HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment
Understanding how aligned LLMs internally represent safety is critical for diagnosing alignment vulnerabilities, as it explains why jailbreaks succeed and informs the design of robust alignment strategies. Prior work shows that aligned LLMs encode harmfulness and refusal as separable directions in the residual stream at prompt-side token positions. We show that jailbreaks succeed at prompt encoding by suppressing either the refusal or harmfulness direction before any token is generated, with distinct attack classes occupying separable regions of the harmfulness-refusal plane. Extending the analysis to response-token positions, we find that the model recognizes harmful content while it is ...
| Authors | Shei Pern Chua, Hao Wu, Qianli Ma et al. |
|---|---|
| Primary category | cs.AI |
| Published | 1 July 2026 |
| Last updated at source | 8 July 2026 |
Connected in the knowledge graph
- microsoft/HARC-Qwen2.5-7B-InstructModel · cited by
- microsoft/HARC-Llama-3.1-8B-InstructModel · cited by
Models and datasets referencing this paper
Silytics shows public metadata from arXiv and links to the original. Information may be incomplete or out of date. Last refreshed 17 October 2026. Licenses and terms of the original apply to the work itself. Not financial, legal or professional advice.