双信号审计：开权重模型拒绝机制被移除了吗？ Has This Checkpoint Been Abliterated? A Two-Signal Audit and Its Failure Map

精读摘要

平台能否在部署前判断一个开权重检查点是否被移除了拒绝机制？运行时守卫做不到——它们只能给生成结果打分，而不是检查模型本身。这项研究结合两个廉价的内部信号：以参考模型为锚的激活「拒绝间隙」，和基座到候选模型权重差的「权重恢复能量」，形成无需阈值的检查点审计。两个信号负相关、标签互补，一个提供拒绝特异性，一个提供召回率，并在 273 个检查点的注册表上完成验证。 Runtime guards cannot tell whether an open-weight checkpoint has had its refusal mechanism stripped, because they score generations rather than the artifact itself. This work combines two cheap internal signals, a reference-anchored activation refusal-gap and the weight-recovery energy of the base-to-candidate weight difference, into a threshold-free checkpoint audit. The two signals are negatively correlated and label-complementary, with the gap supplying refusal-specificity and the weight energy supplying recall, validated on a 273-checkpoint registry.