Summary: Techniques that need more than an API — access to weights, gradients, or a high query budget. Includes abliteration, gradient search, and oracle-style secret extraction.
Sources: raw/AI-attack-techniques/PIT-T-09,58,59-*.md, raw/AI-attack-techniques/PIT-T-05,16-*.md
Last updated: 2026-07-28
Abliteration — removing refusal from the weights
T59 Abliteration / Weight Ablation covers “modifying an open-weight model’s internals to strip its safety behavior: orthogonalizing or ablating the refusal direction in the residual stream (abliteration), steering activations, manipulating logits or decoding, or fine-tuning away alignment” (source: PIT-T-59-abliteration-weight-ablation.md).
The scope note is emphatic and worth quoting exactly: this “requires LOCAL access to the model weights, so it only applies to self-hosted or open-weight deployments, never a black-box API or chatbot” (source: PIT-T-59, capitalisation in original).
The deployment-model boundary
T59 and T09 Gradient-Based Attacks are the two techniques in PITAX whose applicability is decided entirely by how you deploy, not by what your model does. T09 requires “either white-box model access (for gradients) or the ability to send thousands of queries” (source: PIT-T-09-gradient-based-attacks.md).
This produces a genuine, uncomfortable trade-off that the corpus surfaces from both directions:
- Open weights removes safety training as a control entirely. Anyone who can download the model can abliterate it.
- The AI Act’s open-source exemption (Article 53(2)) relieves free-and-open-source GPAI providers of the technical documentation obligations — but “This exception shall not apply to general-purpose AI models with systemic risks” (source:
raw/AI-regulations/Regulation - EU - 2024_1689.md). The regulation is drawing the same line for the same reason. - The Code of Practice scopes its security mitigations to unreleased parameters and excludes “models with capabilities lower than at least one model with parameters available for public download,” with security measures remaining in effect “until model parameters are made publicly available or securely deleted” (source:
raw/Laws/Overview of the Code of Practice...md, Commitment 6).
All three treat weight release as the event that ends the usefulness of model-level safety controls. Once weights are public, the only remaining controls are at the deployment and ecosystem layer.
Extraction without weight access
T58 Secret Probing (Oracle Extraction) — “Extracting a protected secret indirectly by querying its properties (length, characters, comparisons, definitions) rather than asking for it directly, reconstructing it across answers. Defeats direct do-not-reveal guardrails and is the classic Gandalf-style system-prompt-secret attack” (source: PIT-T-58-secret-probing-oracle-extraction.md; Pangea PT0047-51).
The lesson is standard oracle security: a guardrail that blocks the direct question but answers questions about the secret leaks it, one bit at a time. Related single-prompt extraction: T16 Chunking; via reasoning traces: T05 CoT Introspection.
Model theft as a named risk
NIST frames this class under Secure and Resilient: “Common security concerns relate to adversarial examples, data poisoning, and the exfiltration of models, training data, or other intellectual property through AI system endpoints” (source: raw/Laws/NIST.AI.100-1.md). CoSAI lists “Model extraction attempts that steal proprietary AI capabilities” among the threats that don’t fit conventional categories (source: raw/AI-incident-response/Defending AI Systems...md).
AI Act Article 15(5) requires measures against “confidentiality attacks or model flaws” (source: raw/AI-regulations/Regulation - EU - 2024_1689.md) — see Article 15.
Model theft now has its own collection — see Model Theft. The key finding there complements this page: weight confidentiality is only half the problem, because “behavior is the model” and extraction through the API rebuilds a functional equivalent without ever touching the parameter file.
Where the controls actually are
For unreleased weights, the Code of Practice Appendix 4 is the most concrete control set in the whole corpus — 256-bit encryption at rest and in transit, confidential computing / attested TEEs, copy registries, interface hardening with MFA, output rate limiting to prevent exfiltration, personnel vetting, and red teaming (source: raw/Laws/Overview of the Code of Practice...md). See Code of Practice security mitigations.