Null-Space Refusal Steering

• Null-space-constrained refusal steering is a method that modulates LLM responses by projecting alterations onto subspaces orthogonal to protected concepts.
• It employs techniques like affine concept editing, spectral residualization, and null-space regularized regression to decouple harmful content steering from general capabilities.
• Empirical results demonstrate robust refusal control with negligible utility loss, minimal output drift, and effective preservation of core language and reasoning skills.

Null-space-constrained refusal steering is a collection of techniques in both activation and weight space that enable fine-grained, selective modulation of refusal behaviors in LLMs while preserving core linguistic, reasoning, and utility capabilities. The central principle is to confine all steering interventions—whether at inference time or via offline editing—to subspaces orthogonal to protected concepts, thereby avoiding interference with unrelated functionalities or causing collateral "model damage." This approach is supported both by affine concept editing in activation space (Marshall et al., 2024), spectral residualization for circuit disentanglement (Cristofano, 13 Jan 2026), null-space-regularized regression (Sheng et al., 8 Jun 2025), separate concept vector steering (Zhao et al., 16 Jul 2025), and circuit-limited fine-tuning in weight space (Kasliwal et al., 4 Feb 2026), as well as by policy gradient projection in RLHF-style safety alignment (Niu et al., 12 Dec 2025).

1. Conceptual Foundations: Null Space Constraints

Null-space-constrained steering leverages geometric decompositions of model activations or parameter updates. The key idea is to identify a "refusal vector" $r$—typically the mean difference between refusal and non-refusal activations at a specified residual-stream layer—and constrain manipulations of activations, weights, or gradients such that they remain orthogonal (i.e., of zero projection) to a complementary set of protected directions. In formal terms, for a given direction $r$ in $\mathbb{R}^d$, the null space $$\mathcal{N}(r) = \{ u \in \mathbb{R}^d : r^T u = 0 \}$$ is the subspace where $r$ exerts no effect. The orthogonal projection operator onto this null space is $P_\mathrm{null} = I - \frac{r r^T}{\|r\|^2}$ (Marshall et al., 2024).

This mathematical constraint is general: analogous projections can be formulated for arbitrary sets of directions (e.g., as in spectral residualization (Cristofano, 13 Jan 2026), where many capability "atoms" are present), for weight vectors (Kasliwal et al., 4 Feb 2026), or for parameter gradients in RL (Niu et al., 12 Dec 2025). The explicit imposition of null-space constraints guarantees invariance of protected subspaces, enabling behavior modulation with minimal adverse effects.

2. Methodologies and Algorithmic Instantiations

Several algorithmic realizations of null-space-constrained refusal steering have emerged across activation-, weight-, and policy-gradient spaces:

Affine Concept Editing (ACE)

ACE combines affine subspace projection with calibrated activation addition. Given an activation $x$, ACE sequentially (a) erases any existing refusal component (applying $P_\mathrm{null}\,x$), (b) recenters towards the mean non-refusal activation, and (c) adds a calibrated amount $\alpha r$:

$$x' = x - \operatorname{proj}^\parallel_r(x) + \operatorname{proj}^\parallel_r(\mu^-) + \alpha r$$

This ensures that, at $\alpha=0$, the activation matches a standardized non-refusal baseline; at $\alpha=1$, it aligns with the canonical refusal mean (Marshall et al., 2024).

Surgical Refusal Ablation (SRA)

SRA refines the raw refusal vector by orthogonalizing it against a matrix $C$ of concept atoms (capability and style vectors) using ridge-regularized residualization:

$$v_\ell^\mathrm{clean} = (I - C(C^T C + \lambda I)^{-1}C^T) r_\ell^\mathrm{raw}$$

This removes any component of $r_\ell^\mathrm{raw}$ that colocalizes with protected behaviors, yielding a clean, disentangled steerable vector (Cristofano, 13 Jan 2026).

Null-Space Regularized Regression (AlphaSteer)

AlphaSteer forms a learned matrix mapping $\Delta$ with a strict null-space constraint ($\Delta H_b=0$ for benign activations $H_b$) and regresses malicious activations toward $r$:

$$\widetilde \Delta^* = \arg\min_{\widetilde\Delta} \| \widetilde\Delta P H_m - R \|_F^2 + \alpha \| \widetilde\Delta P \|_F^2$$

where $P$ projects onto the null space of benign activations. This ensures no change on safe inputs while enforcing robust refusal (Sheng et al., 8 Jun 2025).

Orthogonalization via Multiple Concepts

Concept separation can also be explicitly enforced, e.g., by projecting all steering onto the null space of harmfulness directions, thereby confining refusal edits to subspaces that do not alter the model's latent harmfulness judgment (Zhao et al., 16 Jul 2025).

Circuit-Restricted and Null-Space-Constrained Weight Updates

Offline, null-space constraints manifest as parameter mask $\Pi$ selecting only the causally relevant "refusal circuit" for finetuning, so $\Delta\theta_\mathrm{circuit} \in \mathrm{Im}(\Pi)$ and no change occurs in $\ker(\Pi)$ (Kasliwal et al., 4 Feb 2026). In RL, safety gradients are projected into the null space of general task gradients, so all updates are orthogonal to utility-preserving directions (Niu et al., 12 Dec 2025).

3. Distinctiveness from Prior Refusal Steering

Traditional activation steering methods, including Contrastive Activation Addition (CAA: $x' = x + \alpha r$), Directional Ablation ($x' = x - \operatorname{proj}^\parallel_r(x)$), or their naively combined forms, do not enforce any null-space constraint and thus risk perturbing off-target behaviors and high-variance axes in activation space. As a result, such methods have been observed to induce incoherent completions, output distribution drift, and a degradation of core capabilities ("Ghost Noise") (Marshall et al., 2024, Cristofano, 13 Jan 2026).

Null-space-constrained methods systematically address this by:

• Ensuring that $\alpha=0$ returns the model to a natural, standardized non-refusal "anchor" (Marshall et al., 2024).
• Projecting out unwanted collateral components, either explicitly (by spanning with atoms (Cristofano, 13 Jan 2026) or other concept directions (Zhao et al., 16 Jul 2025)), or implicitly (by hard utility preservation constraints (Sheng et al., 8 Jun 2025)).
• Limiting steering to only a causally responsible circuit or parameter subspace (Kasliwal et al., 4 Feb 2026).
• Updating model parameters only in directions that are orthogonal to general capability gradients, reducing "alignment tax" and preserving utility (Niu et al., 12 Dec 2025).

4. Empirical Outcomes and Capability Preservation

The adoption of null-space constraints is consistently shown to yield strong refusal control with negligible loss in general skill. For instance, in ACE and AlphaSteer, model refusal on harmful prompts is modulated over the full [0,1]-$\alpha$ range without shifting the response distribution for harmless prompts or incurring utility degradation, even at high steering strengths (Marshall et al., 2024, Sheng et al., 8 Jun 2025).

Empirical metrics used include:

• Refusal rates on held-out harmful and harmless prompt suites.
• First-token KL and teacher-forced perplexity ($\Delta$PPL) on Wikitext-2 (for assessing distribution drift) (Cristofano, 13 Jan 2026).
• Math (GSM8K), code (MBPP), and general knowledge (MMLU) benchmarks (Kasliwal et al., 4 Feb 2026, Niu et al., 12 Dec 2025).
• Capability preservation is evidenced by near-zero $\Delta$PPL and accuracy drop ($<1\%$) on supervised utility tasks, even with aggressive steering (Cristofano, 13 Jan 2026, Sheng et al., 8 Jun 2025, Niu et al., 12 Dec 2025).

The practical guidance is to extract protected directions using small, representative concept datasets (for both style/confound removal and explicit skill retention) (Cristofano, 13 Jan 2026), and select steering layers via correlation analysis or grid search (Marshall et al., 2024).

5. Theoretical Guarantees and Interpretability

Null-space-constrained refusal steering benefits from clear theoretical properties. For instance, in Null-Space Constrained Policy Optimization (NSPO), the projected gradient satisfies

$P_N = I - A(A^T A)^{-1}A^T$

ensuring that the update is both a descent direction for the safety objective and leaves all general-task gradients unchanged. First-principles Taylor analysis confirms that capability loss $\Delta \mathcal{L}_\mathrm{cap}$ is minimized as $$\langle v, \nabla_\theta \mathcal{L}_\mathrm{cap}\rangle \to 0$$ after projection (Niu et al., 12 Dec 2025, Cristofano, 13 Jan 2026).

In concept-centered approaches, affine decompositions and null-space projections partition activation space into interpretable, semantically meaningful dimensions, providing mechanistic explanations for modification effects (Marshall et al., 2024, Zhao et al., 16 Jul 2025). Empirical analysis using, e.g., cosine similarity, confirms that harmfulness and refusal are nearly orthogonal in hidden space (Zhao et al., 16 Jul 2025), and that refusal control can be achieved without perturbing the internal harmfulness belief distribution.

A summary of comparison points:

Approach	Null-space explicit?	Utility Preservation	Distribution Drift (ΔPPL/KL)	Layer/Parameter Locality
ACE	Yes	Guaranteed	None	1 layer (mid)
SRA	Yes (multi-atom)	Empirical	Negligible	1–N layers
AlphaSteer	Yes (hard)	Guaranteed	None	1–3 layers
C-Δθ	Implicit (param.)	Empirical	Minimal	~5% of params
NSPO	Yes (gradient)	Provable	None	All θ, but projected

6. Applications, Limitations, and Extensions

Null-space-constrained refusal steering is currently applied for:

• Robust refusal of unsafe, harmful, or policy-violating prompts, with tunable selectivity (Marshall et al., 2024, Sheng et al., 8 Jun 2025, Cristofano, 13 Jan 2026).
• Targeted removal or restoration of refusal only for specific content classes, protecting, e.g., political queries while maintaining alignment on harmful content (García-Ferrero et al., 18 Dec 2025).
• Offline model editing (via weight updates) for checkpoint deployment with no runtime hooks (Kasliwal et al., 4 Feb 2026).
• Reinforcement learning safety alignment minimizing the alignment tax (Niu et al., 12 Dec 2025).

Limitations include the need for curated datasets covering both refusal/compliance and all protected concepts for atom-building (Cristofano, 13 Jan 2026), sensitivity to layer choice, and SVD/eigendecomposition costs for very high-dimensional spaces. Some methods rely on linearity or low-rank assumptions, which may not capture all aspects of model entanglement. A plausible implication is that further scaling to larger concept registries and more complex behaviors may require nonlinear or hierarchical extensions.

7. Outlook and Broader Significance

Null-space-constrained refusal steering serves as a unified paradigm for safe, interpretable, and minimally invasive behavior control in LLMs. It is underpinned by explicit geometric and statistical principles and has demonstrable empirical effectiveness across alignment, safety, and utility retention regimes (Marshall et al., 2024, Cristofano, 13 Jan 2026, Sheng et al., 8 Jun 2025, Zhao et al., 16 Jul 2025, Niu et al., 12 Dec 2025, Kasliwal et al., 4 Feb 2026). The approach is extensible to other model directions—including bias, sentiment, or stylistics—by construction of custom concept atoms or protected subspaces.

The emerging consensus in the literature is that null-space-constrained methods systematically outperform naive (single-vector) steering, both in reducing over-refusal and collateral drift, and in enabling topic, category, or capability-specific interventions. This suggests that null-space principles will play a central role in future scalable and robust safety alignment pipelines for foundation models.