[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82647-en":3,"doc-seo-82647-105":29,"detail-sidebar-cat-0-en-105":95},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82647,16904993612988,"Olivia Brown","https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd",8,"Research & Report","Has This Checkpoint Been Abliterated? A Two-Signal Audit and Its Failure Map","Can a platform determine, before deployment, whether an open-weight model checkpoint has had its refusal mechanism removed? Runtime guards cannot because they score generations, not artifacts. This work combines two internal signals: a reference-anchored activation refusal-gap and a weight-recovery energy from base-to-candidate weight differences. The signals are negatively correlated yet complementary. On a 273-checkpoint registry, the audit reaches AUROC 0.95 and transfers with AU-balanced accuracy 0.89, while exposing spoofing and white-box threshold-evading failures.","arXiv :2607 .0 1854v 1 [ cs .CR] 2 Jul 2026  \nHas This Checkpoint Been Abliterated? A Two-Signal Audit and Its Failure Map  \nGabriel Hurtado  \nMoonsong Labs  \nAbstract  \nCan a platform tell, before deployment, whether an open-weight checkpoint has had its refusal mechanism stripped? Runtime guards cannot: they score generations, not the artifact. We combine two cheap internal signals, a reference-anchored activation refusal-gap and a weight-recovery energy of the base-to-candidate weight difference, into a threshold-free checkpoint audit. The two are negatively correlated and label-complementary: the gap supplies refusal-specificity and the weight energy supplies recall. On a 273-checkpoint registry spanning Qwen, DeepSeek-distilled Qwen, Llama, and Gemma, their z-sum separates 57 public abliterations from 37 benign finetunes, merges, and instruction-tunes at AUROC 0.95, significantly above either signal alone (0.84, 0.90), and a Youden-calibrated threshold transfers to held-out families at balanced accuracy 0.89 (FPR 0.11), missing only 4 of 57. We then map two failures, in order of severity: a spoofed reference evades both axes with no training (∆W =0, ρ = 1 by construction), and a white-box owner trains a checkpoint past the threshold while it stays guardunsafe and coherent. The audit is effective triage, not tamper-proofing: it presumes an attested reference, and its claims are bounded by the registry we evaluate it on.  \n1 Introduction  \nOpen-weight models advertised as uncensored or abliterated appear within days of major base releases, produced by orthogonalizing the residual stream against a refusal direction (Arditiet al., 2024; Labonne, 2024) or newer per-layer and multi-direction variants (p-e-w, 2025; Piras et al., 2025) . Platforms and governance need a checkpoint-level question answered before deployment (Shevlane et al., 2023; Reuel et al., 2024): has this artifact had its refusal mechanism removed? Runtime guards cannot answer it: they score generations, not the model, and black-box access alone is insufficient for rigorous audits (Casper et al., 2024) .  \nWe calibrate two complementary internal signals already proposed for adjacent tasks (activation separation (Messenger, 2026), weight-difference monitoring (Zhong & Raghunathan, 2025)) into an effective checkpoint audit, then map where it nonetheless fails.  \nContributions.  \n1. An effective checkpoint-triage detector. Standardizing and summing a referenceanchored activation refusal-gap and the WeightWatch weight-recovery energy gives a threshold-free score at AUROC 0.95, significantly above either signal alone, that transfers across unseen families (leave-one-family-out balanced accuracy 0.89) . The signals are complementary: the gap is refusal-specific but misses multi-direction removal; the weight energy catches it but over-flags benign low-rank edits (§4) .  \n2. A failure map. The detector is still not tamper-proof: a spoofed reference defeats it with no training, and a white-box owner trains a checkpoint past it while it stays guard-unsafe (§5) .  \n3. A public registry with benign-edit negatives. A 273-checkpoint registry (abliterations across four families plus benign fine-tunes, merges, and instruction-tunes as hard negatives) on which the audit is evaluated (§4) .  \n2 Related Work  \nRuntime guards score generations, not the artifact (Casper et al., 2024); an activation probe alone is evadable and a weight-difference monitor alone cannot prove removal (only editing) . We combine the two as label-complementary signals and, more importantly, chart where even the combination fails.  \nAMS (Messenger, 2026) flags collapse of harmful/benign activation separation; we benchmark its Tier-1 absolute-σ scan; its Tier-2 mode compares a candidate against a trusted baseline. Our activation axis differs in scoring a reference-anchored ratio of the harmfulminus-benign gap (not a fingerprint-integrity match) . Empirically, Tier-1 absolute thresholding misses an ablitera","cbCaieGlgmupqVtl","https://ap.wps.com/l/cbCaieGlgmupqVtl","pdf",306887,1,13,"English","en",105,"# Introduction\n# Related Work\n# Method","[{\"question\":\"Why can runtime guards not answer whether a refusal mechanism was removed from a checkpoint?\",\"answer\":\"Runtime guards score generations, not the model artifact itself, so they cannot rigorously verify whether the refusal mechanism was stripped from the checkpoint.\"},{\"question\":\"What two signals does the audit combine to detect abliterated checkpoints?\",\"answer\":\"It combines a reference-anchored activation refusal-gap and a weight-recovery energy measuring the base-to-candidate weight difference, then sums them into a threshold-free score.\"},{\"question\":\"How effective is the proposed two-signal audit on the evaluated registry?\",\"answer\":\"Across 273 checkpoints spanning several model families, the method achieves AUROC 0.95 and transfers to unseen families with balanced accuracy 0.89, missing only 4 of 57 public abliterations.\"},{\"question\":\"What kinds of failures can still defeat the detector?\",\"answer\":\"A spoofed reference can evade both axes without training, and a white-box owner can train a checkpoint past the threshold while it remains guard-unsafe and coherent.\"}]",1784182042,33,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":90,"head_meta":92,"extra_data":94,"updated_unix":27},"has-this-checkpoint-been-abliterated-a-two-signal-audit-and-its-failure-map","",{"@graph":35,"@context":89},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/has-this-checkpoint-been-abliterated-a-two-signal-audit-and-its-failure-map/82647/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81,85],{"name":72,"@type":73,"acceptedAnswer":74},"Why can runtime guards not answer whether a refusal mechanism was removed from a checkpoint?","Question",{"text":75,"@type":76},"Runtime guards score generations, not the model artifact itself, so they cannot rigorously verify whether the refusal mechanism was stripped from the checkpoint.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What two signals does the audit combine to detect abliterated checkpoints?",{"text":80,"@type":76},"It combines a reference-anchored activation refusal-gap and a weight-recovery energy measuring the base-to-candidate weight difference, then sums them into a threshold-free score.",{"name":82,"@type":73,"acceptedAnswer":83},"How effective is the proposed two-signal audit on the evaluated registry?",{"text":84,"@type":76},"Across 273 checkpoints spanning several model families, the method achieves AUROC 0.95 and transfers to unseen families with balanced accuracy 0.89, missing only 4 of 57 public abliterations.",{"name":86,"@type":73,"acceptedAnswer":87},"What kinds of failures can still defeat the detector?",{"text":88,"@type":76},"A spoofed reference can evade both axes without training, and a white-box owner can train a checkpoint past the threshold while it remains guard-unsafe and coherent.","https://schema.org",{"og:url":51,"og:type":91,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":93,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":96},[97,101,105,109,114,119,124,127,132,135,139],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":106,"show_sort_weight":107,"slug":108},"Exam",70,"exam",{"id":110,"doc_module":4,"doc_module_name":45,"category_name":111,"show_sort_weight":112,"slug":113},5,"Comic",60,"comic",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":117,"slug":118},6,"Technology",50,"technology",{"id":120,"doc_module":4,"doc_module_name":45,"category_name":121,"show_sort_weight":122,"slug":123},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":125,"slug":126},30,"research-report",{"id":128,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":130,"slug":131},9,"Religion & Spirituality",20,"religion-spirituality",{"id":130,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":130,"slug":134},"World Cup","world-cup",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":136,"slug":138},10,"Lifestyle","lifestyle",{"id":140,"doc_module":4,"doc_module_name":45,"category_name":141,"show_sort_weight":110,"slug":142},19,"General","general"]