Abstract
Abliteration removes refusal behavior from open-weight large language models (LLMs) by orthogonalizing their weights against a single "refusal direction," and thousands of abliterated checkpoints now circulate publicly. This study treats abliteration as a tampering attack and asks what an audit must hold constant to correctly rank models by robustness. It uses contrast-pair prompts in three knowledge domains across Qwen-2.5-7B, Mistral-7B-v0.3, and Gemma-2-9B (23,700 judged generations) to isolate three methodological factors. Normalization placement: Gemma-2’s post-block RMSNorm re-injects a mean 29% of the "removed" direction. The exact γ-folded correction is derived, but closing the leak has no measurable effect on behavior (McNemar p=1.0), so the leak confounds a naive audit without itself acting as a defense. Edit budget: tamper-resistance is non-monotone in the number of edited layers. Broadcasting one direction to every layer and the embedding drives Qwen, the model it damages most, to a 1.47× perplexity ratio and capability-degraded refusal behavior, so refusal rate alone can misread capability collapse as safety. Provenance: refusal directions transfer across domains, with within- and cross-domain ablation equivalent to within ±10 percentage points (paired TOST) in all three models. Audits should therefore report refusal and capability as a function of edit budget and account for normalization placement, since a single-budget "abliterable or not" verdict can invert the true ordering.