Large language models (LLMs) are text generators trained to refuse harmful requests, but this safety behavior often depends on a tiny set of neurons, or processing units. Attackers who can inspect a model's internals can remove or alter those units and unlock unsafe outputs.
The proposed method, Addition by Subtraction, repeatedly switches off the safety-critical neurons during finetuning, a second round of training, while using , a technique that rewards safe responses. The model gradually learns to keep refusing harmful requests using other parts of its network, spreading safety across the model.
After this training, pruning attacks fail even when attackers remove three times more neurons than before, and disabling a single refusal direction also stops working. Attack success rates drop by up to 90 percent for some attacks, with little effect on general abilities. This makes open-weight models, whose parameters anyone can inspect, much harder to jailbreak.