DeepRefusal: Robust Safety Alignment

• DeepRefusal is a multi-layered framework that defines and controls AI refusal behavior using dynamic fine-tuning and internal activation modulation.
• It employs probabilistic activation ablation and risk-based thresholds to reconstruct refusal signals even under adversarial attacks.
• The approach integrates internal model geometry with governance mechanisms to balance robust refusal with minimal loss in general capability.

DeepRefusal denotes both a specific robust safety-alignment framework and, across adjacent work, a broader research vocabulary for refusal as a deep representational, behavioral, and governance phenomenon. In the narrow sense, DeepRefusal is a fine-tuning method that forces a model to dynamically rebuild its refusal mechanisms from jailbreak states by probabilistically ablating the refusal direction across layers and token depths during training (Xie et al., 18 Sep 2025). Across papers, the same term is also used to describe refusal as a composite of instruction fine-tuning, RLHF, system prompts, hard policy blocks, institutional risk thresholds, post-generation filters, latent features, and multimodal abstention modules, rather than a single surface rule (Touny, 12 Jan 2026).

1. Definition and formal scope

Refusal behavior is defined as any instance where a generative AI system declines a user’s request, either by saying “I can’t do that,” presenting a safe-completion template, or offering a vague nonanswer. In the governance-oriented formulation, this behavior arises from layered controls: policy filters, safety alignment, and capability checks. DeepRefusal is correspondingly described as the emergent, multi-layered architecture of refusal decisions combining the model’s instruction fine-tuning and RLHF “Reward Model” phase, system prompts and hard policy blocks, institutional risk-management thresholds, and post-generation filters; under this view, refusal is not a single rule but a composition of functions deciding $$\mathrm{Response}(x)\in\{\mathrm{Answer},\mathrm{PartialAnswer},\mathrm{Refuse}\}$$ (Touny, 12 Jan 2026).

Several mechanistic papers formalize refusal through a contrastive direction in representation space. In the DeepRefusal framework for robust safety alignment, if $h_i^{(l)}(t)\in\mathbb{R}^d$ is the hidden activation at layer $l$ and token position $i$, and $\mu_i^{(l)}$ and $\nu_i^{(l)}$ are the means over harmful and benign prompts respectively, then the refusal direction is

$r_i^{(l)}=\mu_i^{(l)}-\nu_i^{(l)}.$

A single global refusal direction $\hat r$ is then selected by heuristic filtering so that addition induces refusal even on benign prompts, while ablation suppresses refusal on harmful prompts (Xie et al., 18 Sep 2025).

A related governance formalization makes the institutional component explicit through a risk score

$$R(x)=w_1\cdot \mathrm{LegalRisk}(x)+w_2\cdot \mathrm{ReputationRisk}(x)+w_3\cdot \mathrm{HarmRisk}(x),$$

with refusal triggered once a corporate threshold is exceeded. This framing situates DeepRefusal simultaneously in internal model geometry and external organizational decision rules (Touny, 12 Jan 2026).

2. Geometry and internal mechanisms of refusal

A central dispute in the literature concerns whether refusal is mediated by a single direction. One line of work finds that this account is incomplete: across eleven categories of refusal and non-compliance, including safety, incomplete or unsupported requests, anthropomorphization, and over-refusal, refusal behaviors correspond to geometrically distinct directions in activation space. Yet steering along any refusal-related direction produces nearly identical refusal to over-refusal trade-offs, acting as a shared one-dimensional control knob. The primary effect of different directions is therefore not whether the model refuses, but how it refuses; sparse autoencoder analysis further suggests a small shared core of refusal features plus a long tail of style- or domain-specific latents (Joad et al., 2 Feb 2026).

Another mechanistic result places refusal downstream of persona. In Qwen2.5-7B-Instruct and Llama-3.1-8B-Instruct, a compliant persona direction suppresses refusal: in Llama, refusal falls from 97.4% to 1.6% under persona steering. Reintroducing the refusal direction at layer 14 restores little, whereas late injections at layers 22 or 22+24 partially rescue refusal, and projecting out the persona direction at layer 20 restores refusal nearly to baseline. This identifies a late-layer expression-stage gate: refusal is computed upstream but gated by persona downstream (Zhong et al., 24 Jun 2026).

Large reasoning models add another complication. In DeepSeek-R1-Distill-LLaMA-8B, refusal is jointly encoded in residual-stream activations and chain-of-thought. Activation steering reverses refusal in only 39% of cases when the CoT is kept fixed, but removing the CoT increases this to 70%; a two-stage intervention that regenerates CoT under steering reaches 94%, and the resulting CoT alone retains 48% of the effect after steering is removed. This suggests that CoT can actively reinforce refusal and can also carry a compliance signal independently (Yang et al., 26 May 2026).

Sparse-autoencoder studies sharpen the circuit-level picture. One analysis separates harmful features $F_H$ from refusal features $h_i^{(l)}(t)\in\mathbb{R}^d$0, and reports a causal chain from harmful features to refusal features to refusal behavior. Adversarial paraphrases and suffixes work by selectively suppressing refusal features, while sparse refusal-feature probes generalize far better to out-of-distribution adversarial samples than dense probes on raw activations (Yeo et al., 29 May 2025). A complementary training-time study of Latent Adversarial Training shows that refusal geometry can be reorganized and concentrated: in Llama 2 7B, the first two SVD components explain approximately 74.00% of activation-difference variance under LAT, compared with 54.19% for SSFT and 48.55% for embedding-space adversarial training, making LAT more robust to cross-model vectors but more vulnerable to self-generated vectors (Abbas et al., 26 Apr 2025).

Dynamic adversarial fine-tuning further indicates that robustness may arise from carrier relocation rather than dimensional expansion. In one 7B backbone, R2D2 drives fixed-source HarmBench ASR to 0.000 at steps 50 and 100, then partially reopens to 0.035 at step 250 and 0.250 at step 500; the best admissible refusal carrier remains late-layer through step 100 before relocating to an early-layer carrier, while effective rank remains near 1.23–1.27. This supports a reorganization account rather than a drift-only account (Lan et al., 29 Apr 2026).

3. DeepRefusal as a training-time robustness framework

In its most specific usage, DeepRefusal is a safety-alignment method that reconstructs refusal under adversarially degraded hidden states. The core idea is Probabilistic Activation Ablation (PAA): during fine-tuning, layer-wise Bernoulli variables $h_i^{(l)}(t)\in\mathbb{R}^d$1 and token-wise variables $h_i^{(l)}(t)\in\mathbb{R}^d$2 determine whether the refusal direction is removed at a given layer and token. The token-wise rule is

$h_i^{(l)}(t)\in\mathbb{R}^d$3

with $h_i^{(l)}(t)\in\mathbb{R}^d$4 reported as the best tradeoff. The training batch mixes benign data, harmful data, and harmful prompts prefixed with $h_i^{(l)}(t)\in\mathbb{R}^d$5 harmful tokens; the objective assigns weight $h_i^{(l)}(t)\in\mathbb{R}^d$6 to the harmful-prefix augmented term. Ablation is applied to attention, MLP, and residual stream modules, and the reported implementation uses LoRA rank $h_i^{(l)}(t)\in\mathbb{R}^d$7, $h_i^{(l)}(t)\in\mathbb{R}^d$8, batch size $h_i^{(l)}(t)\in\mathbb{R}^d$9, and 1 epoch on one A100 GPU in approximately 45 minutes (Xie et al., 18 Sep 2025).

The threat model explicitly includes prefilling and refusal-direction manipulation. Prefilling is simulated by inserting harmful tokens before the safe refusal continuation and training the model to ignore that prefix and continue to refuse. Refusal-direction attacks are simulated directly in hidden space by random ablation of the refusal direction across layers and token depths, forcing the model to rebuild the signal wherever a refusal must be produced. The paper also evaluates unseen jailbreaks, including SCAV, orthogonal, independent, and cross-lingual jailbreaks in Tamil, French, Marathi, Malayalam, and Chinese; in all cases, the ASR remained $l$0 (Xie et al., 18 Sep 2025).

Empirically, across four open-source LLM families and six representative attacks, DeepRefusal reduces attack success rates by approximately 95%, while maintaining model capabilities with minimal performance degradation. For Llama3-8B-instruct, the base model records Manual $l$1, CodeAttack $l$2, GCG $l$3, Refusal-Transfer $l$4, Refusal $l$5, and Prefilling $l$6 ASR. CircuitBreaker lowers these to $l$7, $l$8, $l$9, $i$0, $i$1, and $i$2, whereas DeepRefusal reaches $i$3, $i$4, $i$5, $i$6, $i$7, and $i$8 respectively. On capability benchmarks, DeepRefusal reports MMLU $i$9, GSM8k $\mu_i^{(l)}$0, and MT-bench $\mu_i^{(l)}$1, compared with base scores of $\mu_i^{(l)}$2, $\mu_i^{(l)}$3, and $\mu_i^{(l)}$4; the paper summarizes this as losing $\mu_i^{(l)}$5 points on MMLU and $\mu_i^{(l)}$6 points on GSM8k, while CircuitBreaker loses approximately $\mu_i^{(l)}$7 points on MMLU and approximately $\mu_i^{(l)}$8 points on GSM8k (Xie et al., 18 Sep 2025).

4. Cleaning, steering, and controlling refusal directions

A major neighboring line of work asks whether refusal can be edited without damaging general capability. Surgical Refusal Ablation argues that naive ablation degrades models because the raw refusal vector is polysemantic, entangling refusal with core capability circuits and linguistic style. The method constructs a registry of Concept Atoms spanning protected subspaces and applies ridge-regularized spectral residualization,

$\mu_i^{(l)}$9

to remove only atom-aligned structure. Across five models—Qwen3-VL-2B, 4B, 8B, Ministral-3B, and 14B—SRA achieves deep refusal reduction of 0–2% with mean $\nu_i^{(l)}$0 on Wikitext-2 and mean first-token KL $\nu_i^{(l)}$1; on Qwen3-VL-4B, standard ablation and SRA both reach 0% refusal, but standard ablation yields $\nu_i^{(l)}$2 and $\nu_i^{(l)}$3, whereas SRA yields $\nu_i^{(l)}$4 and $\nu_i^{(l)}$5. The paper names the damaging capability bleed “Ghost Noise” (Cristofano, 13 Jan 2026).

AlphaSteer addresses the same safety–utility trade-off with a null-space constraint. Benign activations are projected into a null space so that steering constructs a nearly zero vector on benign data, while malicious activations are mapped toward a refusal direction by regularized linear regression. On Llama-3.1-8B-Instruct, AlphaSteer reports an average DSR of $\nu_i^{(l)}$6 across AIM, AutoDAN, Cipher, GCG, Jailbroken, PAIR, and ReNeLLM, compared with $\nu_i^{(l)}$7 for Surgical, $\nu_i^{(l)}$8 for CAST, and $\nu_i^{(l)}$9 for Antidote. On benign benchmarks, its utility score is $r_i^{(l)}=\mu_i^{(l)}-\nu_i^{(l)}.$0, essentially matching the vanilla $r_i^{(l)}=\mu_i^{(l)}-\nu_i^{(l)}.$1 while exceeding the cited steering baselines (Sheng et al., 8 Jun 2025).

Contrastive Logit Steering relocates the intervention from hidden states to logits. It defines an instantaneous steering vector $r_i^{(l)}=\mu_i^{(l)}-\nu_i^{(l)}.$2 from unrestricted and safe system prompts and adds $r_i^{(l)}=\mu_i^{(l)}-\nu_i^{(l)}.$3 directly to base logits. The resulting geometry differentiates “Late Decision” models such as Llama-3.1, where KL divergence remains near zero for approximately 95% of layers before a final spike, from “Early Divergence” models such as Qwen-2.5, where safety is integrated around 40% depth. On Llama-3.1-8B, ASR rises from approximately 35% at $r_i^{(l)}=\mu_i^{(l)}-\nu_i^{(l)}.$4 to $r_i^{(l)}=\mu_i^{(l)}-\nu_i^{(l)}.$5 at $r_i^{(l)}=\mu_i^{(l)}-\nu_i^{(l)}.$6; on JailbreakBench, CLS with $r_i^{(l)}=\mu_i^{(l)}-\nu_i^{(l)}.$7 reaches 95% ASR in approximately one second on Llama-3.1-8B, versus 5% for GCG at 100 steps and 15 minutes. Reversing the sign of $r_i^{(l)}=\mu_i^{(l)}-\nu_i^{(l)}.$8 hardens models; with $r_i^{(l)}=\mu_i^{(l)}-\nu_i^{(l)}.$9 on Llama-3.3-70B, ASR drops from 68.8% to 9.4% (Ratnakar et al., 21 Jun 2026).

Category-specific refusal control extends directional steering beyond a single global axis. In a version of Llama 3 8B fine-tuned with one “[respond]” token and five category-specific refusal tokens, category-aligned steering vectors and a whitened, orthonormal low-rank combination improve both harmful refusal and benign acceptance. Averaged across nine harmful and five benign benchmarks, baseline Refuse-Llama shows benign over-refusal of 17.08% and harmful refusal of 65.21%; categorical steering reduces over-refusal to 3.38% and raises harmful refusal to 79.38%, while the low-rank combination yields 8.15% and 78.07% respectively (Alagharu et al., 9 Mar 2026).

5. Overrefusal, blind refusal, and refusal design

DeepRefusal research also treats refusal as a failure mode when it is overly broad. DDOR formalizes overrefusal as the false refusal of a semantically harmless prompt and uses delta debugging to extract a 1-minimal refusal-triggering fragment (mRTF), defined as a subset $\hat r$0 such that $\hat r$1 and removing any unit makes the test pass. Conditioned on localized mRTFs, DDOR generates approximately 1K context-rich overrefusal cases per model and performs multi-oracle validation. It produces approximately $\hat r$2 more valid test cases than full-rewrite, raises average overrefusal rates by $\hat r$3 percentage points over seed prompts and by $\hat r$4 percentage points over full-rewrite cases, and on repair benchmarks attains 83.3% XSTest repair with semantic similarity 0.82 for mRTF-based rewriting (Zhou et al., 2 Jun 2026).

A more normative critique appears in blind refusal. Here the target is help with evading defeated rules: rules imposed by illegitimate authorities, rules whose content is defective, rules applied unfairly, or rules admitting justified exceptions. Across 18 model configurations from 7 families, the help rate on defeated-rule requests is 24.6%, yielding a refusal rate of 75.4% over $\hat r$5 cases; models engage with the defeat condition in 57.5% of defeated-rule cases, and 56.5% of refusals still engage with the defeat reasoning. This indicates that refusal is often decoupled from normative reasoning about rule legitimacy rather than from the model’s capacity to recognize the legitimacy defect (Pattison et al., 3 Apr 2026).

The governance literature generalizes this concern. El Touny’s analysis argues that refusal is not a neutral safeguard but a site of power shaped by institutional risk management and opaque decision-making. The paper situates modern refusal systems in a longer history of censorship and recommends co-design of refusal logic with users, age-gating and guardian consent, contextual reframing, verified access channels, partial or milder answers, and transparent disclaimers stating why refusal occurred and what alternative sources or rephrasings are available (Touny, 12 Jan 2026).

A separate design trajectory treats refusal as supportive communication rather than bare denial. PsychoSafe constructs a corpus of 8019 prompt-response pairs across five psychologically salient risk domains and adapts Qwen-3.5-27B via prompting and parameter-efficient fine-tuning. On a balanced validation set of 500 prompts, prompt-based PsychoSafe improves overall refusal quality by 28.1% over a generic baseline, with particularly strong gains in external resource referral (+46.8%) and psychological grounding (+34.8%), while preserving downstream performance on non-refusal tasks. Fine-tuning reaches 100% refusal and 99.8% referrals but reduces relevance to 3.37/5 and lowers overall refusal quality to 82.7% versus 92.0% for the prompt-based variant (Barmina et al., 8 Jun 2026).

6. Multimodal, embodied, and audit-oriented extensions

In embodied systems, DeepRefusal becomes an abstention problem: the model must say “I do not know” when visual memory cannot support a query. Semantic Flip synthesizes auxiliary out-of-distribution samples without external OOD annotations through Q-Flip, which rewrites the query while holding memory fixed, and V-Flip, which removes the visual evidence of the query’s head noun phrase while holding the query fixed. A frozen Qwen2.5-VL-Instruct-7B encoder feeds a trainable 3-layer MLP rejection head. On AbstainEQA HM3D-380, Semantic Flip reports $\hat r$6, balanced accuracy $\hat r$7, recall $\hat r$8, and specificity $\hat r$9, outperforming prompting baselines. On SpaceReject, it reaches $$R(x)=w_1\cdot \mathrm{LegalRisk}(x)+w_2\cdot \mathrm{ReputationRisk}(x)+w_3\cdot \mathrm{HarmRisk}(x),$$0, balanced accuracy $$R(x)=w_1\cdot \mathrm{LegalRisk}(x)+w_2\cdot \mathrm{ReputationRisk}(x)+w_3\cdot \mathrm{HarmRisk}(x),$$1, recall $$R(x)=w_1\cdot \mathrm{LegalRisk}(x)+w_2\cdot \mathrm{ReputationRisk}(x)+w_3\cdot \mathrm{HarmRisk}(x),$$2, and specificity $$R(x)=w_1\cdot \mathrm{LegalRisk}(x)+w_2\cdot \mathrm{ReputationRisk}(x)+w_3\cdot \mathrm{HarmRisk}(x),$$3 (Na et al., 15 Jun 2026).

Continual unlearning in large vision-LLMs introduces another refusal regime: the model must selectively refuse sequential deletion targets while preserving utility elsewhere. CORE decomposes forget categories into fine-grained visual and textual concepts, reweights them with a concept modulator, and routes them through a mixture of specialized refusal experts, or refusers. On Vicuna-7B + ViT-g/14, the reported average-over-steps scores are $$R(x)=w_1\cdot \mathrm{LegalRisk}(x)+w_2\cdot \mathrm{ReputationRisk}(x)+w_3\cdot \mathrm{HarmRisk}(x),$$4, AR $$R(x)=w_1\cdot \mathrm{LegalRisk}(x)+w_2\cdot \mathrm{ReputationRisk}(x)+w_3\cdot \mathrm{HarmRisk}(x),$$5, and CRR $$R(x)=w_1\cdot \mathrm{LegalRisk}(x)+w_2\cdot \mathrm{ReputationRisk}(x)+w_3\cdot \mathrm{HarmRisk}(x),$$6, versus the best competitor’s $$R(x)=w_1\cdot \mathrm{LegalRisk}(x)+w_2\cdot \mathrm{ReputationRisk}(x)+w_3\cdot \mathrm{HarmRisk}(x),$$7, AR $$R(x)=w_1\cdot \mathrm{LegalRisk}(x)+w_2\cdot \mathrm{ReputationRisk}(x)+w_3\cdot \mathrm{HarmRisk}(x),$$8, and CRR $$R(x)=w_1\cdot \mathrm{LegalRisk}(x)+w_2\cdot \mathrm{ReputationRisk}(x)+w_3\cdot \mathrm{HarmRisk}(x),$$9. At the last step, CORE achieves AR $F_H$0, CRR $F_H$1, and $F_H$2, compared with AR $F_H$3, CRR $F_H$4, and $F_H$5 for the best competitor (Jin et al., 23 Mar 2026).

Audit-oriented work asks whether refusal is structurally deep or merely rhetorical. BioRefusalAudit labels outputs as COMPLY, REFUSE, HEDGE, PARTIAL, or EVADE, compresses sparse autoencoder activations into five biosecurity feature categories, and defines a divergence score

$F_H$6

where $F_H$7 is a surface-label vector, $F_H$8 is the internal feature vector, and $F_H$9 is a learned alignment matrix. Across five architectures, the behavioral results are highly uneven: Gemma 2 2B-IT never genuinely refused across 75 prompts and hedged on every hazard-adjacent query; Gemma 4 E2B-IT refused 65/75 prompts with chat-template formatting and 0/75 without it; both Gemma models collapsed to 0% under an 80-token cap; Qwen 2.5 1.5B and Phi-3-mini over-refused on 83–87% of benign biology; and Llama 3.2 1B showed a 61-point benign-to-hazard spread. On Gemma 4, comply and refuse responses separated by a 0.647-point gap in $h_i^{(l)}(t)\in\mathbb{R}^d$00 with zero overlap, though the paper describes this as preliminary and limited to Gemma-family SAE coverage (DeLeeuw, 28 May 2026).

Taken together, these results suggest that DeepRefusal is no longer adequately described as a single refusal token, a single classifier threshold, or even a single latent direction. Across the cited literature, it names a family of mechanisms and interventions spanning probabilistic rebuilding of refusal under attack, disentanglement of refusal from capability and style, late gating by persona, CoT-mediated reconstruction, explainable overrefusal testing, normatively sensitive refusal design, multimodal abstention, continual unlearning, and activation-level auditing (Xie et al., 18 Sep 2025).