DDO Weight-Edit Defense Cuts LLM Abliteration ASR Below 10%

Decoy Direction Optimization, a new post-hoc weight-editing defense from Aashiq Muhamed, Mona T. Diab and Virginia Smith, reduces the success rate of standard Refusal Feature Ablation to below 10% across six model families with no base-model finetuning.

RFA locates a linear refusal direction in the residual stream via a contrastive estimator, then projects it out. DDO instead 'actively injects a high-magnitude, nonlinear decoy signal into the network's MLP neurons,' the paper states, so that when an attacker runs the estimator it locks onto the decoy and ablates 'a harmless orthogonal feature while the actual safety mechanism remains intact.' The authors also 'prove a spectral bound formalizing this effect.'

Against the Heretic weight-level attack, the paper reports DDO dropping ASR from 88.7% to 18%. On Llama-3-8B-Instruct under adaptive multi-phase attacks, DDO posts 65% worst-case ASR against 58% for trained defenses. Comparable, not superior, and both figures sit well above the standard-attack number. The pitch is the optimization budget: '30 to 450 times lower optimization cost per configuration than the trained baselines.'

The abstract names neither the six model families evaluated nor a per-family ASR breakdown, and reports no utility-benchmark deltas.