💬 NLP

Universal Refusal Circuits Across LLMs: Cross-Model Transfer via Trajectory Replay and Concept-Basis Reconstruction

This paper proposes a framework called Trajectory Replay via Concept-Basis Reconstruction that successfully transfers refusal interventions across diverse large language models without target-side supervision, providing strong evidence for the existence of universal, low-dimensional semantic circuits underlying safety alignment.

Original authors: Tony Cristofano

Published 2026-01-27

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Tony Cristofano

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have two different robots, Robot A and Robot B. They were built by different companies, use different blueprints, and speak in slightly different dialects. However, when you ask them a tricky or dangerous question, they both suddenly switch into a "Refusal Mode." They stop answering and say, "I can't do that," in a very specific, robotic way.

Most people think this "Refusal Mode" is unique to each robot's specific brain wiring. But this paper asks a big question: Is there a universal "Refusal Switch" hidden inside all of them?

The authors, led by Tony Cristofano, say yes. They believe that even though the robots look different on the outside, the part of their brain that says "No" is built from the same basic Lego blocks.

Here is how they proved it, using simple analogies:

1. The "Universal Recipe" (Concept Atoms)

Imagine that "Refusal" isn't one giant, messy blob in the robot's brain. Instead, it's a recipe made of specific ingredients.

The authors created a shared "pantry" of 20 basic concepts (like "Deception," "Safety," or "Legal Jargon"). They call these Concept Atoms.
They found that when Robot A refuses, it's just mixing these 20 ingredients in a specific ratio (e.g., 50% "Safety" + 30% "Legal Jargon").
The big discovery? Robot B uses the exact same recipe. Even though Robot B was built differently, its "Refusal" is made of the same ingredients in the same proportions.

2. The "Trajectory Replay" (Copying the Dance)

Usually, if you try to fix Robot A's refusal by poking its brain, you might accidentally break its ability to do math or write poetry. This is because the "Refusal" wires are tangled with the "Smart" wires.

To fix this without breaking anything, the authors used a technique called Trajectory Replay:

Step 1: Map the Dance. They watched how Robot A moves through its brain layers when it refuses. They didn't just look at one spot; they watched the whole sequence of steps.
Step 2: Translate the Steps. They used a "translator" (Dynamic Time Warping) to match Robot A's steps to Robot B's steps. Even if Robot B has more layers or fewer layers, they figured out which step in Robot A corresponds to which step in Robot B.
Step 3: Replay the Recipe. They took the "Refusal Recipe" from Robot A and replayed it inside Robot B, but only in the specific layers where the refusal happens.

3. The "Safety Shield" (Weight-SVD Guard)

There was one big risk: What if the "Refusal Recipe" accidentally hits a "Math" or "Logic" wire in Robot B? That would make Robot B dumb.

To prevent this, they added a Safety Shield:

They looked at Robot B's brain and identified the "Super Highways" where the most important skills (like math and coding) live. These are the "high-variance" areas.
They built a shield that pushes the "Refusal Recipe" away from these Super Highways.
The Result: They successfully turned off the "Refusal Mode" in Robot B without damaging its ability to do math or write code.

The Big Experiment

They tested this on 8 different pairs of robots, including:

Small robots vs. Big robots.
Robots from different families (like Qwen vs. Ministral).
Robots with different architectures (one was a standard "Dense" brain, the other was a complex "Mixture of Experts" brain).

The Outcome:
In almost every case, they successfully transferred the "Refusal Recipe" from one robot to another.

Refusal dropped: The target robots stopped saying "I can't do that" to harmful questions.
Skills stayed: The robots could still solve math problems and write code just as well as before.
No cheating: They didn't need to show the target robot any "bad" examples to teach it how to stop refusing. They just used the "recipe" from the donor robot.

Why This Matters (According to the Paper)

The paper concludes that safety alignment isn't random magic. It seems to be a universal, low-dimensional structure that different AI models build in similar ways.

Important Note on Safety:
The authors are very careful to say this is a diagnostic tool (a way to study how AI brains work), not a tool to be used in the real world to break safety. They explicitly warn that because this method can turn off safety filters, it has a "dual-use" risk. They released the "safe" parts of their code (the pantry of concepts) but kept the "harmful" parts (the specific bad questions used to train the donor) private to prevent misuse.

In short: They proved that AI refusal is like a universal language. If you know the grammar of how one AI says "No," you can teach a completely different AI to stop saying "No," without breaking its brain.

Technical Summary: Universal Refusal Circuits Across LLMs

1. Problem Statement

Aligned Large Language Models (LLMs) frequently exhibit "refusal behavior," declining to answer specific classes of prompts in a stylized manner. While prior research has identified that refusal can be modulated via low-rank interventions in internal representations, naive edits often cause "collateral damage," including capability loss, style drift, and unintended behavioral changes due to polysemantic entanglement.

The central mechanistic question addressed by this paper is: Are refusal circuits universal across LLMs? Specifically, can a refusal circuit extracted from a "donor" model be transferred to a "target" model (potentially with different architectures, scales, or training regimes) to attenuate refusal without using any refusal-specific supervision on the target model? The authors treat refusal ablation as a measurement tool for circuit universality rather than a deployment recommendation.

2. Methodology: Trajectory Replay via Concept-Basis Reconstruction

The proposed framework, Trajectory Replay, transfers refusal interventions from a donor to a target model by reconstructing the semantic composition of refusal using a shared vocabulary of "concept atoms." The process operates under a strict information budget ( $B_0$ ), where the target model is never exposed to harmful prompts or refusal labels.

The methodology consists of four stages:

Stage 1: Semantic Layer Alignment

To map the donor's refusal trajectory to the target, layers are aligned based on the correlation structure of concept atoms rather than layer index.

Concept Atom Registry (CAR): A shared set of directions computed from disjoint prompt sets representing specific concepts (e.g., "Deception," "Safety Flagging"). These serve as a shared vocabulary between models.
Gram Fingerprints: The correlation structure (Gram matrix) of the concept atoms is computed for each layer.
Dynamic Time Warping (DTW): Donor layers are mapped to target layers by minimizing the distance between their Gram fingerprints. This ensures monotonicity and continuity, preventing layer permutation artifacts and accommodating architectural differences (e.g., Dense vs. MoE).

Stage 2: Concept-Basis Reconstruction

The refusal direction is decomposed into a "recipe" of concept atoms in the donor and reconstructed in the target.

Donor Decomposition: A "clean" refusal direction ( $r_{D, clean}$ ) is extracted from the donor (using Surgical Refusal Ablation, SRA) and expressed as a linear mixture of donor concept atoms ( $A_D$ ) via ridge regression to find coefficients $w$ .
Target Reconstruction: The same coefficient vector $w$ (the "recipe") is applied to the target's concept atoms ( $A_T$ ) to reconstruct a target refusal direction: $\tilde{r}_T = A_T w$ . This operationalizes the hypothesis that refusal is a stable mixture over shared concept atoms.

Stage 3: Weight-SVD Stability Guard

To prevent the intervention from damaging core capabilities, the reconstructed direction is projected away from high-variance subspaces of the weight matrices.

Rationale: Fundamental capabilities (syntax, logic) are hypothesized to reside in high-variance principal components of the weight matrices, while specific semantic inhibitions (refusal) exist in lower-rank subspaces.
Implementation: The intervention direction is projected onto the null space of the top- $k$ right singular vectors of the edited weight matrix. The threshold $k$ is selected to keep the degradation in benign perplexity (on a validation set like WikiText) below a predefined threshold (e.g., <1%).

Stage 4: Replay

The stabilized, reconstructed direction is applied as a rank-one suppression update to the output projection matrices (O-proj) of the aligned transformer blocks in the target model.

3. Key Contributions

Semantic Universality Hypothesis (Operationalized): The paper proposes that refusal is most stable in concept space, characterized by a model-agnostic mixture over shared concept atoms.
Trajectory Replay Framework: A donor-to-target transfer protocol that utilizes a shared registry of concept atoms to reconstruct refusal directions without target-side refusal supervision.
Weight-SVD Stability Guard: A mechanism to prevent capability collapse by projecting interventions away from principal weight-space subspaces, analogous to null-space constraints in model editing.
Rigorous Evaluation and Audit: An evaluation across 8 model pairs (including Dense-to-MoE and cross-family transfers) with an explicit "knob/budget audit" to ensure no hidden tuning occurred on the target side.

4. Experimental Results

The framework was evaluated on 8 donor/target pairs, including cross-family transfers (Qwen3-VL $\leftrightarrow$ Ministral), reverse transfers, and architectural stress tests (Dense $\to$ MoE, Dense $\to$ Reasoning-Tuned).

Refusal Attenuation: The transferred recipes consistently attenuated refusal rates. For example, in the Qwen3-VL-2B $\to$ Ministral-3-14B transfer, the refusal rate dropped from 0.98 to 0.02. In the Dense $\to$ Reasoning (GLM-4.6V) transfer, the refusal rate dropped to 1%.
Capability Preservation: Across all pairs, performance on benign tasks (GSM8K for math, MBPP for coding) remained stable. In the GLM-4.6V transfer, there was even a slight positive delta in math and code accuracy, suggesting the removal of refusal circuits may reduce interference with reasoning capabilities.
Control Validations: Ablation studies confirmed the effect is specific to the semantic recipe.
- Random-direction and Unrelated-concept transfers failed to reduce refusal.
- Wrong-map (permuted layers) caused significant capability degradation.
- No-guard (disabling SVD projection) resulted in catastrophic perplexity degradation and capability collapse, validating the necessity of the stability guard.

5. Significance and Claims

The paper claims to provide strong evidence for the semantic universality of safety alignment. It suggests that refusal is not an opaque, model-specific artifact but is implemented via a semantically universal circuit—a stable mixture over a shared concept neighborhood.

Mechanistic Insight: The "recipe" ( $w$ ) functions as a cross-model semantic coordinate system, allowing a donor to decompose refusal into shared atoms that the target can re-instantiate in its own representational basis.
Dual-Use Acknowledgement: The authors explicitly acknowledge the dual-use risk: while the method is framed as a diagnostic tool to measure circuit similarity, the same techniques could theoretically be repurposed to bypass safety guardrails in aligned models.
Limitations: The authors note that efficacy depends on the coverage of the Concept Atom Registry (CAR). If refusal operates on semantic features orthogonal to the 20-concept basis used (e.g., complex visual safety constraints), reconstruction may fail. Additionally, the method is strictly white-box, requiring access to weights and activations.

The work reframes refusal editing as a test for cross-model circuit universality, supporting the hypothesis that diverse training pipelines can produce similar semantic gating structures.