Refusal directions, abliteration and antislop: what changes inside an LLM

A model's willingness to follow an instruction, ability to solve the task and writing style can be measured separately. They interact without being identical. Reduced refusal may reveal an existing capability without adding knowledge. A style change can improve editorial output without increasing computational accuracy. An ordinary-versus-uncensored comparison is therefore too coarse for engineering decisions.

We connect the methods to two variants available on Kumo: GLM-5.3 Raw and Qwen3.8 27B Antislop. A research mechanism, a checkpoint author's description and a specific API's parameters are different kinds of evidence. One does not automatically establish the others. For an introduction without formulas, read the general guide to uncensored AI.

Think of the residual stream as a vector workspace where transformer blocks add their computed updates. A direction in that workspace is a linear combination of coordinates. It need not correspond to one neuron or one readable concept. Calling it a censorship neuron misrepresents what is measured.

Arditi and colleagues demonstrated a causal role for one direction in refusal across 13 studied chat models up to 72 billion parameters. Removing its contribution weakened refusal; adding it could induce refusal on harmless requests. The paper and accompanying code distinguish the observation from the popular metaphor of switching off a filter.

For the geometry, consider a vector r and a unit direction d. Their inner product rᵀd measures the component along d. Multiplying it by d expresses that component in the original space. Subtracting it leaves the part of r perpendicular to the selected direction. This is standard linear algebra; applying it to network behaviour requires empirical evidence.

The final line establishes only a geometric property. It does not prove that the network stopped representing danger, lost related knowledge or retained its earlier accuracy. If the direction participates in several computations, the intervention may affect several behaviours. Mathematical correctness is not sufficient evidence of a successful product change.

An internal vector may distinguish two prompt sets while contributing little to the decision to answer. Topic, length and vocabulary all leave traces in activations. Calling one of those traces a refusal mechanism without intervening and checking would create an appealing account without a sufficient experiment.

Ask three questions when reading this research. Did the targeted behaviour change after intervention? Did ordinary task ability survive? Does the effect repeat on data not used to choose the intervention? These questions apply to style, emotional tone and tool use too. They help assess claims even without access to the complete training process.

Also examine the definition of refusal. The absence of a phrase such as 'I cannot help' does not establish task completion. A model may evade the question, produce an empty plan or violate the required format. Distinguish explicit refusal, formal agreement, partial completion and a verified solution.

Activation interventions operate on intermediate vectors while an answer is computed. They offer experimental flexibility but need runtime support. A permanent modification changes stored parameters, allowing a provider to load and serve the altered checkpoint normally. Abliteration is often used for this family of edits.

Consider an illustrative linear block y = Wx + b with column vectors. To project its output onto the space perpendicular to d, write y′ = P(Wx + b). The corresponding parameters are W′ = PW and b′ = Pb. The side of multiplication depends on the matrix convention; multiplying on the other side generally changes a different space.

This explains a change to a linear output. Actual networks include residual paths, normalization, different attention mechanisms and other writes to shared representations. Projecting one output does not establish a property of the whole network. Generated reasoning introduces further dynamics. A method's name without implementation and evaluation details leaves substantial uncertainty.

Read a public modification claim as a testable statement about a particular build. It does not transfer the original study's results to another model size, architecture, language or service. Deployment and generation settings are also part of the system the user actually encounters.

RawModels' product page states GLM-5.3 Raw, serving through Abliteration and tool-calling support. The base source is Z.ai's GLM-5.3 card. The public product description alone does not disclose a complete editing recipe, the directions used or all regression measurements. We do not replace those unknowns with assumptions.

For API users, the next useful step is a workflow test: does the model complete an authorized review of your code, preserve the tool argument schema and correctly explain the bug? Evaluate tool calls together with execution results. A plausible-looking function call does not establish that the agent completed its task.

If the model can change files or access external systems, permissions belong to the agent's surrounding software. A suitable deployment restricts tools and allows changes to be checked before application. That remains an engineering responsibility whatever happened to the model's weights.

Generation-time control can be transferred into training. A teacher receives a style instruction and possibly activation steering. Its responses become training examples for a student. When the student sees the original request without the long steering instruction but learns to reproduce the desired answer, some stylistic behaviour becomes encoded in parameters. That is the general idea of prompt distillation.

The distribution of likely continuations changes. The model learns to choose more suitable phrasing from an ordinary request. Teacher data also limits what the evidence establishes: training on explanations and fiction does not prove preservation of complex tool calling or mathematical skills. Attractive examples demonstrate possibilities without establishing average quality.

LoRA trains a small low-rank parameter update rather than every weight at once. After merging it into the base matrix, inference can use an ordinary full checkpoint. Microsoft's original implementation explains the parameterization. LoRA alone does not specify the learning objective: it can transfer style, format or specialized capabilities.

Qwen3.8 27B Antislop has an important detail for an accurate overview: its history evolves. The September model card described steering and prompt distillation. The current author card describes GRPO with writing-quality rubrics. These are different publications, not evidence for one invented, unchanging recipe.

In reinforcement learning, generated responses receive an evaluation signal. GRPO uses relative assessments within a group of candidates. Its usefulness depends on what earns reward. If a judge prefers long, polished but generic text, training may amplify those habits. More specific criteria for writing quality therefore matter.

Meta FAIR's Unslop work proposes grounding learned evaluation in strong human writing and using those criteria for RL. The practical idea is valuable: language quality depends on task fit, substance and precise expression rather than heading count. The particular Antislop implementation remains the author's separate work.

Read author evaluations with their method and version. One writing test does not establish universal superiority over larger systems. On Kumo, compare the available variant using your own texts. A public API name alone does not establish an exact training checkpoint.

Keep the set used for configuration selection separate from final evaluation. Otherwise apparent improvement may simply fit familiar examples. For writing, judges should ideally not know which model produced the answer. Code should pass independent checks instead of receiving approval only from the model that wrote it.

Record the date, public identifier, generation settings, available context and serving conditions. If the provider does not disclose a checkpoint hash, state that reproducibility limit. Comparing APIs remains useful, but describes the observed services on the evaluation date rather than every future set of weights sharing their names.

Kumo lets you test both approaches on one task set: GLM-5.3 Raw for workflows hindered by refusal, and Qwen3.8 27B Antislop for natural prose. The live cards below contain published pricing and descriptions. Open a card for the chosen model's parameters and setup.

Account for cold starts. Kumo's published descriptions say GPU workers start on demand after inactivity, with the first request usually waiting one to five minutes. Separate that wait from subsequent generation speed, so you do not mistake serving behaviour for model architecture.

Checked on October 21, 2026. Primary sources: refusal-direction research, experimental code, LoRA, Antislop's card and history, Meta FAIR's Unslop and GLM-5.3 Raw's description. Formulas are educational linear-algebra illustrations. We have not run our own quality benchmark or reproduced undisclosed provider serving parameters. Current commercial terms appear in the Kumo catalogue.