{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2609.16204", "title": "Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration", "summary": "DDO replaces per-checkpoint safety finetuning against Refusal Feature Ablation with a post-hoc weight edit that injects a high-magnitude nonlinear decoy signal into MLP neurons, corrupting the attacker's contrastive estimator of the refusal direction. It requires no base-model finetuning and runs at 30 to 450 times lower optimization cost than trained baselines, so it is feasible on a single 24 GB GPU. It can fail under adaptive multi-phase attacks, where worst-case ASR still reaches 65%, and it only defends against ablation-style attacks, not finetuning-based removal of safety behavior or other jailbreak classes.", "rationale": "The defense is cheap and post-hoc, making it practical for a small team shipping open-weight models, but the 65% worst-case ASR under adaptive attacks means it must be validated against the reader's specific threat model before adoption.", "technique": "Decoy Direction Optimization against refusal ablation", "family": "seguranca_e_guardrails", "recommendation": "testar", "published": "2026-09-14", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2609.16204", "independent_implementations": 0, "total_implementations": 1, "stars": 0, "citations": 0, "claims": [ { "claim_id": "claim-01", "statement": "DDO replaces per-checkpoint safety finetuning against Refusal Feature Ablation with a post-hoc weight edit that injects a high-magnitude nonlinear decoy signal into MLP neurons, corrupting the attacker's contrastive estimator of the refusal direction. It requires no base-model finetuning and runs at 30 to 450 times lower optimization cost than trained baselines, so it is feasible on a single 24 GB GPU. It can fail under adaptive multi-phase attacks, where worst-case ASR still reaches 65%, and it only defends against ablation-style attacks, not finetuning-based removal of safety behavior or other jailbreak classes.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2609.16204", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Reduces ASR under standard RFA to below 10% across six model families and cuts Heretic attack ASR from 88.7% to 18% on Llama-3-8B-Instruct, at 30 to 450 times lower optimization cost per configuration than trained defense baselines; under adaptive multi-phase attacks it remains comparable to trained defenses (65% vs. 58% worst-case ASR).", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2609.16204", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [ { "anchor": "S3.E3", "label": "(3)", "section": "3 Method: Decoy Direction Optimization (DDO)", "role": "loss", "latex": "\\mathcal{L}=\\lambda_{\\text{ref}}\\mathcal{L}_{\\text{refuse}}+\\lambda_{\\text{ret}}\\mathcal{L}_{\\text{retain}}+\\lambda_{\\text{conf}}\\mathcal{L}_{\\text{confusion}}+\\lambda_{\\text{rs}}\\mathcal{L}_{\\text{refusal-score}},", "mathml": "ℒ=λref​ℒrefuse+λret​ℒretain+λconf​ℒconfusion+λrs​ℒrefusal-score,", "context": "DDO optimizes decoy directions {𝐮i} via gradient descent through the defended model, while all base-model weights remain frozen. Scalar gains (β,s) are treated as hyperparameters and tuned via Bayesian hyperparameter search (Optuna; Appendix F.6). The optimization minimizes a composite loss over 128 harmful and 128 safe probes:", "headline": "", "explanation": "", "objective": "", "symbols": {}, "evidence": "", "evidence_url": "", "source_url": "" }, { "anchor": "S3.E2", "label": "(2)", "section": "3 Method: Decoy Direction Optimization (DDO)", "role": "proposed_method", "latex": "\\delta_{i}(\\tilde{\\mathbf{x}}_{\\ell})=s\\,g_{\\beta}(a_{\\ell})\\,\\mathbf{u}_{i},\\qquad g_{\\beta}(a)\\mathrel{\\triangleq}a\\,\\operatorname{silu}(\\beta a)=\\beta a^{2}\\sigma(\\beta a),", "mathml": "δi​(𝐱~ℓ)=s​gβ​(aℓ)​𝐮i,gβ​(a)≜a​silu⁡(β​a)=β​a2​σ​(β​a),", "context": "where 𝐮i⟂𝐫^ℓ is a decoy output direction and β,s>0 are scalar gains. For SwiGLU in replace mode, writing aℓ≜⟨𝐫^ℓ,𝐱~ℓ⟩ for the neuron’s refusal coordinate, its decoy contribution is", "headline": "", "explanation": "", "objective": "", "symbols": {}, "evidence": "", "evidence_url": "", "source_url": "" }, { "anchor": "S3.E1", "label": "(1)", "section": "3 Method: Decoy Direction Optimization (DDO)", "role": "proposed_method", "latex": "\\mathbf{w}_{\\mathrm{up},i}\\leftarrow\\hat{\\mathbf{r}}_{\\ell}^{\\top},\\quad\\mathbf{w}_{\\mathrm{gate},i}\\leftarrow\\beta\\,\\hat{\\mathbf{r}}_{\\ell}^{\\top},\\quad\\mathbf{w}_{\\mathrm{down},i}\\leftarrow s\\cdot\\mathbf{u}_{i},", "mathml": "𝐰up,i←𝐫^ℓ⊤,𝐰gate,i←β​𝐫^ℓ⊤,𝐰down,i←s⋅𝐮i,", "context": "DDO repurposes a small set of SwiGLU (or GeGLU) units to implement a gated read–write map: each unit reads the refusal coordinate and writes into an orthogonal decoy direction. To minimize utility loss, we choose n low-impact units per layer by selecting the n smallest-norm columns of 𝐖down (units whose down-projection contributes weakly to the residual update). In each targeted layer ℓ and for each selected unit i, we write a refusal-aligned trigger into row i of 𝐖up and 𝐖gate (denoted 𝐰up,i and 𝐰gate,i), and a decoy write vector into column i of 𝐖down (denoted 𝐰down,i):", "headline": "", "explanation": "", "objective": "", "symbols": {}, "evidence": "", "evidence_url": "", "source_url": "" } ], "equations_status": "selected", "core_kind": "formula", "equations_fetched_at": "2026-10-11", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }