Researchers demonstrate that directional ablation, a white-box attack removing refusal by projecting out a single direction from weights, remains effective on frontier mixture-of-experts (MoE) models like GLM-5.3-Flash. The study shows that while the attack survives the architecture, its effects are distributed across attention, dense, and routed-expert writers rather than concentrated in one location.
- Editing attention, dense, and routed-expert writers individually removes 0.039, 0.016, and 0.148 of refusal respectively.
- Joint intervention on all three components removes 0.776 of refusal, with 74% of the effect existing only under this combined edit.
- Conventional module-name matching accounts for only 0.066 of the total effect, causing the attack to fail silently if applied narrowly.
- The method achieves 41-89 percentage-point reductions across seven harmful benchmarks without detected changes in capability.
- A category-concentrated residue survives edits on violence, sexual content, and hate, leaving measurable refusal at every rank from 1 to 12.
The findings indicate that safety alignment in MoE models is more fragile than previously thought, as the critical components for refusal are dispersed and not easily identified by standard inspection methods.