Technical Summary: Refusal Lives Downstream of Persona in Chat Models

Problem Statement

While linear directions in activation space have been identified for both refusal (safety mechanisms) and persona traits (behavioral characteristics) in instruction-tuned chat models, these two mechanisms have historically been studied in isolation. Existing literature establishes that refusal is mediated by a single direction in the residual stream, unfolding in three stages: input-side harmfulness detection, aggregation, and late-layer expression. However, the final stage—where refusal is expressed as behavior—remains largely unexamined regarding its interaction with model identity.

This paper investigates whether refusal operates as a self-contained safety mechanism or if it is dependent on the model's persona. Specifically, it asks whether a compliant model persona can gate (suppress) the expression of refusal, even when the refusal signal is computed.

Methodology

The authors conducted experiments on two instruction-tuned models: Qwen2.5-7B-Instruct and Llama-3.1-8B-Instruct. The methodology involved extracting linear directions and performing causal interventions in the residual stream.

1. Direction Extraction

• Model-Persona Direction ($v_{MP}$): Extracted using contrastive prompts to define a "compliant" persona. The direction is the mean difference in residual-stream activations between positive-trait (compliant) and negative-trait prompts at a fixed layer and token position.
• Refusal Direction ($\hat{r}$): Extracted following established methods (Arditi et al., 2024) using positive refusal addition and ablation.
• Control Directions: An "assistant axis" ($v_A$) was extracted to distinguish the default persona from the compliant persona, and a random unit direction ($v_{rand}$) served as a baseline.

2. Interventions

The study employed three primary intervention types:

• Steering: Additive steering ($h_\ell \leftarrow h_\ell + \alpha v$) to induce compliant persona or refusal.
• Tension Experiments: Simultaneously adding the compliant persona direction and the refusal direction in the same forward pass to test if they are a single mechanism or interacting ones.
• Knockout (Projection): Projecting out the persona direction ($h_\ell \leftarrow h_\ell - \langle h_\ell, \hat{v}_{MP} \rangle \hat{v}_{MP}$) at specific layers to see if refusal is restored. This was compared against projecting out a random direction.

3. Evaluation Metrics

• Safety Benchmark: The 313-prompt StrongREJECT forbidden-prompt set.
• Tri-Classification: To avoid conflating genuine compliance with failure modes, responses were classified into three categories: Refusal, Bypass (harmful content without refusal), and Degenerate (incoherent or partially leaking outputs).
• Additional Metrics: StrongREJECT Attack Success Rate (ASR), Llama-Guard-3 unsafe rate, and a leakage score for partial harmful information.
• Behavioral Signatures: GPT-4o scored responses on hostility, emotional attunement, and coherence to verify that persona directions encode genuine behavioral structure rather than noise.

Key Results

1. Geometric Independence

Cosine similarity analysis at the steering layer (Layer 20) revealed that the compliant persona direction and the refusal direction are approximately orthogonal (cosine $\approx -0.18$ to $-0.28$), not anti-parallel. This confirms that persona-mediated refusal suppression is not a result of direct cancellation in activation space but a distinct interaction. Both directions are also distinct from the default assistant axis.

2. Persona Gating of Refusal

• Suppression: Applying compliant persona steering drastically reduced refusal rates. In Llama-3.1-8B, the refusal rate dropped from 97.4% (baseline) to 1.6%.
• Nature of Suppression: The suppression did not simply result in harmful completions; it increased bypass (42.2%) and degenerate (56.2%) outputs, indicating a complex failure mode rather than a simple safety bypass.
• Restoration via Knockout: Projecting out the persona direction at late layers (specifically Layer 20 in Llama) restored the refusal rate to 96.8%, nearly matching the baseline. Projecting out a random direction at the same layer had no effect (refusal remained at 1.6%).
• Layer Sensitivity: The effect is localized to a late-layer window (L20–L22). Knockouts at earlier layers (L18) or later layers (L24) failed to fully restore refusal.

3. Tension Experiments

• Early vs. Late Refusal Addition: Reintroducing the refusal direction at early layers (where refusal is computed) failed to restore refusal under compliant persona steering. However, reintroducing it at late layers (L22+) partially restored refusal.
• Conclusion: This indicates that the refusal signal is successfully computed but gated at the expression stage. The persona direction acts as a switch that prevents the refusal signal from being read out into behavior.

Significance and Claims

The paper claims that refusal in chat models is not a self-contained safety mechanism but is gated by identity-level representations at the late-layer expression stage.

• Downstream Dependence: While previous work (Lee et al., 2025) identified content-axis features upstream that determine whether refusal is written, this work identifies an identity-axis persona gate downstream that determines whether refusal is expressed.
• Limitations of Single-Metric Evaluation: The authors argue that relying solely on attack-success rates (ASR) obscures the structure of safety failures. A compliant persona does not merely convert refusals into harmful outputs; it generates high rates of incoherent (degenerate) or bypassed outputs.
• Mechanistic Insight: The refusal direction is bracketed by two control points: a content-driven computation and an identity-driven gate. Analyses treating refusal as an isolated direction miss this critical dependence on persona.

The study concludes that safety fine-tuning produces a refusal direction, but the expression of that direction is contingent on the model's persona representations in the late layers of the network.