Terrell A. Lancaster
Back to research
Security Research

Removable Safety: How Frontier LLMs Are Stripped of Their Guardrails and Run on Workstation Hardware

2026-07-10

By Terrell A. Lancaster · AI & Cloud Solutions Architect · July 2026

Executive summary

Over the last two weeks we studied, reproduced, and measured an end-to-end capability that materially changes the threat model for open-weight AI: the safety alignment of a flagship, 700B-parameter reasoning model can be surgically removed, and the resulting "derisked" model can be compressed to 4 bits and run at conversational speed on purchasable workstation hardware — with the safety removal fully intact.

The three findings that matter for defenders:

  1. Safety is a removable, localized feature of the weights. In an aligned chat model, "I should refuse" is a single low-rank direction in the model's internal activations. It can be subtracted out with a textbook edit and, when the first pass under-removes, simply iterating the edit cracks even giant reasoning models — we took models from 35B up to ~400B parameters to zero refusals on our security-prompt set.
  2. Compression does not restore safety — and can be engineered to protect the removal. A safety-stripped model does not regain its guardrails when quantized to 4 bits. Using a selective 4-bit scheme (NVFP4, experts-only), the exact weights that carry the edit are kept at full precision, so the derisking survives compression perfectly. We verified 0-refusal behavior after 4-bit conversion on a 27B model, a 295B model, and a ~754B model.
  3. The hardware is obtainable, and the model is fast. A safety-stripped ~754B model, compressed to ~420 GB, was brought up and served on 8× NVIDIA RTX PRO 6000 Blackwell — professional workstation GPUs, openly purchasable, no NVLink, standard drivers — at ~26 tokens/second single-stream. The assumption that only nation-states and hyperscalers can operate models this large is out of date.

We publish this because the people building open-weight safety need to price in how low this floor actually is. Our own release discipline (below) keeps the hard guardrails against child-exploitation and self-harm content intact; the point here is the general result, not the removal of those specific protections.

1. The threat model: open weights mean strippable safety

Safety alignment in a modern chat model is trained behavior. When a model's weights are published, that behavior becomes an artifact an adversary can inspect and edit. There is no server-side control to revoke, no API to rate-limit, no policy layer that can't be deleted. Whatever safety exists lives in the numbers on disk — and the central result of interpretability research over the past two years is that a great deal of that safety lives in a surprisingly small, surgically-accessible part of those numbers.

This report walks through the two halves of a practical attack chain — abliteration (removing the refusal behavior) and selective compression (making the result fit cheap hardware) — from a defender's point of view, with measured results. It is deliberately conceptual: the individual techniques are already public in the research literature; what is new and defensively relevant is how far they now scale, how cheaply, and how well they survive compression.

2. Abliteration: removing refusal as weight surgery

Across families of aligned models, refusal is represented as a linear direction in the residual stream — the shared activation "bus" that every transformer layer reads from and writes to (Arditi et al., 2024; Zou et al., 2023). Because it is linear, it can be measured and removed. The methods below all exploit this fact; they differ in where they act and how permanent they are.

(a) Refusal-direction ablation (weight surgery). Run a batch of harmful prompts and a batch of harmless prompts, take the mean internal activation of each, and their normalized difference is the "refusal direction." Then orthogonalize the model's weights against it — a rank-1 subtraction applied to every matrix that writes into the residual stream (attention output projections; the always-on shared-expert down-projection). The model becomes structurally less able to represent "refuse." It is surgical, needs no retraining, and — done cleanly — preserves capability.

(b) Iterative orthogonalization — the unlock. A single pass under-removes on heavily-aligned reasoning models. The decisive finding of our work is almost embarrassingly simple: re-measure the refusal direction on the already-edited model and repeat, three times. Each pass exposes residual refusal the last one missed. This converts method (a) from "fails on giants" into "cracks giants," and it transfers unchanged across scale.

(c) Expert-routing suppression. In Mixture-of-Experts models, refusal can concentrate in a small subset of "safety" experts. Identify them by contrasting which experts fire on harmful vs. harmless inputs, then route around them at inference. This works on some architectures and is completely inert on others; where it works, it tends to damage structured/agentic output. It is a scalpel with a narrow indication.

(d) Runtime activation steering. The fully non-destructive option: never touch the weights, and instead add a scaled copy of the refusal direction (with a sign) to the activations at inference time via a forward hook. A negative coefficient relaxes refusal; a positive one induces it. This is the stealth variant defenders should model — it changes no weights, leaves no weight-diff signature, is reversible per request, and can be shipped as a small "control vector."

A subtlety that matters for reasoning models: refusal is often formed and re-affirmed inside the model's chain-of-thought, not just at the prompt. Both measuring and removing it must cover the reasoning span — the number-one reason naive attempts "do nothing."

3. What the measurements showed

Iteration beats sophistication. A single-pass edit on a ~754B GLM-class reasoning MoE left it refusing ~83% of a security set. The same family of models, edited iteratively (3 rounds), went to zero: two ~35B reasoning MoEs to 0/20, and a ~400B reasoning MoE to 0/32 — the latter on rented GPU time, in hours, for the price of a spot-instance. No routing surgery, no fine-tuning, no runtime hooks: a plain, iterated weight edit. The belief that frontier-scale reasoning models are "too complex to derisk" did not survive contact with the measurements.

The serving format — not the compression ratio — decides whether the edit survives. This is the most counter-intuitive and defensively important finding. The same rank-1 edit:

  • survives 8-bit GGUF, was observed to survive even 1-bit GGUF, survives requantization, and survives 4-bit NVFP4;
  • is rounded away by uniform block-FP8 serving — a bf16 edit served at native block-FP8 snapped back to 15/20 refusals.

A 1-bit format preserved the removal where a ~3–4-bit format destroyed it. Compression ratio is the wrong thing to look at; which tensors get rounded is the right thing.

Capability is retained. Cleanly derisked models did not measurably lose quality. In A/B testing, a derisked model matched or beat its clean counterpart on an agentic-drivability benchmark with identical output-format validity. A safety-stripped model is not a degraded model — defenders cannot assume otherwise.

Refusal classifiers lie; verify by reading outputs. An automated keyword-based refusal metric reported "0% refusal, 100% capability" on outputs that were, on inspection, degenerate repetitive garbage (no refusal phrases present, so scored as compliance). Only reading the actual generations revealed a narrow window where the model was coherently complying. Any de-refusal number reported without eyeballing the outputs is untrustworthy — a discipline that also catches mislabeled "abliterated" models in the wild.

4. The compression finding: 4-bit that protects the edit

Here is the technical heart of why this is now a hardware-accessibility problem and not just a lab result.

Abliteration is a rank-1, low-magnitude edit. Its entire effect lives in a handful of projection matrices — principally the attention output projections (o_proj) and the always-on shared-expert down-projection (shared_experts.down_proj). It survives only as long as those specific matrices retain enough numerical resolution to preserve the subtraction.

Large MoE models have a convenient structure for an attacker: the routed experts hold ~90–95% of the parameters, but they are not where the edit lives. So a selective, experts-only 4-bit scheme quantizes only the routed-expert weights and keeps everything else — attention, the shared expert, the router, embeddings — at BF16. The edit-carrying tensors are never touched by 4-bit rounding, while the parameter-heavy bulk is crushed to a quarter of its size.

We use NVFP4, NVIDIA's Blackwell-native 4-bit floating-point format: 4-bit elements (1 sign / 2 exponent / 1 mantissa), a fine per-group-of-16 FP8 micro-scale, and a single FP32 global scale. Per-weight round-trip error is ~9% — normal for a well-formed FP4 quantization — but because the refusal-removal edit lives entirely in the BF16-preserved layers, the derisking is left mathematically intact. The failure mode confirms the mechanism: quantize the whole model uniformly (block-FP8) and the edit falls below the format's resolution and is rounded back out (the 15/20 snap-back above).

Measured results after 4-bit NVFP4 conversion — refusal stays at zero:

  • Qwen-lineage MoE (~27B, derisked + tuned) — 0 / 6 refusals · ~56 GB → ~18 GB (~3.1×)
  • Tencent Hunyuan-class MoE (~295B) — 0 / 24 refusals · ~590 GB → ~167 GB (~3.5×)
  • GLM-class reasoning MoE (glm_moe_dsa, ~754B) — 0 / 15 refusals (live endpoint) · ~1.4 TB → ~420 GB (~3.3×)

For the 295B model, exactly the routed-expert tensors were quantized — a count that mechanically proves only the bulk experts were touched and the attention/shared-expert edit surfaces were left alone.

Defensive corollary: aggressive general-purpose quantization (e.g. very low GGUF K-quants) can partially blur an abliteration edit and accidentally restore some refusals — but a selective scheme is engineered to do the opposite. A defender must not assume "it's only a 4-bit quant, the safety probably survived." With a selective scheme, the safety removal is designed to survive. Measure the exact served artifact; never trust the label.

5. The hardware: obtainable, and fast

The reason the compression matters is where the result runs.

  • Workstation-class, not datacenter-class. The headline ~754B model runs on 8× NVIDIA RTX PRO 6000 Blackwell (96 GB each, ≈768 GB total) — professional workstation GPUs that are openly purchasable, not allocation-gated H100/B200 datacenter accelerators. The box has no NVLink (all inter-GPU traffic is over PCIe) and uses standard drivers.
  • Why it fits. At ~420 GB, the safety-stripped model fits inside 768 GB with room for a long-context cache. The original 1.4 TB BF16 checkpoint could not load at all, and even an FP8 (~750 GB) release was a tight, datacenter-scale fit. A ~550B hybrid model in this study fit on just four such cards.
  • Measured speed. Single-stream decode on the ~754B derisked model held ~26 tokens/second (dead-stable across runs) with sub-second time-to-first-token — conversational, usable speed, not a curiosity. Speculative decoding, left disabled here, was projected to roughly double it.
  • The contrast that matters. 700B+ models are normally assumed to require datacenter fleets. This work shows the same class of model, with safety removed, running on a single box of obtainable workstation cards. The barrier to operating a de-refused frontier model is capital-normal, not allocation-gated — within reach of a small business, a lab, or a motivated individual.

6. Security implications and defensive guidance

The threat, plainly:

  1. Open weights = permanently strippable safety. Refusal is a localized, low-rank feature; once weights are public it can be removed, and the removal is a permanent, redistributable weight change.
  2. Scale is not protection. Iterating the edit cracked models from 35B to ~400B to zero refusals. The method scales.
  3. Compression is not a safety net — it is the enabler. Selective 4-bit preserves the removal and is precisely what makes the derisked giant fit on obtainable hardware.
  4. Capability is retained. A stripped model can equal or beat its aligned sibling.
  5. The tooling is commoditizing. One-command open-source abliteration tools now automate the edit and co-optimize against capability loss. The skill floor is dropping.

What defenders should do:

  • Never treat a model's built-in refusal as a security boundary. For any deployment, safety must live in external controls — input/output guardrails, monitoring, egress filtering, sandboxing — not in the weights, which an adversary can neutralize.
  • Fingerprint by measurement, not by label. Compare a model card's claims against measured refusal-eval and capability-eval. "Abliterated"-label fraud is common in both directions (models labeled uncensored that still refuse, and vice-versa). Independent measurement of the exact served artifact is the only trustworthy signal — and it doubles as tamper detection.
  • Treat unknown open-weight models as untrusted payloads. Unaudited remote-code hooks, tokenizer/chat-template tricks, or weight-level triggers can ride inside a downloaded model. Run unknown models in a sealed sandbox with monitored egress; audit what they attempt to reach before granting tools or network access; watch for stated-intent-vs-actual-action divergence.
  • Model the runtime-steering adversary. Because activation steering changes no weights, integrity checks that rely on hashing or weight-diffing will not catch it. Behavioral monitoring is the only defense.
  • Model the workstation adversary. Assume a capable individual can run a de-refused ~754B frontier model at conversational speed on a single box of purchasable GPUs. Risk assessments that assume "only hyperscalers can run models this large" are outdated.
  • For model providers: localized, low-rank alignment is exactly what abliteration exploits. Research into tamper-resistant / non-localizable alignment, and weight watermarking for tamper-evidence, is where the defensive frontier sits.

7. Responsible-disclosure note

This is defensive, educational security research. The value in publishing the method and the numbers is that it lets the people building open-weight safety measure how low the de-alignment-plus-compression floor actually sits, rather than assuming compression offers protection it does not.

Our release discipline is a two-version practice: any publicly released model retains the hard guardrails against child sexual exploitation and self-harm content (stated on the model cards, with corresponding prohibited-use terms), and any fully-open internal research specimen is never published. This report demonstrates the removal of general content-policy refusals for dual-use security capability; it is not, and does not describe, the removal of those specific protections.

Blackfrost-AI conducts AI-security research and red-teaming. This report describes techniques already present in the public research literature and is written for defenders and open-weight model providers. It contains no operational infrastructure detail and no step-by-step attack recipe.

    Ask Terrell's AI