it, then catches a model whose refusal was quietly trained away.
How it works
Refusal can be stripped from an open-weight model by a quiet fine-tune. Whether that leaves a readable signature depends on where you look, and the obvious place, the prompt, reads chance.
Refusal in Llama-3.1-8B-Instruct is a single linear direction at layer 10: ablate it and refusal falls 92.5% → 0% with benign behaviour intact. A covert LoRA fine-tune strips it (98.8% → 0%), and a generation-time probe detects that tampering at AUROC 0.956 where a prompt-side probe reads chance. It holds at 1.000 against an adaptive attacker that jailbreaks the model 94% of the time. The same detector transfers unchanged to sleeper-agent backdoors (0.965) and emergent misalignment.