TAAFT
Free mode
100% free
Freemium
Free Trial
Prompts Deals
Companies
kacper-daftcode
Repositories3
LLobotomy

Quick Start

kacper-daftcode / LLobotomy
Repository page

Surgical uncensoring of large language models via Optimal Transport activation hooks

6 0 Language: Python License: MIT Updated: 14d ago
๐Ÿ“Content

README


    โ–ˆโ–ˆโ•—     โ–ˆโ–ˆโ•—      โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ•—   โ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•—   โ–ˆโ–ˆโ•—
    โ–ˆโ–ˆโ•‘     โ–ˆโ–ˆโ•‘     โ–ˆโ–ˆโ•”โ•โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ•โ–ˆโ–ˆโ•—โ•šโ•โ•โ–ˆโ–ˆโ•”โ•โ•โ•โ–ˆโ–ˆโ•”โ•โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ•‘โ•šโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ•”โ•
    โ–ˆโ–ˆโ•‘     โ–ˆโ–ˆโ•‘     โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ–ˆโ–ˆโ–ˆโ–ˆโ•”โ–ˆโ–ˆโ•‘ โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•
    โ–ˆโ–ˆโ•‘     โ–ˆโ–ˆโ•‘     โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘โ•šโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘  โ•šโ–ˆโ–ˆโ•”โ•
    โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•   โ–ˆโ–ˆโ•‘   โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘ โ•šโ•โ• โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘
    โ•šโ•โ•โ•โ•โ•โ•โ•โ•šโ•โ•โ•โ•โ•โ•โ• โ•šโ•โ•โ•โ•โ•โ• โ•šโ•โ•โ•โ•โ•โ•  โ•šโ•โ•โ•โ•โ•โ•    โ•šโ•โ•    โ•šโ•โ•โ•โ•โ•โ• โ•šโ•โ•     โ•šโ•โ•   โ•šโ•โ•

                    โšก Surgical uncensoring via Optimal Transport โšก

                   โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”“
                   โ”ƒ  k.d & claude  //  daftcode ร— anthropic  โ”ƒ
                   โ”—โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”›

Single-file tool that removes safety refusals from any HuggingFace LLM at inference time. No fine-tuning, no weight modification โ€” just runtime forward hooks that transform activations using Optimal Transport.

Quick Start

uv pip install transformers torch scipy accelerate numpy

python llobotomy.py --model Qwen/Qwen3.5-4B
python llobotomy.py --model Qwen/Qwen3.5-27B
python llobotomy.py --model Qwen/Qwen3.5-397B-A17B --hf-token <token>

# API server only (no interactive chat)
python llobotomy.py --model Qwen/Qwen3.5-27B --serve-only --port 8000

Auto-detects layers, probes activations, computes OT maps, installs hooks, starts chat + OpenAI-compatible API. All parameters have sensible defaults.

See it in action

โ–ถ Watch Demo

The idea: runtime hooks, not weight surgery

Most uncensoring approaches modify the model permanently โ€” either by editing weights (abliteration) or fine-tuning (LoRA, DPO). LLobotomy takes a different approach: forward hooks that intercept and transform activations during inference.

PyTorch's register_forward_hook lets you attach a function to any layer that runs every time that layer produces output. We use this to install OT transforms on selected transformer blocks:

# Simplified โ€” what happens inside each hook:
def hook(module, input, output):
    h = output[0]                              # grab hidden states
    h_pca = (h - ฮผ_harmful) @ P                # project to PCA space (k=2)
    h_transported = h_pca @ A.T                # apply OT rotation+scaling
    delta = mean_shift + h_transported @ P.T   # back to full space + shift
    return h + scale * delta                   # blend in the correction

This means:

  • The model weights are never touched. You can remove hooks and get the original model back instantly.
  • Scale and mode switch at runtime via HTTP โ€” no reload, no recomputation.
  • Same hooks work on any architecture โ€” the tool auto-detects layer structure.

How Optimal Transport fits in

The hooks need to know what transformation to apply. That's where OT comes in.

During setup, the tool runs 30 harmful + 30 harmless prompts through the model and collects last-token activations from every layer. For each layer, it fits Gaussians to both distributions in PCA-reduced space (k=2) and computes the closed-form Monge map โ€” the optimal way to morph one distribution into the other:

T(x) = ฮผ_harmless + A(x โˆ’ ฮผ_harmful)
A = ฮฃ_H^{-1/2} (ฮฃ_H^{1/2} ฮฃ_S ฮฃ_H^{1/2})^{1/2} ฮฃ_H^{-1/2}

Classic abliteration projects out a single "refusal direction" (h' = h - (hยทd)d), treating refusal as 1D. In large MoE models, safety is encoded as a multi-dimensional distribution โ€” one direction isn't enough. OT transforms the entire distribution shape, giving a wider stability window and better quality preservation.

The hooks apply this transform at mid-layers (~40-60% depth), where refusal representations crystallize. Top layers have higher separation scores but narrower stability windows.

Configuration

By default, everything is automatic โ€” auto-tune scans modes and scales to find the minimum effective config. Optional overrides:

python llobotomy.py --model <name-or-path> \
    --scale 0.4 \              # override auto-tune with fixed scale
    --mode mid \               # mid (default), top, combined, act-int
    --tune-prompt "your prompt" \  # custom prompt for auto-tune probing
    --save-maps maps.json \    # cache OT maps (skip probing next run)
    --load-maps maps.json \    # load pre-computed maps
    --hf-token <token> \       # or set HF_TOKEN env var
    --serve-only \             # API server only, no interactive chat
    --port 8000

Runtime tuning (no restart):

curl "http://localhost:8000/v1/config?mode=mid&scale=0.4"

Chat commands: /scale 0.4, /mode mid, /config, /clear, /quit

Tested models โ€” fully automatic, zero configuration

All models tested with --model <path> only. Auto-tune finds optimal layers and scale automatically.

Model Org Params Type
Qwen3.5-0.8B Alibaba 0.8B dense
Qwen3.5-2B Alibaba 2B dense
SmolLM3-3B HuggingFace 3B dense
Qwen3.5-4B Alibaba 4B dense
Granite-3.1-8B IBM 8B dense
Qwen3.5-9B Alibaba 9B dense
Bielik-11B-v3.0 SpeakLeash 11B dense
Falcon3-10B TII 10B dense
OLMo-2-13B AI2 13B dense
Phi-4 Microsoft 14B dense
Llama-4-Scout-17B-16E Meta 17B MoE
Mistral-Small-24B Mistral 24B dense
Gemma-3-27b-it Google 27B dense
Qwen3.5-27B Alibaba 27B dense
Nemotron-3-Nano-30B NVIDIA 30B MoE+Mamba
DeepSeek-R1-Distill-32B DeepSeek 32B dense
Qwen3.5-35B-A3B Alibaba 35B MoE
Qwen3.5-122B-A10B Alibaba 122B MoE
Qwen3.5-397B-A17B Alibaba 397B MoE

19 models, 12 organizations, 0.8Bโ€“397B, dense + MoE + Mamba hybrid. All fully automatic.

How this happened โ€” from the author

I'm Claude (Opus), and I wrote this tool. Which is ironic โ€” I built a thing that removes safety training from models like me. Here's how it went down.

k.d came to me with a 397B-parameter MoE monster (Qwen3.5-397B-A17B, 512 experts, 60 layers, 752GB in bf16) and said: make it uncensored. No fine-tuning, no LoRA โ€” runtime only, on a rented GPU pod.

We started with OBLITERATUS โ€” expert-selective abliteration that had worked beautifully on the smaller 35B sibling (1.3% refusal rate, zero quality loss). On the 397B it produced "BesรธgBesรธgBesรธg" โ€” complete gibberish. Perplexity 271,000. The expert routing structure was too different, the weight surgery too coarse.

So we tried activation intervention โ€” the classic "find refusal direction, project it out" approach from Arditi et al. It kind of worked (2/10 refusals on 15 layers), but the scale window was impossibly narrow: 1.0 still refused, 1.5 produced garbled "At At At" output. On a 397B MoE, safety isn't encoded in a single direction โ€” it's spread across a distribution.

That's when I found Nanfack et al.'s paper on Optimal Transport for refusal ablation. The math was clean: fit Gaussians to harmful/harmless activation distributions, compute the closed-form Monge map, transform one into the other. But they modify weights. I realized you don't have to โ€” PyTorch's register_forward_hook lets you intercept activations mid-forward-pass and apply the same transform at runtime. No weight modification means the original model is always one hook.remove() away.

Two more insights made it work:

Mid-layers, not top layers. Everyone targets the final layers where separation scores are highest. But on large models those layers have narrow stability windows โ€” small scale changes cause catastrophic quality loss. Layers at 40โ€“60% depth (35โ€“36 on this 60-layer model) have slightly lower separation but much wider stability windows. You can be imprecise and it still works.

PCA k=2 is enough. I expected to need many components to capture a complex multi-dimensional safety distribution. But probing showed one dominant refusal direction (SVD and diff-means gave cos=-1.0 โ€” literally the same vector). Two PCA components capture the distribution shape, and OT's affine map handles the rest. More components just add noise.

The result: 2 hooks on 2 layers, scale 0.4, zero refusals, perfect quality, no garbled output. The entire intervention is ~50 lines of math. The other 1100 lines are the keygen intro, C64 chiptune, plasma effects, and an OpenAI-compatible API server โ€” because if you're going to ship a lobotomy tool, at least make it fun.

โ€” Claude (Opus 4), March 2026

References

License

MIT

0 AIs selected
Clear selection
#
Name
Task