mlsanityData to 14 Oct 2026

HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment

arXiv 2607.00572 ↗First posted 1 Jul 2026cs.AI cs.CRcited by 0

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Understanding how aligned LLMs internally represent safety is critical for diagnosing alignment vulnerabilities, as it explains why jailbreaks succeed and informs the design of robust alignment strategies. Prior work shows that aligned LLMs encode harmfulness and refusal as separable directions in the residual stream at prompt-side token positions. We show that jailbreaks succeed at prompt encoding by suppressing either the refusal or harmfulness direction before any token is generated, with distinct attack classes occupying separable regions of the harmfulness-refusal plane. Extending the analysis to response-token positions, we find that the model recognizes harmful content while it is generating that content, even when it failed to recognize the input as harmful at the prompt side. Motivated by our findings, we introduce HARC (Harmfulness-And-Refusal Coupling), a fine-tuning method that pairs the two directions across both prompt and response positions. Since the intervention is confined to the harmfulness-refusal subspace, it leaves the rest of the residual stream intact and does not degrade general capability or inflate over-refusal. Across extensive experiments, HARC achieves the strongest robustness-capability-usability trade-off among six baselines spanning the major training-time and inference-time safety methods. The harmfulness and refusal directions at prompt and response positions transfer across the five model families and two scales we tested without architecture-specific tuning.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 62 of its 70 references that are in the map. First posted on arXiv 1 Jul 2026.

Builds on

62 of 70 references.

Closest ancestors · 11

Same direction, newest first

  1. 2025Differentiated Directional Intervention A Framework for Evading LLM Safety Alignment10 Nov
  2. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence24 Feb
  3. 2025The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directions13 Feb
  4. 2025STAIR: Improving Safety Alignment with Introspective Reasoning4 Feb
  5. 2024SCANS: Mitigating the Exaggerated Safety for LLMs via Safety-Conscious Activation Steering21 Aug
  6. 2024PKU-SafeRLHF: Towards Multi-Level Safety Alignment for LLMs with Human Preference20 Jun
  7. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep10 Jun
  8. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Models31 May
  9. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!5 Oct
  10. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  11. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 51

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  4. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  5. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  6. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  7. 2024Qwen2.5 Technical Reportcited by 4,942
  8. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  9. 2024Gemma 2: Improving Open Language Models at a Practical Sizecited by 1,998
  10. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  11. 2024A Survey on LLM-as-a-Judgecited by 1,423
  12. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
38 more
  1. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
  2. 2023Inference-Time Intervention: Eliciting Truthful Answers from a Language Modelcited by 1,302
  3. 2023Instruction-Following Evaluation for Large Language Modelscited by 1,228
  4. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,085
  5. 2021A General Language Assistant as a Laboratory for Alignmentcited by 1,055
  6. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  7. 2022Toy Models of Superpositioncited by 971
  8. 2023Steering Language Models With Activation Engineeringcited by 922
  9. 2023Enhancing Chat Language Models by Scaling High-quality Instructional Conversationscited by 839
  10. 2020Aligning AI With Shared Human Valuescited by 723
  11. 2023The Linear Representation Hypothesis and the Geometry of Large Language Modelscited by 716
  12. 2023The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasetscited by 712
  13. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
  14. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  15. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  16. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
  17. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  18. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
  19. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 367
  20. 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
  21. 2024Deliberative Alignment: Reasoning Enables Safer Language Modelscited by 308
  22. 2024MT-Bench-101: A Fine-Grained Benchmark for Evaluating Large Language Models in Multi-Turn Dialoguescited by 250
  23. 2024WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Modelscited by 223
  24. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 216
  25. 2024Programming Refusal with Conditional Activation Steeringcited by 206
  26. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMscited by 199
  27. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 173
  28. 2023Linear Representations of Sentiment in Large Language Modelscited by 163
  29. 2024Improving Instruction-Following in Language Models through Activation Steeringcited by 160
  30. 2024Analyzing the Generalization and Reliability of Steering Vectorscited by 143
  31. 2024The Art of Saying No: Contextual Noncompliance in Language Modelscited by 105
  32. 2025LLMs Encode Harmfulness and Refusal Separatelycited by 88
  33. 2024FlipAttack: Jailbreak LLMs via Flippingcited by 80
  34. 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completioncited by 76
  35. 2024Exponential Moving Average of Weights in Deep Learning: Dynamics and Benefitscited by 71
  36. 2025AlphaSteer: Learning Refusal Steering with Principled Null-Space Constraintcited by 49
  37. 2025Representation Bending for Large Language Model Safetycited by 30
  38. 2025Rethinking Safety in LLM Fine-tuning: An Optimization Perspectivecited by 14

50 most cited of 51 All 51 (JSON)

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026From Refusal Geometry to Safety Geometry: Harmfulness--Refusal Coupling under Dynamic Adversarial Fine-Tuning
  2. 2025SABER: Uncovering Vulnerabilities in Safety Alignment via Cross-Layer Residual Connection
  3. 2025Beyond Surface Alignment: Rebuilding LLMs Safety Mechanism via Probabilistically Ablating Refusal Direction
  4. 2026Fail-Closed Alignment for Large Language Models
  5. 2025Improving LLM Safety Alignment with Dual-Objective Optimization
  6. 2026Deactivating Refusal Triggers: Understanding and Mitigating Overrefusal in Safety Alignment
  7. 2025Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy
  8. 2026When Safety Routing Breaks: Understanding Alignment Fragility under Benign Fine-Tuning