There Is More to Refusal in Large Language Models than a Single Direction

TL;DR

The paper reframes refusal in large language models as a multi-directional phenomenon, showing that 11 distinct refusal categories correspond to geometrically different directions in activation space. Despite this diversity, linear steering along any refusal-related direction yields nearly identical trade-offs between refusal and over-refusal, effectively acting as a single control knob that modulates whether the model refuses rather than how it refuses. Sparse autoencoders reveal a reusable core of refusal-related latents shared across datasets, plus a long tail that captures style- and domain-specific refusals, explaining why different directions produce similar outcomes. The work highlights a nuanced picture of internal refused behavior, with implications for interpretability and safety that linear interventions alone cannot provide robust safety guarantees for in-the-wild systems.

Abstract

Prior work argues that refusal in large language models is mediated by a single activation-space direction, enabling effective steering and ablation. We show that this account is incomplete. Across eleven categories of refusal and non-compliance, including safety, incomplete or unsupported requests, anthropomorphization, and over-refusal, we find that these refusal behaviors correspond to geometrically distinct directions in activation space. Yet despite this diversity, linear steering along any refusal-related direction produces nearly identical refusal to over-refusal trade-offs, acting as a shared one-dimensional control knob. The primary effect of different directions is not whether the model refuses, but how it refuses.

Figures (1)

• Figure 1: styles of refusals produced by steering along four distinct refusal directions.