AI models separate harmfulness detection from refusal responses, researchers discover

Researchers have uncovered a fundamental distinction in how large language models handle safety: they maintain separate internal representations for detecting harmful content and deciding whether to refuse requests. This finding could reshape how developers approach AI safeguards.

How models encode safety#

Previous safety research focused on a single "refusal direction"—an internal pathway that appears to drive models' rejection of harmful instructions. But the new work identifies an additional dimension: a harmfulness direction that independently encodes the model's perception of whether content is actually harmful. These two mechanisms operate as distinct, parallel systems within the model's neural architecture rather than as parts of a unified safety framework.

Steering versus judgment#

Manipulating the harmfulness direction produces markedly different effects than manipulating the refusal direction. When researchers steered models along the harmfulness pathway, they could trick them into perceiving benign instructions as dangerous—yet steering along the refusal direction simply triggered rejection responses without altering the model's underlying judgment about whether something is genuinely harmful. This separation suggests that refusals and harm perception function as independent cognitive processes.

Implications for jailbreaks and adversarial attacks#

The framework explains why certain jailbreak techniques work: they reduce refusal signals while leaving the model's internal sense of harmfulness intact. Similarly, when researchers adversarially finetuned models to accept harmful instructions, the models' latent understanding of harmfulness barely budged—only their willingness to act changed. This disconnect points to a vulnerability in how current safety approaches operate.

A new safeguard approach#

The findings led to a practical application called Latent Guard, which leverages a model's encoded harmfulness representation as an intrinsic safety layer. Rather than relying purely on refusal behavior, Latent Guard monitors the model's internal perception of harm. In testing, it matched or surpassed the performance of Llama Guard 3 8B—a dedicated, separately trained safety model—while also reducing false alarms that block harmless requests.