Understanding Refusal in Language Models with Sparse Autoencoders (2025)

Abstract: Refusal is a key safety behavior in aligned language models, yet the internal mechanisms driving refusals remain opaque. In this work, we conduct a mechanistic study of refusal in instruction-tuned LLMs using sparse autoencoders to identify latent features that causally mediate refusal behaviors. We apply our method to two open-source chat models and intervene on refusal-related features to assess their influence on generation, validating their behavioral impact across multiple harmful datasets. This enables a fine-grained inspection of how refusal manifests at the activation level and addresses key research questions such as investigating upstream-downstream latent relationship and understanding the mechanisms of adversarial jailbreaking techniques. We also establish the usefulness of refusal features in enhancing generalization for linear probes to out-of-distribution adversarial samples in classification tasks.

## introduction most llms have been safety fine-tuned @xcite to suppress misaligned behaviors, such as responding to harmful queries. however, recent studies demonstrate that these safety mechanisms can be circumvented by appending adversarial suffixes @xcite or paraphrasing prompts @xcite . building on advances in mechanistic interpretability for understanding refusal behavior @xcite , our work investigates how refusal is encoded within the latent space of llms. previous work has shown that llms encode features and concepts in a largely linear manner @xcite , enabling extracted directions to steer model behavior towards truthfulness or harmlessness @xcite @xcite . prior work has shown that refusal can be captured via a linear direction in activation space @xcite , but this high-level characterization offers limited insight into how refusal actually functions within the model. for example, when the model encounters an adversarial instruction that successfully jailbreaks it, relying on a single linear direction offers limited insight. this representation only shows whether the model's state aligns more or less with that direction, but not how the jailbreak occurs. building on advances in mechanistic interpretability @xcite , we leverage sparse autoencoders (saes) @xcite to decode the reasons behind refusal in safety-aligned models. in this work, we identify and causally validate features related to refusal across two open-source chat models. our analysis reveals several key insights: (1) llms distinctly encode harm and refusal as separate feature sets, with the harmful features exhibiting a clear causal effect on refusal features, (2) adversarial jailbreaks operate by suppressing specific refusal-related features, and (3) these disentangled features significantly improve classification on challenging out-of-distribution adversarial examples. we enumerate the contents of our work as such: past studies detect refusal using predefined phrase matching or fine-tuned classifiers @xcite . meanwhile, works performing mechanistic analysis @xcite showed that the refusal behavior can be extracted as a single direction that is highly effective in steering @xcite towards or against refusal. @xcite traced upstream sae features that causally activate this refusal direction in the downstream computation graph. meanwhile, adversarial work @xcite @xcite revealed that short "jailbreak" suffixes and prompt expressions can suppress the same circuit, forcing models to comply with disallowed requests. sparse autoencoders. saes were proposed to mitigate the superposition @xcite problem endemic to dense activations, by recasting hidden states as the sum of an overcomplete and sparse set of features. recent efforts on saes has focused scaling to large models @xcite , and open-sourcing them @xcite . @xcite ; @xcite found that sae features were shown to be more informative and sparse than neurons, making them well-suited for causal analysis. others have demonstrated that these features reveal how llms perform diverse tasks @xcite . ## experiments in sect.4.2, we investigate whether llms encode harm and refusal as distinct feature space representations and examine their conditional relationship. sect.4.3 analyzes the mechanisms of adversarial jailbreaks, including suffixes and benign rephrasings. in sect. 4.4, we show that sae features provide a clearer signal at detecting ood adversarial jailbreak instructions. model. in our work, we study gemma-2-2b @xcite and llama-3.1-8b @xcite , both of which have un-dergone safety alignment and reliably refuse harmful instructions. we utilize open-sourced saes, gemmascope @xcite and lla-mascope @xcite , with an expansion factor of 32 and 8 respectively. although these saes were trained on base model activations, prior work @xcite shown that they transfer well to instruct-tuned models and we perform further evaluation to confirm this is true in sect. a.9. following @xcite , we exclude the bos foot_3 token due to its abnormally large activations which we found to be non-informative. ## conclusion in this work, we adapted existing attribution methods to identify minimal sets of sae features that are highly causal towards refusal. leveraging these features, we uncovered key insights into how refusal is mediated-tracing the influence of harmful concepts as upstream triggers towards refusalrelated features that directly influence refusal. we further examined how adversarial attacks targeting jailbreaks impact these features, finding a similar suppression effect from certain trigger tokens. finally, we demonstrated the practical utility of sae features, showing that they offer clearer signals for classifying unseen, out-of-distribution samples.