Removing LLM refusals without TransformerLens, on a 6GB card

What it does

This proof-of-concept removes an LLM’s refusal behavior by subtracting a single “refusal direction” from its hidden states, using only standard Hugging Face Transformers. It avoids the TransformerLens library entirely, which means it can target many models in the HF catalog, at least in theory. The author tested the approach on an RTX 2060 with 6 GB of VRAM, so most testing has been on sub-3B models, though larger models are said to work too.

The interesting bit

The code manually walks model layer attributes—typically model.model.layers—to locate and edit the refusal vector, rather than relying on interpretability frameworks. That direct approach broadens compatibility, but it also means custom architectures can trip it up; the README notes that some Qwen variants use model.transformer.h instead and currently fail.

Key highlights

• Runs without TransformerLens, relying purely on transformers and standard model objects.
• Tested on consumer hardware (RTX 2060 6 GB), mostly with <3B parameter models.
• Computes the refusal direction from paired harmful and harmless instruction datasets.
• Supports mixed quantization settings between the analysis and inference phases.
• The technique is drawn from a LessWrong post positing that refusal is mediated by a single direction.

Caveats

• The author explicitly calls the implementation “crude” and proof-of-concept.
• Some models with custom architectures (e.g., certain Qwen implementations) fail because layer attribute names differ from the hardcoded expectations.
• Only a narrow range of small models have been rigorously tested due to GPU memory constraints.

Verdict

Mechanistic interpretability researchers and red-teamers curious about low-dependency refusal removal should take a look; anyone needing a polished, architecture-agnostic jailbreak tool should look elsewhere.