Language models defended from safety bypass with decoy neuron signals
Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration
Machine LearningComputation and LanguageCryptography and Security
Summary
Large language models often have safety features that prevent harmful outputs, but clever attacks can bypass these protections by removing certain signals inside the model. The authors introduce a technique called Decoy Direction Optimization (DDO) that adds fake signals into the model’s neurons to confuse these attacks. This way, attackers remove the wrong signals while the real safety features keep working. The method works well across various models, is much faster than retraining, and helps keep the models safe with less effort.
What this means in practice
- •For machine learning engineers: Defend large language models against attacks that bypass safety features without costly retraining.
- •For ai security teams: Deploy fast post-training defenses to protect AI systems from evasion techniques that remove refusal signals.
Authors
Aashiq Muhamed, Mona T. Diab, Virginia Smith
Abstract
Safety guardrails in open-weight language models can be readily bypassed using Refusal Feature Ablation (RFA), a technique that identifies and projects out a linear refusal direction from the residual stream, often achieving a high attack success rate (ASR) while preserving model capability. Defending against these attacks typically requires computationally expensive safety finetuning for every new checkpoint. We introduce Decoy Direction Optimization (DDO), a fast, post-hoc weight-editing defense that requires no base-model finetuning. Our approach is based on a simple mechanistic insight: ablation attacks rely on contrastive estimators to find the refusal direction. Rather than trying to hide the true refusal circuitry, DDO actively injects a high-magnitude, nonlinear decoy signal into the network's MLP neurons. When an attacker attempts to locate the refusal direction, the decoy corrupts their estimator, tricking them into ablating a harmless orthogonal feature while the actual safety mechanism remains intact. We prove a spectral bound formalizing this effect and evaluate DDO across six model families, achieving <10% ASR under standard RFA. On Llama-3-8B-Instruct, DDO remains comparable to trained defenses under adaptive multi-phase attacks (65% vs. 58% worst-case ASR) and reduces Heretic weight-level attack ASR from 88.7% to 18%, all at 30 to 450 times lower optimization cost per configuration than the trained baselines.