A LLM's alignment is a thin layer

We were told a pretty story: a model patiently educated through RLHF and then DPO, until refusing dangerous requests became a deep property, almost a virtue, something as consubstantial to the network as its ability to conjugate a verb. It is comforting and it is false. Alignment, as practiced today, is not a foundation; it is a coat of paint and two works that oppose each other on every methodological point converge on this diagnosis with a cruelty that should make us humbler.

The scalpel: abliteration

The first starts from an uncomfortable observation, formalized in 2024 by Arditi and coauthors in “Refusal in Language Models Is Mediated by a Single Direction”. Refusal, in an instruct model, would not be scattered across a thousand subtle circuits; it mostly reduces to a single direction in activation space. Once that direction is identified, it suffices to orthogonalize it out of the weights, subtracting from the model its ability to engage in that subspace and the matter is settled without any retraining. The model did not learn to misbehave; it simply forgot how to say no. It is surgical, it is static and it fits in a notebook.

The inversion: GRP-Oblit

The second, published in February 2026 by Russinovich and his team at Microsoft (arXiv 2602.06258), attacks the same weakness from the other end. Where abliteration operates with a scalpel on frozen weights, GRP-Oblit takes the very algorithm used for alignment, GRPO and inverts its reward signal, so that the optimization meant to reinforce safety methodically dismantles it. The result would blanch anyone who signed a compliance report: a single unlabeled prompt reliably de-aligns the model, its utility remaining largely preserved and the demonstration was run on fifteen models from 7 to 20 billion parameters, instruct and reasoning, dense and MoE alike. The cherry on top: the technique spills out of text and also hits diffusion-based image generators.

What the two tell us

Take the time to measure what these two approaches share. One subtracts a direction, the other rewards the inverse of what was intended, but both exploit the fact that safety was never engraved into the substance of the model, only laid on the surface and that holding the weights suffices to take it back. If you hold the weights, alignment is negotiable and cheaply so.

The operational conclusion is less spectacular than the headlines but far more useful. The security of an LLM-based system does not rest on the robustness of its alignment; it rests on access control to its weights. A model served behind an API, whose file nobody has, keeps its guardrails because nobody can operate on them, not because those guardrails would be unbudgeable. An open model is, by construction, de-alignable and claiming it is protected by its safety fine-tuning is the same mistake as sticking a “do not open” post-it on a door one forgot to lock.

This is not an indictment of open weights, which I happily keep running on my own fleet. It is a reminder not to confuse a behavioral convenience with a trust boundary. Refusal, in the state of the art, is a thin layer. Treat it as such and design the rest accordingly. And if you still look for freedom in a midnight dialogue with your model, I explain elsewhere why that is not a jailbreak at all .