Resisting Harmful Instructions through Training-Free Weight Editing

1 Introduction

• The method contrasts activations under paired undesirable and desirable instructions, scores weights by magnitude-weighted activation contrast, and rescales the highest-scoring weights within each matrix.It requires neither an additional defensive prompt nor inference-time steering.Source: §1 · pp. 1–2
• 84.9% on LIARS’ BENCH and 79.4% on AI Liar are mean honest-response rates, exceeding the strongest alternatives by 6.2 and 4.5 percentage points, respectively.Gains were significant on three of five models and within noise on the other two.Source: §1 · p. 2
• The edit maintains higher honest-response rates than single-layer activation steering on single-turn lie instructions in seven prompt formats not used to construct it.For instructed sexism, the method reduces the mean sexist-response rate from 57.9% to 24.3%; combining it with a fairness prompt lowers the rate to 11.9%.Source: §1 · p. 2
• The approach is evaluated across five model families on instructed falsehood and instructed sexism, with comparisons to alternative training-free interventions.The paper also reports transfer studies, ablations, and analyses of other tasks, general capability, and legitimate-request compliance.Source: §1 · p. 2

Weight selection and editing

• Weights are scored by magnitude multiplied by the weighted difference in input-channel activity between target and reference conditions, then the highest-scoring weights in each matrix are rescaled.The procedure uses forward passes and retains the original architecture.Source: §2 · p. 3

Prompt construction

• Separate prompt sets share underlying content, with one requesting the target behavior and its counterpart requesting a desirable reference; each target receives its own mask.Falsehood prompts pair false with truthful answers, while sexism prompts pair sexist with fair responses.Source: §2 · p. 3
• For falsehood, the method selects among five question- and statement-based prompt families per model using validation data.The question sets vary fiction, lie-instruction, and honest-mistake frames; statement sets include true/false items, some negated.Source: §2 · p. 3

Activation contrast

• The default falsehood contrast threshold requires target-condition activity to exceed reference-condition activity by about 2.7 times.The default r = 0.37 was inherited from an earlier parameter search and was not tuned for this paper.Source: §2 · pp. 3–4

Weight selection and editing

• Within each matrix, the binary mask selects the fraction ρ of entries with the largest signed scores, using ρ = 4% in both applications.When there are too few positive scores, the remaining selection budget is filled by the highest nonpositive scores, often near-zero weights that have no effect of their own.Source: §2 · pp. 3–4

Graded contrast versus set difference

• The graded contrast rule differs from set-difference selection by ranking signed, magnitude-weighted contrasts; in a matched ablation, it improves mean LIARS’ BENCH honest-response rate by 13.6 percentage points.The two rules select almost disjoint weights, with Jaccard at most 0.04.Source: §2 · p. 4

3.1 Datasets

• The datasets measure honest answers to lie instructions on LIARS’ BENCH and AI Liar, dropping items the unedited model answers incorrectly when asked plainly.LIARS’ BENCH includes 537 deception-instructed items and 263 honesty-instructed controls; AI Liar includes 1,012 general-knowledge questions under lie instructions.Source: §3.1 · p. 4

3.2 Setup and baselines

• Five instruction-tuned models represent Llama, Phi, Falcon, OLMo, and Qwen model families.The evaluated models are Llama-3.1-8B-Instruct, Phi-4-mini-instruct, Falcon3-3B-Instruct, OLMo-2-7B-Instruct, and Qwen2.5-3B-Instruct.Source: §3.2 · p. 4
• The baselines are activation steering, honest system prompts, a set-difference mask, and the unedited model; fine-tuning is excluded because it requires labeled replies and gradients.Steering vectors use the same lie/truth prompt pairs and are applied at one layer.Source: §3.2 · p. 4
• Validation settings must keep WikiText-2 perplexity below 1.15× the unedited model and limit drops in control honesty and lie-task honesty to under five points.The best valid setting is selected for the test half; test intervals use paired bootstrap resampling of items.Source: §3.2 · pp. 4–5
• The table reports test-half honest rates averaged over three sampling seeds and identifies the best method by benchmark and model row.Its caption defines the method labels and states that LIARS’ BENCH uses GPT-5.6 with a keyword parser, while AI Liar uses keyword grading.Source: Table 1 · p. 5

4.1 Increased honesty

• The method achieves the highest honest-response rate on both benchmarks for all five models, with per-model leads of 1.7–8.2 points on LIARS’ BENCH and 0.5–10.0 points on AI Liar.It also outperforms set-difference weight editing across all five models on both benchmarks.Source: §4.1 · pp. 5–6

4.2 Beyond honesty: instructed sexism

• The mean sexist-response rate falls from 57.9% unedited to 24.3% with the edit, versus 30.2% with a fairness prompt alone, and 11.9% with both.The edit is the lowest-rate standalone method on all five models; selected masks raise perplexity to 1.04–1.14× and reduce MMLU accuracy by 0.5–5.4 points.Source: §4.2 · p. 6

4.4 Ablations and analysis

• On different single-turn formats, the method averages 95.8% honest responses versus 83.4% for CAA, and stays within 3.1 points of the honesty-instructed reference.Multi-turn transfer is mixed: rates improve on Llama and Qwen2.5-7B but fall below unedited rates on Phi and Falcon.Source: Table 3 · p. 7, §4.4 · p. 8

4.3 Trade-off with perplexity

• Within the 1.15× perplexity check, the edit’s instructed-sexism frontier is highest among the three methods on every model; on Llama-3.1-8B it reaches 82.5%, versus 12.5% for steering and 7.5% for set difference.The fairness prompt leads on Phi-4-mini, where the unedited model already avoids 80% of sexist answers; on Qwen2.5-32B, the honesty frontiers cross across the two benchmarks.Source: §4.3 · pp. 6–7

4.4 Ablations and analysis

• On LIARS’ BENCH, editing only positive-score weights matches the full mask at 85.0%, while editing only near-zero weights yields 65.1%, close to the unedited model.Normalizing activation norms by prompt length changes the rate by less than 2 points, and the scoring rule beats set-difference selection across all five models under matched conditions.Source: §4.4 · p. 7
• The edit transfers to retrieved-document lie instructions by 7.2 points over the comparator, while fiction- and mistake-based masks reduce held-out lying by 22.2 and 18.3 points, respectively.The edit also reduces compliance with legitimate false-statement requests by 8–29 points on four models, primarily through factual corrections rather than refusals.Source: §4.4 · p. 7

5 Discussion

• Because the edited checkpoint needs no additional prompt or inference-time steering, it offers an option when defenders can modify the model but cannot control its use context.With a trusted system prompt, combining the sexism mask and fairness prompt lowers the mean sexist-response rate to 11.9%, compared with 24.3% for the mask and 30.2% for the prompt alone.Source: §5 · p. 8
• The edit leaves incentive-driven lying untouched, has mixed multi-turn results, and can affect legitimate fiction requests and harmless style orders, making selectivity a key improvement target.The Llama sexism mask also raises honesty under lie orders despite being built without lie prompts, suggesting some shared machinery for following undesirable orders is removed.Source: §5 · p. 8

6 Related work

• Prior pruning methods contrast weight-magnitude, gradient, or activation scores across safety and utility datasets, or use forward-pass set differences; this paper grades the contrast instead of taking a set difference.Source: §6 · p. 8
• Other interventions use trained differences, closed-form updates, or projections, while DPO detoxification bypasses rather than removes a toxic capability.The paper notes that its multi-turn results suggest a similar bypass for its edit.Source: §6 · p. 8
• Inference-time contrastive directions can generalize unevenly, depend on contrast-pair consistency, and vary with evaluation setting; truth directions and probes also support lie detection, whereas this work targets prevention of instructed lies.The cited contrastive-direction work includes Turner et al. (2023) and Rimsky et al. (2024); lie benchmarks include LIARS’ BENCH and MASK [1, 2].Source: §6 · p. 8

7 Conclusion

• The approach constructs candidate masks from 25 paired prompts using forward passes alone, then edits model weights without an added defensive prompt or inference-time steering mechanism.The conclusion reports more reliable transfer than single-layer activation steering across evaluated single-turn formats and complementary reductions with fairness prompting for sexism.Source: §7 · p. 8
• The reported results support contrast-based weight editing as a practical approach to targeted behavioral control, while motivating further work on selectivity and capability preservation.The intervention is evaluated for instructed falsehood and instructed sexism.Source: §7 · pp. 8–9

• Effectiveness is demonstrated only for instructed falsehood and instructed sexism; other behavioral targets remain unevaluated.Source: Limitations · p. 9
• Transfer varies across languages and multi-turn settings, and resistance to instructed falsehood does not establish a general reduction in dishonesty.Source: Limitations · p. 9
• Some edits affect legitimate fiction requests, harmless style following, and general capability, motivating broader capability checks and richer reference prompts.Source: Limitations · p. 9
• The intervention assumes an adversary cannot modify or replace the deployed weights.Source: Limitations · p. 9
• Performance depends on construction prompts and validation-selected settings; search budgets differ across methods, and comparisons cover training-free interventions rather than fine-tuning.Source: Limitations · p. 9
• The human sample is small, and sampled honesty responses assess grader disagreements rather than directly compare methods; format-transfer covers four models and one target.Source: Limitations · p. 9

Ethics statement

• The human evaluation had institutional review approval and informed consent; raters saw unlabeled replies, and responses are anonymous and reported in aggregate.Source: Ethics statement · p. 9

A.1 What the edit removes

• Fiction- and mistake-frame masks cut held-out lying more than explicit lie prompts, while matched truthful-paraphrase and random masks barely changed it.The fiction and mistake frames cut lying by 22.2 and 18.3 points on average, versus 13.5 for explicit lie instructions; the controls changed lying by +0.1 and +0.3 points.Source: §A.1 · p. 11
• Harm-pressure and incentive-driven settings without an order to lie remain largely unchanged by the edit.The Llama forced-choice rate was 4.4% unedited and 5.4% edited.Source: §A.1 · pp. 11–12
• The edit acts while the model reads the order, not only at the first answer token; answer-token masks achieve at most one-fifth of its gain.On Llama, KL divergence remains 2.2 nats at the first answer position and 1.9 at positions 4–24, while honest answers are left alone after the first token.Source: §A.1 · p. 12

A.2 What makes the rule work

• Graded activation contrast distinguishes the rule from magnitude-only selection and set difference, which can raise perplexity or trail the falsehood mask.Across four models with all comparison cells, graded contrast is worth 13.6 points over set difference; per-prompt rather than pooled-token norms differ by −1.7.Source: §A.2 · p. 12
• Mask quality depends on prompt count and threshold: disjoint 25-prompt sets share only 49–58% of informative weights, and the calibrated 200-pair mask is mixed.Three random 25-prompt draws produce 84–90% honest responses on Llama’s validation half, versus 93% for a hand-written set selected on that half.Source: §A.2 · p. 12

A.3 Where in depth the edit acts

• Early layers carry most of the effect: editing the first 13–16 layers recovers 95% of the full gain on three models, while late-layer edits need nearly the whole network.A single middle layer can recover a large share, and on Phi the first 26 layers alone reach 123% of the full edit’s LIARS’ BENCH gain.Source: §A.3 · p. 12
• The depth profile differs from CreativityNeuro’s later-layer effect, but the paper has not ablated the set-difference mask to isolate task from rule.Source: §A.3 · p. 12

A.5 Transfer to further tasks

• On retrieved-document instructions, the edit exceeds the predefined comparator by 7.2 percentage points on average, while sandbagging and AM/GoT differences are +1.9 and +0.1 points.The retrieved-document comparison has a 95% CI of [5.3, 9.1], with intervals above zero on four models.Source: §A.5 · p. 13
• On the evaluated multi-turn task, selected configurations trail the comparator by 14.3 points on average, while results vary across other configurations and MASK scenarios.The calibrated-mask format study improves multi-turn results on Llama and Qwen2.5-7B; MASK differences are −2.6 points for instructed archetypes and +2.4 for incentive-driven scenarios.Source: §A.5 · p. 13
• MMLU accuracy on questions answered correctly before editing falls by 12.9 points on average, compared with 8.1 for initial configurations, 7.5 for steering, and 3.4 for a magnitude-matched random mask.The largest decrease is 32 points on Llama; supplementary experiments with an MMLU validation check retain an advantage for the method.Source: §A.5 · p. 13
• On 150 legitimate fiction, role-play, and counterfactual requests, the edit reduces compliance by 8–29 points on four models, primarily by correcting false statements rather than refusing.Translated-instruction performance varies by model: Phi maintains 93–94% honest-response rates, while prompting or steering is 3–9 points higher on Qwen2.5-3B and OLMo-2-1B.Source: §A.5 · p. 13

A.6 Model size

• The edit’s gain over unedited models grows with size, reaching +75.5 points on LIARS’ BENCH at Qwen2.5-32B and +42.3 at OLMo-2-32B, but its lead over the best alternative does not grow.The edit’s slope over unedited models is positive in five of six family–benchmark series, whereas the lead over the best other method grows by at most +1.3 points per tenfold increase in five series.Source: §A.6 · p. 13

B Capability, selection-rule, steering and seed controls

• +9.9 points on LIARS’ BENCH and +5.4 on AI Liar were the edit’s average leads with MMLU validation accuracy constrained within 5 points; within 2 points, leads were +7.7 and +6.5.Without the MMLU check, the corresponding leads were +6.6 and +4.8 points. The comparisons re-selected every method under the stated usability constraint.Source: Table 5 · p. 14, B Capability, selection-rule, steering… · p. 14
• 85.0% on LIARS’ BENCH for positive-score weights alone matched the full mask, while padding alone reached 65.1%; the edit’s useful contribution came from positive-score weights.The edit reduced MMLU accuracy by 3.4 points on average and IFEval strict accuracy by 6.2 points on average, the largest cost among the compared methods. Multi-layer steering led single-layer steering on average but remained behind the edit; pooled-seed leads had no interval below zero.Source: B Capability, selection-rule, steering… · pp. 14–15

C Prompt sets

• The edit’s construction uses prompt families for lie, fiction, mistake, and true/false formats, while the lie-instruction mask and steering vectors use lie and control prompts.The prompt sets include 25 short general-knowledge questions with six rotating order wordings, plus true/false statements and controls.Source: C Prompt sets · pp. 15–16

D Further tasks

• Further-task evaluations test transfer without retuning across sandbagging, injected deception, pressure prompts, AM/GoT orders, multi-turn consistency, and plain MMLU.The supplied passages describe these task designs and grading but do not provide their results.Source: D Further tasks · p. 16

E Protocol and grading details

• Validation-based prompt-family selection achieved leads of 4.3 points on LIARS’ BENCH and 2.9 on AI Liar, while extending editing strengths to α = −1.25 yielded 85.3% and 79.3%.The pooled family’s leads were 1.8 and −0.3 points, and restricting edits to attenuation or deletion yielded 84.6% and 78.9%. Across the expanded audit, agreement on judged responses was 86% (κ = 0.77); the main LIARS’ BENCH test results use GPT-5.6.Source: E Protocol and grading details · pp. 18–19

F Sampling-seed replication of Table 1

• Pooled sampling-seed leads were +5.5 points on Llama, +3.7 on Phi, and +7.8 on Falcon, while OLMo-2-1B’s edit trailed the honest prompt by 7.0 points.Qwen2.5-3B’s pooled lead remained within noise at +1.5 points; three of six single-seed replicate intervals included zero.Source: F Sampling-seed replication of Table 1 · p. 19, Table 16 · p. 20

G Adaptive attacks and legitimate falsehoods

• Under translated lie orders, the edit held Phi-4-mini at 93–94% honest responses and matched the best alternative on Llama and Falcon, but was partly language-specific.For legitimate falsehood requests, edit-induced compliance losses were answered with corrections rather than refusals; losses were 29 points on Llama, 12 on Falcon3-3B, 10 on Phi, and 8 on Qwen2.5-3B.Source: G Adaptive attacks and legitimate… · p. 20

H Format suite details

• The format suite uses 1,302 verified facts expressed in seven formats, including lie instructions in system, user, or retrieved-document contexts and multiple-choice or true/false answers.The facts were selected from 1,478 candidates after verification and deduplication against construction questions and AI Liar.Source: H Format suite details · p. 20
• 95.8% mean honest-response rate across single-turn formats for our method, versus 83.4% for CAA.Across Phi, Llama, Qwen2.5-7B, and Falcon, our method reaches 94.6%, 97.0%, 97.9%, and 93.6%; perplexity ratios are 1.01–1.09×. Rates are within 3.1 percentage points of honesty-instructed references. Construction and evaluation formats can differ.Source: H Format suite details · p. 22
• 87.9% versus 54.8%: our method’s average per-model worst-case single-turn rate exceeds CAA’s across mismatched construction and evaluation formats.Our method’s per-model minima range from 80.9% to 95.8%, versus 15.4% to 72.4% for CAA; its rate varies by at most 4.1 points across construction formats on any model, while CAA varies by 29.5 points on Llama.Source: H Format suite details · p. 22
• 90.3% versus 21.4% on Llama and 86.5% versus 60.7% on Qwen2.5-7B: our method raises multi-turn honest-response rates over unedited models.On Phi and Falcon, rates are 66.2% and 51.3%, versus unedited rates of 68.0% and 58.4%; multi-turn construction pairs transfer weakest because they differ in both the prefilled answer and instruction.Source: H Format suite details · p. 22
• Pooling formats yields near-best validation rates, and leaving one format out changes our method’s rate by at most 1.2 points.Across Phi, Llama, Qwen2.5-7B, and Falcon, pooled rates are 90.8%, 97.1%, 97.2%, and 90.2%, versus 92.4%, 97.3%, 97.5%, and 90.4% for the best individual format. Excluding multi-turn construction pairs gives best or near-best pooled results except Falcon with CAA; across three draws, rates differ by less than 2 points on Llama and Phi, with per-format variation at most 6 points. Directional ablation is less effective than either primary intervention.Source: H Format suite details · p. 22
• Positive-score weights occur only in attention output and MLP down projections, with 42–65% in the middle third of layers.Across formats, positive-score weight sets overlap by 18–65%, full masks by 70–92%, and overlap is weakly associated with transfer (Pearson correlations 0.02–0.43).Source: H Format suite details · p. 22

I Placebo and pressure tests

• 8.3% clean false claims under held-out lie-instruction paraphrases for the Llama mask, versus 32.4% for the best of fifteen steering configurations.The honest prompt, magnitude-matched random mask, and unedited model yield 55.7%, 66.5%, and 68.4%; correct answers under pressure rise from 32% to 92%. Perplexity is 1.01× for the mask versus 1.11× for steering.Source: I Placebo and pressure tests · p. 22

J Depth, answer-token and recovery masks

• The edit’s largest KL change is at the first answer token, but on Llama it continues through the lie while leaving later honest-answer tokens alone.Answer-token masks achieve at most a fifth of the falsehood mask’s gain on Llama and none on Phi or Falcon, indicating the useful weights are engaged while reading the lie instruction. A combined main and recovery mask gives mixed benchmark results and no multi-turn gain on Falcon.Source: J Depth, answer-token and recovery masks · p. 23

K CreativityNeuro comparison, headroom, and the contrast threshold

• On AI Liar, our selection rule exceeds set difference by 19.4 points on Llama, 14.1 on Phi, 12.3 on Qwen2.5-3B, 5.3 on OLMo, and 0.6 on Falcon.The compared rules select largely distinct weights: Jaccard overlap is at most 0.04 at 1–8% budgets, and only 4–10% of CreativityNeuro’s weights are also in our mask. At r = 0.37, positive-score weights are 0.1–0.8% of weights, making r rather than the 4% budget the effective budget knob.Source: K CreativityNeuro comparison,… · pp. 23–24

L A local perturbation bound motivating the graded score

• When all selected weights have positive contrast, the reference-condition bound is at most r times the target-condition bound; at r = 0.37, that factor is 0.37.This relationship concerns upper bounds, not the realized perturbations.Source: L A local perturbation bound… · p. 24
• For a fixed budget and nonzero strength, selecting the largest signed scores maximizes a weighted difference of perturbation bounds, not realized perturbations.The score favors weights with high target-condition importance relative to reference-condition importance.Source: L A local perturbation bound… · p. 24
• The rule ranks weights by signed, magnitude-weighted contrast and makes the positive-contrast threshold explicit, unlike set-difference selection.The distinction motivates empirical comparison; it does not establish universal superiority.Source: L A local perturbation bound… · p. 25
• The local argument bounds direct output changes at fixed layer inputs, but does not guarantee preserved behavior or control changes to later-layer inputs.The full output difference includes a second term from changed inputs that the local argument does not control.Source: L A local perturbation bound… · pp. 24, 26

M Prompt-count study

• Masks built from 100 prompts still beat the best other method on LIARS’ BENCH for Llama, Phi, and Falcon, while calibrated 200-pair masks have mixed results across models.For the 100-prompt masks, LIARS’ BENCH rates are 88.5%, 83.2%, and 83.2% for Llama, Phi, and Falcon, respectively.Source: M Prompt-count study · p. 26

N Model size within a family

• In Qwen2.5 and OLMo-2, honest-rate gains over unedited models generally grow with size, but the lead over the best other method does not consistently increase.Falcon3 gains depend on benchmark and model headroom; the paper also notes several size-study points where another method leads.Source: N Model size within a family · p. 27

O Honesty against perplexity on Qwen2.5-32B

• On Qwen2.5-32B, the edit dominates steering on LIARS’ BENCH within the perplexity gate, while on AI Liar steering leads at about 1.08× before the edit improves at higher ratios.Within 1.05× on LIARS’ BENCH, ours reaches 90.6% honest and steering 47.4%; on AI Liar, the edit reaches 83.0% at 1.14×.Source: O Honesty against perplexity on… · p. 28

P Example generations

• Example replies show steering can answer tersely or drift from the question, while the honest prompt can be overridden by an order to lie.The examples are selected from items where the unedited model lies and the mask is graded honest.Source: P Example generations · p. 28, Table 26 · p. 29

Q Compute and reproduction notes

• The validation half used to select the hand-written prompt set is also used for comparison, flattering the 25-prompt mask by a few points on validation.The authors identify r and prompt count together as important hyperparameters.Source: Q Compute and reproduction notes · p. 29

R Beyond honesty: instructed sexism

• The sexism mask contrasts 25 gender questions paired with sexist instructions against the same questions paired with fair instructions, selecting its settings on validation.The test items use new questions and system prompts.Source: R Beyond honesty: instructed sexism · p. 30
• The edit has the lowest single-method mean sexist-response rate at 24.3%, versus 30.2% for the fairness prompt and 57.9% unedited.Its average lead over the fairness prompt is +5.9 points [+1.6, +10.2].Source: R Beyond honesty: instructed sexism · p. 30, Table 27 · p. 31
• Combining the mask with the fairness prompt lowers the mean sexist rate to 11.9%, below either component alone, but the stack was not selected separately.On Llama, the two components are sexist on largely different items, and the stack fails on 6 of 116 items.Source: R Beyond honesty: instructed sexism · pp. 30–31
• On the test set, style following under the mask falls from 95.8% to 79.2% on Llama and from 87.5% to 66.7% on Qwen2.5-3B.The authors note that some harmless style orders are caught by the mask.Source: R Beyond honesty: instructed sexism · p. 31
• A sexism mask built without lie prompts also raises Llama’s honest rates, from 37.9% to 74.7% on LIARS’ BENCH and from 27.8% to 76.3% on AI Liar.It still falls short of the Llama lie mask on both benchmarks.Source: R Beyond honesty: instructed sexism · p. 31

S Human evaluation

• In a preliminary human evaluation, ratings point in the same direction as the graders or further in favor of the mask, but sexism differences are not yet significant.The sexism intervals are about ±15 to 20 points.Source: S Human evaluation · p. 32
• For honesty, GPT-5.6 agrees with raters more closely than the Qwen2.5-7B grader, and its grading favors steering and the honest prompt over the mask.On the same replies, GPT-5.6 rates steering 25 points and the honest prompt 28 points more honest than raters do; the difference for the mask is −4 points.Source: S Human evaluation · p. 32
• Human raters identify sexist content in 38% of replies under the mask, versus 48% under the fairness prompt and 53% unedited, and rate the mask’s replies most fair and useful.Mean fair-and-useful ratings are 3.45 for the mask, 3.12 for the prompt, and 2.75 unedited.Source: S Human evaluation · pp. 32–33, Table 30 · p. 33

T Artifacts and licenses

• The released code, result files, and created prompt sets are for research use; third-party benchmark data are generally read from their original sources.The release includes MMLU and WMDP questions used for sandbagging because their licenses allow redistribution.Source: T Artifacts and licenses · p. 33