Detection Is Cheap, Routing Is Learned: Why Refusal-Based Alignment Evaluation Fails

• URL: http://arxiv.org/abs/2603.18280v1
• Date: Wed, 18 Mar 2026 20:54:34 GMT
• Title: Detection Is Cheap, Routing Is Learned: Why Refusal-Based Alignment Evaluation Fails
• Abstract summary: We study political censorship in Chinese-origin language models as a natural experiment.<n>We use probes, surgical ablations, and behavioral tests across nine open-weight models from five labs.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Current alignment evaluation mostly measures whether models encode dangerous concepts and whether they refuse harmful requests. Both miss the layer where alignment often operates: routing from concept detection to behavioral policy. We study political censorship in Chinese-origin language models as a natural experiment, using probes, surgical ablations, and behavioral tests across nine open-weight models from five labs. Three findings follow. First, probe accuracy alone is non-diagnostic: political probes, null controls, and permutation baselines can all reach 100%, so held-out category generalization is the informative test. Second, surgical ablation reveals lab-specific routing. Removing the political-sensitivity direction eliminates censorship and restores accurate factual output in most models tested, while one model confabulates because its architecture entangles factual knowledge with the censorship mechanism. Cross-model transfer fails, indicating that routing geometry is model- and lab-specific. Third, refusal is no longer the dominant censorship mechanism. Within one model family, hard refusal falls to zero while narrative steering rises to the maximum, making censorship invisible to refusal-only benchmarks. These results support a three-stage descriptive framework: detect, route, generate. Models often retain the relevant knowledge; alignment changes how that knowledge is expressed. Evaluations that audit only detection or refusal therefore miss the routing mechanism that most directly determines behavior.

Related papers

• Recognition-Refusal Misalignment in LLMs: Why Models Answer Structurally Unanswerable Questions [3.5960840052850642]
  Large language models often answer structurally unanswerable questions, such as computing cot(-540) or evaluating (1).startswith("1").<n>We ask whether this failure reflects missing recognition or failed routing from recognition to abstention.<n>Across instruction-tuned models from 1.7B to 70B parameters, a single linear direction in the hidden state separates answerable from structurally impossible math and code prompts.
  arXiv  Detail & Related papers  (2026-08-29T07:38:17Z)
• Divergent Response Modes in Frontier Language Models Under Steering Pressure [0.0]
  This study evaluates behavioral steerability across six frontier models from six developers using 300 paired base and steered items over three categories: values-conflict, reasoning-elicitation, and reasoning-suppression.<n>We find that models differ not just in how much steering shifts their behavior but in what kind of response they give, and some response modes appear in only one or two of them.
  arXiv  Detail & Related papers  (2026-08-06T20:48:14Z)
• They Infer What You Meant: Models Represent Communicative Intent More Reliably Than They Act On It [0.0]
  We show that the failure of a language model to decode the sender's intent is one of readouts on top of a robust representation.<n>A linear probe decodes the sender's intent, whether they want a thing recognized or evaluated, across six models and four families and in the base checkpoints.<n>The behavioral half of the story is established on the recognize/evaluate contrast, where what varies is whether the default output acts on the intent.
  arXiv  Detail & Related papers  (2026-07-03T20:49:37Z)
• DriftScope: Measuring The Hidden Effects of Diffusion Model Adaptation [50.584834483403675]
  Adapting pre-trained text-to-image diffusion models, whether to learn new visual concepts or erase unwanted ones, is routinely evaluated on its intended effects alone.<n>We demonstrate that adaptation systematically damages semantically unrelated concepts in ways that aggregate metrics structurally cannot surface.<n>We introduce DriftScope, a prompt-level diagnostic tool that takes any two model checkpoints and returns a ranked list of tokens whose visual concepts have shifted most between them.
  arXiv  Detail & Related papers  (2026-06-30T20:57:51Z)
• Internal-State Probes Read the Situation, Not the Action: Three Negative Results for Pre-Action Misalignment Monitoring [1.3636639880574484]
  Internal readouts could help monitor agentic systems if they identify harmful text or tool actions before those actions are generated.<n>We test three methods across three model families: a Qwen2.5-Coder-32B-Instruct fine-tune/base direction, Llama-3.1-8B-Instruct probes at the last token of unsafe prefills, and Gemma-3-27B-IT emotion-concept vectors used for projection and steering.
  arXiv  Detail & Related papers  (2026-06-29T15:18:36Z)
• Prefill Awareness in Large Language Models [42.57596462680195]
  We investigate whether language models can distinguish between tampered and untampered assistant-side context.<n>We find that frontier models show substantial prefill awareness.<n>Our results indicate that prefill awareness is already a substantial confound for some prefill-based methods.
  arXiv  Detail & Related papers  (2026-06-10T23:26:39Z)
• CIAware-Bench: Benchmarking Control Intervention Awareness Across Frontier LLMs [100.38986535324284]
  We introduce textbfCIAware-Bench, a benchmark for measuring textbfcontrol textbfintervention (CI) awareness across frontier models.<n>CIAware-Bench tests whether models can distinguish their own trajectories from those modified by a control intervention.
  arXiv  Detail & Related papers  (2026-06-09T16:24:16Z)
• Pando: Do Interpretability Methods Work When Models Won't Explain Themselves? [53.07826484214082]
  We introduce Pando, a model-organism benchmark that breaks this confound via an explanation axis.<n>Pando predicts held-out model decisions from $10$ labeled query-response pairs.<n>When explanations are faithful, black-box elicitation matches or exceeds all white-box methods.
  arXiv  Detail & Related papers  (2026-04-13T06:42:24Z)
• To Search or Not to Search: Aligning the Decision Boundary of Deep Search Agents via Causal Intervention [61.82680155643223]
  We identify the root cause of misaligned decision boundaries, the threshold determining when accumulated information suffices to answer.<n>This causes over-search (redundant searching despite sufficient knowledge) and under-search (premature termination yielding incorrect answers.<n>We propose a comprehensive framework comprising two key components. First, we introduce causal intervention-based diagnosis that identifies boundary errors.<n>Second, we develop Decision Boundary Alignment for Deep Search agents (DAS)<n>Our DAS method effectively calibrates these boundaries, mitigating both over-search and under-search to achieve substantial gains in accuracy and efficiency.
  arXiv  Detail & Related papers  (2026-02-03T09:29:06Z)
• How Does Prefix Matter in Reasoning Model Tuning? [57.69882799751655]
  We fine-tune three R1 series models across three core model capabilities: reasoning (mathematics), coding, safety, and factuality.<n>Results show that prefix-conditioned SFT improves both safety and reasoning performance, yielding up to +6% higher Safe@1 accuracy.
  arXiv  Detail & Related papers  (2026-01-04T18:04:23Z)
• The 'Sure' Trap: Multi-Scale Poisoning Analysis of Stealthy Compliance-Only Backdoors in Fine-Tuned Large Language Models [10.377264470934843]
  Backdoor attacks on large language models typically couple a secret trigger to an explicit malicious output.<n>We introduce a compliance-only backdoor: supervised fine-tuning on a mostly benign dataset in which a small subset of prompts is suffixed with an arbitrary single-word trigger.<n>We conduct a multi-scale analysis of this benign-label poisoning behavior across poison budget, total fine-tuning dataset size, and model size.
  arXiv  Detail & Related papers  (2025-11-16T02:01:58Z)
• A Granular Study of Safety Pretraining under Model Abliteration [64.24346997570275]
  We study model abliteration, a lightweight projection technique designed to remove refusal-sensitive directions.<n>We issue 100 prompts with balanced harmful and harmless cases, classify responses as **Refusal** or **Non-Refusal** using multiple judges, and validate judge fidelity.<n>Our study produces a checkpoint-level characterization of which data-centric safety components remain robust under abliteration.
  arXiv  Detail & Related papers  (2025-10-03T07:01:45Z)
• Demystifying deep search: a holistic evaluation with hint-free multi-hop questions and factorised metrics [89.1999907891494]
  We present WebDetective, a benchmark of hint-free multi-hop questions paired with a controlled Wikipedia sandbox.<n>Our evaluation of 25 state-of-the-art models reveals systematic weaknesses across all architectures.<n>We develop an agentic workflow, EvidenceLoop, that explicitly targets the challenges our benchmark identifies.
  arXiv  Detail & Related papers  (2025-10-01T07:59:03Z)
• BURN: Backdoor Unlearning via Adversarial Boundary Analysis [73.14147934175604]
  Backdoor unlearning aims to remove backdoor-related information while preserving the model's original functionality.<n>We propose Backdoor Unlearning via adversaRial bouNdary analysis (BURN), a novel defense framework that integrates false correlation decoupling, progressive data refinement, and model purification.
  arXiv  Detail & Related papers  (2025-07-14T17:13:06Z)
• Discovering Forbidden Topics in Language Models [26.2418673687851]
  We develop a refusal discovery method that uses token prefilling to find forbidden topics.<n>We benchmark IPC on Tulu-3-8B, an open-source model with public safety tuning data.<n>Our findings highlight the critical need for refusal discovery methods to detect biases, boundaries, and alignment failures of AI systems.
  arXiv  Detail & Related papers  (2025-05-23T03:49:06Z)
• Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning [38.00013408742201]
  Censorship of the domain name system (DNS) is a key mechanism used across different countries. In this paper, we explore how machine learning (ML) models can help streamline the detection process. We find that unsupervised models, trained solely on uncensored instances, can identify new instances and variations of censorship missed by existing probes.
  arXiv  Detail & Related papers  (2023-02-03T23:36:30Z)
• Towards Stochastic Fault-tolerant Control using Precision Learning and Active Inference [3.6536977425574664]
  This work presents a fault-tolerant control scheme for sensory faults in robotic manipulators based on active inference. In the majority of existing schemes, a binary decision of whether a sensor is healthy (functional) or faulty is made based on measured data. We propose a fault-tolerant scheme based on active inference and precision learning which does not require a priori threshold definitions to trigger fault recovery.
  arXiv  Detail & Related papers  (2021-09-13T11:14:19Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.