HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment
06:00 · July 2, 2026 · arXiv cs.AI RSS
Understanding how aligned LLMs internally represent safety is critical for diagnosing alignment vulnerabilities, as it explains why jailbreaks succeed and informs the design of robust alignment strategies. Prior work shows that aligned LLMs encode harmfulness and refusal as separable directions in the residual stream at prompt-side token positions. We show that jailbreaks succeed at prompt encoding by suppressing either the refusal or harmfulness direction before any token is generated, with distinct attack classes occupying separable regions of the harmfulness-refusal plane. Extending the analysis to response-token positions, we find that the model recognizes harmful content while it is generating that content, even when it failed to recognize the input as harmful at the prompt side. Motivated by our findings, we introduce HARC (Harmfulness-And-Refusal Coupling), a fine-tuning method that pairs the two directions across both prompt and response positions. Since the intervention is confined to the harmfulness-refusal subspace, it leaves the rest of the residual stream intact and does not degrade general capability or inflate over-refusal. Across extensive experiments, HARC achieves the strongest robustness-capability-usability trade-off among six baselines spanning the major training-time and inference-time safety methods. The harmfulness and refusal directions at prompt and response positions transfer across the five model families and two scales we tested without architecture-specific tuning.
Summary
Aligned large language models encode harmfulness and refusal as distinct linear directions in the residual stream. Prior work identified a refusal direction at the post-instruction token position and a separate harmfulness direction at the final instruction token. Analysis of successful jailbreaks shows that these attacks suppress one or both directions during prompt encoding, placing different attack families in separable regions of the resulting two-dimensional plane. The model therefore registers the input as non-harmful and produces no refusal signal before generation begins.
Extending the same extraction procedure to response-token positions reveals that the model continues to detect harmful content while generating it, even when prompt-side detection failed. The four directions—prompt and response versions of both concepts—remain linearly separable and become nearly orthogonal in later layers. This structure appears consistently across five instruction-tuned model families at two scales, indicating it is a general property of current alignment rather than an artifact of any single architecture.
HARC exploits these observations by fine-tuning only within the two-dimensional harmfulness–refusal subspace. An additive margin hinge loss couples the directions at both prompt and response positions, so that activation along either vector reliably triggers refusal. Because the intervention leaves the remainder of the residual stream unchanged, general capabilities and over-refusal rates stay comparable to the base model. Across four jailbreak suites, two over-refusal benchmarks, and five capability evaluations, HARC records the strongest robustness–capability–usability trade-off among six representative training-time and inference-time baselines. The extracted directions transfer directly to other model families without per-architecture retuning.
Why it matters
High technical depth and novelty on LLM safety directly support Dutch/EU priorities in ethical, transparent AI. Actionable for researchers developing robust alignment techniques under the AI Act context.
