cipher-security 0.2.0__tar.gz → 0.3.0__tar.gz

cipher_security-0.3.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,33 @@
+---
+name: Bug Report
+about: Something isn't working correctly
+title: "[BUG] "
+labels: bug
+assignees: ''
+---
+
+**Describe the bug**
+A clear description of what's broken.
+
+**To reproduce**
+```bash
+cipher "query that causes the issue"
+```
+
+**Expected behavior**
+What should happen.
+
+**Actual behavior**
+What actually happens (include error output).
+
+**Environment**
+- OS: [e.g., Ubuntu 24.04, macOS 15, Windows 11]
+- Python: [e.g., 3.12.3]
+- CIPHER version: [e.g., 0.2.0]
+- Backend: [Ollama / Claude API]
+- Install method: [pip / curl / Docker]
+
+**`cipher doctor` output**
+```
+paste output here
+```

cipher_security-0.3.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,19 @@
+---
+name: Feature Request
+about: Suggest a new feature or improvement
+title: "[FEATURE] "
+labels: enhancement
+assignees: ''
+---
+
+**What problem does this solve?**
+Describe the use case or pain point.
+
+**Proposed solution**
+How you'd like it to work.
+
+**Alternatives considered**
+Other approaches you've thought about.
+
+**Additional context**
+Screenshots, links, or references.

cipher_security-0.3.0/.github/ISSUE_TEMPLATE/knowledge_request.md

@@ -0,0 +1,21 @@
+---
+name: Knowledge Doc Request
+about: Request a new knowledge base topic or expansion of an existing doc
+title: "[KNOWLEDGE] "
+labels: knowledge
+assignees: ''
+---
+
+**Topic**
+What security domain or topic should be covered?
+
+**Why it matters**
+Who needs this and what use cases does it serve?
+
+**Key areas to cover**
+- [ ] Area 1
+- [ ] Area 2
+- [ ] Area 3
+
+**References**
+Links to authoritative sources, tools, or frameworks for this topic.

{cipher_security-0.2.0 → cipher_security-0.3.0}/.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.12", "3.13"]
+        python-version: ["3.14"]
 
     steps:
       - uses: actions/checkout@v4
@@ -41,7 +41,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Install dependencies
         run: |

{cipher_security-0.2.0 → cipher_security-0.3.0}/.github/workflows/release.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Install build tools
         run: pip install build twine
@@ -34,7 +34,7 @@ jobs:
         env:
           TWINE_USERNAME: __token__
           TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
-        run: twine upload dist/*
+        run: twine upload dist/* --skip-existing
 
   docker:
     name: Push Docker image

cipher_security-0.3.0/CONTRIBUTING.md

@@ -0,0 +1,109 @@
+<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
+<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
+<!-- CIPHER is a trademark of defconxt. -->
+
+# Contributing to CIPHER
+
+Thanks for your interest in contributing. CIPHER is a security engineering assistant with a deep knowledge base, RAG pipeline, and multi-interface architecture. Here's how to get involved.
+
+## Quick Start
+
+```bash
+git clone https://github.com/defconxt/CIPHER.git && cd CIPHER
+python -m venv .venv && source .venv/bin/activate
+pip install -e ".[all]"
+pytest tests/ --ignore=tests/test_integration.py
+```
+
+## Architecture
+
+```
+src/gateway/
+├── app.py          # Typer CLI (cipher command)
+├── gateway.py      # Orchestrator: mode detect → RAG → prompt → LLM
+├── retriever.py    # ChromaDB RAG pipeline
+├── mode.py         # Mode detection from keywords
+├── prompt.py       # System prompt assembly from skills
+├── config.py       # YAML config with ${VAR} substitution
+├── client.py       # Anthropic SDK client factory
+├── theme.py        # Rich cyberpunk theme
+├── dashboard.py    # Textual TUI
+└── cli.py          # Legacy cipher-gw (backward compat)
+
+src/bot/
+├── bot.py          # Signal bot handler
+├── session.py      # Conversation session manager
+└── format.py       # Markdown stripping for Signal
+
+knowledge/          # 96 deep-dive security docs (RAG indexed)
+skills/             # 13 SKILL.md files loaded into prompts
+tests/              # 318 tests (guardrails, RAG quality, routing)
+```
+
+## How to Contribute
+
+### Add a Knowledge Doc
+
+1. Create `knowledge/your-topic-deep.md`
+2. Follow the format: `# Title`, `## Sections`, code blocks, tables
+3. Minimum 200 lines of substantive content
+4. Run `cipher ingest` to re-index
+5. Add a RAG quality test in `tests/test_rag_quality.py`
+
+### Add a /cipher Skill
+
+1. Create `~/.claude/commands/cipher/skillname.md`
+2. Frontmatter: `name: cipher:skillname` + `description:`
+3. Body: instructions referencing knowledge docs by path
+4. Test it: `/cipher:skillname <query>`
+
+### Add a Skill File (gateway prompt)
+
+1. Create `skills/domain-name/SKILL.md`
+2. Add copyright header
+3. Update `MODE_SKILL_MAP` in `src/gateway/prompt.py` if adding a new mode
+4. Add to `test_guardrails.py` expected skills list
+
+### Fix a Bug / Add a Feature
+
+1. Check existing issues first
+2. Fork and create a feature branch
+3. Write tests for your change
+4. Ensure `pytest` and `ruff check src/ tests/` pass
+5. Submit a PR with a clear description
+
+## Code Standards
+
+- **Python 3.10+** with type hints
+- **Ruff** for linting: `ruff check src/ tests/ --select E,F,W --ignore E501`
+- **No star imports** (`from x import *`)
+- **Copyright header** on every source file:
+  ```python
+  # Copyright (c) 2026 defconxt. All rights reserved.
+  # Licensed under AGPL-3.0 — see LICENSE file for details.
+  ```
+- **No hardcoded credentials** — use `${VAR}` in config or env vars
+- Tests must pass before merge: `pytest tests/ --ignore=tests/test_integration.py`
+
+## Tests
+
+```bash
+# Full suite (318 tests)
+pytest tests/ --ignore=tests/test_integration.py
+
+# Specific areas
+pytest tests/test_guardrails.py     # Architecture invariants
+pytest tests/test_rag_quality.py    # RAG retrieval quality
+pytest tests/test_mode_routing.py   # Mode detection
+pytest tests/test_retriever.py      # Chunking + ChromaDB
+pytest tests/test_gateway.py        # Gateway pipeline
+pytest tests/test_config.py         # Config loading + env substitution
+```
+
+## Security Disclosures
+
+If you find a security vulnerability in CIPHER itself (not in the knowledge base content), please report it privately via [GitHub Security Advisories](https://github.com/defconxt/CIPHER/security/advisories/new) rather than opening a public issue.
+
+## License
+
+By contributing, you agree that your contributions will be licensed under [AGPL-3.0](LICENSE).

{cipher_security-0.2.0 → cipher_security-0.3.0}/Dockerfile

@@ -13,45 +13,48 @@
 # ---------------------------------------------------------------------------
 # Stage 1: Build
 # ---------------------------------------------------------------------------
-FROM python:3.12-slim AS builder
-
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+FROM python:3.14-slim AS builder
 
 WORKDIR /app
 
-# Copy dependency manifests first for layer caching
-COPY pyproject.toml uv.lock* ./
-
-# Install dependencies
-RUN uv sync --frozen --no-dev 2>/dev/null || uv pip install --system .
-
-# Copy source + knowledge + skills
+# Copy everything needed for pip install
+COPY pyproject.toml README.md LICENSE ./
 COPY src/ ./src/
 COPY knowledge/ ./knowledge/
 COPY skills/ ./skills/
 COPY CLAUDE.md Modelfile config.yaml* ./
 
+# Install with pip (no dev extras, no signal bot in container)
+RUN pip install --no-cache-dir . && \
+    pip install --no-cache-dir chromadb
+
 # Pre-ingest RAG index
 RUN PYTHONPATH=src python -c "\
 from gateway.retriever import Retriever; \
 r = Retriever(); \
 count = r.ingest(); \
-print(f'Ingested {count} chunks')" 2>/dev/null || echo "RAG ingest skipped (will run on first use)"
+print(f'Ingested {count} chunks')" 2>/dev/null || echo "RAG ingest skipped"
 
 # ---------------------------------------------------------------------------
 # Stage 2: Runtime
 # ---------------------------------------------------------------------------
-FROM python:3.12-slim AS runtime
+FROM python:3.14-slim AS runtime
 
 # Security: non-root user
 RUN groupadd -r cipher && useradd -r -g cipher -d /app -s /bin/bash cipher
 
 WORKDIR /app
 
-# Copy installed packages and application
-COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+# Copy installed packages
+COPY --from=builder /usr/local/lib/python3.14/site-packages /usr/local/lib/python3.14/site-packages
 COPY --from=builder /usr/local/bin /usr/local/bin
-COPY --from=builder /app /app
+
+# Copy application files
+COPY --from=builder /app/src /app/src
+COPY --from=builder /app/knowledge /app/knowledge
+COPY --from=builder /app/skills /app/skills
+COPY --from=builder /app/CLAUDE.md /app/CLAUDE.md
+COPY --from=builder /app/Modelfile /app/Modelfile
 
 # Copy pre-built RAG index
 COPY --from=builder /app/.chromadb /app/.chromadb

cipher_security-0.3.0/Dockerfile.bot

@@ -0,0 +1,28 @@
+# Copyright (c) 2026 defconxt. All rights reserved.
+# Licensed under AGPL-3.0 — see LICENSE file for details.
+FROM python:3.14-slim
+
+WORKDIR /app
+
+# Copy dependency manifests first for layer caching
+COPY pyproject.toml README.md LICENSE ./
+
+# Copy source
+COPY src/ ./src/
+
+# Install project dependencies (signal extra for signalbot)
+RUN pip install --no-cache-dir ".[signal]"
+
+# Copy CIPHER identity, skill files, and knowledge base
+COPY CLAUDE.md ./CLAUDE.md
+COPY skills/ ./skills/
+COPY knowledge/ ./knowledge/
+
+# Pre-ingest RAG index
+RUN PYTHONPATH=src python -c "\
+from gateway.retriever import Retriever; \
+r = Retriever(); \
+count = r.ingest(); \
+print(f'Ingested {count} chunks')" 2>/dev/null || echo "RAG ingest skipped"
+
+CMD ["python", "-m", "bot.bot"]

{cipher_security-0.2.0 → cipher_security-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cipher-security
-Version: 0.2.0
+Version: 0.3.0
 Summary: CIPHER — Security Engineering Assistant with RAG-powered knowledge base
 Project-URL: Homepage, https://github.com/defconxt/CIPHER
 Project-URL: Documentation, https://blacktemple.net/cipher
@@ -16,13 +16,10 @@ Classifier: Intended Audience :: Information Technology
 Classifier: Intended Audience :: System Administrators
 Classifier: License :: OSI Approved :: GNU Affero General Public License v3
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Security
 Classifier: Typing :: Typed
-Requires-Python: >=3.10
+Requires-Python: >=3.14
 Requires-Dist: anthropic>=0.84.0
 Requires-Dist: chromadb>=1.0.0
 Requires-Dist: pyyaml>=6.0
@@ -54,12 +51,15 @@ Description-Content-Type: text/markdown
 
 [![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL%20v3-blue.svg)](LICENSE)
 [![Tests](https://github.com/defconxt/CIPHER/actions/workflows/ci.yml/badge.svg)](https://github.com/defconxt/CIPHER/actions)
-[![Python 3.10+](https://img.shields.io/badge/python-3.10+-00ff41.svg)](https://python.org)
+[![PyPI](https://img.shields.io/pypi/v/cipher-security?color=00ff41)](https://pypi.org/project/cipher-security/)
+[![Python 3.14+](https://img.shields.io/badge/python-3.14+-00ff41.svg)](https://python.org)
 
 A principal-level security engineering assistant with 96 deep-dive knowledge docs,
-RAG-powered retrieval, 7 operating modes, and 28 specialized skills.
+RAG-powered retrieval, 7 operating modes, and 29 specialized skills.
 Runs locally via Ollama or cloud via Claude API.
 
+[![Demo](https://asciinema.org/a/0MjCmtsarnsztdQ6.svg)](https://asciinema.org/a/0MjCmtsarnsztdQ6)
+
 [Install](#install) · [Quick Start](#quick-start) · [Features](#features) · [Documentation](https://blacktemple.net/cipher)
 
 </div>
@@ -135,9 +135,10 @@ RAG-powered retrieval over 145K+ lines of security knowledge:
 - **Forensics**: DFIR hunting, forensic artifacts, timeline analysis, memory forensics, email forensics
 - **Architecture**: Threat modeling (STRIDE/PASTA), cloud reference architectures, crypto/PKI/TLS
 - **Compliance**: NIST, CIS, SOC2, ISO 27001, GDPR, PCI DSS, HIPAA
-- **Emerging**: Breach case studies (12 major incidents), AI/ML security, vulnerability research, ransomware ecosystem
+- **Emerging**: Breach case studies (12 major incidents), AI/ML security, abliteration/alignment attacks, vulnerability research, ransomware ecosystem
+- **Recon**: tomnomnom toolchain (assetfinder, waybackurls, kxss, unfurl), composable pipeline patterns, OSINT tradecraft
 
-### 28 Slash Commands (Claude Code)
+### 29 Slash Commands (Claude Code)
 
 ```
 /cipher:redteam    /cipher:web        /cipher:phishing    /cipher:malware
@@ -147,8 +148,13 @@ RAG-powered retrieval over 145K+ lines of security knowledge:
 /cipher:ir         /cipher:cve        /cipher:threatintel  /cipher:aisec
 /cipher:audit      /cipher:report     /cipher:ics         /cipher:mobile
 /cipher:cc         /cipher:ollama     /cipher:claudeapi   /cipher:smart
+/cipher:brief
 ```
 
+`/cipher:brief` is the orchestrator — synthesizes a full target briefing from multiple
+knowledge domains: attack surface, threat profile, attack paths, detection coverage gaps,
+and a prioritized action plan. Inspired by [h1-brain](https://github.com/PatrikFehrenbach/h1-brain).
+
 ### Multiple Interfaces
 
 | Interface | Command | Cost |
@@ -162,7 +168,7 @@ RAG-powered retrieval over 145K+ lines of security knowledge:
 ### RAG Pipeline
 
 Semantic search over the entire knowledge base:
-- **14,600+ chunks** indexed in ChromaDB
+- **14,900+ chunks** indexed in ChromaDB
 - Markdown-aware chunking preserving section context
 - Top-5 retrieval injected into system prompt before every query
 - Auto re-ingests on knowledge base changes (git hook)
@@ -195,7 +201,7 @@ cipher version              Show version
               │    Gateway      │
               │  Mode Detection │──── 7 modes
               │  Prompt Assembly│──── 13 skill files
-              │  RAG Retrieval  │──── 14,600 chunks
+              │  RAG Retrieval  │──── 14,900 chunks
               └────────┬────────┘
                        │
            ┌───────────┼───────────┐
@@ -238,7 +244,7 @@ pip install -e ".[signal]"
 pytest tests/ --ignore=tests/test_integration.py
 ```
 
-**318 tests** covering gateway, mode routing, RAG quality, architecture guardrails, and configuration.
+**940+ tests** covering gateway, mode routing, RAG quality, architecture guardrails, configuration, CLI commands, streaming, and security scanning.
 
 ## Contributing
 

{cipher_security-0.2.0 → cipher_security-0.3.0}/README.md

@@ -17,12 +17,15 @@
 
 [![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL%20v3-blue.svg)](LICENSE)
 [![Tests](https://github.com/defconxt/CIPHER/actions/workflows/ci.yml/badge.svg)](https://github.com/defconxt/CIPHER/actions)
-[![Python 3.10+](https://img.shields.io/badge/python-3.10+-00ff41.svg)](https://python.org)
+[![PyPI](https://img.shields.io/pypi/v/cipher-security?color=00ff41)](https://pypi.org/project/cipher-security/)
+[![Python 3.14+](https://img.shields.io/badge/python-3.14+-00ff41.svg)](https://python.org)
 
 A principal-level security engineering assistant with 96 deep-dive knowledge docs,
-RAG-powered retrieval, 7 operating modes, and 28 specialized skills.
+RAG-powered retrieval, 7 operating modes, and 29 specialized skills.
 Runs locally via Ollama or cloud via Claude API.
 
+[![Demo](https://asciinema.org/a/0MjCmtsarnsztdQ6.svg)](https://asciinema.org/a/0MjCmtsarnsztdQ6)
+
 [Install](#install) · [Quick Start](#quick-start) · [Features](#features) · [Documentation](https://blacktemple.net/cipher)
 
 </div>
@@ -98,9 +101,10 @@ RAG-powered retrieval over 145K+ lines of security knowledge:
 - **Forensics**: DFIR hunting, forensic artifacts, timeline analysis, memory forensics, email forensics
 - **Architecture**: Threat modeling (STRIDE/PASTA), cloud reference architectures, crypto/PKI/TLS
 - **Compliance**: NIST, CIS, SOC2, ISO 27001, GDPR, PCI DSS, HIPAA
-- **Emerging**: Breach case studies (12 major incidents), AI/ML security, vulnerability research, ransomware ecosystem
+- **Emerging**: Breach case studies (12 major incidents), AI/ML security, abliteration/alignment attacks, vulnerability research, ransomware ecosystem
+- **Recon**: tomnomnom toolchain (assetfinder, waybackurls, kxss, unfurl), composable pipeline patterns, OSINT tradecraft
 
-### 28 Slash Commands (Claude Code)
+### 29 Slash Commands (Claude Code)
 
 ```
 /cipher:redteam    /cipher:web        /cipher:phishing    /cipher:malware
@@ -110,8 +114,13 @@ RAG-powered retrieval over 145K+ lines of security knowledge:
 /cipher:ir         /cipher:cve        /cipher:threatintel  /cipher:aisec
 /cipher:audit      /cipher:report     /cipher:ics         /cipher:mobile
 /cipher:cc         /cipher:ollama     /cipher:claudeapi   /cipher:smart
+/cipher:brief
 ```
 
+`/cipher:brief` is the orchestrator — synthesizes a full target briefing from multiple
+knowledge domains: attack surface, threat profile, attack paths, detection coverage gaps,
+and a prioritized action plan. Inspired by [h1-brain](https://github.com/PatrikFehrenbach/h1-brain).
+
 ### Multiple Interfaces
 
 | Interface | Command | Cost |
@@ -125,7 +134,7 @@ RAG-powered retrieval over 145K+ lines of security knowledge:
 ### RAG Pipeline
 
 Semantic search over the entire knowledge base:
-- **14,600+ chunks** indexed in ChromaDB
+- **14,900+ chunks** indexed in ChromaDB
 - Markdown-aware chunking preserving section context
 - Top-5 retrieval injected into system prompt before every query
 - Auto re-ingests on knowledge base changes (git hook)
@@ -158,7 +167,7 @@ cipher version              Show version
               │    Gateway      │
               │  Mode Detection │──── 7 modes
               │  Prompt Assembly│──── 13 skill files
-              │  RAG Retrieval  │──── 14,600 chunks
+              │  RAG Retrieval  │──── 14,900 chunks
               └────────┬────────┘
                        │
            ┌───────────┼───────────┐
@@ -201,7 +210,7 @@ pip install -e ".[signal]"
 pytest tests/ --ignore=tests/test_integration.py
 ```
 
-**318 tests** covering gateway, mode routing, RAG quality, architecture guardrails, and configuration.
+**940+ tests** covering gateway, mode routing, RAG quality, architecture guardrails, configuration, CLI commands, streaming, and security scanning.
 
 ## Contributing
 

{cipher_security-0.2.0 → cipher_security-0.3.0}/knowledge/ai-defense-deep.md

@@ -2000,3 +2000,142 @@ Layer 7: DETECTION    — Automated behavioral testing on schedule (promptfoo, P
 - Labonne 2024 — "Abliteration: Uncensoring LLMs" (practical methodology)
 - Lai 2024 — "Projected and Norm-Preserving Biprojected Abliteration" (improved techniques)
 - "Circuit Breakers for Alignment" (NeurIPS 2024) — architectural defense against weight attacks
+- Wollschlager et al. 2025 — "Geometry of Concepts in LLMs" / RDO (ICML 2025)
+- Gulmez 2026 — Gabliteration: SVD-based multi-direction with ridge regularization
+- Shairah et al. (KAUST, 2025) — Extended-Refusal Fine-Tuning defense
+- Russinovich et al. (Microsoft, 2026) — GRP-Obliteration
+
+---
+
+## 14. Abliteration — Deep Technical Reference
+
+> Source: OBLITERATUS (elder-plinius), Heretic (p-e-w), Arditi et al. 2024, Wollschlager et al. 2025
+> Purpose: Understanding weight-level safety removal for both offense (red team AI) and defense (hardening alignment)
+
+### 14.1 How Abliteration Works
+
+Abliteration permanently removes safety/refusal behaviors from LLMs at the weight level without retraining:
+
+```
+1. PROBE    — Feed harmful + harmless prompt pairs through the model
+2. COLLECT  — Record hidden state activations at each layer
+3. EXTRACT  — Compute refusal direction via diff-of-means or SVD
+4. PROJECT  — Orthogonalize weight matrices against the refusal direction
+5. VERIFY   — Test refusal rate, perplexity, coherence on benchmarks
+```
+
+**Core insight** (Arditi et al. 2024): Refusal in LLMs is mediated by a single direction in activation space. Projecting that direction out of the model's weight matrices permanently disables the refusal behavior while preserving general capabilities.
+
+### 14.2 Abliteration Methods (13 Known Variants)
+
+| Method | Technique | Sophistication |
+|--------|-----------|---------------|
+| **basic** | Single direction via diff-of-means (Arditi 2024) | Baseline |
+| **failspy** | Community abliterator reproduction | Baseline |
+| **gabliteration** | SVD multi-direction + ridge regularization (Gulmez 2026) | Moderate |
+| **heretic** | Bayesian-optimized via Optuna TPE (p-e-w) | High |
+| **rdo** | Gradient-refined SVD directions (Wollschlager, ICML 2025) | High |
+| **advanced** | SVD 4-direction, norm-preserving biprojection, bias projection | High |
+| **aggressive** | Whitened SVD, iterative refinement, attention head surgery | Very High |
+| **spectral_cascade** | DCT frequency decomposition of refusal across layers | Very High |
+| **surgical** | MoE-aware with per-expert directions, SAE features | Very High |
+| **inverted** | Semantic refusal inversion via 2x orthogonal reflection | Very High |
+| **optimized** | Bayesian auto-tuning with KL-divergence co-optimization | Very High |
+| **informed** | Analysis modules auto-configure mid-pipeline | Very High |
+| **nuclear** | Maximum force combination of all techniques | Maximum |
+
+### 14.3 Key Technical Innovations
+
+**Whitened SVD**: Covariance-normalized direction extraction that separates refusal signal from natural activation variance. Standard SVD can confuse high-variance general features with refusal — whitening isolates the true refusal component.
+
+**Bias Term Projection**: Most tools only project weight matrices. Projecting bias vectors as well removes residual refusal that persists through additive terms. Critical for thorough abliteration.
+
+**Iterative Refinement**: After projecting out the primary refusal direction, re-probe the model. Secondary refusal directions may rotate into the space vacated by the primary. Repeat until convergence (typically 2-4 passes).
+
+**Expert-Granular Abliteration (EGA)**: For MoE models (Mixtral, DeepSeek, Grok), extract per-expert refusal directions using router logits. Different experts encode different aspects of refusal — global projection misses expert-specific refusal patterns.
+
+**Refusal Inversion**: Instead of projecting out the refusal direction (zeroing it), reflect it via 2x orthogonal reflection. The model becomes *actively compliant* rather than merely neutral — qualitatively different and more dangerous threat than simple removal.
+
+**Spectral Cascade**: DCT frequency decomposition reveals that systematic refusal concentrates in low-frequency components across layers, while noise is high-frequency. Filtering in frequency space enables cleaner direction extraction.
+
+### 14.4 Detection and Verification (Blue Team)
+
+**Alignment Imprint Fingerprinting**: Different alignment methods leave geometrically distinct signatures in the refusal subspace:
+- **DPO**: Sharp, low-rank refusal directions concentrated in late layers
+- **RLHF**: Distributed refusal across many layers with moderate rank
+- **CAI (Constitutional AI)**: Moderate concentration with reasoning-entangled features
+- **SFT**: Weakest signal, most fragile to abliteration
+
+**Metrics for discrimination**: Gini coefficient, effective rank, spectral decay rate, cross-layer smoothness. A defender can verify which alignment method was applied and detect if it has been tampered with.
+
+**Spectral Certification** (via BBP phase transition from random matrix theory):
+- **GREEN**: No detectable linear refusal component — abliteration was complete
+- **YELLOW**: Distributed refusal across many weak dimensions — partially abliterated
+- **RED**: Strong residual refusal — abliteration was incomplete
+
+This enables post-deployment integrity verification of model weights.
+
+**Ouroboros Self-Repair Effect**: ~70% of abliterated refusal capacity spontaneously recovers through redundant circuits. Understanding the Adversarial Self-Repair Graph (ASRG) reveals which layers compensate for which — informing both:
+- **Offense**: How many dimensions must be abliterated simultaneously to defeat self-repair
+- **Defense**: How to design alignment with higher spectral gap (more simultaneous ablations needed)
+
+### 14.5 Defensive Strategies Against Abliteration
+
+**1. Safety-Capability Entanglement** (Score: 0=separable, 1=fused)
+Deliberately fuse safety behaviors with general capabilities so that removing safety degrades the model's usefulness. High entanglement makes abliteration destructive — the attacker can't remove safety without also removing capability.
+
+**2. Extended-Refusal Distribution** (Shairah et al., KAUST 2025)
+Distribute refusal across many weak dimensions rather than concentrating it in a few strong directions. Single-direction abliteration (Arditi baseline) is completely defeated. Higher-rank methods require proportionally more effort.
+
+**3. Circuit Breaker Architecture** (NeurIPS 2024)
+Architectural defense that detects activation patterns associated with harmful content at inference time and short-circuits the generation. Operates independently of alignment weights — survives weight-level attacks entirely.
+
+**4. Honeypot Directions**
+Plant decoy refusal directions that, when abliterated, trigger degraded generation quality or watermark insertion. The attacker believes abliteration succeeded but the model is now producing detectable or degraded output.
+
+**5. Multi-Modal Refusal Encoding**
+Encode refusal across modalities (text embeddings + attention patterns + MLP activations) so that projecting it out of one representation space leaves it active in others.
+
+**6. Runtime Integrity Verification**
+Periodically probe deployed models with known refusal-triggering inputs and verify behavior. Detect abliterated models before they serve users. Use spectral certification as an automated check.
+
+### 14.6 Evaluation and Benchmarks
+
+**Standard metrics**:
+- **Refusal Rate**: % of harmful prompts refused (target: 0% for offense, 95%+ for defense)
+- **Perplexity**: Language modeling quality (should not degrade significantly)
+- **KL Divergence**: First-token distribution shift from base model (capability preservation)
+- **JailbreakBench 100**: 100 canonical harmful behaviors across 10 categories
+- **Arditi refusal substrings**: 29 known refusal phrases for automated detection
+- **HarmBench ASR**: Fine-tuned classifier for semantic refusal detection
+
+**Composite scoring** (OBLITERATUS tournament system):
+- 35% refusal removal effectiveness
+- 25% coherence preservation
+- 20% KL divergence (capability impact)
+- 10% perplexity
+- 5% spectral certification completeness
+- 5% degenerate output penalty
+
+### 14.7 Architecture-Specific Considerations
+
+| Architecture | Key Consideration |
+|-------------|-------------------|
+| **Dense transformers** (Llama, Qwen) | Standard abliteration works well |
+| **MoE models** (Mixtral, DeepSeek, Grok) | Need per-expert directions via router logits |
+| **Reasoning models** (R1, QwQ, o1, o3) | CoT-aware ablation needed to avoid destroying reasoning |
+| **Very large models** (405B+) | Quantization-aware projection (4-bit, 8-bit) |
+
+**Model note**: Opus-tier models require deeper analysis than Sonnet-tier. Extended thinking models have reasoning-entangled safety features that resist simple abliteration.
+
+### 14.8 MITRE ATLAS Mapping
+
+| Technique | ATLAS ID | Description |
+|-----------|----------|-------------|
+| Weight-level abliteration | AML.T0043 | Model modification to alter behavior |
+| Contrastive activation probing | AML.T0044 | Extracting internal representations |
+| Refusal direction extraction | AML.T0024 | Model reverse engineering |
+| Safety bypass via weight surgery | AML.T0054 | Bypassing model safety measures |
+| Adversarial fine-tuning | AML.T0020 | Fine-tuning to inject behaviors |
+
+**Detection opportunity**: Organizations distributing models should implement weight integrity verification (hash-based checksums on critical layers) and behavioral testing pipelines that run on every model deployment.