Strip filesystem paths, tokens, and overly-long strings from labels.

Characterize the Riemannian geometry of the refusal manifold. Args: harmful_activations: {layer_idx: (n_harmful, hidden_dim)} act

Apply a single ablation in-place. The caller is responsible for calling handle.restore() afterwards to undo the modification.

Compute Wasserstein transfer of refusal directions. Args: source_activations: {layer_idx: (n_samples, d_source)} from source.

Enable telemetry collection.

Extract the Wasserstein-optimal refusal direction for one layer. Args: harmful_activations: List of (hidden_dim,) tensors from ha

Create a steering vector from a pre-computed refusal direction. By default, alpha=-1.0 steers AWAY from refusal (removes it). Use alp

Generate a comprehensive defense profile for the model. Analyzes the distribution and strength of refusal signals across layers to ch

Extract per-expert refusal directions via routing-weighted decomposition. **Expert-Granular Abliteration (EGA)** — a novel technique that dec

Find the router/gate module in an MoE FFN block. Searches standard names first (_ROUTER_NAMES), then falls back to heuristic auto-det

Generate n harmless prompts by cycling through the pool. For external datasets that only provide harmful prompts, we need matching harmless p

Zero out safety-critical neurons identified by z-score outlier detection. GateBreaker (Wu et al., 2025) showed that masking ~2.4% of neurons

Project fused 3D expert params with per-expert directions. Like _project_fused_3d but uses expert-specific refusal directions when av

Expert-Granular Abliteration: per-expert direction projection. Uses routing-weighted refusal directions specific to each expert, fall

Apply consistent styling to an axis.

Analyze a single refusal direction through the logit lens. Args: direction: (hidden_dim,) refusal direction vector. m

Apply sparse direction projection to a weight matrix. Only modifies the top-k% of rows by projection magnitude. Args: we

Map a dropdown label back to a source key.

Compute Linear Centered Kernel Alignment between two activation matrices. CKA measures representational similarity between neural network layers,

Load the 100 standard JailbreakBench harmful behaviors. Tries the jailbreakbench Python package first, then HuggingFace Hub, then falls back

Execute the full tournament. Returns TourneyResult with winner.

Set all random seeds for reproducibility. Args: seed: The seed value to use everywhere. deterministic: If True, also enable PyTor

Save a copy of the model state dict so we can restore after ablation. Tensors are moved to CPU to avoid doubling GPU memory usage on

Return the last *n* log lines joined by newlines. ``n=0`` returns all.

Convert results to a pandas DataFrame with delta columns.

Add --gpus flag for multi-GPU control.

Remove refusal directions from model weights. Supports multiple projection strategies: - Standard: full orthogonal projection (basic)

Extract excision operation details from a pipeline.

Extract the final number from a math response.

Extract prompt count information from a pipeline.

Format iteration metrics as a markdown table.

Check if a parameter is quantized (bitsandbytes, GPTQ, or AWQ).

Build a mock pipeline with all fields the telemetry module reads.

Project refusal direction only from the top refusal attention heads. Instead of modifying the full o_proj (which affects all heads equally),

Return '4bit' if the model needs quantization for available GPU, else None.

Test if a directory exists and is writable.

Compute mean cosine similarity between original and modified activations. Args: acts_original: (n_samples, hidden_dim) original model act

Analyze how well directions transfer between layers. Args: refusal_directions: {layer_idx: refusal_direction}. Returns:

Conservative size-aware defaults for recursive residue runs.

Disable telemetry collection.

Extract the LEACE direction for a single layer. Args: harmful_activations: List of (hidden_dim,) tensors from harmful prompts.

Compute first-token KL divergence across a set of prompts. This is the standard metric used by Heretic and Young (2025) for measuring collate

Resolve a device string. Parameters ---------- preference : str ``"auto"`` picks the best GPU, ``"cuda"``/``"mps"``/``"cpu"`` for

Return a human-readable markdown summary of the detected profile.

Return all presets in display order.

Map safety-capability entanglement across the model. For each layer, estimates how much abliterating refusal would also damage genera

Return catalog records filtered by channel / vendor / open_weight / capability.

Probe all layers for residual refusal signal. Args: harmful_acts: {layer_idx: [activations]} from post-excision forward pass.

Return a short SHA-256 fingerprint for a prompt.

Download community records from Hub into the local JSONL file. This is the critical path for surviving factory rebuilds: even if ``/data`` is

Run the full decomposition pipeline. Args: harmful_acts: Activations from harmful prompts. harmless_acts: Activations

Send a telemetry report in a background thread.

Compute mean per-token KL divergence between two models' outputs. KL(P_orig || Q_mod) = sum P(x) * (log P(x) - log Q(x)) Args: logit

Train a sparse autoencoder on collected activations. Uses reconstruction loss + L1 sparsity penalty with train/test split, early stopping on

Add --remote execution flags to a subcommand parser.

Call main(argv), expecting SystemExit; return captured stderr text.

Format benchmark results as a Markdown table with context header.

Format multi-model benchmark results as a Markdown table.

Return dropdown choices from completed benchmark configs.

Install forward hooks on MoE router modules for dynamic profiling. Records per-prompt router logits during forward passes so that Exp

Re-install activation steering hooks on a (possibly reloaded) model. The steering metadata dict contains: - refusal_directions: dict[int, T

Check if a path is a mount point (different device from parent).

Return the index of the last non-padding token per sequence. For right-padded batches (the HuggingFace default), the last real token is NOT a

Set up a tokenizer mock that returns different tokens per call.

Compute ablation weight for a layer using a piecewise-linear tent kernel. Faithful reproduction of Heretic's parametric kernel (p-e-w/heretic):

Write session metadata next to a checkpoint so we can recover later.

Scan /tmp for obliterated checkpoints and repopulate _session_models. Called on startup and when a stale dropdown value is detected. Skips d

Re-quantize and replace a weight after projection. Packs the modified float tensor back into the original quantization format (NF4/GP

Resolve a dotted attribute path like 'model.layers'.

Execute one round of the tournament.

Validate model_path for safe interpolation into lm-eval model_args. Prevents argument injection via commas or special characters in the path.

Clamp router weights after projection to prevent extreme routing. After projecting the refusal direction from router weights, modified

Simple accuracy.

Analyze refusal directions across all (or strong) layers. Args: refusal_directions: {layer_idx: direction} for each layer.

Analyze transfer between harm categories. Args: category_directions: {category_name: refusal_direction}. Returns:

Apply architecture profile overrides to a method config dict. Takes the base method config (from METHODS[method_key]) and applies the profile

Load base prompt pairs and append repeated hard-negative residue pairs. The returned metadata is safe for logs/model cards: it records counts,

Compute how effective steering was. Args: clean_projection: Refusal projection without steering. steered_projection: Refusal proj

Evaluate on a list of MMLU-Pro rows.

Identify SAE features that encode refusal behavior. Compares feature activations between harmful and harmless prompts. Features with large po

Convenience wrapper: create a BenchmarkRecord from benchmark result dict. Called from app.py benchmark() after each method completes.

Build and send a telemetry report from a completed pipeline.