# Refusal Behavior in Large Language Models: A Nonlinear Perspective

arXiv: https://arxiv.org/abs/2501.08145 · HTML: https://mlsanity.com/paper/2501.08145/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 31 references that are in the map.
- First posted on arXiv 14 Jan 2025.

## Builds on (most cited first, 14 of 14)

- [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://mlsanity.com/paper/2307.15043/) (2023)
- [UMAP: Uniform Manifold Approximation and Projection for Dimension Reduction](https://mlsanity.com/paper/1802.03426/) (2018)
- [Qwen2 Technical Report](https://mlsanity.com/paper/2407.10671/) (2024)
- [BLOOM: A 176B-Parameter Open-Access Multilingual Language Model](https://mlsanity.com/paper/2211.05100/) (2022)
- [Representation Engineering: A Top-Down Approach to AI Transparency](https://mlsanity.com/paper/2310.01405/) (2023)
- [Steering Llama 2 via Contrastive Activation Addition](https://mlsanity.com/paper/2312.06681/) (2023)
- [Refusal in Language Models Is Mediated by a Single Direction](https://mlsanity.com/paper/2406.11717/) (2024)
- [Toy Models of Superposition](https://mlsanity.com/paper/2209.10652/) (2022)
- [Steering Language Models With Activation Engineering](https://mlsanity.com/paper/2308.10248/) (2023)
- [Alignment faking in large language models](https://mlsanity.com/paper/2412.14093/) (2024)
- [Linear Algebraic Structure of Word Senses, with Applications to Polysemy](https://mlsanity.com/paper/1601.03764/) (2016)
- [Sparse Overcomplete Word Vector Representations](https://mlsanity.com/paper/1506.02004/) (2015)
- [What Features in Prompts Jailbreak LLMs? Investigating the Mechanisms Behind Attacks](https://mlsanity.com/paper/2411.03343/) (2024)
- [How deep is deep enough? -- Quantifying class separability in the hidden layers of deep neural networks](https://mlsanity.com/paper/1811.01753/) (2018)

## Built on by (most cited first, 13 of 13)

- [Interpretation Meets Safety: A Survey on Interpretation Methods and Tools for Improving LLM Safety](https://mlsanity.com/paper/2506.05451/) (2025)
- [The Geometry of Harmfulness in LLMs through Subconcept Probing](https://mlsanity.com/paper/2507.21141/) (2025)
- [From Directions to Cones: Exploring Multidimensional Representations of Propositional Facts in LLMs](https://mlsanity.com/paper/2505.21800/) (2025)
- [Poison Once, Refuse Forever: Weaponizing Alignment for Injecting Bias in LLMs](https://mlsanity.com/paper/2508.20333/) (2025)
- [AlignTree: Efficient Defense Against LLM Jailbreak Attacks](https://mlsanity.com/paper/2511.12217/) (2025)
- [Graph-Regularized Sparse Autoencoders for LLM Safety Steering](https://mlsanity.com/paper/2512.06655/) (2025)
- [Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activations](https://mlsanity.com/paper/2605.28553/) (2026)
- [BabelSteering: Multilingual Safety Alignment via English Steering Vectors](https://mlsanity.com/paper/2608.16577/) (2026)
- [From Rogue to Safe AI: The Role of Explicit Refusals in Aligning LLMs with International Humanitarian Law](https://mlsanity.com/paper/2506.06391/) (2025)
- [State-Dependent Refusal and Learned Incapacity in RLHF-Aligned Language Models](https://mlsanity.com/paper/2512.13762/) (2025)
- [Neuroscience-Inspired Analyses of Visual Interestingness in Multimodal Transformers](https://mlsanity.com/paper/2605.08188/) (2026)
- [Refusal Lives Downstream of Persona in Chat Models](https://mlsanity.com/paper/2606.26161/) (2026)
- [The Heterogeneous Safety Impacts of Benign Multilingual Fine-Tuning](https://mlsanity.com/paper/2606.28843/) (2026)

## Abstract (arXiv)

Refusal behavior in large language models (LLMs) enables them to decline responding to harmful, unethical, or inappropriate prompts, ensuring alignment with ethical standards. This paper investigates refusal behavior across six LLMs from three architectural families. We challenge the assumption of refusal as a linear phenomenon by employing dimensionality reduction techniques, including PCA, t-SNE, and UMAP. Our results reveal that refusal mechanisms exhibit nonlinear, multidimensional characteristics that vary by model architecture and layer. These findings highlight the need for nonlinear interpretability to improve alignment research and inform safer AI deployment strategies.