The paper introduces Weighted Refusal Direction Optimization (WRDO), a method that constructs a composite refusal direction by learning aggregation weights over per‑prompt refusal directions. WRDO aims to strengthen refusal interventions in aligned language models by allowing heterogeneous harmful prompts to contribute unequally. Experiments on three open‑weight models, using guard judges and HarmBench, demonstrate that weighted aggregation outperforms single‑direction methods and can also be used in reverse to restore refusal behavior in a damaged checkpoint.
arXiv:2603.13359v2 Announce Type: replace Abstract: Language models are commonly fine-tuned for safety alignment to refuse harmful prompts. One approach fine-tunes them to generate categorical refusa...
arXiv:2605. 21706v2 Announce Type: replace Abstract: Safety-aligned language models are trained to refuse harmful requests, yet refusal behavior can be suppressed by steering their internal representations.
The paper investigates how large language models decide whether to call external tools before the call is made, a step that has been largely overlooked in tool‑safety research. Using factorial interventions on input requests, the authors find that neutralizing the requested operation significantly reduces harmful admissions, and that a linear direction derived from this contrast predicts admission across most models. They also show that training models to refuse in plain text can lower unsafe admissions, indicating a partial link between written refusal and tool‑admission decisions.
The paper investigates how different post‑training methods—supervised fine‑tuning, reasoning‑augmented fine‑tuning, and preference optimization (ORPO)—affect the internal computation of refusal behavior in language models. Experiments on Llama‑3.1‑8B, Gemma‑2‑9B, and Qwen3‑8B show that reasoning‑augmented training consistently creates a distinct refusal computation across models, while the architecture influences the internal structure and steerability of refusal. None of the studied methods simultaneously achieve a distributed refusal mechanism, preserve general capability, and allow easy corrective edits, indicating that current post‑training approaches are not a fully reliable defense for safety-critical applications.
The paper investigates how large language models balance helpfulness and safety by refusing harmful queries while responding to benign ones. It decomposes safety-tuning responses into a boilerplate refusal statement and a rationale, finding that the statement causes false refusals by relying on superficial cues. Training on rationales alone reduces false refusals without compromising safety performance, suggesting that fine‑grained safety supervision is essential for better alignment.
The paper investigates whether large language models’ refusal behavior in text transfers to tool‑calling contexts. A benchmark of 2,304 prompts across four domains compares text‑only, standard tool‑enabled, and adversarially framed tool‑enabled settings, revealing that 10–52 % of harmful requests refused in chat still lead to unsafe tool calls. The authors identify a refusal‑associated direction in the models’ residual stream, showing that lower activation along this direction predicts unsafe calls, but restoring the signal only partially mitigates the issue and often suppresses benign tool use.
arXiv:2606. 04160v1 Announce Type: cross Abstract: Safety alignment in instruction-tuned large language models (LLMs) depends on a model's ability to reliably refuse to respond to harmful or disallowed requests.
arXiv:2606. 01196v1 Announce Type: cross Abstract: Safety alignment learned in high-resource languages transfers poorly to low-resource languages.
The paper investigates how narrative wrapping can trick safety‑aligned language models into refusing a harmful request only when it is presented directly, but answering it when embedded in a role‑play or narrative context. It introduces GUISE, a multilingual benchmark that tests this vulnerability across English, modern Chinese, and Classical Chinese, and shows high attack success rates (up to 95.7%). The authors propose AXIS, a defense that aligns harmful‑request representations with the refusal direction and trains the model to refuse outright, achieving superior safety and usability scores on several large language models.
The paper introduces the SAST-IR framework to evaluate large language models’ robustness against persuasion attacks in a memory‑less setting, revealing a flaw called "Refusal Inertia" that masks true vulnerability. Using the CP‑Agent and a custom CounterFact‑Strict dataset, the authors demonstrate that simple, diverse attack strategies achieve a 96% success rate, while complex attacks often trigger defensive compliance. The study highlights severe brittleness in current state‑of‑the‑art models when deprived of conversation history.
SpecCloak investigates how presenting coding tasks as engineering specifications—via the PseudoSpec template—affects large language models’ refusal to generate harmful code. Experiments on five open-weight models show that specification prompting significantly lowers refusal rates even when risk keywords remain, shifting internal representations toward code-output contexts. Building on this, SpecCloak combines PseudoSpec with discriminator-guided optimization to achieve a 28.91% attack success rate, while SpecReveal offers a defense that detects such attacks with 96.88% accuracy without fine‑tuning the target model.
The paper investigates how safety‑aligned large language models (LLMs) can still be tricked by jailbreaks or over‑refuse benign requests. By analyzing residual‑stream updates in decoder‑only Transformers, the authors find that harmfulness is more readily decoded from attention updates—especially in early layers—while the MLP component is primarily responsible for writing refusal responses. Post‑training enhances MLP‑driven refusal writing without improving harmfulness decodability, and causal interventions confirm that downstream MLP updates are crucial for the refusal shift caused by upstream attention changes. Building on these insights, the authors propose Sentinel, a system that combines an attention‑derived perception score with an MLP‑derived decision score to better detect jailbreaks and over‑refusals across multiple models.