From Refusal Tokens to Refusal Control: Discovering and Steering Category-Specific Refusal Directions

• URL: http://arxiv.org/abs/2603.13359v1
• Date: Mon, 09 Mar 2026 06:37:16 GMT
• Title: From Refusal Tokens to Refusal Control: Discovering and Steering Category-Specific Refusal Directions
• Abstract summary: We leverage a version of Llama 3 8B fine-tuned with categorical refusal tokens to enable inference-time control over fine-grained refusal behavior.<n>We construct categorical steering vectors with a lightweight probe that determines whether to steer toward or away from refusal during inference.<n>Across benchmarks, both categorical steering vectors and the low-rank combination consistently reduce over-refusals on benign prompts while increasing refusal rates on harmful prompts.
• Score: 7.599054770990825
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Language models are commonly fine-tuned for safety alignment to refuse harmful prompts. One approach fine-tunes them to generate categorical refusal tokens that distinguish different refusal types before responding. In this work, we leverage a version of Llama 3 8B fine-tuned with these categorical refusal tokens to enable inference-time control over fine-grained refusal behavior, improving both safety and reliability. We show that refusal token fine-tuning induces separable, category-aligned directions in the residual stream, which we extract and use to construct categorical steering vectors with a lightweight probe that determines whether to steer toward or away from refusal during inference. In addition, we introduce a learned low-rank combination that mixes these category directions in a whitened, orthonormal steering basis, resulting in a single controllable intervention under activation-space anisotropy, and show that this intervention is transferable across same-architecture model variants without additional training. Across benchmarks, both categorical steering vectors and the low-rank combination consistently reduce over-refusals on benign prompts while increasing refusal rates on harmful prompts, highlighting their utility for multi-category refusal control.

Related papers

• Targeted Neuron Modulation via Contrastive Pair Search [0.0]
  We show that neuron-level intervention enables reliable behavioral steering without the quality tradeoffs of residual-stream methods.<n>We find that base models contain similar late-layer discrimination structures but steering these neurons produces only content shifts.<n>More broadly, our findings suggest that alignment fine-tuning transforms pre-existing discrimination structure into a sparse, targetable refusal gate.
  arXiv  Detail & Related papers  (2026-05-12T15:47:38Z)
• On the Failure of Topic-Matched Contrast Baselines in Multi-Directional Refusal Abliteration [0.0]
  This work investigates whether a topically matched contrast baseline yields superior refusal directions.<n>It was found that topic-matched contrast produces no functional refusal directions at any tested weight level.<n>The implications for the design of contrast baselines in abliteration research are discussed.
  arXiv  Detail & Related papers  (2026-03-23T14:55:00Z)
• Provably Reliable Classifier Guidance via Cross-Entropy Control [4.298880233819988]
  We show that cross-entropy loss at each diffusion model step is sufficient to control the corresponding guidance error.<n>Our result yields an upper bound on the sampling error vectors-guided diffusion models and bears resemblance to a reverse log-Sobolev-type inequality.
  arXiv  Detail & Related papers  (2026-01-29T02:59:04Z)
• Refusal Steering: Fine-grained Control over LLM Refusal Behaviour for Sensitive Topics [2.4839105527363574]
  We introduce Refusal Steering, an inference-time method to exercise fine-grained control over Large Language Models refusal behaviour.<n>We show that it can remove political refusal behaviour while retaining safety alignment for harmful content.
  arXiv  Detail & Related papers  (2025-12-18T14:43:04Z)
• A Granular Study of Safety Pretraining under Model Abliteration [64.24346997570275]
  We study model abliteration, a lightweight projection technique designed to remove refusal-sensitive directions.<n>We issue 100 prompts with balanced harmful and harmless cases, classify responses as **Refusal** or **Non-Refusal** using multiple judges, and validate judge fidelity.<n>Our study produces a checkpoint-level characterization of which data-centric safety components remain robust under abliteration.
  arXiv  Detail & Related papers  (2025-10-03T07:01:45Z)
• AdvChain: Adversarial Chain-of-Thought Tuning for Robust Safety Alignment of Large Reasoning Models [62.70575022567081]
  We propose AdvChain, an alignment paradigm that teaches models dynamic self-correction through adversarial CoT tuning.<n>Our work establishes a new direction for building more robust and reliable reasoning models.
  arXiv  Detail & Related papers  (2025-09-29T04:27:23Z)
• The Rogue Scalpel: Activation Steering Compromises LLM Safety [11.402179030703188]
  Activation steering is a technique for controlling LLM behavior by adding semantically meaningful vectors directly into a model's hidden states during inference.<n>We demonstrate the opposite: steering systematically breaks model alignment safeguards, making it comply with harmful requests.
  arXiv  Detail & Related papers  (2025-09-26T08:49:47Z)
• Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning [19.823784666021822]
  ACTOR minimizes over-refusals by leveraging internal activation patterns from diverse queries.<n>ACTOR precisely identifies and adjusts the activation components that trigger refusals, providing stronger control over the refusal mechanism.
  arXiv  Detail & Related papers  (2025-07-06T05:47:04Z)
• COSMIC: Generalized Refusal Direction Identification in LLM Activations [43.30637889861949]
  We introduce bfCOSMIC (Cosine Similarity Metrics for Inversion of Concepts), an automated framework for direction selection.<n>It identifies viable steering directions and target layers using cosine similarity - entirely independent of model outputs.<n>It reliably identifies refusal directions in adversarial settings and weakly aligned models, and is capable of steering such models toward safer behavior with minimal increase in false refusals.
  arXiv  Detail & Related papers  (2025-05-30T04:54:18Z)
• Derailing Non-Answers via Logit Suppression at Output Subspace Boundaries in RLHF-Aligned Language Models [0.0]
  We introduce a method to reduce refusal rates of large language models (LLMs) on sensitive content without modifying model weights or prompts.<n>Motivated by the observation that refusals in certain models were often preceded by the specific token sequence of a token.<n>Our findings suggest that refusal behaviors can be circumvented by blocking refusal subspaces at specific points in the generation process.
  arXiv  Detail & Related papers  (2025-05-28T20:25:24Z)
• TrustLoRA: Low-Rank Adaptation for Failure Detection under Out-of-distribution Data [62.22804234013273]
  We propose a simple failure detection framework to unify and facilitate classification with rejection under both covariate and semantic shifts.<n>Our key insight is that by separating and consolidating failure-specific reliability knowledge with low-rank adapters, we can enhance the failure detection ability effectively and flexibly.
  arXiv  Detail & Related papers  (2025-04-20T09:20:55Z)
• Refusal Tokens: A Simple Way to Calibrate Refusals in Large Language Models [68.15108215197279]
  A key component of building safe and reliable language models is enabling the models to appropriately refuse to answer certain questions.<n>We propose refusal tokens, one such token for each refusal category or a single refusal token, which are prepended to the model's responses during training.
  arXiv  Detail & Related papers  (2024-12-09T18:40:44Z)
• Indiscriminate Disruption of Conditional Inference on Multivariate Gaussians [60.22542847840578]
  Despite advances in adversarial machine learning, inference for Gaussian models in the presence of an adversary is notably understudied. We consider a self-interested attacker who wishes to disrupt a decisionmaker's conditional inference and subsequent actions by corrupting a set of evidentiary variables. To avoid detection, the attacker also desires the attack to appear plausible wherein plausibility is determined by the density of the corrupted evidence.
  arXiv  Detail & Related papers  (2024-11-21T17:46:55Z)
• Unintentional Unalignment: Likelihood Displacement in Direct Preference Optimization [60.176008034221404]
  Direct Preference Optimization (DPO) and its variants are increasingly used for aligning language models with human preferences.<n>Prior work has observed that the likelihood of preferred responses often decreases during training.<n>We demonstrate that likelihood displacement can be catastrophic, shifting probability mass from preferred responses to responses with an opposite meaning.
  arXiv  Detail & Related papers  (2024-10-11T14:22:44Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.