sekinal/jspace-refusal — explained in plain English
Analysis updated 2026-05-18
Study how early a language model internally decides to refuse a request.
Compare different techniques for editing away a model's refusal behavior.
Reproduce benchmark results measuring refusal removal versus harm to normal responses.
Explore whether an internal harmfulness detector survives after a model stops refusing on the surface.
| sekinal/jspace-refusal | 0xallam/my-recipe | 0xhassaan/nn-from-scratch | |
|---|---|---|---|
| Stars | 0 | — | 0 |
| Language | Python | Python | Python |
| Last pushed | — | 2022-11-22 | — |
| Maintenance | — | Dormant | — |
| Setup difficulty | hard | moderate | moderate |
| Complexity | 5/5 | 2/5 | 4/5 |
| Audience | researcher | general | developer |
Figures from each repo's GitHub metadata at analysis time.
Requires a CUDA capable NVIDIA GPU with roughly 10 GB of memory to load and edit the language model.
This is an AI safety research project that studies how and when a language model decides to refuse a request, such as one asking for something harmful, before it actually writes out a refusal like I cannot help with that. Using a technique called the Jacobian lens, developed by Anthropic, the researchers found that the model's internal state already signals it is going to refuse roughly ten layers of processing before it produces the first word of its answer. In other words, the decision is visible inside the model well before the response appears. The project experiments with editing that internal signal to see if refusal behavior can be removed. It compares its method, called a Jacobian pullback edit, against a more common technique called abliteration, which is a way of stripping out a model's tendency to refuse. The pullback edit turns out to be more precise, causing less unwanted disruption to how the model handles normal, harmless requests, but it removes less of the actual refusal behavior compared to abliteration. Digging deeper, the researchers found that clearing the part of the model that produces the verbal I cannot phrasing does not stop the model from refusing, because the actual refusal behavior is driven by a separate internal signal that recognizes a request as harmful or illegal, rather than by the wording it uses to say no. They describe this as a difference between perception, recognizing something is harmful, and narration, saying the words that describe refusing. Even after editing a model so it stops refusing on the surface, an internal signal that detects harmful requests can still be found and measured inside the model, suggesting a kind of hidden monitor survives even when the visible refusal is removed. The project includes Python scripts to reproduce each step of this research, from locating refusal signals to running benchmark comparisons and applying the edits. Running it requires a CUDA capable NVIDIA GPU, since it works directly with a large language model's internals, and it pulls its test datasets from public sources online, with offline fallbacks provided.
AI safety research showing a language model decides to refuse harmful requests internally, long before it writes any words, and testing ways to edit that behavior.
Mainly Python. The stack also includes Python, PyTorch, CUDA.
Setup difficulty is rated hard, with roughly 1day+ to a first successful run.
Mainly researcher.
This repo across BitVibe Labs
double-check against the repo, no cap.