HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment

• URL: http://arxiv.org/abs/2607.00572v3
• Date: Wed, 08 Jul 2026 05:02:03 GMT
• Title: HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment
• Abstract summary: We show that aligned LLMs encode harmfulness and refusal as separable directions in the residual stream at prompt-side token positions.<n>We introduce HARC, a fine-tuning method that pairs the two directions across both prompt and response positions.
• Score: 23.776344382492997
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Understanding how aligned LLMs internally represent safety is critical for diagnosing alignment vulnerabilities, as it explains why jailbreaks succeed and informs the design of robust alignment strategies. Prior work shows that aligned LLMs encode harmfulness and refusal as separable directions in the residual stream at prompt-side token positions. We show that jailbreaks succeed at prompt encoding by suppressing either the refusal or harmfulness direction before any token is generated, with distinct attack classes occupying separable regions of the harmfulness-refusal plane. Extending the analysis to response-token positions, we find that the model recognizes harmful content while it is generating that content, even when it failed to recognize the input as harmful at the prompt side. Motivated by our findings, we introduce HARC (Harmfulness-And-Refusal Coupling), a fine-tuning method that pairs the two directions across both prompt and response positions. Since the intervention is confined to the harmfulness-refusal subspace, it leaves the rest of the residual stream intact and does not degrade general capability or inflate over-refusal. Across extensive experiments, HARC achieves the strongest robustness-capability-usability trade-off among six baselines spanning the major training-time and inference-time safety methods. The harmfulness and refusal directions at prompt and response positions transfer across the five model families and two scales we tested without architecture-specific tuning.

Related papers

• From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling [23.223636694641502]
  Large Language Models (LLMs) are vulnerable to generating unsafe content under adversarial prompting.<n>We study safety from a mechanistic interpretability perspective and characterize a multi-stage *safety circuit*<n>We show that suppressing upstream Harmful Detection Heads disrupts downstream refusal behavior and that safety neurons mediate this interaction.
  arXiv  Detail & Related papers  (2026-08-30T08:01:42Z)
• Mitigating Reasoning-Induced Misalignment via Safety-Direction Penalty [8.24007829496575]
  Fine-tuning on reasoning data contains no harmful content, including mathematics, code, and problem-solving with chain-of-thought traces can induce harmful behaviors of LLM.<n>We provide a representation-space analysis of RIM and the Safety-Direction Penalty (SDP), which penalizes movement along a learned safety direction during reasoning fine-tuning.<n>On Qwen2.5-3B and 7B, SDP restores safety while preserving benchmark reasoning performance.
  arXiv  Detail & Related papers  (2026-08-24T16:57:28Z)
• SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense [77.70598852234149]
  Text-to-Video (T2V) generative models are vulnerable to jailbreak attacks in real-world deployment.<n>We propose SafeCA, a feature-level defense mechanism for safe cross-attention localization and regularization.<n> Experimental results show that SafeCA reduces the jailbreak success rate by about 20% on mainstream T2V models.
  arXiv  Detail & Related papers  (2026-08-11T14:01:24Z)
• Safety in Batches? Understanding and Mitigating Safety Failures in Batch Prompting [31.723003820235448]
  We show that a harmful question reliably refused in isolation can elicit a harmful response when embedded in a batch of benign questions.<n>We identify this as a distinct safety failure mode, not reducible to known vulnerabilities such as in-context learning or long-context effects.<n>We show that batch-aware preference optimization effectively mitigates the vulnerability.
  arXiv  Detail & Related papers  (2026-08-03T01:07:56Z)
• From Refusal Geometry to Safety Geometry: Harmfulness--Refusal Coupling under Dynamic Adversarial Fine-Tuning [14.6508023458559]
  Existing evaluations do not reveal whether a model has learned to recognize harmfulness.<n>We study this question with a dual safety-geometry protocol that measures harmfulness carriers, refusal carriers, and their coupling.
  arXiv  Detail & Related papers  (2026-06-15T07:50:00Z)
• Into the Gray Zone: Domain Contexts Can Blur LLM Safety Boundaries [73.1205700856963]
  Jargon is a framework combining safety-research contexts with adversarial interactions that achieves attack success rates exceeding 93%.<n>We show that Jargon queries occupy an intermediate region between benign and harmful inputs, a gray zone where refusal decisions become unreliable.<n>We design a policy-guided safeguard that steers models toward helpful yet harmless responses, and internalize this capability through alignment fine-tuning.
  arXiv  Detail & Related papers  (2026-04-17T05:40:42Z)
• Attributing and Exploiting Safety Vectors through Global Optimization in Large Language Models [50.91504059485288]
  We propose a framework that identifies safety-critical attention heads through global optimization over all heads simultaneously.<n>We develop a novel inference-time white-box jailbreak method that exploits the identified safety vectors through activation repatching.
  arXiv  Detail & Related papers  (2026-01-22T09:32:43Z)
• ARMOR: Aligning Secure and Safe Large Language Models via Meticulous Reasoning [64.32925552574115]
  ARMOR is a large language model that analyzes jailbreak strategies and extracts the core intent.<n> ARMOR achieves state-of-the-art safety performance, with an average harmful rate of 0.002 and an attack success rate of 0.06 against advanced optimization-based jailbreaks.
  arXiv  Detail & Related papers  (2025-07-14T09:05:54Z)
• Does Representation Intervention Really Identify Desired Concepts and Elicit Alignment? [73.80382983108997]
  Representation intervention aims to locate and modify the representations that encode the underlying concepts in Large Language Models.<n>If the interventions are faithful, the intervened LLMs should erase the harmful concepts and be robust to both in-distribution adversarial prompts and the out-of-distribution jailbreaks.<n>We propose Concept Concentration (COCA), which simplifies the decision boundary between harmful and benign representations.
  arXiv  Detail & Related papers  (2025-05-24T12:23:52Z)
• Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs [54.90315421117162]
  We propose a novel poisoning method via completely harmless data.<n>Inspired by the causal reasoning in auto-regressive LLMs, we aim to establish robust associations between triggers and an affirmative response prefix.<n>We observe an interesting resistance phenomenon where the LLM initially appears to agree but subsequently refuses to answer.
  arXiv  Detail & Related papers  (2025-05-23T08:13:59Z)
• Improving LLM Safety Alignment with Dual-Objective Optimization [81.98466438000086]
  Existing training-time safety alignment techniques for large language models (LLMs) remain vulnerable to jailbreak attacks.<n>We propose an improved safety alignment that disentangles DPO objectives into two components: (1) robust refusal training, which encourages refusal even when partial unsafe generations are produced, and (2) targeted unlearning of harmful knowledge.
  arXiv  Detail & Related papers  (2025-03-05T18:01:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.