mlsanityData to 7 Oct 2026

Residual Paving: Diagnosing the Routing Bottleneck in Selective Refusal Editing

arXiv 2605.20262 ↗First posted 18 May 2026cs.LG cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

We study selective refusal editing as a three-way control problem: induce non-refusal on designated edit prompts while preserving benign behavior and harmful refusals outside the edit set. We introduce Residual Paving, a routed residual editing method for frozen instruction-tuned transformers that separates route selectivity, whether to intervene, from residual-edit capacity, what edit to apply. An early-layer router predicts a scalar gate and expert mixture; when active, prompt-conditioned bottleneck residual experts apply later-layer residual updates while leaving the backbone unchanged. This decomposition supports an oracle-routing diagnostic where only the learned scalar gate is replaced with the held-out edit/keep label, leaving the residual editor and frozen backbone fixed. On the primary Gemma-3-4B-IT held-out split, learned Residual Paving reduces edit refusal from 88.6% to 4.0%, with 95.5% benign distribution preservation and 87.3% harmful distribution preservation. Same-protocol one-direction steering controls are much weaker on edit success, leaving edit refusal at 86.8% for Edit-target ActAdd and 78.9% for DIM-style refusal steering. The remaining failure is off-target harmful-keep degradation: harmful refusal remains below the frozen-base rate, 65.3% vs. 81.6%. Across six backbones, oracle routing improves the keep-side diagnostic score on every reported row, with median gain +12.9 pp, supporting the interpretation that learned route selectivity is the main observed bottleneck. Trajectory diagnostics on two backbones further suggest directed movement toward edit-target continuations rather than generic refusal suppression.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 34 of its 35 references that are in the map. First posted on arXiv 18 May 2026.

Builds on

34 of 35 references.

References · 34

  1. 2017Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layercited by 3,413
  2. 2021Switch Transformers: Scaling to Trillion Parameter Models with Simple and Efficient Sparsitycited by 3,014
  3. 2022Locating and Editing Factual Associations in GPTcited by 2,609
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  6. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  7. 2022Editing Models with Task Arithmeticcited by 1,076
  8. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
  9. 2022Mass-Editing Memory in a Transformercited by 976
  10. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  11. 2023Steering Language Models With Activation Engineeringcited by 824
  12. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
22 more
  1. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  2. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 477
  3. 2024A StrongREJECT for Empty Jailbreakscited by 352
  4. 2024SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusalcited by 224
  5. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 222
  6. 2024Programming Refusal with Conditional Activation Steeringcited by 191
  7. 2024Improving Instruction-Following in Language Models through Activation Steeringcited by 149
  8. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independencecited by 104
  9. 2024The Art of Saying No: Contextual Noncompliance in Language Modelscited by 100
  10. 2024Steering Language Model Refusal with Sparse Autoencoderscited by 89
  11. 2025LLMs Encode Harmfulness and Refusal Separatelycited by 75
  12. 2024Semantics-Adaptive Activation Intervention for LLMs via Dynamic Steering Vectorscited by 61
  13. 2025FalseReject: A Resource for Improving Contextual Safety and Mitigating Over-Refusals in LLMs via Structured Reasoningcited by 53
  14. 2025Angular Steering: Behavior Control via Rotation in Activation Spacecited by 45
  15. 2025Refusal Direction is Universal Across Safety-Aligned Languagescited by 37
  16. 2024Refusal in LLMs is an Affine Functioncited by 26
  17. 2025Steering MoE LLMs via Expert (De)Activationcited by 23
  18. 2025Activation Steering with a Feedback Controllercited by 11
  19. 2025RepIt: Steering Language Models with Concept-Specific Refusal Vectorscited by 10
  20. 2025Steering When Necessary: Flexible Steering Large Language Models with Backtrackingcited by 7
  21. 2025Refusal Steering: Fine-grained Control over LLM Refusal Behaviour for Sensitive Topicscited by 5
  22. 2026Knowing without Acting: The Disentangled Geometry of Safety Mechanisms in Large Language Modelscited by 1

Built on by

Not cited yet.