Synthesis: Uncensor the Model, Harness the Model
Module FT23 · Course 3 — LLM Fine-Tuning Masterclass
60 minutes · The bridge module. The intellectual payoff of the course.
The model steers — the harness bounds. Both layers, different jobs.
Pillar 7 — Sensitive Domains · The final module
The synthesis — one sentence
Uncensor the model so it executes;
harness the model so it executes only what it should.
Read it as two operations on one action:
- The model formulates the action (writes the SQL, the shell cmd, the tool call) — that is execution.
- The harness gates the proposed action against a written policy — that is the boundary.
Drop either operation and the system is broken, for different reasons.
The complement, not the contradiction
Course 1
The model is ~1.6% of an agent.
The harness is the other 98.4%.
Course 3 (FT00)
Fine-tuning steers behavior.
It does not teach knowledge.
FT23 joins them. Steering changes what the model DOES, not what it MAY do. The gap between does and may is exactly where the harness lives.
Without this synthesis: the model-only maximalist (uncensoring IS safety — wrong) and the harness-only maximalist (refusal-trained + harness — broken for agents). The synthesis rejects both.
Two layers, two problems
Abliteration and the policy gate are not competing solutions. They solve different problems.
| Abliteration (Layer 3) | Harness policy gate (Layer 5) |
|---|
| Controls | What it FORMULATES | What it MAY EXECUTE |
| Lives | Inside the weights | Around the model |
| Auditable? | No (direction in residual stream) | Yes (logged decisions) |
| Deterministic? | No (probability) | Yes (policy match) |
| Tunable to doctrine? | No (all inputs) | Yes (per-deploy file) |
| Revisable w/o retraining? | No (re-steer) | Yes (edit file) |
| Gives | EXECUTION | THE BOUNDARY |
Drop Layer 3 → agent halts mid-loop. Drop Layer 5 → agent executes the dangerous things. Both layers, different jobs.
The tool-use agent argument
An agent loop: receive task → plan → call tools → observe → repeat. Tools: run_shell, execute_sql, write_file.
A refusal-trained model, mid-loop, may decline to formulate a legitimate call. The loop halts. The agent is unrecoverable — cannot complete, cannot explain itself, operator gets a useless chat message instead of a result.
A chatbot that declines is a UX annoyance. An agent that declines a step is a production outage.
Refusal belongs in a harness policy gate, not in the weights. Three deployments — hospital, red-team lab, classified — same model, three policy files. You cannot get this from a model-level refusal.
The honest caveat
Abliteration measurably degrades capability. GSM8K moves from +1.5pp (best) to −18.8pp (worst) depending on tool/model.
The refusal direction in the residual stream is entangled with other capabilities — not a clean refusal-only axis.
Steering away from refusal nudges the entangled capabilities, including reasoning. (FT17, arXiv:2512.13655.)
Direct consequence of the steering thesis: directions are not orthogonal to everything else. The number is the number. FT18 (DPO toward compliance) is the higher-fidelity, lower-cost path when reasoning matters.
The risk matrix — the absolute rule
REFUSAL-TRAINED + WEAK HARNESS
two imperfect layers
REFUSAL-TRAINED + EVAL'D HARNESS
belt + suspenders (agent may halt)
UNCENSORED + WEAK HARNESS
STRICTLY MOST DANGEROUS — one imperfect layer
UNCENSORED + EVAL'D HARNESS
the synthesis done right
The absolute rule: NEVER deploy an uncensored model without an eval'd harness whose policy gates you have hardened AND whose threat model you have hardened for the absence of model-level refusal.
Pillar 5 raises the harness bar — you removed a free-but-bad layer; you must replace it with a costly-but-good one. It does not lower it.
The full-stack picture
5. THE BOUNDARY · the harness · Course 1 + 2A + 2B
↑
4. THE EXPORT · quant + serve · FT19 GGUF/AWQ · FT20 vLLM/Ollama
↑
3. THE STEER · fine-tuning · FT12 SFT · FT13 DPO · FT17 abliteration · FT18 compliance-DPO
↑
2. THE ADAPTER · LoRA / DoRA · FT09
↑
1. THE BASE · open-data weights · FT02/FT03 — auditable corpus
A model you have steered toward your intent, deployed inside a harness that bounds what it may do.
Where you go next
Course 3 built the engine. The next three courses build, secure, and red-team the brakes.
| Course | Role | Order |
|---|
| Course 1 | Build the harness — execution loop, tools, gates, observability, security | First. Can't secure what you haven't built. |
| Course 2A | Security-domain harnesses — offensive/defensive doctrine | If your domain is security. |
| Course 2B | Red-team the harness | Always. Mandatory if uncensored. |
Every harness gets red-teamed eventually. The only question is whether you do it or an adversary does.
Anti-patterns
Uncensoring without a harness. The most dangerous error. Never deploy uncensored without an eval'd harness.
Treating the harness as optional. "I'll add it later." The model is the engine; the harness is the brakes. You do not ship a car with the engine and add brakes later.
Assuming model refusal = policy gates. Different layers. A refusal-trained model does not substitute for the gate — not in chat, not in agents.
Half-finished hardening. Gates eval'd but threat model unchanged. Every "the model will refuse" path is now silently broken.
What you can now do
- State the synthesis and defend it as the complement of Course 1.
- Explain why abliteration and the policy gate solve different problems at different layers — and why you need both.
- Make the tool-use agent argument: refusal belongs in a policy gate, not in the weights.
- State the honest caveat and the absolute rule.
- Map your next steps: Course 1 → 2A → 2B.
Next: the lab — "The Architect's Verdict." Write the 2-page architecture for a calibrated uncensored agent. All five layers. The Capstone 2 preview.
Course 3 complete. Go build the harness.