💬 NLP

The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence

This paper proposes a gradient-based approach to representation engineering to demonstrate that LLM refusal is not governed by a single direction, but rather by multiple, complex, and functionally independent multi-dimensional "concept cones."

Original authors: Tom Wollschläger, Jannes Elstner, Simon Geisler, Vincent Cohen-Addad, Stephan Günnemann, Johannes Gasteiger

Published 2026-02-10

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Tom Wollschläger, Jannes Elstner, Simon Geisler, Vincent Cohen-Addad, Stephan Günnemann, Johannes Gasteiger

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to understand how a high-tech security system in a massive skyscraper works. Most people assume there is just one "Master Switch" that turns the alarms on or off. If you find that switch and flip it, the whole building goes silent.

This paper, "The Geometry of Refusal in Large Language Models," argues that AI security (the part that makes an AI say, "I cannot help you with that harmful request") is much more complex than a single switch. It’s not just one lever; it’s a whole room full of complex dials, sliding panels, and interconnected gears.

Here is the breakdown of their discovery using three simple analogies:

1. From the "Master Switch" to the "Control Room" (Concept Cones)

The Old Idea: Previous researchers thought AI refusal was like a single light switch. If you "flip" the direction of the AI's thoughts toward "refusal," it says no. If you "flip" it away, it says yes.

The New Discovery: The authors found that refusal isn't a single line; it’s a "Concept Cone."

The Analogy: Imagine you are trying to steer a boat. Instead of just having one "Left" or "Right" lever, imagine you have a joystick that can move in many directions within a specific wedge-shaped area. As long as you move the joystick anywhere inside that "cone," the boat turns.
The Meaning: There isn't just one "refusal direction." There is an entire region of mathematical space. You can nudge the AI in thousands of slightly different ways, and as long as you stay within that "cone," the AI will still refuse to be harmful.

2. The "Ghost in the Machine" (Representational Independence)

The Old Idea: Scientists used to think that if two mathematical directions were "perpendicular" (like a North-South line and an East-West line), they were independent. Changing one shouldn't affect the other.

The New Discovery: In an AI, even if two directions look perpendicular on paper, they are often "tangled" together.

The Analogy: Imagine two dancers performing on a stage. Even if they are dancing in different corners of the room (perpendicular), if one dancer performs a massive, heavy stomp, the floor vibrates, and the other dancer loses their balance. They are "mathematically" in different places, but "mechanistically" they are affecting each other.
The Meaning: The researchers created a new, stricter way to find "truly independent" directions—directions that, when messed with, don't cause a "vibration" that affects other parts of the AI's brain. They found that there are multiple, completely separate "gears" driving refusal. One gear might handle "don't help with bombs," while another handles "don't help with hate speech," and they operate independently.

3. The "Precision Surgeon" (Gradient-Based Engineering)

The Problem: Most ways of studying AI are like using a sledgehammer to fix a watch. If you try to "turn off" the refusal mechanism, you often accidentally break the AI's ability to do math or speak English (this is called "over-refusal").

The New Discovery: The authors developed a new tool called RDO (Refusal Direction Optimization).

The Analogy: Instead of using a sledgehammer, they developed a laser-guided scalpel.
The Meaning: Their method allows them to find the exact "nerve" that controls refusal. They can "numb" that nerve (to test if they can bypass safety) without accidentally "paralyzing" the rest of the AI's intelligence. It is much more precise, making it a better tool for both hackers (to find weaknesses) and defenders (to build stronger shields).

Why does this matter?

If you want to protect a city, you need to know if it's protected by one single gate or a complex web of sensors. This paper proves that AI safety is a complex web. By understanding the "geometry" (the shape and structure) of how an AI says "No," we can build much smarter, more robust "digital guards" that are harder to trick and don't accidentally break the AI's helpfulness.

Technical Summary: The Geometry of Refusal in Large Language Models

1. Problem Statement

The safety alignment of Large Language Models (LLMs) is often bypassed by adversarial "jailbreak" attacks. While prior research (notably Arditi et al., 2024) suggested that model refusal is governed by a single linear direction in the activation space, this view is potentially oversimplified. The authors identify a gap in understanding: we do not fully know if refusal is a monolithic mechanism or a collection of independent processes, nor do we know if these mechanisms can be precisely manipulated without causing significant "side effects" (e.g., degrading the model's general intelligence or causing "over-refusal" of benign queries).

2. Methodology

The paper introduces several novel algorithmic frameworks to move beyond simple "difference-in-means" (DIM) extraction methods:

Refusal Direction Optimization (RDO): A gradient-based approach to "representation engineering." Instead of just looking at activation differences, RDO uses a multi-objective loss function to optimize a direction $r$ $r$ that satisfies three properties:
1. Monotonic Scaling: Adding the direction increases refusal probability.
2. Surgical Ablation: Subtracting the direction allows the model to answer harmful prompts without breaking its ability to answer harmless ones.
3. Retain Loss: A KL-divergence-based constraint that ensures intervening with the direction does not change the model's output on benign instructions.
Refusal Cone Optimization (RCO): An extension of RDO to higher dimensions. The authors search for an orthonormal basis that forms a polyhedral cone. Any vector within this cone is optimized to mediate refusal, suggesting refusal is a multi-dimensional volume rather than a single line.
Representational Independence (RepInd): A new criterion to determine if two directions are truly independent. The authors argue that orthogonality is insufficient because non-linear transformations in neural networks can cause orthogonal directions to influence one another. They define Representational Independence as a state where ablating one direction does not change the cosine similarity of the other direction in the residual stream across layers.

3. Key Contributions

Discovery of Concept Cones: Proving that refusal is encoded in multi-dimensional "concept cones" (up to 5D in tested models).
New Metric for Independence: Introducing "Representational Independence" to account for non-linear interactions in LLM layers.
Gradient-Based Engineering: Providing a top-down, optimization-based method (RDO) that is more precise and controllable than previous statistical methods.
Mechanistic Evidence: Demonstrating that multiple, functionally independent refusal mechanisms exist and can be accessed via input perturbations (e.g., GCG adversarial suffixes).

4. Key Results

Superior Precision: RDO-extracted directions outperform the standard DIM method. Specifically, RDO causes significantly fewer side effects on benchmarks like TruthfulQA, ARC, and MMLU.
Complexity of Refusal: The study found that refusal is not a single axis. Sampling multiple directions from a refusal cone leads to higher Attack Success Rates (ASR) than a single direction, implying that different vectors in the cone capture complementary aspects of the refusal mechanism.
Model Scaling: Larger models (e.g., Qwen 2.5 14B) appear to support higher-dimensional refusal cones compared to smaller models, suggesting that increased model capacity allows for more complex, distributed safety mechanisms.
Input Accessibility: The authors showed that adversarial attacks (like GCG) can specifically target and "suppress" these independent refusal directions, proving these directions are not just latent mathematical artifacts but are actively utilized by the model during inference.

5. Significance

This work shifts the paradigm of LLM safety interpretability from a linear/unidimensional view to a geometric/multi-dimensional view.

For Defense: It suggests that "patching" a single refusal direction may be insufficient to prevent jailbreaks, as attackers can exploit other independent directions within the refusal cone. Robust defense requires addressing the entire geometric structure of refusal.
For Interpretability: It provides a rigorous framework (RepInd) for researchers to identify truly independent features in high-dimensional activation spaces, moving beyond the limitations of simple Euclidean orthogonality.
For Alignment: It offers a path toward more "surgical" alignment—improving safety while minimizing the degradation of helpfulness and general reasoning capabilities.