mlsanityData to 7 Oct 2026

Knowing without Acting: The Disentangled Geometry of Safety Mechanisms in Large Language Models

arXiv 2603.05773 ↗First posted 6 Mar 2026cs.CR cs.AI cs.LGcited by 1

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Safety alignment is often conceptualized as a monolithic process wherein harmfulness detection automatically triggers refusal. However, the persistence of jailbreak attacks suggests a fundamental mechanistic decoupling. We propose the textbfunderlineDisentangled textbfunderlineSafety textbfunderlineHypothesis (DSH), positing that safety computation operates on two distinct subspaces: a textitRecognition Axis (vH, ``Knowing'') and an textitExecution Axis (vR, ``Acting''). Our geometric analysis reveals a universal ``Reflex-to-Dissociation'' evolution, where these signals transition from antagonistic entanglement in early layers to structural independence in deep layers. To validate this, we introduce textitDouble-Difference Extraction and textitAdaptive Causal Steering. Using our curated textscAmbiguityBench, we demonstrate a causal double dissociation, effectively creating a state of ``Knowing without Acting.'' Crucially, we leverage this disentanglement to propose the Refusal Erasure Attack (REA), which achieves State-of-the-Art attack success rates by surgically lobotomizing the refusal mechanism. Furthermore, we uncover a critical architectural divergence, contrasting the textitExplicit Semantic Control of Llama3.1 with the textitLatent Distributed Control of Qwen2.5. The code and dataset are available at https://anonymous.4open.science/r/DSH.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 42 of its 53 references that are in the map. First posted on arXiv 6 Mar 2026.

Builds on

42 of 53 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025PII Jailbreaking in LLMs via Activation Steering Reveals Personal Information Leakage3 Jul
  2. 2024Uncovering Safety Risks of Large Language Models through Concept Activation Vector18 Apr
  3. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 38

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2024The Llama 3 Herd of Modelscited by 14,192
  3. 2024Qwen2.5 Technical Reportcited by 4,713
  4. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  5. 2017Interpretability Beyond Feature Attribution: Quantitative Testing with Concept Activation Vectors (TCAV)cited by 1,309
  6. 2016Understanding intermediate layers using linear classifier probescited by 1,279
  7. 2023Inference-Time Intervention: Eliciting Truthful Answers from a Language Modelcited by 1,259
  8. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
  9. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  10. 2023Steering Language Models With Activation Engineeringcited by 824
  11. 2023The Linear Representation Hypothesis and the Geometry of Large Language Modelscited by 679
  12. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
26 more
  1. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  2. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
  3. 2024Mechanistic Interpretability for AI Safety -- A Reviewcited by 415
  4. 2023Language Models Represent Space and Timecited by 306
  5. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 242
  6. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMscited by 185
  7. 2024A Minimaximalist Approach to Reinforcement Learning from Human Feedbackcited by 141
  8. 2024Steering Language Model Refusal with Sparse Autoencoderscited by 89
  9. 2023Aligning Large Language Models with Human Preferences through Representation Engineeringcited by 71
  10. 2024On the Role of Attention Heads in Large Language Model Safetycited by 70
  11. 2024Revisiting Jailbreaking for Large Language Models: A Representation Engineering Perspectivecited by 44
  12. 2024Steering Without Side Effects: Improving Post-Deployment Control of Language Modelscited by 44
  13. 2025FairSteer: Inference Time Debiasing for LLMs with Dynamic Activation Steeringcited by 37
  14. 2024Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Modelscited by 34
  15. 2025Personalized Text Generation with Contrastive Activation Steeringcited by 30
  16. 2025Taxonomy, Opportunities, and Challenges of Representation Engineering for Large Language Modelscited by 29
  17. 2025Representation Bending for Large Language Model Safetycited by 28
  18. 2024GPT-4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanationcited by 24
  19. 2025Mechanistic Interpretability of Emotion Inference in Large Language Modelscited by 24
  20. 2024Compact Proofs of Model Performance via Mechanistic Interpretabilitycited by 17
  21. 2024Efficient Universal Goal Hijacking with Semantics-guided Prompt Organizationcited by 13
  22. 2025Injecting Universal Jailbreak Backdoors into LLMs in Minutescited by 13
  23. 2024Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroringcited by 10
  24. 2024Federated Data-Efficient Instruction Tuning for Large Language Modelscited by 9
  25. 2024Adversarial Style Augmentation via Large Language Model for Robust Fake News Detectioncited by 5
  26. 2024SQL Injection Jailbreak: A Structural Disaster of Large Language Modelscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Residual Paving: Diagnosing the Routing Bottleneck in Selective Refusal Editingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026When Safety Routing Breaks: Understanding Alignment Fragility under Benign Fine-Tuning
  2. 2025The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directions
  3. 2026The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs
  4. 2026When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMs
  5. 2025Probing the Robustness of Large Language Models Safety to Latent Perturbations
  6. 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modifications
  7. 2026Jailbreak Context Lingers: Divergent Safety Routing and Its Cross-Task Predictability in Tool Agents
  8. 2026SafeEvo: Deciphering the Safety Alignment Mechanism and Evolution in Language Models