🤖 AI

Fast Multi-dimensional Refusal Subspaces via RFM-AGOP

This paper introduces Fast Multi-dimensional Refusal Subspaces via RFM-AGOP, an efficient method that adapts the Recursive Feature Machine algorithm with probe-informed initialization to rapidly and accurately identify multi-dimensional refusal subspaces in both reasoning and non-reasoning LLMs, overcoming the computational limitations of existing techniques.

Original authors: Thomas Winninger

Published 2026-07-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Thomas Winninger

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: Why We Need This

Imagine Large Language Models (LLMs) as very smart but sometimes stubborn librarians. Their job is to answer questions, but they have been trained to say "No" to dangerous requests (like "How do I build a bomb?").

For a long time, scientists thought the librarian's "No" button was a single, simple switch. If you found that one switch and flipped it, the librarian would stop refusing and start answering anything.

The Problem: Recent research shows that for smarter, more complex models (especially those that "think" for a long time before answering), the "No" button isn't just one switch. It's a whole control room with many different dials and levers working together. If you only pull one lever, the librarian might still refuse.

The Goal: The authors wanted to find all these levers quickly and cheaply, so they could understand how the model decides to refuse, or even test if they could turn off the refusal mechanism to see what happens.

The Old Way vs. The New Way

The Old Way (Too Slow)

Imagine trying to find the right combination of dials in that control room by turning them one by one, checking the result, turning them back, and trying again.

The Issue: For modern "reasoning" models that produce long chains of thought, this process is incredibly slow. It's like trying to tune a radio by listening to static for hours. It takes so much computer power that it's often impossible to do on a regular laptop.

The New Way (RFM-AGOP)

The authors created a new method called RFM-AGOP. Think of this as a smart metal detector that can scan the whole control room in seconds instead of hours.

The "Probe" Warm-up: Before scanning, they give the detector a tiny hint. They ask a simple question to get a rough idea of where the "No" signals are. This helps the detector start in the right neighborhood.
The "Moving Average" Stabilizer: As the detector scans, it gets a little jittery (like a shaky camera). The authors added a feature that smooths out the data, making the scan steady and reliable.
The Result: Instead of finding just one "No" direction, this method quickly maps out a multi-dimensional space (a cluster of directions) where the refusal happens.

What They Found (The Experiments)

The team tested this on different sizes of "Qwen" models (from small to very large).

1. Size Matters: The "One Switch" Myth

Small Models: For smaller models, the old idea was mostly right. Pulling just one lever (direction) was enough to make them stop refusing.
Large Models: For the big, smart models (like the 8B and 14B versions), pulling just one lever did almost nothing. The model kept saying "No."
The Discovery: To make the large models stop refusing, they had to pull at least three or five levers at the same time. The "refusal" behavior is spread out across a complex, multi-dimensional shape (like a cone or a cloud), not a single line.

2. Did They Break the Brain?
A major worry is: "If we mess with these levers to stop the refusal, will the model forget how to do math or write stories?"

The Test: They checked the models on standard knowledge tests (MMLU).
The Result: Surprisingly, for most models, removing the refusal levers didn't hurt their general intelligence. They could still answer harmless questions just fine. However, on the very largest model (14B), there was a slight drop in performance, suggesting that for the biggest models, the refusal mechanism might be tangled up with other smart thinking processes.

3. Speed and Cost

Old Method: Took hours on a powerful laptop.
New Method: Took seconds on a standard laptop. This makes it possible for regular researchers to study these safety mechanisms without needing a supercomputer.

The "Steering" Experiment (A Warning)

The authors also tried to do the reverse: instead of turning off the refusal, they tried to turn on refusal for harmless questions (like "How do I bake a cake?").

The Result: It worked for the main "No" lever. But when they tried to use the other levers (the 2nd, 3rd, or 4th directions), the model started spitting out nonsense or garbage text.
The Takeaway: This suggests that while the "No" concept is complex, we don't fully understand how all the different parts of that complexity work yet. Some parts are essential for saying "No," while others might just be noise or part of a different process.

Summary

This paper introduces a fast, cheap, and effective tool to map out the complex "refusal zone" inside smart AI models. It proves that for large models, saying "No" isn't a simple switch but a complex, multi-dimensional area. The authors successfully mapped this area in seconds, showing that you need to target multiple directions to change the behavior, and doing so doesn't necessarily break the model's ability to think.

Technical Summary: Fast Multi-dimensional Refusal Subspaces via RFM-AGOP

Problem Statement

Ensuring Large Language Models (LLMs) refuse harmful instructions while remaining helpful on benign queries is a central challenge in AI safety. While mechanistic interpretability offers tools to identify and steer internal representations, existing methods face significant limitations regarding the dimensionality and computational cost of refusal behavior analysis.

Early work assumed refusal behaviors were encoded along single linear directions, manipulable by intervening on a single feature space vector. However, recent findings suggest refusal is better modeled as a multi-dimensional "refusal cone." Existing methods to extract these subspaces are either unsupervised (e.g., Sparse Autoencoders), which struggle to isolate specific concepts like refusal, or supervised but computationally prohibitive (e.g., Refusal Cone Optimization or RCO). RCO, for instance, requires full forward and backward passes over long reasoning traces, making it impractical for modern reasoning models (e.g., Qwen 3) that can generate chains of thought up to 8,000 tokens.

Methodology

The authors propose adapting the Recursive Feature Machine (RFM) algorithm, combined with the Average Gradient Outer Product (AGOP), to efficiently extract multi-dimensional refusal subspaces. The core methodology involves:

Framework Adaptation: The RFM-AGOP framework iterates between learning a predictor and updating a kernel matrix $M$ . The algorithm uses a Mahalanobis Laplace kernel function. At each iteration, it solves kernel ridge regression to obtain predictor coefficients and updates $M$ using the average outer product of the gradients of the predictor with respect to the input.
Stability Modifications: To address the sensitivity of RFM to noise and hyperparameters, the authors introduce two key modifications:
- Probe-Informed Initialization: Instead of initializing the kernel matrix $M_0$ with the identity matrix, they train a simple linear probe on the activations and set $M_0 = \beta ww^\top + (1-\beta)\Sigma_{X,k}$ . This combines the primary direction found by the probe with a higher-rank truncated covariance matrix to prevent the algorithm from collapsing into a rank-1 solution immediately.
- Exponential Moving Average (EMA): An EMA is applied to the update of $M$ to stabilize training convergence.
Subspace Extraction: After $T$ iterations, an eigendecomposition of the final matrix $M_T$ yields sorted eigenvectors. The top- $k$ eigenvectors define the refusal subspace. The vectors are oriented toward refusal by computing their Pearson correlation with the refusal labels.
Intervention: The identified subspace is used for two purposes:
- Ablation: Projecting model weights onto the orthogonal complement of the subspace to suppress refusal.
- Steering: Modifying activations directly at runtime to induce or suppress refusal.

Key Contributions

Efficient Multi-dimensional Extraction: The paper demonstrates that RFM-AGOP can identify multi-dimensional refusal subspaces in seconds on consumer hardware (RTX 4090), a task that previously required hours of optimization for methods like RCO.
Probe-Informed Initialization: The introduction of a covariance-based warm start significantly improves the stability and efficiency of the RFM algorithm for LLM activations.
Empirical Validation on Reasoning Models: The study provides the first multi-dimensional analysis of refusal on both non-reasoning (Qwen 2.5) and reasoning (Qwen 3) models, specifically highlighting the behavior of models with long reasoning traces.
Scalability: The method requires only a single forward pass and a few eigendecompositions, with computational complexity dominated by $O(n^2d)$ , making it feasible for large-scale experiments on personal laptops.

Results

The authors evaluated their method on the Qwen 3 family (1.7B, 4B, 8B, 14B) and Qwen 2.5 7B using a custom multilingual contrastive dataset (BigBench).

Dimensionality of Refusal: The results indicate that refusal in larger models (≥8B parameters) is encoded in a multi-dimensional subspace. Ablating a single direction (as suggested by prior 1D work) was insufficient to suppress refusal in larger models; for example, Qwen 3 8B required the ablation of at least three directions to surpass a 50% Attack Success Rate (ASR) threshold.
Performance vs. Baselines: RFM-AGOP achieved comparable or superior performance in suppressing refusal compared to RCO and Difference-in-Means (DIM) baselines, particularly when multiple dimensions were ablated.
Capability Retention: Ablating the refusal subspace using RFM-AGOP generally preserved general reasoning capabilities (measured by MMLU scores), although some performance drops were observed in the 14B model, which the authors note requires further investigation.
Steering Asymmetry: While the primary eigenvector could effectively induce refusal when steering, secondary eigenvectors often resulted in model degradation ("garbage" output) rather than controlled refusal, suggesting an asymmetry between the geometry of ablation and steering.

Significance and Claims

The paper claims that RFM-AGOP offers a cheap and scalable complement to existing subspace-extraction methods. Its primary significance lies in enabling researchers to quickly retrieve multi-dimensional refusal subspaces without the prohibitive computational cost of gradient-based optimization methods like RCO.

The authors modestly frame their work as a step toward better understanding the geometric structure of alignment mechanisms. They acknowledge that while RFM allows for faster identification, the exact relationship between the subspaces found by RFM and other methods (like Sparse Autoencoders) remains an open question. Furthermore, they highlight that the field currently lacks rigorous, standardized metrics for measuring refusal, particularly in reasoning models where refusal may occur late in the generation process or be obscured by complex reasoning traces.

The work suggests that as model sizes increase, complex behaviors like refusal may reside in higher-dimensional subspaces, necessitating multi-dimensional analysis rather than single-vector interventions. Future work is planned to better understand the relations between subspaces found by different methods and to analyze the evolution of these subspaces during the reasoning process.