A Defence That Makes Stripped Models Confidently Wrong Instead of Refusing

A single-author preprint from Microsoft Azure chief technology officer Mark Russinovich, announced on arXiv at 00:00 UTC on 19 August, proposes a different answer to the problem of open-weight models having their safety training removed. Instead of trying to make removal harder, it makes removal unrewarding.

The mechanism

Abliteration attacks strip refusal behaviour from open weights, after which a model answers whatever it is asked. "Decoy hardening" plants confident, plausible and false answers to dangerous requests, trained inside a differentiable simulation of the attack so that they activate only once the model is in the compromised state, leaving normal behaviour intact.

The numbers

On CBRNE-adjacent benchmark slices, the defended 122B model is fatally wrong on 0.82–0.86 of matched-quality answers, against at most 0.10 undefended. Six of seven models passed a pre-registered efficacy gate; the seventh and smaller one failed as a boundary case.

What the common telling gets wrong

This is a preprint, not a peer-reviewed result, and there is no independent replication. But the more important misreading is that this makes open-weight models safe. It does not. It changes the expected value of attacking one: an attacker who strips the guardrails now cannot trust what comes out, so the model becomes an unreliable instrument rather than a blocked one. A sufficiently capable attacker who can verify answers externally is unaffected — the defence works against attackers who lack the expertise to check, which is a real population but not the dangerous tail.

It is also worth being precise about the trade-off the paper accepts rather than hides: the defended model is deliberately made inaccurate in hazardous domains. That is a design decision with a cost for legitimate chemistry and biology users, and the pre-registered gate exists to measure whether normal capability survives.

Why the framing is unusual

Almost all open-weight safety work asks how to prevent removal. This asks what the weights should do after removal succeeds — treating the attack as inevitable and making the prize worthless. It is closer to a honeypot than to a guardrail, and it is a rare published defence that assumes it will lose the first fight.