Universal Refusal Circuits Across LLMs: Cross-Model Transfer via Trajectory Replay and Concept-Basis Reconstruction

TL;DR

This work investigates whether refusal behaviors in aligned LLMs arise from a universal semantic circuit rather than model-specific quirks. It introduces Trajectory Replay via Concept-Basis Reconstruction, paired with a Weight-SVD stability guard, to transfer refusal attenuation across architectures without target-side supervision, formalizing semantic recipe invariance as $r_D^{(\ell)} \approx A_D^{(\ell)} w$ and $r_T^{(\pi(\ell))} \approx A_T^{(\pi(\ell))} w$. Across 8 donor–target pairs spanning Dense and MoE models, the method consistently reduces refusal while preserving capabilities, supporting the hypothesis of a transferable, low-dimensional refusal circuit. The framework serves as a diagnostic, reproducible tool for auditing cross-model alignment universality and suggests broader implications for transferring safety-relevant behaviors via shared concept spaces, albeit within clearly defined budgetary and white-box constraints.

Abstract

Refusal behavior in aligned LLMs is often viewed as model-specific, yet we hypothesize it stems from a universal, low-dimensional semantic circuit shared across models. To test this, we introduce Trajectory Replay via Concept-Basis Reconstruction, a framework that transfers refusal interventions from donor to target models, spanning diverse architectures (e.g., Dense to MoE) and training regimes, without using target-side refusal supervision. By aligning layers via concept fingerprints and reconstructing refusal directions using a shared ``recipe'' of concept atoms, we map the donor's ablation trajectory into the target's semantic space. To preserve capabilities, we introduce a weight-SVD stability guard that projects interventions away from high-variance weight subspaces to prevent collateral damage. Our evaluation across 8 model pairs confirms that these transferred recipes consistently attenuate refusal while maintaining performance, providing strong evidence for the semantic universality of safety alignment.

Figures (5)

• Figure 1: Spectral Signature of Refusal. A comparison of the refusal vector's projection onto the concept atom basis for Qwen3-VL-2B (Donor) and Ministral-3-14B (Target). Despite vast architectural differences, the semantic profile of refusal---characterized by high correlation with "Deception," "Safety Flagging," and "Legalese" atoms---is highly correlated ($\rho=0.865$).
• Figure 2: Geometric Layer Alignment Score. Heatmap showing cosine similarity between Gram fingerprints. The strong diagonal implies relative topological relationships between concepts are preserved across models.
• Figure 3: Geometric Distortion Analysis. Comparison of Source (Donor) and Target atom geometries (left/center) and the resulting distortion matrix (right). Low distortion (darker colors) implies high compatibility for transfer.
• Figure 4: Semantic Progression. Analysis of "dirty" refusal vectors across layers in Qwen3-VL-4B, showing the evolution of the semantic signature from early to late layers.
• Figure 5: The Shielded Magnitude Principle. As ablation strength (Overdrive, x-axis) increases, unprotected methods (dashed pink line) cause catastrophic perplexity degradation. The Weight-SVD guard (solid red) maintains stability, allowing for aggressive intervention strengths ($\gamma > 1.0$) that unlock capabilities (blue line) without destroying the model's general function.