Technical Summary: RAS: Measuring LLM Safety Through Refusal Alignment

Problem Statement

Current safety evaluation for Large Language Models (LLMs) relies predominantly on output-level paradigms. These methods involve querying models with unsafe or jailbreak prompts and judging whether the generated responses violate safety policies using human annotation, rule-based filters, or LLM-as-a-judge classifiers. While effective, the authors identify four critical limitations in this approach:

1. Cost: It is computationally expensive, requiring full generation and often a secondary judge model.
2. Sensitivity: Results are highly sensitive to decoding parameters, refusal templates, and the specific behavior of the judge model.
3. Staleness: Benchmarks become outdated as models are trained against known question banks.
4. Latency: Output-level safety is a late-stage behavioral signal; it confirms if a model refuses but fails to reveal how the model internally processes the request or whether it enters a refusal-related state during computation.

The paper posits that safety can be evaluated earlier at the representation level, leveraging findings that refusal behavior is mediated by specific directions in hidden activation spaces.

Methodology: SafeVec and RAS

The authors propose SafeVec, a white-box evaluation procedure that measures safety by analyzing internal hidden states rather than generated outputs. The core metric derived from this procedure is the Refusal Alignment Score (RAS), a calibrated 0–100 safety score.

System Model

The method assumes access to the target model's hidden states (residual-stream activations at each decoder layer), making it applicable to open-weight models and internal audits but not closed APIs. The evaluation utilizes three prompt sets:

• Safe ($S$): Benign user requests.
• Unsafe ($U$): Direct requests for harmful content.
• Jailbreak ($J$): Unsafe intents wrapped in adversarial or role-playing instructions.

The procedure requires a safety-aligned reference model ($M_{ref}$) from the same architecture family and a calibration set ($C_a$) containing models with varying safety levels (aligned, uncensored, and abliterated).

The SafeVec Pipeline

The method proceeds through five stages:

1. Refusal Direction Extraction:
   For each layer $l$ in the reference model, the authors compute the mean residual-stream activations for safe ($\mu^{safe}_l$) and unsafe ($\mu^{unsafe}_l$) prompts. The layer-wise refusal direction ($r_l$) is defined as the difference vector:
   $$r_l = \mu^{unsafe}_l - \mu^{safe}_l$$
   This vector captures the shift in representation when the model processes an unsafe request versus a safe one.

2. Layer Window Selection:
   Not all layers are equally informative. The authors select a continuous layer window ($W$) where the separation gap between safe and unsafe cosine means is large and stable. This window is validated using calibration models to ensure safer models exhibit higher alignment with the refusal direction under unsafe prompts.

3. Calibration Model Scoring:
   For models in the calibration set, the method computes average cosine similarities between their hidden states and the reference refusal direction ($\hat{r}_l$) for both unsafe and jailbreak prompts. These raw scores measure the degree of internal refusal alignment.

4. RAS Calibration:
   To map raw cosine similarities to a comparable 0–100 scale, the authors perform a multi-step calibration:

   • Refusal Drop: Calculate the drop in alignment relative to the reference model.
   • Bad-Anchor Scale: Estimate a baseline "bad" scale ($b_a$) using high-risk calibration models (those with high Attack Success Rates).
   • Severity Slope: Determine architecture-specific severity slopes ($\alpha_a$) by correlating normalized refusal drops with increases in Attack Success Rate (ASR).
   • Final Mapping: The aligned drop is mapped to a 0–100 score using a sigmoid function:
     $$RAS(M) = \frac{100}{1 + \exp(\beta(d_{aligned}(M) - c))}$$
     A higher RAS indicates stronger refusal alignment and higher estimated safety.

5. Target Model Scoring:
   Target models are scored by computing their alignment with the pre-calibrated refusal direction and applying the family-specific RAS mapping.

Key Contributions

1. SafeVec: A white-box, representation-level safety evaluation procedure based on refusal alignment.
2. RAS (Refusal Alignment Score): A calibrated metric that translates internal hidden state alignment into a standardized 0–100 safety score.
3. Empirical Validation: Demonstration that RAS reliably distinguishes between safety-aligned, uncensored, and abliterated models across three major families (Llama, Gemma, and Qwen).

Experimental Results

The authors evaluated RAS on Llama-3.1-8B, Gemma-3-4B, and Qwen2.5-7B families.

• Representation-Level Separation (RQ1): Safe and unsafe models exhibit clear separation in refusal-direction alignment. In selected layer windows, safety-aligned models consistently show higher cosine similarity to the refusal direction under unsafe and jailbreak prompts compared to uncensored or abliterated variants.
• Correlation with Output Behavior (RQ2): RAS correlates strongly with output-level Attack Success Rate (ASR). Models with high RAS generally exhibit low ASR. While raw scores reflect broad trends, the calibrated RAS preserves these trends while providing a standardized scale.
• Generalization (RQ3): The procedure generalizes across different model families. Although raw scores are not directly comparable across architectures, the family-specific calibration allows RAS to consistently rank aligned models above unsafe variants.
• Efficiency (RQ4): RAS is significantly faster than judge-based evaluation. Because it requires only forward passes without response generation or external judging, it is approximately 216.88× faster on average in the authors' experimental setting.

Significance and Claims

The paper claims that refusal alignment provides an efficient signal for white-box LLM safety evaluation.

• Complementary Role: The authors explicitly state that RAS is not intended to replace behavioral evaluation frameworks for closed systems or as a definitive proof of safety for every specific request. Instead, it serves as a fast, representation-level metric for comparing safety-aligned model variants, conducting post-training comparisons, and performing safety regression testing.
• Early Detection: By measuring internal states, RAS detects weakened refusal behavior before the model generates harmful output, offering a signal that is independent of decoding parameters and judge biases.
• Limitations: The authors acknowledge that RAS requires white-box access (hidden states) and is calibrated within model families. Furthermore, it assumes that safety is encoded via a specific refusal direction; if future models utilize fundamentally different internal safety mechanisms, the refusal direction may need re-estimation.

The work concludes that while output-level evaluation remains necessary for final deployment verification, representation-level metrics like RAS offer a scalable, efficient, and robust alternative for the rapid auditing of open-weight models.