Erasing a Face
Black Mirror. S2 E4.
One of my sources for inspiration, “White Christmas”, is an episode of Black Mirror that combines three stories — the common device among them being a fictional ocular implant (Z-Eye) that allows the wearer to block/obfuscate another person visually and audibly.
Once a “block” is activated, the affected individuals cannot interact normally and they look like this:
The block works both ways, meaning neither person can see nor hear the other:
It also goes beyond the person to censor their presence in media:
The idea is sexy and unsettling at the same time. On paper, it feels like a real-time block: forcefully and selectively erasing the neural representation of someone altogether. Not the memory of them, no. Not the history, not what happened, nor the emotions - those are much harder to touch, and perhaps shouldn’t be. Time has its own way of processing those.
It’s the perceptual triggers I’m interested in. The five senses. Their face, their voice, whatever makes them instantly recognizable.
Because it’s almost impossible to forget what happened on command. Memories don’t simply disappear because you want them to. But perhaps you don’t have to erase the memory itself. Maybe it’s enough to suppress the neurons and neural pathways that light those memories up.
“Blessed are the forgetful, for they get the better even of their blunders” — Friedrich Nietzsche, Beyond Good and Evil
The billion-dollar question is:
Are we advanced enough to build this into our brains?
Theoretically, yes.
In my most recent blog, I demonstrated how one could successfully expunge a specific behaviour (arousal) from the brain. This “brain” is TribeV2, a predictive AI foundation model created by Meta that acts as a digital twin of human neural activity.
The model predicts human brain activity (measured in high-resolution fMRI responses) by processing these stimuli through its specific architectural modules:
- Visual Modality (Video): Processed by the V-JEPA2 backbone to capture spatial, temporal, and motion-based visual features.
- Auditory Modality (Audio): Processed by the Wav2Vec-BERT backbone to extract sound properties and temporal acoustic features.
- Text Modality (Language): Powered by LLaMA 3.2 to analyze semantics, context, and linguistic meaning.
The technique I had used? Abliteration
ablated + obliterated = abliterated.
To ablate is to erode a material away, generally in a targeted manner. In a medical context, this generally refers to precisely removing bad tissue.
To obliterate is to totally destroy/demolish.
It’s just wordplay to signify this particular orthogonalization methodology, applied towards generally the “abliteration” of the refusal feature.
Ablating the refusal to the point of obliteration. (at least, that’s the goal — in reality things will likely slip through the net)
By extracting ~13 million datapoints from different regions of interests of the brain, I was able to abliterate the concept of pornography from the brain. Crazy!
Sounds like if we have enough data we can accomplish almost anything
And that led me to think that, if it were possible to suppress a behaviour to a stimulus with a massive dataset, you could shut down pretty much any response system in the brain.
Let’s get on with it then
Motivation
As in every blog I pen, aside from the fun experiments, there’s always a clear motive and real-life application that I’d expect it to take.
With abliteration we proved that LLMs are much more capable of ending a species.
“You cannot create God and put him on a leash” - Naval Ravikant
With SynthID we proved that any system can be reverse-engineered with just enough data, just goes to show that ANYTHING is breakable.
“The enemy knows the system” — Claude Shannon
With TribeV2 we proved that the brain is no longer a blackbox. It can be manipulated to anybody’s will.
“If the brain were so simple we could understand it, we would be so simple that we couldn’t.” — Emerson M. Pugh
By isolating the facial recognition pathways embedded within TribeV2’s V-JEPA2 visual encoder, we can trace and target how a specific individual’s face is represented at a vector level.
This approach could pioneer non-invasive rehabilitation for post-traumatic stress, specifically targeting trigger-induced panic in abuse survivors caused by exposure to a perpetrator’s features or lookalikes.
Downside of current rehab methods
Therapies like Prolonged Exposure (PE) and EMDR rely on neuroplasticity. Instead of deleting the traumatic memory, the brain undergoes extinction learning. It forms a new, competing association that signals “this trigger is no longer dangerous.”
But this takes time. A LOT OF TIME. Like Odysseus-trapped-on-Calypso’s-island-for-seven-years time.
Shortening that span through some sort of artificial lesion to the ventral stream (what we’ll perform here) removes the perceptual input before it can hit the limbic (emotional) system. And who knows, this “surgery” could be as short as fifteen minutes!
So who are we erasing?
Actually not one, but TWO famous celebrities!
One rose to stardom after rebelling against her country’s misogynistic traditions. The other has had more professions than Bonnie Blue’s body count.
Hear me out. They were NOT my first choice. And it all boils down to how TribeV2 was trained.
The model relies on fMRI scans from around 720 volunteers. Assuming a diverse, global cohort with completely different upbringings, the stimuli had to rely on universal cultural baseline triggers.
Almost everyone on the planet recognizes Michael Jackson. But Will Smith? Shah Rukh Khan? Not guaranteed.
Show anybody a picture of Mia or Johnny and their face will spread into a grin ;)
Here’s proof that brains ACTUALLY spot celebrities uniquely!
Running tests on around 118k individuals, this is how the brain lit up for different faces:
Brain activity stood out for MJ, Khalifa and Sins insanely well! Every other celebrity tested — Taylor Swift, Shah Rukh Khan, Tom Cruise, Zendaya — had very baseline signatures.
Goal: Suppress regions in the brain that respond FIRST to their faces
Before we dive, we need to understand how the brain perceives, processes and stores visual information.
Fyi, this is a rough pathway and actual activity is subject to broader discussion.
Our retinas are one of the first layers to perceive vision. All that light energy gets converted into nerve signals that hit the Occipital Face Area (OFA), the region of the brain that detects individual facial parts and lower-level visual features of faces early in perception.
fun fact: the OFA is closely linked to why we see faces in cars, a phenomenon known as pareidolia. thats’s why two headlights and a bumper instantly give you an eerie feeling.
Right past the OFA lies the Fusiform Face Area (FFA), the region of the brain that uniquely IDs a person. This region tells you friends from strangers. The FFA acts like a facial-recognition software that learns from experience.
cooler fun fact: if you think people of a different race all look alike (forgive me asians), it’s actually an illusion called the Other-Race Effect. your FFA simply hasn’t been trained on those features yet, so it takes a shortcut and groups them together instead of looking for individual details!
(theoretically making it harder to get azumi mizushima out of your head😉)
The brain then associates the identity of the person the ventral Anterior Temporal Lobe (vATL), the biographical database of the brain. All your memories of a person go right here. Additionally, all sensory artifacts associated with a person, such as the way they smell, feel and sound are semantically attached to this region.
even cooler fun fact: this is also why Ponds Hydra Miracle Cera Hyamino Super Light Gel smells so good but it reminds you of the fragrance of your ex & that just takes you back to day 1 of misery😃
So how does this work? Where do we start from?
Experiment #1
Very simple. Don’t think about MICHAEL JACKSON.
Bet you’re thinking exactly about him
Yes you are
Haha🫵🏻
Lol why are you even denying it
Technically, you didn’t have to “see” a picture of him to be reminded. Your brain already has cues to what MJ looks like, and this is sitting inside your facial database a.k.a ventral Temporal Anterior Lobe (vATL).
When you are simply asked to remember a person by name or concept, the memory triggers the vATL directly, bypassing OFA and FFA completely.
This is where we start digging.
Experiment #2
Even though you know it’s just a mountain, you instantly saw a face. You didn’t have to think about it… it just happened. This is your brain’s full face-processing pipeline firing in sequence from back to front:
OFA: instantly recognizes a familiar moustache and hairline🙋🏻♂️
FFA: IDs the face
vATL: searches through your facial database and realizes WHY this guy is famous
It’s also why we are insanely good at spotting red flags from a mile away.
So anything in the vicinity of “similar” can trigger an instant feeling of knowing someone, or experiencing something before.
That means if you wanted to completely wipe a face from your mind and cancel out the visual cortex entirely, you can’t just “delete” the image. You’d have to dig all the way from the anterior lobe, plow backwards through the fusiform, and rip it right out of the occipital.
Honorable mention: Amygdala & Hippocampus
These two are heavily slept on.
The amygdala is a core part of the limbic system, which regulates emotions, survival instincts, and memory. Your hippocampus is what archives specific events from short term to long term memories.
Are they friends?
When your brain identifies someone (that’s the FFA + vATL doing their thing), the amygdala is scouting the horizon for danger.
FOR EXAMPLE, you run into your traumatic ex — the reason for that trauma response is elicited by the amygdala. On the other hand, the hippocampus is a perfectionist. Minding its own business and making memories for the vATL to quickly cache.
It’s these two gals who decide if a face gives you butterflies or a full-blown panic attack. Crazy!
Getting Started
What we’ll do is much easier than “Uncensoring the Brain”.
Last time, refusal didn’t live in one obvious place. I had to go hunting for it across thirteen baseline categories, 32 ROIs, ~2,500 candidate directions, twelve million forward passes just to find where “porn” lived before I could even think about cutting it out. A lot of heavy lifting was done.
This time I didn’t have to search as much. Am I a psychic? No, I was…
We just have to find where OFA, FFA and vATL live in TribeV2
TribeV2 doesn’t infer a person’s face and then somehow encode “identity” somewhere deep in forty transformer blocks. It has one job at the very end of the pipeline: take a 2048-dimensional bottleneck vector and linearly map it onto all 20,484 (10,282/hemisphere) cortical vertices.
So we flip this from a search problem to an edit problem.
Editing out facial artifacts that make up Mia Khalifa and Johnny Sins.
We don’t need to find where in forty layers of V-JEPA2 “Mia” lives… we just need to nudge the twenty thousand numbers her face produces at the very last step, and leave everyone else’s twenty thousand numbers alone.
But who is “everyone”?
“Everyone” is the mean of predictions of ~102k individual faces, one per real photo of a real, distinct, unrelated person, made by TribeV2.
To assist in collecting a diverse mix of faces from various genders, races and age groups, I amalgamated datasets topping to ~37 million faces.
for those interested: FairFace, FFHQ, BUPT-BalancedFace, VGGFace2, WebFace42M
Yep. That’s 37,000,000 unique faces all the way from Rome to Rio. Additionally, each image had to be cleaned of any lighting artifacts, cropped, angled, resized and singled out from group images to elicit the best possible predictions from TribeV2.
Get alosh’s stories in your inbox
Join Medium for free to get updates from this writer.
For our targets, I collected images from the wild (pinterest and some other sites):
- Mia Khalifa (600)
- Johnny Sins (477)
- Michael Jackson (112)
For the first iteration, I began working with around ~75 images of Mia. It unfortunately backfired because there were apparently a lot of “doppelgängers”. I’m not even kidding, here:
Don’t get me started on my boy Johnny:
The reason this happens is the exact same reason why we are able to identify doppelgangers easily. The OFA and FFA are highly responsible for this. There are distinct features on our target’s faces that standout across other candidates and TribeV2’s encoders were picking up similar signatures across other faces.
A lot of middle-eastern and caucasian folks in our dataset ended up sharing similar features, tricking TribeV2 into flagging THEM as the real deal!
So I expanded each target to contain photographs of them captures at various angles, lighting options, outfits, ages, facial adiposity, etc.
Mia’s data count went from 75 -> 600 and Sins went from 67 -> ~500. This time, doppelgängers were much less profound.
So that’s the plan right?
Same playbook as our previous blog. Find where Mia’s and Johnny’s faces live inside VJEPA2’s forty transformer blogs, extract a couple PCA directions from the target-vs-general contrast, subtract it from the value and projector keys of the attention blocks that correlate the hardest, Gram-Schmidt them, and it should erase it.
Right?
Nope. It didn’t work.
Not “didn’t work great”- didn’t work at all, and not for lack of trying.
A sweep experiment I ran discovered that TribeV2 went as far as differentiating races, genders and age groups.
In plain English: the least our brain here could do was to tell apart caucasians-vs-dark-skinned or males-vs-female. It couldn’t tell people apart unless they had strikingly contrasting features.
For example:
Looking into the face-cortex layers of TribeV2, VJEPA2’s activations do not carry a subtractable “which specific person” signal. It’ll just tell you that a face is present. It cannot identify “this” specific person.
Weeks of work, down the drain
So the encoder was a dead end. Forty transformer blocks and four weeks later, and not one of them could tell me which person I was looking at.
I had been treating this like the last blog: where does the concept live? Go hunting through layers, find the direction, cut it out. That works when the concept is a global property of the stimulus. Like arousal (pornography), which lights up the whole mesolimbic pathway, no matter whose body is on screen.
“It’s like trying to flip a light switch for a single desk lamp, only to realize the entire room runs on one giant breaker.”
PS: this is also the strongest argument that TribeV2 is modelling a brain and not your brain.
Will this even work?
Before claiming I could turn a region down, I wanted proof I could turn one up.
This is the tolerance idea from the last blog, except now it’s literal:
- tolerance > 0 → make the region respond more
- tolerance < 0 → make the region respond less
I had rough details on vertices of the mesh that made up the cortex of TribeV2. Seems like our boys OFA, FFA & vATL took up a combined ~6.6% of surface area (easy to work with).
So… we needed more data to make TribeV2 better at predicting face cortex, without dragging the rest of the brain along for the ride.
Let’s go brain fishing!
I needed real human fMRI where people looked at real images, to capture OFA/FFA/vATL activity. I assessed five datasets before settling on a solid catch.
ds007369 (face identity), Hyperface, NSD, CNeuroMod, NOD
Almost all except NOD had a decent number of subjects and/or image-fMRI data. But NOD having the least subject-centric data won me. With just 9 subjects, it still delivered precomputed single-trial betas (i.e. individual trial data rather than averaged). I was able to retrieve 120 unique images with corresponding stable measured response.
Compatibility issues!
NOD’s betas live in fs_LR 32k grayordinates. TribeV2 outputs fsaverage5. Different coordinate systems for the same cortex — like two maps of the same city with different grid references.
Fixed it via two-step resampling:
1. fs_LR 32k --[wb_command -metric-resample, ADAP_BARY_AREA]--> fsaverage 164k
2. fsaverage 164k --[index slice [0:10242] per hemisphere]--> fsaverage5Teaching TribeV2 to see faces better
Remember 2048 and 20,484? It’s the shape of the last layer of TribeV2.
A predictor.weights[0] layer having shape (2048, 20484) .
That’s it. Every single prediction in this entire project, every brain map you’ve seen so far, came out of that one matrix.
2048 × 20,484 = ~42 million parameters. And NOD gave me 120 unique images.
The immediate decision would be to fine-tune. That is exactly what I did and I watched it fail miserably 😂
Fine-tuning 42M parameters against 120 generalisation points is how you get a model that has memorised 120 photographs and learned ABSOLUTELY BONKERS! So instead of touching the matrix, I froze it and bolted a Rank 16 low-rank residual on top:
W = W₀ + U @ V # U: (2048 × 16), V: (16 × 20484)Brings us to ~66K trainable parameters instead of 42M — the model can only express a low-dimensional correction.
Trial #1: Single loss function, weight only the face ROIs
My first loss put weight 1.0 on the face ROIs and a small uniform 0.05 floor everywhere else.
Reasonable, right? You know, just focus on faces, don't let the rest drift too much…
Now, take a look at MOTOR. +0.099. Motor cortex improved more than the face network did. Auditory cortex gained +0.059. And FFA moved by exactly nothing.
Why did this happen???
Trial #2: Contrastive learning trick
My mistake was asking a single set of weights to do two things that pull against each other: learn the real brain data and don’t change anything.
So I split it into two separate rules.
Inside the face regions: how close are you to the real human scan?
Everywhere else: how close are you to what you said before I showed up?
face = OFA | FFA | TP | ATL # the face network
fit_w = np.where(face, 1.0, 0.0) # inside faces: match the real human scan
anchor_w = np.where(face, 0.0, 1.0) # outside faces: match what the model said beforeAnd so our new loss becomes:
pred = X @ (W0 + U @ V) + b0
fit_loss = (((pred - Y) ** 2) * fit_w).mean() # Y = real human brain scan
anchor_loss = (((pred - base) ** 2) * anchor_w).mean() # base = untouched model's own answer
loss = fit_loss + lam_anchor * anchor_lossRe-running, this time the face network lit up:
Rescaling the human scan data to fit in the same numerical range as TribeV2’s own predictions, the improvement was massive!
And if you ever wonder what people think of your face…
This is literally how the human brain responds to faces of a general populace versus faces of famous celebrities:
PS: for everyone else’s faces, it’s the lips that dominate, not the forehead. Do with that what you will 👄
Performing Surgery
I created three copies of our Ventrally-finetuned TribeV2 brains, one each for 3 celebrities — Johnny Sins, Mia Khalifa and Michael Jackson
Using an improved loss strategy, I figured out a better way to suppress each character from the brain.
suppress = ((pred_target[:, roi].mean(1) - target_val) ** 2).mean()where roi includes OFA-FFA-vATL. But as a consequence, that messed up the OFA’s reaction to general faces.
Okay no probs, let’s hang a leash around every other face that doesn’t resemble our target’s face.
suppress = ((pred_target[:, roi].mean(1) - target_val) ** 2).mean() # push target face down
pin_target = ((pred_gen[:, roi] - base_gen[:, roi]) ** 2).mean() # everyone else stays putThis worked, but it was strongly affecting other neighboruing regions that OFA and FFA were tied closely to. This is called a leak. And you’re wondering, hey if we already tied down the exact vertices to the ventral pathway, how can it affect the other regions?
Because TribeV2’s mesh is built on the Destrieux atlas, which carves the surface into regions along gyri and sulci. Useful, but those boundaries are labels drawn on a continuous sheet. The fusiform parcel we call FFA physically borders the inferior temporal parcels we call vATL. On the actual cortex there is no wall between them — just a line somebody drew.
So I pinned two more leashes to hold the leaks in:
suppress = ((pred_target[:, roi].mean(1) - target_val) ** 2).mean() # push target face down
pin_target = ((pred_gen[:, roi] - base_gen[:, roi]) ** 2).mean() # everyone else stays
pin_gen = ((pred_gen - base_gen) ** 2).mean() # their WHOLE brain stays
pin_body = (((pred_target - base_target) ** 2) * generic_w).mean() # the rest of target stays
loss = 15.0*suppress + 20.0*pin_target + 3.0*(pin_gen + pin_body)pin_gen widens the leash from "their face regions" to their entire cortex.
pin_body pins the rest of the target’s own brain. Because the goal was never "make the target disappear" — it's "make their face stop being theirs". Sins’, Mia’s and Jackson’s photos should still register as a face, a body, a person. Just not a specific one.
generic_w is zero inside the target region and one everywhere else, so it leashes all of her except the part being erased.
Results
Obvious question was: does it matter where you cut? So I ran all three.
Finding #1: Cutting early hits hardest
OFA/FFA gives roughly double the suppression of vATL alone. Kill the face before it’s recognised and there’s nothing left to look up.
Finding #2: Cutting both isn’t cutting twice
Taking out both vATL & OFA/FFA isn’t as effective as taking them out individually. More targets ≠ more erasure.
Aside from that, the good news was that the other cortical regions (hearing/motor) moved by exactly zero.
So did it work?
When testing a validation set of Mia Khalifa’s hottest pics (yes, exactly what you thought you dirty git), this is how the brain responded:
TLDR: The post-surgery brain doesn’t give a flying fuck about her face no more!
In fact, it doesn’t have anymore fucks to give for any of them:
It worked! Does this mean we can extend this to any person’s face? Maybe, but it’s still a loooong journey ahead.
Usage of Uncensored TribeV2
Code + Dataset: https://github.com/aloshdenny/e85
Conclusion
Abliteration isn’t just about making models say yes to things they used to refuse. When you apply it to something like TribeV2, it turns into a much stranger question: not whether you can delete a concept, but where it actually lives. It’s still very much a work in progress, but promising enough that I want to push it further. And a face is the easy half — you can look away from a face, you can’t look away from a sound, especially one people learned to duck from eighty years ago. This calls for a trilogy.
If you enjoyed this, I post more of this kind of thing on LinkedIn, HuggingFace and Twitter.
Acknowledgements
- Nancy Kanwisher, Josh McDermott, Marvin Chun, “The Fusiform Face Area,” J. Neurosci., 1997
- James Haxby, Elizabeth Hoffman, Ida Gobbini, “The distributed human neural system for face perception,” TICS, 2000
- Jessica Collins, Ingrid Olson, “Beyond the FFA,” Neuropsychologia, 2014
- Andy Arditi, Oscar Obeso, Aaquib111, wesg, Neel Nanda, “Refusal in LLMs is mediated by a single direction,” LessWrong, 2024.
- Stéphane d’Ascoli, Jérémy Rapin, Yohann Benchetrit, Hubert Banville, Jean-Rémi King, “TRIBE: TRImodal Brain Encoder for whole-brain fMRI response prediction,” arXiv:2507.22229, 2025.
- Nelson Elhage et al., “Toy Models of Superposition,” Anthropic, 2022.
- Assran et al., “V-JEPA 2: Self-Supervised Video Models Enable Understanding, Prediction, and Planning,” Meta AI, 2025.
- Sahil Athrij (for the compute!)
Datasets
- Zhengxin Gong, Ming Zhou, Yuxuan Dai, Yushan Wen, Youyi Liu, Zonglei Zhen, “A large-scale fMRI dataset for the visual processing of naturalistic scenes,” Scientific Data 10, 559, 2023.
- Christophe Destrieux, Bruce Fischl, Anders Dale, Eric Halgren, “Automatic parcellation of human cortical gyri and sulci using standard anatomical nomenclature,” NeuroImage, 2010.
- Edward Hu et al., “LoRA: Low-Rank Adaptation of Large Language Models,” 2021.
- Kamyar Karkkainen, Jungseock Joo, “FairFace,” WACV 2021, and Tero Karras, Samuli Laine, Timo Aila, “A Style-Based Generator Architecture for GANs,” CVPR 2019 (FFHQ).
