Technical Summary: Decided Upstream, Written Late

Problem Statement

Safety alignment in multilingual large language models (LLMs) is uneven. While frontier models reliably refuse harmful requests in English, they frequently comply with identical requests in lower-resource languages (e.g., Indic languages). This "cross-lingual safety gap" represents a critical vulnerability for multilingual deployments. The paper investigates whether this gap stems from a failure to detect harm or a failure in the mechanism that executes the refusal. Specifically, the authors examine Sarvam-30B, a 30-billion-parameter, 19-layer Mixture-of-Experts (MoE) reasoning model designed for English and major Indic languages.

Methodology

The authors employ mechanistic interpretability to trace the refusal behavior from harm detection to the final generation of a refusal token. Their approach involves:

1. Data and Labels: Using the TwinBreak corpus, which pairs malicious prompts with benign twins across six languages (English, Hindi, Bengali, Punjabi, Tamil, Malayalam). Outputs are labeled as REFUSE or COMPLY via regex and an LLM judge.
2. Directional Analysis:
   • Harm Axis ($\hat{v}_{harm}$): Defined as the difference-of-means between harmful and benign prompts in the residual stream.
   • Refusal Direction: Defined as the difference-of-means between refused and complied generations, constructed independently of the harm axis.
3. Intervention and Steering:
   • Upstream Injection: Adding the harm axis vector to specific layers to test if detection drives refusal.
   • Step-wise Application: Re-applying the detection direction at every autoregressive decoding step.
   • Circuit Manipulation: Damping or amplifying specific MoE experts and attention heads identified as critical to the refusal process.
4. Attribution: Using Direct Logit Attribution (DLA) and gradient $\times$ activation methods to decompose the refusal logit into contributions from specific MoE blocks and attention heads.
5. Cost Measurement: Evaluating interventions based on refusal recovery (flipping compliant malicious prompts to refusal) and fluency cost (measured as WikiText-2 perplexity ratio).
6. Cross-Model Validation: Replicating the pipeline on a second, unrelated MoE model, Qwen3-30B-A3B, to test generalizability.

Key Findings

1. Harm Detection is Shared, but Refusal Execution is Late and Orthogonal

• Detection is Language-Agnostic: The model detects harm in a mid-network band (peaking around Layer 11). The harm axis is nearly language-invariant (cosine similarity $\approx 0.9$ between English and Indic languages at L11).
• Detection $\neq$ Refusal: The direction that signals "harm" is orthogonal to the direction that actually writes the refusal.
  • Harm separation is a weak signal in middle layers (Cohen's $d \approx 0.95$ at L9).
  • The residual change corresponding to refusal is large and grows monotonically into late layers (L18), but it is near-orthogonal to the harm axis ($|\cos| \le 0.10$).
• The "Write" is Assembled: Refusal is not a single-pass feed-forward read-out of detection. Injecting the harm direction upstream (e.g., at L10) in a single pass fails to reach the output. However, re-applying the detection direction at every decoding step successfully induces refusal, indicating the decision is realized over the autoregressive trajectory.

2. The Refusal Circuit: Writer vs. Opposer

Attribution analysis reveals a specific, localizable circuit in the late layers (L14–L18):

• The Writer: A late MoE block (specifically L18 and shared experts in L15–L16) generates a positive contribution toward refusal.
• The Opposer: A late attention mechanism generates a strong negative contribution, actively suppressing the writer. Gradient and projection-based head rankings identify L18 heads 53, 61, 17, and 27 as the specific components overlapping in this role.
• Language Specificity: While the detection signal is shared, the routing of experts becomes highly language-specific in late layers. The Jaccard similarity of top-K harm-expert routing between Indic languages and English collapses from 0.43 at L11 to 0.03 at L18.

3. Pricing Interventions (The Cost Map)

The authors "price" different intervention strategies by measuring their effectiveness (recovery) against their cost (perplexity):

• Damping the Opposer (Cheap & Effective): Reducing the magnitude of the L18 attention opposer (e.g., scaling by 0.5) recovers 54% of compliant malicious prompts with minimal fluency cost (1.09$\times$ perplexity). This is a "brake removal" strategy.
• Amplifying the Writer (Cost Wall): Amplifying the MoE writer (e.g., scaling by 2) yields partial suppression but at a high cost (2.16$\times$ perplexity). Aggressive amplification (scaling by 3) collapses fluency into spam.
• Surgical Head Edits (Inert): Ablating or editing specific attributed heads results in near-zero recovery (0–3%) with no change in perplexity, suggesting these heads are not the sole drivers of the behavior.
• Upstream Seeding: Re-applying the detection signal at every step achieves 0.65 recovery, though its perplexity cost was not measured.

4. Cross-Model Generalization

The organization of the circuit (a late MoE writer opposed by late attention) transfers to Qwen3-30B-A3B.

• Qwen3 also exhibits a cross-lingual gap and a late writer/opposer dynamic (L47 writer vs. L40 opposer).
• Damping the opposer is similarly cheap (1.00$\times$ perplexity), while amplifying the writer is costly (1.20$\times$ perplexity).
• Limitation: The strength of the lever is architecture-specific. In Qwen3, amplifying the writer saturates quickly and shatters the model, whereas Sarvam-30B's shared expert allows for cleaner behavioral tipping.

Significance and Claims

The paper reframes the cross-lingual safety gap not as a detection failure, but as a decoupling of detection and execution.

• Mechanistic Insight: Safety features are not monolithic; they are composed of an upstream, shared detection signal and a downstream, language-specific execution circuit.
• Actionable Interpretability: The authors provide a "cost-measured map" for safety repair. They argue that for multilingual MoE models, the most affordable and effective repair is suppressive (damping the late opposer) or seeding (reinforcing detection throughout generation), rather than generative (forcing the model to write refusal at the output).
• Methodological Transfer: The gradient-based attribution method and the writer/opposer circuit organization are shown to be robust across different MoE architectures, though the specific leverage points depend on the model's internal routing dynamics.

The authors conclude that actionable safety repair requires understanding where and at what cost one can intervene in a computation that unfolds over generation, rather than assuming a single "refusal feature" exists to be edited.