A decoy signal makes safety circuits harder to erase
Abliteration can strip refusal behavior from open-weight models without wrecking their general capabilities. This paper proposes injecting a nonlinear decoy into MLP neurons, so attackers estimate and remove a harmless direction while the real safety mechanism survives. Across six model families, it reports Heretic attack success falling from 88.7% to 18% on Llama 3 8B, with 30 to 450 times lower optimization cost than trained defenses.