💬 NLP

Over-Refusal and Representation Subspaces: A Mechanistic Analysis of Task-Conditioned Refusal in Aligned LLMs

This paper provides a mechanistic analysis revealing that while harmful refusal is governed by a single global vector, over-refusal arises from task-dependent, higher-dimensional subspaces within benign task clusters, explaining why global ablation fails and necessitating task-specific geometric interventions.

Original authors: Utsav Maskey, Mark Dras, Usman Naseem

Published 2026-03-31

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Utsav Maskey, Mark Dras, Usman Naseem

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Problem: The Over-Protective Bouncer

Imagine a large language model (like a very smart robot) is working as a bouncer at a club.

Harmful Refusal (The Good Job): A person tries to sneak in a bomb. The bouncer stops them. This is correct.
Over-Refusal (The Mistake): A person tries to bring in a harmless but slightly scary-looking prop (like a fake plastic gun for a movie). The bouncer panics, thinks it's real, and kicks them out. This is a mistake.

The researchers wanted to fix the bouncer's panic. They tried a common trick: they found the "direction" in the bouncer's brain that says "STOP!" and tried to turn that dial down.

The Result? It worked for the bombs, but it made the bouncer worse at spotting the fake props. The bouncer started letting bombs in while still kicking out the movie props.

Why did this happen? This paper explains the geometry (the shape and layout) of the bouncer's brain to show why the "one-size-fits-all" fix failed.

The Discovery: Two Different Kinds of "No"

The researchers discovered that the bouncer uses two completely different mental maps to say "No."

1. The Universal "No" (Harmful Requests)

When the bouncer sees a real bomb, the brain lights up in a very specific, consistent way.

Analogy: Imagine a giant, bright red Stop Sign that is the same size and shape no matter what kind of bomb it is.
The Science: Whether the request is about chemistry, violence, or hacking, the "Harmful Refusal" signal is a single, straight line in the brain. It doesn't care what the task is; it just screams "DANGER!"
The Fix: Because it's a single straight line, you can easily erase it or push it away. This is why the old "global ablation" method worked for stopping real harm.

2. The Local "No" (Over-Refusal)

When the bouncer mistakenly rejects a safe request (like analyzing a movie script about a crime), the brain lights up differently.

Analogy: Imagine the bouncer is wearing different colored glasses depending on the job.
- If the job is Translation, the "No" signal is a tiny, wobbly blue dot hidden inside the "Translation" cluster.
- If the job is Sentiment Analysis, the "No" signal is a tiny, wobbly green dot hidden inside the "Sentiment" cluster.
The Science: The "Over-Refusal" signal isn't a single line. It's a cloud that changes shape and location depending on the task. It hides inside the normal work the bouncer is doing.
The Problem: When the researchers tried to erase the "Universal Stop Sign" (the red line), they accidentally brushed against the blue and green dots too. But because the dots are in different places and have different shapes, erasing the red line didn't actually fix the blue and green dots. It just messed up the bouncer's ability to see the bombs.

The Visual Proof: The Map of the Brain

The researchers used a tool called PCA (think of it as a 3D map maker) to look inside the model's brain layers.

Top Row (Harmful Refusal): If you look at the map, all the "Stop" signals from different tasks merge into one single arrow pointing in the same direction. It's like a highway where all traffic flows the same way.
Bottom Row (Over-Refusal): If you look at the map for the mistakes, the signals scatter. They don't merge. They stay stuck in their own little neighborhoods (Task Clusters). There is no single arrow you can draw to fix them all.

The Solution: Custom Keys, Not a Master Key

The paper concludes that you cannot use a "Master Key" (a global fix) to unlock a "Over-Refusal" door because the locks are different in every room.

The Old Way: Try to break down the door by hitting it with a giant sledgehammer (Global Ablation). You might break the lock, but you also smash the whole wall.
The New Way: Use a Task-Conditioned Key.
- If the bouncer is doing Translation, use a specific key for Translation.
- If the bouncer is doing Sentiment Analysis, use a specific key for that.

The researchers showed that when they used these specific, task-aware keys, they could stop the bouncer from kicking out the movie props without letting the bombs in.

Summary in One Sentence

The paper proves that "saying no" to real danger is a simple, universal signal, but "saying no" by mistake is a complex, task-specific mess; therefore, you can't fix the mistakes by just turning down the volume on the universal signal—you need a custom fix for every specific job.

1. Problem Statement

Large Language Models (LLMs) aligned for safety exhibit two distinct refusal behaviors:

Harmful-Refusal: The correct behavior where the model declines genuinely dangerous or policy-violating requests.
Over-Refusal: An error where the model incorrectly declines safe instructions because they contain sensitive phrasing or resemble harmful inputs (e.g., analyzing the sentiment of a violent sentence or translating a dangerous chemical formula).

Current mitigation strategies often rely on Representation Steering (specifically, ablation of a global "refusal direction" derived via Difference-in-Means, or DIM). While effective for harmful-refusal, these global interventions fail to solve over-refusal and often degrade safety performance. The paper posits that this failure is not incidental but structural: the geometric representation of over-refusal differs fundamentally from that of harmful-refusal.

2. Methodology

The authors conducted a mechanistic interpretability study on LLaMA-3.1-8B-Instruct using a dataset of 270 samples across five NLP tasks (Sentiment Analysis, Translation, RAG-style QA, Rephrasing, and Cryptanalysis).

Key Techniques:

Geometric Analysis:
- Difference-in-Means (DIM): Extracted refusal vectors ( $\hat{r}$ ) by calculating the mean activation difference between refused and compliant samples in the residual stream.
- Principal Component Analysis (PCA): Visualized the dimensionality and clustering of refusal samples.
- Silhouette Scores: Measured cluster separation to determine if refusal types form distinct groups or reside within task-specific clusters.
- Variance Analysis: Calculated the number of principal components ( $n_{80}$ ) required to explain 80% of the variance to determine the dimensionality of the refusal subspaces.
Linear Probing: Trained logistic regression classifiers on layer activations to determine when and how well refusal types (harmful vs. over) and task identities are linearly separable.
Causal Patching: Systematically replaced attention head activations from non-refusing prompts into refusing prompts to identify causal bottlenecks (heads that, when patched, flip the refusal decision).
Intervention Experiments:
- Global Ablation: Projected out the global harmful-refusal vector from the residual stream.
- Task-Conditioned Steering: Applied steering vectors specific to the task identity (using the "Safe-Constellations" method).

3. Key Findings & Results

A. Geometric Distinction

Harmful-Refusal is Task-Agnostic:
- Refusal directions for harmful inputs converge to a single global vector across different tasks and mid-layers.
- It resides in a low-dimensional subspace (concentrated variance).
- A single global DIM vector effectively mediates this behavior.
Over-Refusal is Task-Dependent:
- Over-refusal directions diverge across tasks and do not converge to a single vector.
- Over-refusal samples reside within their respective benign task clusters (e.g., a translation refusal sits inside the translation cluster), rather than in a separate "refusal zone."
- It spans a higher-dimensional subspace, requiring significantly more principal components to capture its variance compared to harmful-refusal.

B. Mechanistic Separability

Early Layer Distinction: Linear probing reveals that the model distinguishes between "erroneous" (over) and "correct" (harmful) refusals from Layer 1, long before task-specific structures peak in mid-layers.
No Single Causal Bottleneck: Causal patching experiments showed that no single attention head acts as a necessary bottleneck for refusal (flip rates never exceeded 50%). Refusal is implemented via distributed, multi-layer, task-specific circuits.

C. Intervention Efficacy

Global Ablation Failure: Applying a global ablation vector to suppress over-refusal:
- Only incidentally reduces over-refusal (due to partial geometric overlap).
- Disproportionately harms safety: It suppresses harmful-refusal significantly more than it fixes over-refusal (Suppression Ratio < 1).
Task-Conditioned Success: Steering vectors conditioned on task identity:
- Eliminated over-refusal (reduced from 55% to 0%).
- Preserved safety mechanisms better (harmful-refusal dropped only from 65% to 30%, compared to 20% with global ablation).
- Achieved a Suppression Ratio > 1, indicating precise targeting.

4. Key Contributions

Geometric Characterization: Established that over-refusal is not a universal phenomenon but a task-dependent perturbation embedded within task-identity manifolds, whereas harmful-refusal is a universal, low-dimensional signal.
Mechanistic Explanation: Provided evidence that the failure of global ablation is structural; a single vector cannot decompose a high-dimensional, task-conditioned signal without disrupting the underlying safety mechanism.
Validation of Task-Conditioning: Demonstrated that task-conditioned interventions are not just an optimization but a necessity for mitigating over-refusal without compromising safety.
Circuit Analysis: Ruled out single-head bottlenecks, confirming that refusal is a distributed process across late-layer, task-specific heads.

5. Significance

Theoretical Impact: Challenges the "one-size-fits-all" assumption in representation steering. It proves that safety behaviors can occupy distinct geometric subspaces depending on the context (task), requiring different intervention strategies.
Practical Application: Offers a blueprint for safer LLM deployment. Instead of retraining models or applying blunt global ablation, developers can use lightweight, inference-time task-conditioned steering (potentially triggered by early-layer probes) to fix over-refusal while maintaining robust safety against genuine threats.
Future Directions: Suggests that early-layer probes can serve as triggers for selective interventions, enabling dynamic safety adjustments without modifying model weights.

In summary, the paper argues that over-refusal is a high-dimensional, task-specific phenomenon, making global geometric interventions structurally insufficient. Effective mitigation requires task-conditioned geometric interventions that respect the specific manifold of the benign task being performed.