mlsanityData to 7 Oct 2026

The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directions

arXiv 2502.09674 ↗First posted 13 Feb 2025cs.CL cs.AIcited by 38

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 2 more
Abstract (arXiv)

Large Language Models' safety-aligned behaviors, such as refusing harmful queries, can be represented by linear directions in activation space. Previous research modeled safety behavior with a single direction, limiting mechanistic understanding to an isolated safety feature. In this work, we discover that safety-aligned behavior is jointly controlled by multi-dimensional directions. Namely, we study the vector space of representation shifts during safety fine-tuning on Llama 3 8B for refusing jailbreaks. By studying orthogonal directions in the space, we first find that a dominant direction governs the model's refusal behavior, while multiple smaller directions represent distinct and interpretable features like hypothetical narrative and role-playing. We then measure how different directions promote or suppress the dominant direction, showing the important role of secondary directions in shaping the model's refusal representation. Finally, we demonstrate that removing certain trigger tokens in harmful queries can mitigate these directions to bypass the learned safety capability, providing new insights on understanding safety alignment vulnerability from a multi-dimensional perspective. Code and artifacts are available at https://github.com/BMPixel/safety-residual-space.

Key facts. Cited by 38 papers in the map (data through 7 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 36 of its 53 references that are in the map. First posted on arXiv 13 Feb 2025.

Builds on

36 of 53 references.

References · 36

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2024The Llama 3 Herd of Modelscited by 14,192
  4. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  5. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  7. 2023A Survey of Large Language Modelscited by 2,537
  8. 2020Shortcut Learning in Deep Neural Networkscited by 1,928
  9. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  10. 2023Inference-Time Intervention: Eliciting Truthful Answers from a Language Modelcited by 1,259
  11. 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
  12. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
24 more
  1. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  2. 2023The Linear Representation Hypothesis and the Geometry of Large Language Modelscited by 679
  3. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  4. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 520
  5. 2024A StrongREJECT for Empty Jailbreakscited by 352
  6. 2023Are aligned neural networks adversarially aligned?cited by 305
  7. 2023Low-Resource Languages Jailbreak GPT-4cited by 290
  8. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decodingcited by 233
  9. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 222
  10. 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modificationscited by 220
  11. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 197
  12. 2024A Mechanistic Understanding of Alignment Algorithms: A Case Study on DPO and Toxicitycited by 179
  13. 2024Safety Layers in Aligned Large Language Models: The Key to LLM Securitycited by 126
  14. 2024AttnLRP: Attention-Aware Layer-Wise Relevance Propagation for Transformerscited by 116
  15. 2024How Alignment and Jailbreak Work: Explain LLM Safety through Intermediate Hidden Statescited by 92
  16. 2024FlipAttack: Jailbreak LLMs via Flippingcited by 73
  17. 2024On the Role of Attention Heads in Large Language Model Safetycited by 70
  18. 2024What Makes and Breaks Safety Fine-tuning? A Mechanistic Studycited by 54
  19. 2024Multilingual Large Language Model: A Survey of Resources, Taxonomy and Frontierscited by 49
  20. 2023Latent Space Translation via Semantic Alignmentcited by 46
  21. 2024A safety realignment framework via subspace-oriented model fusion for large language modelscited by 40
  22. 2024Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Modelscited by 34
  23. 2024Mission Impossible: A Statistical Perspective on Jailbreaking LLMscited by 21
  24. 2024How Does DPO Reduce Toxicity? A Mechanistic Neuron-Level Analysiscited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 7; 2026: 31.

38 papers.

Sort:

By area:

  1. 2025Towards Reasoning Era: A Survey of Long Chain-of-Thought for Reasoning Large Language Modelscited by 381
  2. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independencecited by 104
  3. 2026Locate, Steer, and Improve: A Practical Survey of Actionable Mechanistic Interpretability in Large Language Modelscited by 22
  4. 2025SOM Directions are Better than One: Multi-Directional Refusal Suppression in Language Modelscited by 9
  5. 2026Analysing the Safety Pitfalls of Steering Vectorscited by 9
  6. 2026Causality is Key for Interpretability Claims to Generalisecited by 8
  7. 2025Safety Subspaces are Not Linearly Distinct: A Fine-Tuning Case Studycited by 6
  8. 2025Read the Scene, Not the Script: Outcome-Aware Safety for LLMscited by 6
  9. 2026Before the Last Token: Diagnosing Final-Token Safety Probe Failurescited by 3
  10. 2026AgentLens: Interpretable Safety Steering via Mechanistic Subspaces for Multi-Turn Coding Agentcited by 3
  11. 2026Fail-Closed Alignment for Large Language Modelscited by 2
  12. 2026Alignment Reduces Expressed but Not Encoded Gender Bias: A Unified Framework and Studycited by 2
26 more
  1. 2026Alignment Dynamics in LLM Fine-Tuningcited by 2
  2. 2026Low-Resource Safety Failures Are Action Failures, Not Representation Failurescited by 2
  3. 2025ReGA: Model-Based Safeguard for LLMs via Representation-Guided Abstractioncited by 1
  4. 2025NeuroBreak: Unveil Internal Jailbreak Mechanisms in Large Language Modelscited by 1
  5. 2026SPINAL -- Scaling-law and Preference Integration in Neural Alignment Layerscited by 1
  6. 2026Do Prompts Guarantee Safety? Mitigating Toxicity from LLM Generations through Subspace Interventioncited by 1
  7. 2026Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMscited by 1
  8. 2026Explaining and Breaking the Safety-Helpfulness Ceiling via Preference Dimensional Expansioncited by 1
  9. 2026Not All Refusals Are Equal: How Safety Alignment Fails Cybersecurity at Scalecited by 1
  10. 2026What Do Compliance Detectors Read? An Audit of Activation Probes and Guard Modelscited by 1
  11. 2026Attributing and Exploiting Safety Vectors through Global Optimization in Large Language Modelscited by 0
  12. 2026Simulated Adoption: Decoupling Magnitude and Direction in LLM In-Context Conflict Resolutioncited by 0
  13. 2026Why Does RLAIF Work At All?cited by 0
  14. 2026GeoLAN: Geometric Learning of Latent Explanatory Directions in Large Language Modelscited by 0
  15. 2026Toward Stable Value Alignment: Introducing Independent Modules for Consistent Value Guidancecited by 0
  16. 2026Why Do Safety Guardrails Degrade Across Languages?cited by 0
  17. 2026Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attackcited by 0
  18. 2026High-Dimensional Random Projection for Activation Steering in Language Modelscited by 0
  19. 2026HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignmentcited by 0
  20. 2026A Cross-Architecture Audit of Direction-Based Inference-Time Defences in Vision-Language Modelscited by 0
  21. 2026Safety Cost of Steering Vectors Is Separable and Reduciblecited by 0
  22. 2026Refusal geometry reflects refusal training: diverse refusal prefixes can raise stable rank and weaken refusal vector ablation attackscited by 0
  23. 2026Beyond Shallow Alignment: How Post-Training Methods Determine Refusal Circuits And Steering Robustnesscited by 0
  24. 2026Safety Monitors Mostly Catch What the Model Already Refusescited by 0
  25. 2026Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliterationcited by 0
  26. 2026Tool Mediation Alters Refusal Mechanisms in Large Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Understanding the Effects of Safety Unalignment on Large Language Models
  2. 2026When Safety Routing Breaks: Understanding Alignment Fragility under Benign Fine-Tuning
  3. 2025The Blessing and Curse of Dimensionality in Safety Alignment
  4. 2026Deactivating Refusal Triggers: Understanding and Mitigating Overrefusal in Safety Alignment
  5. 2026The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs
  6. 2026Understanding and Preserving Safety in Fine-Tuned LLMs
  7. 2025Differentiated Directional Intervention A Framework for Evading LLM Safety Alignment
  8. 2026Beyond Refusal Patterns: Safe-Role Internalization for Robust and Generalizable LLM Safety Alignment