Characterize refusal mechanisms at the representation level

Determine how refusal mechanisms in safety-aligned transformer-based large language models operate in terms of their underlying internal token representations across layers, clarifying the representational implementation of refusal beyond activation-space directions.

Background

Prior work has identified that refusal behavior in aligned LLMs can be mediated by specific directions in activation space. However, the representational basis of refusal—how internal token representations encode and trigger refusal across layers—has not been clearly described. The paper motivates this gap and studies representation hijacking during inference, highlighting the need to understand refusal at the representation level.

References

While recent works identified refusal directions that emerge in the activation space \citep{arditi2024refusal}, it remains unclear how these refusal mechanisms operate in terms of the underlying representations. This is especially crucial since those representations can be changed in-context as the result of user prompts \citep{park2025iclr}.

— In-Context Representation Hijacking  (2512.03771 - Yona et al., 3 Dec 2025) in Section 1, Introduction

A form of refusal survived every subspace we fitted on the categories it concentrates in, which is the one positive result here a defender can build on, though what carries it is unknown and hardening one writer group may run into the same non-additivity the attack did.

— How Fragile Is Safety Alignment at Frontier Scale? A Single-Direction Attack on a 320B MoE  (2609.09793 - Shi et al., 9 Sep 2026) in Conclusion; discussed in Section 'Ethics and Responsible Release', paragraph 'What defenders gain'

Mediation: our design establishes causal sufficiency (inducing and suppressing abstention); a full mediation analysis of natural abstention (e.g., activation patching between matched control/void pairs, for which TRAPSBench's minimal-pair structure is well suited) is left to future work.

— TRAPSBench: Vision-Language Models Encode but Fail to Express Epistemic Restraint  (2608.13167 - Pramono et al., 13 Aug 2026) in Appendix, Section “Activation Steering Details,” subsection “Interpretation,” paragraph “Scope of the causal claim”

They do not establish that all visual safety mechanisms are diffuse.

— Do VLMs Share Safety Neurons Across Modalities?  (2608.30750 - Li et al., 31 Aug 2026) in Section 5, subsection “Text vs. Visual Safety Neurons,” paragraph “Representation-level evidence indicates a higher-dimensional visual safety subspace”

We leave tracing full reasons behind this behavior of Qwen3-8B for future work.

— Beyond Shallow Alignment: How Post-Training Methods Determine Refusal Circuits And Steering Robustness  (2609.03887 - Nguyen et al., 3 Sep 2026) in Appendix, Section Refusal Direction Cosine Similarity

We report this as a candidate mechanism, not a proven one: it is consistent with both observations but was not tested by directly intervening on the signal.

— Locating and Steering Refusal Beyond Attention  (2609.04721 - Bosco et al., 4 Sep 2026) in Appendix, Section “Causal ablation of the transported direction: attention is modest, the Mamba mixer dominates,” paragraph “A candidate mechanism: Zamba2 is architecturally Mamba-dominated”