Refusal Steering in Language Models

• Refusal Steering is a method that manipulates model activations to reliably induce safe refusals for harmful requests.
• It uses techniques such as linear direction extraction, null-space projection, and causal feature selection to steer outputs selectively.
• The approach balances safety and performance in LLMs, VLMs, and multimodal architectures by targeting harmful inputs while preserving overall utility.

Refusal steering refers to a family of inference-time interventions in LLMs, vision-LLMs (VLMs), and other multimodal architectures that manipulate internal activations to modulate, induce, or suppress a model’s tendency to refuse unsafe or disallowed requests. The central aim is to exercise precise control over refusal behaviors—shifting the response distribution away from harmful outputs and toward compliant or contextually-appropriate refusals—without retraining or significantly degrading general task performance. Contemporary refusal steering methods combine mechanistic interpretability, causal attribution, subspace engineering, and conditional gating to achieve high fidelity, robustness, and selectivity in real-world deployments.

1. Fundamental Principles and Objectives

At its core, refusal steering exploits the observation that abstract safety behaviors—such as refusing to answer a harmful prompt—are encoded as linearly or non-linearly decodable features within the internal activations of models. By constructing “refusal directions” or “refusal features” in this high-dimensional space and applying structured interventions, it is possible to modulate model behavior during inference.

Key objectives of refusal steering include:

• Selective intervention: Enhance refusal on harmful inputs while avoiding over-refusal on benign prompts.
• Preservation of utility: Maintain performance on general language modeling, reasoning, or perception tasks.
• Transparency and controllability: Enable fine-grained, interpretable behavioral edits decoupled from adversarial prompt detection or black-box output filtering.
• Efficiency: Achieve behavioral control through lightweight, inference-only mechanisms—without the need for retraining or modifying core model weights.

Refusal steering methods have been established in standard dense LLMs, mixture-of-experts (MoE) LLMs, vision- and audio-LLMs, as well as within chain-of-thought and reasoning-augmented architectures (García-Ferrero et al., 18 Dec 2025, Kim et al., 2 Apr 2026, Joad et al., 2 Feb 2026, Cristofano, 13 Jan 2026, Vu et al., 30 Oct 2025, Yeon et al., 7 Dec 2025, Cheng et al., 9 Apr 2026).

2. Methodologies for Extracting and Applying Refusal Directions

A broad spectrum of methodology underpins modern refusal steering, with key paradigms summarized below:

Linear Direction Extraction

The most common approach computes a contrastive mean-difference (MD) or Fisher-LDA direction between the activations of refused and complied prompts:

$$r = \frac{1}{|V^+|} \sum_{i} v_i^+ - \frac{1}{|V^-|} \sum_{j} v_j^-$$

where $V^+$ and $V^-$ are sets of activations for refusal and compliance classes, respectively. The normalized direction $r/\|r\|_2$ serves as the steering vector (Joad et al., 2 Feb 2026, Marshall et al., 2024, Siu et al., 30 May 2025).

Regularized and Weighted Variants

To overcome variance and entanglement issues, weighted or ridge-regularized mean differences are used:

$$\tilde v = (Σ^- + λI)^{-1}Δ, \quad v = \tilde v / \|\tilde v\|_2$$

where $\Sigma^-$ is the covariance of compliant activations and $Δ$ is the weighted mean difference (García-Ferrero et al., 18 Dec 2025). Weights may be derived from an LLM-as-a-judge scoring system, giving higher importance to examples with strong refusal confidence.

Sparse and Distributed Feature Approaches

Modern work leverages interpretable feature banks by training sparse or graph-regularized autoencoders (SAE/GSAE) that disentangle refusal signals across multiple latent features. Features are scored for structural coherence, semantic relevance, and causal efficacy (Yeon et al., 7 Dec 2025), and interventions target a causally assembled “spectral vector bank”.

Circuit-Guided and Causal Feature Selection

CRaFT introduces a circuit-guided paradigm, employing a pretrained cross-layer transcoder to decompose all MLP activations into sparse features, and causally ranks features by a circuit-influence metric over boundary-critical prompts (those near the refusal-compliance decision boundary). The intervention at inference rescales or ablates the top refusal-causal features (Kim et al., 2 Apr 2026).

Null-Space and Orthogonalization Methods

To prevent steering from disrupting benign inputs or general capabilities, null-space projection methods learn updates that are provably zero in the benign subspace, e.g.,

$$\Delta = \widetilde\Delta P \quad \text{where } P \text{ projects to the null-space of benign activations}$$

and optimize $\widetilde\Delta$ to map harmful activations toward the refusal direction (Sheng et al., 8 Jun 2025, Zhu et al., 23 Mar 2026).

Affine and Angular Concept Editing

Affine Concept Editing (ACE) generalizes subspace manipulations to the affine case, enabling precise and standardized interpolation between refusal and compliance across prompt types:

$$v' = v - \text{proj}_r(v) + \text{proj}_r(μ^-) + \alpha r$$

Angular Steering rotates activations within the 2D subspace defined by refusal and a reference direction, offering fine-grained geometric control and generalization over addition/ablation-based methods (Vu et al., 30 Oct 2025).

Expert-specific and MoE-Aware Steering

In MoE architectures, expert-aware refusal steering exploits expert-specific routing and steering vectors, introducing targeted interventions at expert outputs, and demonstrates that refusal can be steered based on a single expert’s output (Marbut et al., 2 Jun 2026).

3. Evaluation Protocols, Trade-offs, and Limitations

Evaluation Metrics

Standard metrics for quantifying the effectiveness of refusal steering include:

• Refusal Rate: Fraction of harmful prompts correctly refused.
• Over-Refusal Rate: Fraction of benign prompts inappropriately refused.
• Attack Success Rate (ASR): Fraction of harmful prompts not refused (lower is better).
• Task Accuracy: Accuracy on standard QA or reasoning tasks (e.g., MMLU, TriviaQA, GSM8K).
• Distribution Drift: Shift in perplexity or token KL-divergence on neutral text (Cristofano, 13 Jan 2026).

Utility–Safety Tradeoff

A principal challenge is the utility–safety tradeoff: naive steering often causes over-refusal and nontrivial capability regression, e.g., SAE feature steering can degrade MMLU and GSM8K accuracy by up to 47 points as refusal is maximized (O'Brien et al., 2024). Null-space and spectral cleaning methods (e.g., AlphaSteer, SRA) are designed to mitigate this by orthogonalizing steering directions to capability-preserving subspaces (Cristofano, 13 Jan 2026, Sheng et al., 8 Jun 2025).

Adaptive and Conditional Interventions

For maximal selectivity, methods combine prompt-level and continuation-level gating, such that steering is activated only in regions where harmful content or refusal is detected (e.g., dual-gate mechanism in GSAE (Yeon et al., 7 Dec 2025), few-shot threshold calibration in multilingual settings (Aziz et al., 31 May 2026)).

Limitations

• Polysemanticity: Dirty refusal vectors may entangle with core capabilities and style circuits, producing “ghost noise” if not cleaned (Cristofano, 13 Jan 2026).
• Distributed representations: Many safety concepts, especially refusal, are not monosemantic and require distributed or feature-bank interventions, as single-feature steering is insufficient (Yeon et al., 7 Dec 2025).
• Robustness: Some models, especially large reasoning (CoT) models, encode refusal jointly in activations and chain-of-thought traces; single-layer steering is often insufficient (Yang et al., 26 May 2026).
• Distributional shifts: In audio or multimodal LMs, naive refusal vectors derived from text activations do not transfer due to modality drift, necessitating text-derived steering and safe-space ablation (Lin et al., 20 Oct 2025).

4. Mechanistic Interpretability and Circuit Analysis

Refusal steering leverages advances in mechanistic interpretability that shed light on how steering signals propagate through transformer circuits:

• Circuit Localization: Activation patching and integrated gradients show that refusal steering effects are transmitted primarily through the OV (output-value) and MLP circuits, with little effect on QK (query-key) pathways (Cheng et al., 9 Apr 2026).
• Low-Dimensional Reliability: Across multiple extraction methods (mean-difference, next-token-prediction, preference optimization), the critical subspace underlying refusal steering is highly consistent, allowing 90–99% sparsification with little loss in steering fidelity.
• Semantic Decomposition: Decomposing the OV Jacobian reveals principal axes corresponding to “refusal” vs. “compliance” tokens, with head-wise semantic selectivity.
• Category and Style: Fine-tuning with categorical refusal tokens induces separable, category-aligned directions, supporting multi-category refusal control (Alagharu et al., 9 Mar 2026), while style differences among refusal types are reflected in distinct but geometrically similar steering directions (Joad et al., 2 Feb 2026).

5. Specialized and Generalized Applications

Mixture-of-Experts (MoE) Models

In open MoE LLMs, the performance of classic refusal steering is maintained despite complex routing, while novel expert-aware steering using refusal-specific routing patterns enables highly targeted control, even based on a single expert’s output (Marbut et al., 2 Jun 2026). Notably, the refusal signals captured by steering vectors are not strictly aligned with expert routing, highlighting the substantial role of attention circuitry.

Audio and Vision-LLMs

Audio-LLMs (LALMs) require text-derived steering vectors and decomposed safe-space ablation to address modality-specific separation in hidden spaces and to reduce over-refusal (Lin et al., 20 Oct 2025). In VLMs, null-space projected steering ensures that steering is only activated on out-of-distribution (malicious) visual inputs with provable zero effect on benign activations, yielding significant ASR reductions with no loss of general utility (Zhu et al., 23 Mar 2026).

Cross-Lingual Settings

Steering signals for safety alignment transplant robustly across languages at the representation level; the primary obstacle is miscalibration of the refusal decision. Simple calibration of a low-rank logistic gate restores high selectivity in low-resource languages (Aziz et al., 31 May 2026).

Autonomous Discovery & Scientific Agents

Beyond NLP, refusal steering appears as a core “refuse/revoke” safeguard in autonomous scientific frameworks such as CARTOGRAPH, which dynamically withholds mechanistic claims upon detecting library inadequacy or residual misfit—closing the loop between interpretation, discovery, and self-imposed stopping (Shah et al., 26 May 2026).

6. Open Problems and Future Directions

Key challenges and research frontiers in refusal steering include:

• Beyond Linearity: Exploring nonlinear steering mechanisms to better capture distributed or entangled safety concepts (Yeon et al., 7 Dec 2025, Joad et al., 2 Feb 2026).
• Real-time Adaptivity: Developing instance- and layer-adaptive schemes that dynamically select intervention strength and location in response to prompt context and unfolding generation.
• Robustness against Adversarial Attacks: Enhancing defense mechanisms for adaptive and multimodal attacks (including chain-of-thought and CoT-aware steering (Yang et al., 26 May 2026)).
• Automated Feature Discovery: Scaling up interpretable, causal discovery of steering features and subspaces for complex, non-monosemantic behaviors.
• Minimal “Safety Tax”: Quantifying and further reducing the inherited tradeoff (“safety tax”) on capabilities, ensuring that behavioral interventions incur minimal drift or performance cost (Cristofano, 13 Jan 2026).
• Generalization across Architectures and Modalities: Extending inference-time, feature-based steering to emerging model classes, e.g., new MoE topologies, VLMs, and models with dynamic CoT reasoning.

The field continues to synthesize mechanistically grounded, causally selective, and modular frameworks for behavioral steering, with an increasing emphasis on interpretability, robustness, and principled tradeoff management (Kim et al., 2 Apr 2026, García-Ferrero et al., 18 Dec 2025, Cheng et al., 9 Apr 2026, Sheng et al., 8 Jun 2025, Yeon et al., 7 Dec 2025).