# Addition by Subtraction

Safety alignment in open-weight models is highly sparse: pruning a small set of safety-critical neurons or ablating a single refusal direction can make a model produce harmful content. ABS-Align gradually prunes those identified safety-critical neurons during preference finetuning, forcing refusal behavior to be re-established through other parts of the network, and restores the pruned neurons afterward. Across Gemma-2-2B-IT, Llama-3-8B-Instruct, Llama-3.2-3B-Instruct and Qwen-3-4B, attack success generally falls against TwinBreak, NeuroStrike, refusal-direction ablation and ten SORRY-Bench black-box attacks, with reductions of about 90% for some attacks, while TruthfulQA improves and general capabilities change little.

Safety alignment in open-weight models is highly sparse: pruning a small set of safety-critical neurons or ablating a single refusal direction can make a model produce harmful content. ABS-Align gradually prunes those identified safety-critical neurons during preference finetuning, forcing refusal behavior to be re-established through other parts of the network, and restores the pruned neurons afterward. Across Gemma-2-2B-IT, Llama-3-8B-Instruct, Llama-3.2-3B-Instruct and Qwen-3-4B, attack success generally falls against TwinBreak, NeuroStrike, refusal-direction ablation and ten SORRY-Bench black-box attacks, with reductions of about 90% for some attacks, while TruthfulQA improves and general capabilities change little.