Loading
Life sciences · Preprint
arXiv · September 4, 2026
Raises a question worth testing. It does not answer one.
This preprint proposes that refusal mechanisms in large language models are governed by a single direction in the residual stream that is architecturally portable across transformers and state-space models, alignable via rigid rotation, and can be manipulated to control safety. The work is mechanistic and exploratory, examining internal model representations rather than measuring real-world safety or harm reduction in deployed systems.
Mechanistic interpretability study with controlled interventions across multiple architecture families. Language models spanning four architecture families (SSM, transformer, recurrent, hybrid); no human subjects or deployed system evaluation. Intervention: Removal of aligned refusal direction; detector-triggered gating applied to control the direction. Compared with: Removal of random direction of the same size; trivial rule baseline (fixed refusal when detector fires).
A single direction in the residual stream governs refusal across both transformer and SSM architectures Rigid rotation aligns refusal representations between architectures, allowing cross-architecture probe transfer A harm probe trained on a transformer successfully flags harmful inputs in an SSM after alignment
No measurement of real-world safety outcomes or harm in deployed systems A harm probe trained on a transformer successfully flags harmful inputs in an SSM after alignment
The source did not state who this applies to in practice.
Mechanistic study of language model internals using interpretability techniques; demonstrates a phenomenon across architectures but lacks clinical endpoints, real-world deployment evidence, or peer review.
As stated by the source record.
Quoted from the source exactly as published.
Graded across the dimensions that decide whether you should act, each from what the source actually supports. There is no single score, and where a dimension was not assessed it says so.
Where inside a language model does refusal live, and does that place change when the architecture does? In a transformer, refusal is governed by a single direction in the residual stream, a finding that safety and interpretability tooling now depend on. State-space models (SSMs) route information through a recurrent update instead of attention, sharing no token-mixing mechanism with a transformer. Does the same safety representation survive this shift, or must it be rediscovered per architecture? It survives. A single rigid rotation, which can only reorient a space and not reshape it, aligns one model's representation space with another's, so the two genuinely share the representation. A harm probe trained on a transformer then flags an SSM's harmful inputs, and removing the aligned direction makes a model answer attacks it would otherwise refuse, while a random direction of the same size does far less. What is architecture-specific is not where the direction is steered but where it must be read. Each layer computes a fresh output that is then added into the residual stream, and harm is cleanly readable at this output, the write site, before the addition. A control that holds the intervention's strength fixed shows that what matters is where the direction is estimated, not where it is applied. Applied through a detector-triggered gate, this direction lowers jailbreak success in all four architecture families we test (SSM, transformer, recurrent, hybrid), and on the SSM it holds against an attacker that tunes its prompt against the defense. The gate only matches a trivial rule that returns a fixed refusal whenever the same detector fires, so what transfers across architectures is the direction itself, not defense strength. Safety tooling built on refusal therefore ports to a new architecture by re-estimating the direction at that architecture's write site, not by rebuilding it.
Taken from the source record, never inferred. Follow any of these and new work involving them reaches your briefing.