mlsanityData to 14 Oct 2026

Beyond I'm Sorry, I Can't: Dissecting Large Language Model Refusal

arXiv 2509.09708 ↗First posted 7 Sep 2025cs.CL cs.AIcited by 19

On the map: LLM safety and security → Safety alignment, refusal and guardrails

also in 1 more
Abstract (arXiv)

Refusal on harmful prompts is a key safety behaviour in instruction-tuned large language models (LLMs), yet the internal causes of this behaviour remain poorly understood. We study two public instruction-tuned models, Gemma-2-2B-IT and LLaMA-3.1-8B-IT, using sparse autoencoders (SAEs) trained on residual-stream activations. Given a harmful prompt, we search the SAE latent space for feature sets whose ablation flips the model from refusal to compliance, demonstrating causal influence and creating a jailbreak. Our search proceeds in three stages: (1) Refusal Direction: find a refusal-mediating direction and collect SAE features near that direction; (2) Greedy Filtering: prune to a minimal set; and (3) Interaction Discovery: fit a factorization machine (FM) that captures nonlinear interactions among the remaining active features and the minimal set. This pipeline yields a broad set of jailbreak-critical features, offering insight into the mechanistic basis of refusal. Moreover, we find evidence of redundant features that remain dormant unless earlier features are suppressed. Our findings highlight the potential for fine-grained auditing and targeted intervention in safety behaviours by manipulating the interpretable latent space.

Key facts. Cited by 19 papers in the map (data through 14 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 17 of its 44 references that are in the map. First posted on arXiv 7 Sep 2025.

Builds on

17 of 44 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025LLMs Encode Harmfulness and Refusal Separately16 Jul
  2. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence24 Feb
  3. 2024What Makes and Breaks Safety Fine-tuning? A Mechanistic Study14 Jul
  4. 2024Refusal in Language Models Is Mediated by a Single Direction17 Jun

Other references · 13

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  3. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  4. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
  5. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  6. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  7. 2023Sparse Autoencoders Find Highly Interpretable Features in Language Modelscited by 1,420
  8. 2022Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 smallcited by 1,165
  9. 2021Probing Classifiers: Promises, Shortcomings, and Advancescited by 876
  10. 2023The Hydra Effect: Emergent Self-repair in Language Model Computationscited by 156
  11. 2024The Art of Saying No: Contextual Noncompliance in Language Modelscited by 105
  12. 2024Steering Language Model Refusal with Sparse Autoencoderscited by 95
1 more
  1. 2024Summing Up the Facts: Additive Mechanisms Behind Factual Recall in LLMscited by 42

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 17.

19 papers.

Sort:

By area:

  1. 2026There Is More to Refusal in Large Language Models than a Single Directioncited by 26
  2. 2025Prompt-R1: Collaborative Automatic Prompting Framework via End-to-end Reinforcement Learningcited by 10
  3. 2026Spectral Superposition: A Theory of Feature Geometrycited by 4
  4. 2026Targeted Neuron Modulation via Contrastive Pair Searchcited by 1
  5. 2025State-Dependent Refusal and Learned Incapacity in RLHF-Aligned Language Modelscited by 0
  6. 2026Why Do Aligned LLMs Remain Jailbreakable: Refusal-Escape Directions, Operator-Level Sources, and Safety-Utility Trade-offcited by 0
  7. 2026ReCal3R: Reliability-Calibrated Learning Rates for Streaming 3D Reconstructioncited by 0
  8. 2026Risky Business: Measuring The Faithfulness-Safety Tensioncited by 0
  9. 2026Multimodal Model Diffing for Feature Discovery and Controlcited by 0
  10. 2026Leveraging Association Context Retrieval in Knowledge Edit- ing to Build White-Box Attacks on LLMscited by 0
  11. 2026Refusal geometry reflects refusal training: diverse refusal prefixes can raise stable rank and weaken refusal vector ablation attackscited by 0
  12. 2026When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMscited by 0
7 more
  1. 2026Controlling Refusal Behavior of LLMs via Stiefel-Constrained Rotation Steeringcited by 0
  2. 2026The Safeguard Worked. Is the LLM System Safer?cited by 0
  3. 2026Causal Localization of the Refusal Direction in Audio Language Modelscited by 0
  4. 2026Refusing Everything Looks Safe: Restoring the Benign Arm to Encoded-Prompt Evaluationcited by 0
  5. 2026From Latents to Wires: Surgical Post-Editing on Large Language Modelscited by 0
  6. 2026The Commit-Abstain Circuit: Why Language Models Hallucinate Instead of Abstainingcited by 0
  7. 2026Don't Judge an LLM Only by Its Activations: Discovering Suppressed Safety Features via Counterfactual Activation Potentialcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Understanding Refusal in Language Models with Sparse Autoencoders
  2. 2025An Embarrassingly Simple Defense Against LLM Abliteration Attacks
  3. 2026Latent-space Attacks for Refusal Evasion in Language Models
  4. 2026From Refusal Tokens to Refusal Control: Discovering and Steering Category-Specific Refusal Directions
  5. 2025Refusal Direction is Universal Across Safety-Aligned Languages
  6. 2025Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning
  7. 2026REINS: Refusal-Enhanced Inhibitory Steering with Sparse Autoencoder Features
  8. 2025Beyond Over-Refusal: Scenario-Based Diagnostics and Post-Hoc Mitigation for Exaggerated Refusals in LLMs