mlsanityData to 14 Oct 2026

Over-Refusal and Representation Subspaces: A Mechanistic Analysis of Task-Conditioned Refusal in Aligned LLMs

arXiv 2603.27518 ↗First posted 29 Mar 2026cs.CLcited by 2

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Aligned language models that are trained to refuse harmful requests also exhibit over-refusal: they decline safe instructions that seemingly resemble harmful instructions. A natural approach is to ablate the global refusal direction, steering the hidden-state vectors away or towards the harmful-refusal examples, but this corrects over-refusal only incidentally while disrupting the broader refusal mechanism. In this work, we analyse the representational geometry of both refusal types to understand why this happens. We show that harmful-refusal directions are task-agnostic and can be captured by a single global vector, whereas over-refusal directions are task-dependent: they reside within the benign task-representation clusters, vary across tasks, and span a higher-dimensional subspace. Linear probing suggests that the two refusal types are representationally distinct from the early transformer layers. These findings provide a mechanistic explanation of why global direction ablation alone cannot address over-refusal, and establish that task-specific geometric interventions are necessary.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 27 of its 59 references that are in the map. First posted on arXiv 29 Mar 2026.

Builds on

27 of 59 references.

Closest ancestors · 6

Same direction, newest first

  1. 2025Refusal Falls off a Cliff: How Safety Alignment Fails in Reasoning?7 Oct
  2. 2025Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning6 Jul
  3. 2025Understanding Refusal in Language Models with Sparse Autoencoders29 May
  4. 2025FalseReject: A Resource for Improving Contextual Safety and Mitigating Over-Refusals in LLMs via Structured Reasoning12 May
  5. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence24 Feb
  6. 2024POROver: Improving Safety and Reducing Overrefusal in Large Language Models with Overgeneration and Preference Optimization16 Oct

Other references · 21

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2022Locating and Editing Factual Associations in GPTcited by 2,691
  3. 2022Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 smallcited by 1,165
  4. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,085
  5. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  6. 2023Towards Automated Circuit Discovery for Mechanistic Interpretabilitycited by 724
  7. 2023The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasetscited by 712
  8. 2024Not All Language Model Features Are One-Dimensionally Linearcited by 212
  9. 2023Attribution Patching Outperforms Automated Circuit Discoverycited by 209
  10. 2024Improving Instruction-Following in Language Models through Activation Steeringcited by 160
  11. 2025LLMs Encode Harmfulness and Refusal Separatelycited by 88
  12. 2024Adaptive Activation Steering: A Tuning-Free LLM Truthfulness Improvement Method for Diverse Hallucinations Categoriescited by 77
9 more
  1. 2024On the Role of Attention Heads in Large Language Model Safetycited by 72
  2. 2024Surgical, Cheap, and Flexible: Mitigating False Refusal in Language Models via Single Vector Ablationcited by 48
  3. 2025Understanding (Un)Reliability of Steering Vectors in Language Modelscited by 47
  4. 2025Refusal Direction is Universal Across Safety-Aligned Languagescited by 38
  5. 2024Whispering Experts: Neural Interventions for Toxicity Mitigation in Language Modelscited by 32
  6. 2025SafeSwitch: Steering Unsafe LLM Behavior via Internal Activation Signalscited by 29
  7. 2025To Steer or Not to Steer? Mechanistic Error Reduction with Abstention for Language Modelscited by 29
  8. 2023Uncovering Intermediate Variables in Transformers using Circuit Probingcited by 12
  9. 2025Should LLM Safety Be More Than Refusing Harmful Instructions?cited by 7

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Beyond Shallow Alignment: How Post-Training Methods Determine Refusal Circuits And Steering Robustnesscited by 1
  2. 2026EmoRSS: Mitigating Emotion-Induced Over-Refusal in Large Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026There Is More to Refusal in Large Language Models than a Single Direction
  2. 2026Refusal geometry reflects refusal training: diverse refusal prefixes can raise stable rank and weaken refusal vector ablation attacks
  3. 2025SafeConstellations: Mitigating Over-Refusals in LLMs Through Task-Aware Representation Steering
  4. 2026Latent-space Attacks for Refusal Evasion in Language Models
  5. 2025SOM Directions are Better than One: Multi-Directional Refusal Suppression in Language Models
  6. 2026The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs
  7. 2026Universal Refusal Circuits Across LLMs: Cross-Model Transfer via Trajectory Replay and Concept-Basis Reconstruction
  8. 2025Beyond I'm Sorry, I Can't: Dissecting Large Language Model Refusal