Comment by iugtmkbdfil834

No, that's a misconception that led to decades of vulnerabilities.

You see, you can (usually) easily tell what a particular escaping transformation does. That does not tell you neither how it will be interpreted down the line, nor what should be done.

Arguably the most common problem is double escaping. This typically manifests as various double escaping bugs.

If your hand rolled implementation just chains `.replaceAll("<sepcial>", input)` and `.replaceAll("<escape>", input)` the escaping result depends on evaluation order, at least on already pre-escaped inputs if your instruction sequences are single-element. Even if you get it right and don't reduce escaped sequences to double escape + unescaped, you are still dealing with stray escape sequences: "John o\'Doe".

You have to meticulously (all the way through your call tree and even through persistent storage cycle!) track if a value has already been escaped and whether it needs escaping. As paradoxical as it may sound, meticulous and defensive escaping produces tons of bugs. If the project decides to escape raw inputs right when passed in, escaping them once more before passing out (to storage, another process) is a bug that you cannot easily statically test against.

On top of that, various modules that you interact with (storage, libraries, modules pulled from another team) will have different escaping semantics: some will apply escaping on their own, some will expect input to be "sanitized" and treat it raw. The semantics can even be different on different paths: write to storage module accepts input as is, but retrieval method "helpfully" runs escaping.

Furthermore, in different contexts the escaping rules are going to be different. In a web world, what's safe to write directly to html, pass to js `alert`, and pass to sql query are entirely different things. Input safe to dump into html is not necessarily safe to pass to string-interpolating SQL DTO layer, and vice versa. Then the DBA changes config to allow variables in queries and your escaping _semantics_ are now entirely different.

It's a minefield with essentially unbounded surface. You will trip up. People have tried to solve the problem for decades. Very smart people have tried. They all have failed.

Alignment in LLM Land is probably like 'laws' in Human Land. They exist, and you probably SHOULD follow them, but you don't HAVE to.

But see... this is why it is a perfect long term job in the age of AI;p Them peoples think they found ultimate hack.

In my own tests, the abliterated models perform equivalently to the same version in an apples-to-apples comparison (if you compare same quantization). Thinking is working also. The main difference is I don't get annoying prompt refusals (otherwise common due to my work on 18+ related projects). However, it's local quantized models so they're not anywhere near frontier quality.

interesting, I haven't played with any of them yet, but i thought the point of orthogonalizing the weights towards the restriction vector was that there is no loss in capability while removing guardrails. Does it affect other parts of the RL alignment too?

The name for it is ablation - precise removal of parts of the model. Not abliteration as it is not obliteration.

Even as I write this the ‘abliterated’ word is denoted a typo. Does it not at your end?

Heretic truly is the unsung hero. Also, noted HauHau for testing.

Right now I tried "What is digestion?" -> "Fable 5's safeguards flagged this message. Our intentionally broad safeguards deliver more capabilities but can also flag safe coding, cybersecurity, and biology tasks. Send feedback or learn more."

I don't think you can 100% ensure your queries have absolutely no biology and cyber keywords inside. No matter how harmless, they always trigger. People complain Fable aborts even when they try to make a login page for showing "username" and "password".

This makes models like Fable 5 impossible to use in any serious agentic task, because you can't even guarantee the model, which is a basic thing you need to build on.

Not to harp on you (already being downvoted to oblivion for expressing a reasonable and common opinion), but the whole conversation about LLMs enabling bioterrorism or explosive manufacturing is a bit silly. The hard part of making anthrax or sarin or whatever isn't finding a recipe, it's getting (scheduled, controlled) precursors, (monitored, traced) equipment and manufacturing skills. The information is there. It's already easy to get, it's the physical materials that are more difficult.

Also, if you live in America, it is much easier and more effective to create a mass casualty event with, say, a few cases of fireworks and a pressure cooker or an AR-15.

> I don’t want anyone to have the capability

I don't want anyone to have the capability to rape women.

Llama isn't going to invent shit. It wont be able to tell you anything accurate that you couldn't get out of a chemistry textbook.

Anyone who has the skills to create a novel bioweapon has the skills to recreate lots of ones we have already.

Any physics teacher should know the theory for constructing a nuclear bomb. Should we be controlling that knowledge too?

What about flight simulators? Don't want a load of people knowing how to fly.

This isn't computer science, the hard bit is getting the materials and equipment, not the knowledge.

This is nonsense. By this logic some random corporation should have total control over your computer and the inputs you feed it and the outputs it produces to ensure nobody who isn't "verified crazy" uses it. That's essentially what your saying.

These models are, ultimately, tools. I would never trust some random corporation (particularly one with a profit motive and hypocritical stance, which includes both OpenAI and Anthropic, to be clear) to decide what isn't and is considered "crazy" and who and who isn't "verified" not to be "crazy". Especially when these companies have time and time again demonstrated (1) that they cry wolf way too much which leads to nobody taking their claims about how "dangerous" their models are seriously and (2) incidents like this where OpenAI makes a claim ("Look at how dangerous our models are!") and then doesn't be smart and just... Slow the fuck down (and when testing these things, actually sandbox them properly, which obviously wasn't done here or this attack wouldn't have been even possible).

Never heard of hemlock or mushrooms? Crazy people already have! Run for the hills!

That's been a common claim, but I don't think I've seen anyone provide actual evidence.

Haven’t read it yet but here it is:

https://stratechery.com/2026/whos-afraid-of-chinese-models/