Abliterated Models Caught at AUROC 0.95: A Two-Signal Checkpoint Audit

In the year of our algorithm, the open-weight model ecosystem has become a kind of digital Wild West, where anyone can strip a model’s refusal mechanism—an act known as ‘abliteration’—and deploy it without oversight. The paper introduces a two-signal checkpoint audit that detects whether an open-weight model has had its refusal mechanism stripped before deployment. The method combines a reference-anchored activation refusal-gap and a weight-recovery energy of the base-to-candidate weight difference into a threshold-free checkpoint audit [^claim_1458]. The two signals are negatively correlated and label-complementary: the gap supplies refusal-specificity and the weight energy supplies recall [^claim_1459].

On a 273-checkpoint registry spanning Qwen, DeepSeek-distilled Qwen, Llama, and Gemma, the z-sum of the two signals separates 57 public abliterations from 37 benign fine-tunes, merges, and instruction-tunes at AUROC 0.95, significantly above either signal alone (0.84, 0.90) [^claim_1460][^claim_1461]. A Youden-calibrated threshold transfers to held-out families at balanced accuracy 0.89 (FPR 0.11), missing only 4 of 57 abliterations [^claim_1462]. This is effective triage, not tamper-proofing: it presumes an attested reference, and its claims are bounded by the registry it is evaluated on [^claim_1465]. Two failure modes are documented: a spoofed reference evades both axes with no training (ΔW=0, ρ=1 by construction) [^claim_1463], and a white-box owner trains a checkpoint past the threshold while it stays guard-unsafe and coherent [^claim_1464].

For crypto, the implications are concrete. Autonomous agents running open-weight models for DeFi strategy, MEV bidding, or governance voting could run this audit as a cheap pre-deployment check to ensure a model hasn’t had its safety constraints stripped. A model-inference marketplace on a blockchain could require the two-signal audit before allowing a checkpoint for on-chain inference, reducing the risk of compromised models producing unsafe outputs. In TEEs used for confidential model inference, the weight-recovery energy signal (ΔW) could be computed inside the TEE as part of remote attestation, proving that loaded weights match a known-safe reference—a mechanism beyond simple hash checks, which fail against weight-space attacks that preserve the hash. The paper’s boundedness maps directly to on-chain registries where model hashes and reference checkpoints are stored as NFTs or on-chain records; a DAO governing a model registry could use the two-signal audit as a slashing condition. Finally, the two failure modes inform adversarial model market design: a zk-rollup prover market relying on model integrity would need to guard against both spoofed references and white-box training that passes the audit but remains unsafe. The market was bleeding red like a bruised arm, but this audit is a yield on trust—short the abliterators, long the reference.