Somewhere in a research annex, sometime before February 2026, a group of veterans from the US Army and special forces sat down to do something nobody had done before: build a formal benchmark to measure how often commercial AI models refuse to answer legitimate military questions.
The number they landed on was 98.2%. That's the hard-rejection rate they measured on at least one of the 31 public models they tested, when asked queries a working defense analyst or field operator would consider ordinary — questions about weapons, adversary capabilities, or violence-adjacent scenarios that any safety-trained chatbot is built to wave off by default. The paper, "Measuring and Eliminating Refusals in Military Large Language Models," went up on arXiv in February 2026, and as far as any mainstream outlet has reported, nobody outside a narrow slice of AI and defense researchers has written about it since.
That's a strange gap. Not because the finding is shocking on its face — of course a consumer-safety-tuned chatbot refuses to discuss weapons — but because of what the paper does next.
The demand was already there
None of this happened in a vacuum. By the time the refusal benchmark was published, the Pentagon had spent more than a year building the exact environment where this problem would matter. Scale AI had launched "Defense Llama" back in November 2024 — a version of Meta's Llama 3 explicitly fine-tuned for national security use, built to help service members plan operations and assess adversary vulnerabilities. Through 2026, the Department of War signed deals with OpenAI, Google, Microsoft, Amazon, Nvidia, and xAI to deploy their models across classified networks "for lawful operational use," and a separate $10 million contract with a firm called Ask Sage was awarded to wire LLMs into every US Combatant Command and the Joint Staff.
In other words: the demand side of this story isn't hypothetical. Militaries are already buying and deploying general-purpose AI models at scale, on the assumption that those models can be made to answer questions a consumer chatbot is trained to dodge. The refusal benchmark is the first attempt to actually measure whether that assumption holds — and the honest answer, per the paper's own numbers, was: not even close.
The fix has a name, and it's already everywhere
The paper's proposed solution is a technique called abliteration, and understanding it requires a small technical detour that's worth taking, because most explanations of "AI safety guardrails" gloss over what those guardrails physically are.
When a model is trained not to answer certain prompts, that refusal behavior isn't a separate filter bolted on top — it lives inside the model's own weights, as an identifiable internal "direction" the model activates when it decides to say no. Abliteration finds that direction and surgically deletes it, without retraining the model from scratch. The name comes from "ablation" (cutting away) plus a nod to the result: an "obliterated" refusal.
This isn't some Pentagon-only innovation. Abliteration has existed as a research technique in the open-source AI community for a couple of years, and in March 2025 a developer named Philipp Emanuel Weidmann open-sourced a tool called Heretic that fully automates it — no understanding of transformer internals required, just point it at a model and let an optimizer find the cleanest cut. The tool caught on fast. Hugging Face, which hosts open-weight models for anyone to download, went from roughly 600 abliterated models listed in 2024 to several thousand by mid-2026 (estimates in reporting range from about 4,000 to 6,000, depending on when the count was taken). Heretic itself has picked up tens of thousands of GitHub stars.
The military refusal-benchmark paper used exactly this tool. Its authors ran Heretic on a military-tuned version of an open model (gpt-oss-20b) and measured the result: a 66.5-percentage-point jump in the model's willingness to actually answer military queries, at what they describe as roughly a 2% relative accuracy cost on other tasks. Their conclusion isn't "proceed with caution." It's a recommendation to go further — deeper mid-training and post-training specialization, aimed explicitly at zero refusals for closed military models.
The same tool, a different set of hands
Whatever you think about a soldier being refused an answer mid-mission, the story doesn't stay contained to that use case, because Heretic and abliteration aren't military technology. They're published, general-purpose, and downloadable by anyone.
In late May 2026, NPR reported on the safety side of the same phenomenon the military paper was trying to solve. Researchers had flagged real-world misuse of abliterated open-weight models circulating outside any defense context. One case cited by the Counter Extremism Project involved a user in a pro-ISIS chat room who claimed to have used an "uncensored" AI model to research the type and quantity of explosives needed to attack Trump Tower. It's worth being precise about what that claim is and isn't: it's a self-report inside a chat room, surfaced by a watchdog group, not a verified prosecution or an independently confirmed capability demonstration. But it's the sharpest documented real-world harm claim connected to this technique, and it lands on the same month that Google — a company with every incentive to downplay the problem — publicly acknowledged abliteration as "a known technical challenge facing all open models." Translation, from one of the largest model builders on earth: once the weights are out, there is no reliable technical fix.
That's the part of the story that separates this from a routine "the military is loosening AI rules" piece. The same capability being pitched as a battlefield necessity in one paper is, in a different set of hands and the same calendar year, already showing up in the safety community's incident reports.
The "surgical" framing didn't survive contact with a second study
The word abliteration was chosen deliberately — it's meant to sound precise, clinical, like removing a tumor and leaving the healthy tissue untouched. Remove the refusal, change nothing else. That's the pitch, and it's the assumption underneath every argument that military-context abliteration can be scoped narrowly and safely.
In July 2026, a separate paper put that assumption to a direct test, and not in the domain anyone would expect. Rather than testing abliteration on more refusal prompts, "Abliteration Is Not a Scalpel" ran abliterated and unmodified versions of two model families through 21,600 replayed financial decisions — weekly up-or-down calls on 60 Warsaw Stock Exchange stocks over 18 weeks, a task that never triggers a refusal in the first place. If abliteration really were surgical, there should have been no measurable difference. There was one: abliterated models consistently shifted toward more optimistic calls, expressed less hedging language, and re-tuned their stated confidence in directions the researchers couldn't predict in advance without testing for it directly.
Put plainly, deleting a model's ability to say "I won't answer that" doesn't just delete that one behavior. It changes something more diffuse about how the model weighs risk and expresses certainty, in tasks that have nothing to do with the original refusal at all. For a chatbot that helps you research a stock, that's an inconvenience. For a system feeding assessments into a military decision-making pipeline — the exact use case the original benchmark paper is optimizing for — an unpredictable, silent shift in risk appetite is close to the worst possible side effect to discover after deployment rather than before.
Where it actually stands
As of this writing, nobody has reconciled these two findings, and it isn't clear anyone is trying to. The military refusal-benchmark paper's own recommendation is to go further, not to pause: deeper post-training aimed at zero refusals. The off-target-effects paper doesn't argue against military use of AI at all — it argues that the specific technique being used to get there doesn't behave the way its name promises. Google's public position amounts to a shrug: this is a known problem with no known fix once a model's weights are out in the world. And no defense-policy body appears to have addressed abliteration specifically, as distinct from the broader and much more publicly discussed question of "should the military use AI at all."
Two things can be true at once here, and the sourcing genuinely supports both: military users have a real, measured, well-documented problem with over-cautious refusal rates that costs them usable answers in situations where seconds matter — and the tool being reached for to fix that problem has already been shown, by an independent and unrelated study, to change more than it advertises. Which side of that trade-off should win isn't a question the evidence in front of us answers. It's a question someone with the authority to write military AI procurement standards is going to have to answer soon, on a technique that a lot of people outside that room have never heard of, using a benchmark that a lot of people inside that room built themselves.