The paper introduces Decoy Direction Optimization (DDO), a fast weight-editing defense against Refusal Feature Ablation attacks that bypass open-weight model safety guardrails by projecting out the linear refusal direction. Rather than concealing the true refusal circuitry, DDO injects a high-magnitude nonlinear decoy signal into MLP neurons that corrupts an attacker’s contrastive direction-finding estimator, causing it to ablate a harmless orthogonal feature instead. Evaluated across six model families, DDO holds attack success below 10% under standard attacks and cuts a weight-level attack’s success rate from 88.7% to 18%, at 30-450x lower optimization cost than trained defenses.
