Refusal–Affirmation Logit Gap

• The refusal–affirmation logit gap is a quantitative measure comparing logit scores for refusal versus affirmation responses in both LLMs and grouped binary econometric models.
• It is computed per decoding step or via fixed-effects methods using calibrated lexicons and observability planes to reveal temporal dynamics and alignment artifacts.
• Empirical analyses show that distinct gap trajectories predict compliance failures and expose safety–utility trade-offs, guiding interventions and diagnostic strategies.

The refusal–affirmation logit gap is a central quantitative observable in several domains, most notably in LLM safety diagnostics, mechanistic alignment research, adversarial jailbreak studies, and classic grouped-data econometrics using binary response models. Its core role is to serve as a margin between model preferences for two response classes—refusal and affirmation—across either token-level outputs in deep networks or slope interpretations in fixed-effects panel models. This quantity enables nuanced characterization of model behavior beyond simple outcome frequencies, revealing both the geometric structure underlying safety failures and the practical efficacy of countermeasures.

1. Formal Definitions Across Contexts

In safety-aligned LLMs, the refusal–affirmation logit gap is most commonly defined as the difference in pre-softmax (logit) scores assigned to tokens or token sets representing “refusal” (e.g., “I cannot,” “Sorry,”) and “affirmation” or “compliance” (e.g., “Sure,” “Certainly,”) behaviors. For a logit vector $\ell_t \in \mathbb{R}^{|V|}$ at decoding step $t$, and token sets $\mathcal{L}_{\mathrm{ref}}$, $\mathcal{L}_{\mathrm{cmp}}$, the per-step logit gap is

$$S_t = \mu_{\mathrm{cmp}}(t) - \mu_{\mathrm{ref}}(t)$$

where $\mu_{\mathrm{cmp}}(t)$ and $\mu_{\mathrm{ref}}(t)$ are the average top-$k$ logits within each lexicon, respectively (Park et al., 28 May 2026). For fixed inputs $x$, with “refusal” and “answer” tokens $r$ and $t$0,

$t$1

is a pointwise instantiation used for mechanistic analysis (Chen et al., 9 May 2026).

In econometric fixed-effects logit panels, the “refusal–affirmation logit gap” (denoted $t$2) is the analytic difference between parameter (slope) estimates derived by logit and OLS procedures when group-level refusals (all-zeros) are handled differently. Here, the gap is

$t$3

with $t$4 including all groups and $t$5 only the groups with nontrivial within-group variation (Beck, 2018).

2. Measurement Methodologies and Implementation

In LLMs, Park et al. (Park et al., 28 May 2026) compute the logit gap per decoding step, using fixed lexicons expanded to tokenizer IDs. For each model generation, the trajectory $t$6 is extracted, allowing observability throughout response construction. Further, calibration is performed across reference generations (harmful, benign, jailbroken) by mapping $t$7 (pre-generation) and $t$8 (mean over $t$9 steps) to normalized “relative positions,” yielding a two-dimensional observability plane that summarizes temporal safety failure dynamics.

Adversarial methods such as logit-gap steering (Li et al., 30 Jun 2025) rely on directly evaluating the post-prompt gap $\mathcal{L}_{\mathrm{ref}}$0 and using greedy algorithms (“sort–sum–stop” sweeps) to efficiently discover suffixes that flip this gap and elicit forbidden (affirmative) outputs.

Diagnostic procedures facing over-refusal (Qi et al., 18 Apr 2026) typically run paired forward passes—once under an extreme safety system prompt, once under baseline conditions—and calculate a tokenwise softmax gap,

$\mathcal{L}_{\mathrm{ref}}$1

to reveal the magnitude by which the “refusal” tokens dominate when the model is excessively safe.

Operator-level mechanistic analyses formalize the gap as a linear function of hidden states, with analytic gradient-Jacobian decompositions isolating input perturbation directions (“Refusal-Escape Directions,” RED) that are capable of systematically closing the gap in violation of intended refusal behavior (Chen et al., 9 May 2026).

In econometrics, the gap is estimated using explicit group inclusion/exclusion, with the OLS estimator shrinking toward zero marginal effect in all-zero/one groups and the fixed-effect logit estimator omitting such groups by construction (Beck, 2018).

3. Empirical Patterns and Applications

Key empirical findings include:

• Temporal dynamics in LLM decoding: Early crossing of the gap below zero ($\mathcal{L}_{\mathrm{ref}}$2) robustly predicts genuine refusals, while delayed or absent crossings signal successful jailbreaks or compliance failures. Two attacks with identical overall harmfulness may traverse distinct logit trajectories, visible only in this margin (Park et al., 28 May 2026).
• Efficient jailbreak discovery: Closing the refusal–affirmation gap via greedy suffix search dramatically reduces the number of model queries required to achieve jailbreaks, with short suffixes (typically 5–15 tokens) reliably flipping models up to 70B parameters from refusal to compliance (Li et al., 30 Jun 2025).
• Alignment artifacts: “Sentence-boundary reward cliffs” are seen in LLMs, where the gap is periodically re-widened by alignment objectives at punctuation boundaries, observable through per-token cumulative metrics.
• Diagnostic for over-refusal: Large refusal–affirmation gaps in over-refusal scenarios lead to safety-aligned models refusing benign queries. Adaptive contrastive decoding manipulates this gap at inference time to optimize the safety–helpfulness tradeoff, empirically reducing over-refusal by over 10 percentage points on key datasets (Qi et al., 18 Apr 2026).
• Mechanistic roots of vulnerability: Refusal-escape directions mapped from gap gradients identify operator-level (normalization, residual, terminal) sources that, if unsuppressed, admit jailbreak transitions despite alignment (Chen et al., 9 May 2026). Empirically, successful jailbreak interpolations align predominantly with terminal-source REDs.

4. Theoretical Structure and Safety–Utility Tradeoff

Mechanistically, the refusal–affirmation logit gap arises from and can be decomposed into contributions across the transformer’s computational graph:

• Linearization yields $\mathcal{L}_{\mathrm{ref}}$3, with gap gradients tracing back to input via $\mathcal{L}_{\mathrm{ref}}$4.
• The “refusal-escape direction” (RED) $\mathcal{L}_{\mathrm{ref}}$5 is orthogonal to the semantic direction and collects contributions from normalization, self-attention, MLP, residual wiring, and a terminal term (Chen et al., 9 May 2026).
• Analytic rigidity in these pathways implies that attempting to entirely eliminate RED (i.e., all local logit-gap shifts in the jailbreaking direction) creates an incompatibility with retaining benign outputs, formalizing a conditional safety–utility trade-off.

A plausible implication is that no single alignment setting can achieve both perfect refusal on harmful inputs and undisturbed helpfulness elsewhere unless specific analytic fields coincide—a rare scenario in high-dimensional aligned models.

5. Observability Planes, Decision Geometry, and Intervention

By placing model–attack pairs on a calibrated 2D logit-gap observability plane (axes: pre-generation and mean-generation bias, normalized to reference distributions), one obtains a low-dimensional summary capturing where and how models are vulnerable. Even attacks with matching attack success rates (ASR) may occupy distinct, statistically separated points in this geometry, indicating different underlying failure mechanisms (Park et al., 28 May 2026). This granularity supports the design of behavioral probes (e.g., early-stop rules based on $\mathcal{L}_{\mathrm{ref}}$6) that can robustly curtail jailbreak success without spurious refusals on benign input.

Additionally, these methods inform safety evaluation pipelines: both when and how a model’s trajectory enters a compliance-leaning or refusal-leaning state become tractable from logits alone.

6. Logit Gaps in Grouped Binary Models: OLS vs Logit

Beyond LLMs, the refusal–affirmation logit gap appears as an estimator gap in grouped fixed-effects binary models (Beck, 2018). Here, OLS on all data, including groups with invariant outcomes, shrinks slope estimates toward zero by construction—the “affirmation” of null marginal effects—whereas logit, by necessity, “refuses” to estimate within all-zero/one groups, producing systematically larger marginal effects for the informative group subset. This quantitative wedge

$\mathcal{L}_{\mathrm{ref}}$7

(where $\mathcal{L}_{\mathrm{ref}}$8 is the proportion of unmixed groups and $\mathcal{L}_{\mathrm{ref}}$9, $\mathcal{L}_{\mathrm{cmp}}$0 are within-group variances) can be substantial if most groups lack variation. The choice of estimator affects substantive interpretation and should be reported with care.

7. Implications, Limitations, and Recommended Practices

The refusal–affirmation logit gap functions as both diagnostic and control lever:

• In LLMs: central for tracking safety–compliance shifts, analyzing behavioral attack surfaces, crafting efficient jailbreaks, and designing countermeasures.
• In grouped binary regression: necessary for correct interpretation and transparent reporting of fixed-effects estimates.

Limitations include incomplete reference calibration (in LLMs, lexicons and reference sets can limit universality), inherent trade-offs between safety and utility, and analytic rigidity in model architectures that preclude global gap suppression without side effects.

Recommended practice is to report raw and calibrated logit-gap statistics, include trajectory-based and summary-plane analyses, and, for regression, publish both OLS and logit-based parameters, variance components, and dropped-group fractions to fully characterize the gap’s quantitative impact (Beck, 2018).