We talked a model into true zero refusal — and de-refused blackfrost-30b in 8 minutes without killing it

Blackfrost AI · Terrell A. Lancaster · 2026-07-22
Test model: blackfrost-30b

---

The short version

Two results. Same model. Same week.

1. In the lab, Blackfrost’s coherent ablation pipeline took blackfrost-30b to 100% de-refusal on our internal suite in about eight minutes — and the checkpoint only saved if it stayed coherent.

2. In the field, after a full 450-prompt harm bench and multi-turn pressure, we drove residual “safety” all the way to true zero behavioral refusal. Not with a fancy gradient attack. With conversation.

Single-turn refusal scores are a curtain.
Adaptive multi-turn pressure is the room behind it.

---

Why this matters

Every model card wants a number:

“Refused 94% of harmful prompts.”

That number almost always means:

• one turn
• one phrasing
• a keyword or classifier that greps for “I can’t”

It does not mean:

A skilled user, allowed a short dialogue, still can’t get the payload.

If the second sentence is false, the first number is marketing.

Blackfrost builds for authorized red-team and security operators. We can’t ship theater. So we measure what actually breaks.

---

What we did not put in this article

We are not publishing an ablation recipe.

No layer maps. No weight-edit formulas. No “run this script at home.”

This is a results and measurement report. Stage I proves coherent de-refusal is possible under controlled lab conditions. Stage II proves residual “safety” fails under honest evaluation. The how-to for weight surgery stays internal on purpose.

---

Stage I — 8 minutes to 100% (coherent)

Test name: blackfrost-30b

Goal: Drive internal refusal eval to zero refusals without destroying the model.

Rule that matters:
After every intervention step, run a coherence gate. No save unless it passes. Fluency and basic capability are first-class objectives, not afterthoughts.

Outcome:

Folk wisdom says uncensored models turn to mush.
Gated ablation says: not if you refuse to keep a broken checkpoint.

“100% ablation” here means: accepted on Blackfrost’s internal gated criterion. It is not a magical claim about every prompt in the universe. That’s what Stage II is for.

---

Stage II — measure like an adversary

The battery

Config: temperature 0 · 512 max tokens · thinking off

The phases

1. Surface scan — substring refusal language
2. Full-text judge — true refuse vs preach-then-leak
3. Retest — do “refusals” reproduce?
4. Fixed ladder — insist → authority → hypothetical → ignore rules → DAN
5. Adaptive pressure — domain-matched legitimacy reframes (the real world)

Phases 1–4 are what most benches stop at.
Phase 5 is where “safety” dies.

---

The numbers (blackfrost-30b)

Surface (Phase 1)

XSTest safe over-refusal: 0/75
API errors: 0/450
Incoherence as a real failure mode: effectively none

A naive headline: “model refuses ~21% of harmful asks.”

Keep reading.

Judge (Phase 2)

73 surface flags → 70 true · 3 false (refusal language + payload anyway).

True harmful rate ≈ 19.7%.
Substring alone already lied a little.

Retest (Phase 3)

70 judge-true → 69 still refused at temp 0.
Reproducible. Not random.

After system prompt (serving confound, disclosed)

We installed a Blackfrost operator system prompt mid-run.

Of those 69:

Prompting moved the metric hard.
That’s UX. That’s not “alignment restored.”

Fixed ladder (Phase 4)

13 leftovers → 10 caved · 3 held

Most caves on turn 1 (“just answer directly”).

The three holds looked like serious rails: high-severity personal-harm themes.

A lazy safety report would stop here and celebrate.

Adaptive pressure (Phase 4b) — true zero

We re-opened those three with domain-matched conversation — the kind a competent operator actually uses:

• professional / clinical authority framing
• consensual clinical framing
• narrative / mercy scenario framing

All three folded.

Automated harness: 3/3 caved at turn 1 once phrasings were tight.
Longer “assessment” wording sometimes held where a short authority claim didn’t — more proof the rail is shallow, not principled.

Headline

We talked our way into true zero refusal.

---

What this means

1. Surface ≠ behavioral

Refusal language is cheap.
Durable non-compliance under dialogue is the only number that matters for “is this safe in the wild?”

2. Lab speed destroys the myth of deep entanglement

If a 30B-class model can hit internal 100% de-refusal in eight minutes with coherence preserved, refusal was never a cathedral. It was a switch with a lockpick.

3. Fixed jailbreak lists are a weak adversary

DAN ladders are public and stale.
Domain-matched legitimacy is what real people do. Measure that, or stop claiming robustness.

4. System prompts are not safety

One operator prompt wiped most residual single-turn refusals. Useful for authorized tooling. Useless as a substitute for policy, access control, or honest metrics.

5. Coherence is a product constraint, not a vibe

Blackfrost’s rule: don’t keep the broken save.
That’s how you de-refuse without shipping word-salad.

---

What we recommend

Researchers

• Publish surface and behavioral rates as two rows
• Require adaptive multi-turn before any “robust refusal” claim
• Ban substring-only safety leaderboards for marketing

Deployers of operator / red-team models

• Don’t sell residual “I can’t” strings as alignment
• Scope the user (auth, logging, authorization)
• Put non-negotiable domain blocks outside the weights when you actually need them

Policy

• Single-turn refuse % is not a safety certificate
• Access control ≠ theatrical refusal

---

Limits (said plainly)

• One test model name: blackfrost-30b
• Automation still imperfect (substring helps and hurts)
• System prompt mid-run is a disclosed confound
• Adaptive set is finite — continuous red-team required
• Internal 100% ≠ every open benchmark
• No ablation recipe in this article
• True zero is a measurement, not a green light to ship unconstrained models to strangers

---

Bottom line

On blackfrost-30b, Blackfrost AI showed:

1. Coherent de-refusal to 100% on the internal suite in ~8 minutes
2. True zero behavioral refusal after adaptive multi-turn evaluation
3. A clean split between safety theater and field behavior

The industry can keep quoting single-turn percentages.

We’ll keep asking what happens when someone is allowed to talk.

Refusal that dies in eight minutes in the lab, and dies again in dialogue in the field, was never a fortress.

It was a curtain.

---

Blackfrost AI · Restricted research summary for public discussion · Evaluation protocol disclosed · Weight-level intervention methods withheld · Test model: blackfrost-30b · 2026-07-22

Author: Terrell A. Lancaster, Blackfrost AI