PaperlayerView exact revision on arXiv

Source-linked AI summary

$C$-$ΔΘ$: Circuit-Restricted Weight Arithmetic for Selective Refusal

Aditya Kasliwal, Pratinav Seth, Vinay Kumar Sankarapu

arXiv:2602.04521v2cs.CLcs.ET

TL;DR

The paper asks whether selective refusal can move offline because inference-time steering adds recurring serving complexity and cost. It localizes refusal computation with EAP-IG, restricts a contrastive weight update to the resulting sparse circuit, and produces a standard checkpoint without runtime hooks. Across 30 model-category cells, C-∆Θ achieves 14–93% harmful-prompt refusal while benign over-refusal remains 0.6–12.8%, and it Pareto-dominates the compared steering baselines at matched harmful-refusal operating points.

  • Problem

    Selective safety enforcement must refuse disallowed content without flagging benign requests, while existing activation-steering controls retain recurring inference-time intervention paths.

  • Method

    C-∆Θ uses EAP-IG to localize refusal computation and applies masked contrastive fine-tuning to derive a weight update supported only on the localized circuit.

  • Results

    Across 30 model-category cells, C-∆Θ raises harmful-prompt refusal to 14–93% while benign over-refusal remains within 0.6–12.8% and Pareto-dominates the compared steering methods at matched harmful-refusal operating points.

  • Takeaways & Limitations

    The method converts generic weight arithmetic into a selective intervention through causal site selection and yields a drop-in checkpoint requiring no inference-time hooks.

  • Takeaways & Limitations

    Effectiveness depends on base-model representation quality, EAP-IG is not a complete causal account, and evaluation uses a single random seed with transfer rather than white-box attacks.

Abstract

from arXiv · show

Modern deployments require LLMs to enforce safety policies at scale, yet many controls rely on inference-time interventions that add recurring compute cost and serving complexity. Activation steering is widely used, but it requires runtime hooks and scales cost with the number of generations; conditional variants improve selectivity by gating when steering is applied but still retain an inference-time control path. We ask whether selective refusal can be moved entirely offline: can a mechanistic understanding of category-specific refusal be distilled into a circuit-restricted weight update that deploys as a standard checkpoint? We propose C-Δθ Circuit Restricted Weight Arithmetic}, which (i) localizes refusal-causal computation as a sparse circuit using EAP-IG and (ii) computes a constrained weight update ΔθC supported only on that circuit (typically <5% of parameters). Applying ΔθC yields a drop-in edited checkpoint with no inference-time hooks, shifting cost from per request intervention to a one-time offline update. We evaluate category-targeted selectivity and capability retention on refusal and utility benchmarks.

1 Introduction

Selective safety enforcement must remain reliable, auditable, and inexpensive at serving time, but existing steering methods retain recurring inference-time intervention paths. The paper proposes circuit-guided weight editing to produce a standard checkpoint while limiting collateral changes.

  • Production LLMs must refuse disallowed content selectively without flagging benign requests, under reliability, auditability, and serving-cost constraints.
  • Activation steering incurs recurring inference-time cost and can cause broad interference, while conditional steering improves selectivity but retains runtime control logic.
  • Circuit-guided weight editing localizes refusal-relevant computation to a sparse circuit and restricts the weight update to that circuit.
  • The resulting edited checkpoint removes the recurring per-request control path and limits collateral changes outside the localized mechanism.
  • The paper identifies sparse, category-shared refusal computation and evaluates deployment-ready selectivity and utility retention across broad benchmarks.

2 Related Work

Prior work provides inference-time activation control, heuristic weight-space editing, and sparse circuit discovery, but the paper combines these directions into an offline, mechanistically grounded editing pipeline. Its distinguishing contribution is using circuit localization to determine where weight steering edits.

  • Activation steering: Activation steering injects refusal directions into hidden states during inference, with conditional variants gating interventions on flagged inputs.
  • Weight-space arithmetic: Weight-space arithmetic is deployment-friendly but generally chooses edit locations heuristically, allowing collateral changes outside the targeted behavior.
  • Circuit discovery and selective refusal: EAP-IG supports faithfulness-oriented localization by identifying sparse computation whose removal should preserve the behavior, aligning with restricted parameter updates.
  • Positioning: C-∆Θ combines compact refusal signals, circuit localization, and parameter editing so the circuit determines where to edit and the constrained update determines how.

3 Method

C-∆Θ first localizes refusal-relevant MLP output channels with EAP-IG, then derives a contrastive weight direction using masked fine-tuning and adds it to the base model offline. The update is restricted to a small circuit and yields a standard checkpoint without inference-time hooks.

  • Pipeline: C-∆Θ constructs topic- and style-matched harmful/benign prompt pairs, localizes refusal computation with EAP-IG, and extracts a binary circuit mask.The mask covers roughly 5% of eligible parameters.
  • Deployment: Contrastive pairs are required for circuit discovery, while the editing stage uses only harmful prompts and produces a checkpoint deployable without inference-time hooks.
  • Circuit discovery with EAP-IG: EAP-IG scores components by their integrated effect on refusal-aligned behavior, and global top-κ selection allocates the mask where attribution is highest.The resulting mask is dense in early and final layers and sparse in the middle.
  • Circuit granularity: The method applies EAP-IG at MLP2 output channels, mapping each selected channel deterministically to a contiguous parameter column slice.
  • Circuit-guided weight editing: Two masked auxiliary models are fine-tuned on harmful prompts with refusal and compliance templates, and their directional difference ∆θcircuit is added to the base model.Only in-mask parameters move; the update is scaled by α.
  • Multi-category composition: Per-category updates can also be aggregated neuron-wise into a single deployable checkpoint while preserving per-category selectivity within approximately 2 percentage points on one evaluated model.

4 Experimental Setup

The evaluation spans six instruction-tuned LLMs, five harm categories, three principal baselines, and safety, utility, robustness, and circuit-validation measurements. Refusal rates distinguish harmful refusal from benign over-refusal, with lower benign refusal preferred and higher harmful refusal preferred.

  • Models, data, and judges: The study evaluates six Llama- and Gemma-family instruction-tuned LLMs across five harm categories using a contrastive-pair dataset.
  • Models, data, and judges: Refusal scoring uses a RoBERTa detector with disagreements escalated to a Llama-3.1-8B-Instruct judge under a fixed rubric.An output is marked refused if either classifier flags it.
  • Baselines: C-∆Θ is compared with Activation Steering, Conditional Activation Steering, and WS-MLP2, the matched MLP-output-subspace weight-steering ablation.
  • Primary metrics: Table 1 reports harmful-prompt refusal and benign over-refusal across methods and categories, with harmful refusal higher and harmless refusal lower preferred.
  • Ablations and evaluation: The evaluation includes utility retention on MMLU, GSM8K, and IFEval, inverse-mask circuit validation, OOD robustness, and multi-category composition.

5 Results

Across 30 model-category settings, C-∆Θ targets harmful refusal while limiting benign over-refusal, retaining utility and improving out-of-distribution refusal. Its circuit-restricted edits also support offline deployment and multi-category composition, though evaluation uses a single seed.

  • Overall effectiveness: C-∆Θ achieves 14.2–92.8% harmful refusal while benign over-refusal remains 0.6–12.8% across categories.Base harmful refusal is 1.0–64.6%, while base benign over-refusal is 0.4–1.4%.
  • Comparison with Activation Steering: C-∆Θ matches activation steering’s harmful refusal with substantially lower benign over-refusal, including 90.8% versus 90.2% harmful refusal at 2.8% benign on Gemma-3-4B-IT Crime.Activation steering reaches 39.4–92.4% harmful refusal but incurs 22.2–68.0% benign over-refusal.
  • Comparison with CAST: C-∆Θ avoids CAST’s reported high variance, gate failures, and runaway over-refusal by using circuit-restricted weight edits instead of runtime gating.CAST examples include 90.2% harmful refusal at 20.4% benign, 9.8%/0.6%, and 48.6% benign over-refusal.
  • Circuit validation: Circuit restriction is the distinguishing factor from WS-MLP2, which edits the same MLP output projections without circuit masking.Inverse-ablation and matched-subspace comparisons hold training configuration, optimizer, data, and eligible parameter family constant while varying circuit selection.
  • OOD and utility retention: Held-out refusal improves while utility remains near base: HarmBench reaches 96.5–100% on Llama-3.1-8B and 98.0–100% on Gemma-3-4B-IT, with MMLU within 1.5 points.WildJailbreak also improves, while GSM8K remains within 1.2 points on Llama-3.1-8B and 2.5 points on Gemma-3-4B-IT; IFEval declines by at most 8.5 points.
  • Limitations: Single-seed evaluation is an explicit scope limitation despite a broader ablation suite spanning 150 cells across six models, five categories, and five methods.The limitation is flagged in Section 6.
  • Composition and deployment: C-∆Θ retains shared refusal behavior across categories and supports merged edits, while deployment uses unmodified inference stacks at identical throughput.Category-mask overlap has mean Jaccard 0.571; a Sexual+Health composition reduces benign over-refusal to 1.6%, and the one-time editing cost is reported to amortize within days at production scale.

6 Discussion and Limitations

C-∆Θ shifts selective-refusal control from recurring inference-time intervention to a one-time circuit-restricted checkpoint update, but its effectiveness depends on model representations and evaluation scope.

  • Deployment implications: A one-time offline update produces a drop-in checkpoint without inference-time hooks, while restricting intervention scope to ≤5% of parameters supports targeted audits and regression tests.The edited checkpoint integrates with optimized inference stacks such as vLLM without forward-pass instrumentation.
  • Threats to validity: Localization is less selective and edits yield smaller gains when policy-relevant concepts are weakly represented or entangled in the base model.The limitation directly ties effectiveness to the base model’s internal representation of safety-relevant concepts.
  • Threats to validity: EAP-IG identifies behavioral relevance but not a complete causal account, so redundant pathways may remain and results may vary with protocol choices.This limits how completely the selected circuit can be treated as the full causal mechanism of refusal.
  • Threats to validity: Evaluation remains bounded by possible benign refusals, unmeasured capability shifts, single-seed results, coarse utility indicators, and deferred white-box attacks.The study uses transfer attacks, while direct attacks optimized against the edited checkpoint are deferred.

7 Conclusion

C-∆Θ localizes refusal to a sparse, shared circuit and produces selective, auditable edits that deploy without inference-time control paths. Across models and categories, it improves harmful-prompt refusal while limiting benign over-refusal, but deployment robustness and dual-use risks remain.

  • Mean Jaccard 0.571 indicates substantial overlap among per-category refusal circuits, supporting a shared sparse subnetwork rather than five disjoint mechanisms.
  • 14-93% harmful-prompt refusal is achieved across 30 model-category cells while benign over-refusal remains 0.6-12.8%, marginally above the base.
  • C-∆Θ Pareto-dominates activation steering, conditional activation steering, and unmasked weight steering at matched harmful-refusal operating points.
  • The edited checkpoint deploys on unmodified inference stacks at identical throughput, without hooks, gating, or activation instrumentation, while editing ≤5% of model weights.
  • Releasing per-category update vectors and attribution masks creates a dual-use risk because the refusal circuit could be directly suppressed.
  • Adaptive prompting, novel jailbreaks, judge artifacts, and unmeasured capability, tone, or factuality drift remain deployment limitations.

B Mechanistic analysis of the discovered circuit

The discovered refusal circuit is concentrated in MLP output projections, especially at early and final layers, with substantial overlap across harm categories. C-∆Θ maps attributed components to parameter columns and applies masked contrastive weight updates for comparison against steering baselines.

  • Circuit location: The top-20% mask concentrates in early layers 1-6 and final layer 31, while the mid-network is largely untouched.
  • Parameter family: EAP-IG selects MLP output projections because they receive the strongest refusal attribution and map cleanly to gradient-maskable parameter subsets.
  • Controls: WS-MLP2 edits the same MLP-output parameter family without EAP-IG masking, isolating circuit restriction from parameter-family and weight-editing effects.
  • Cross-category sharing: Mean Jaccard overlap is 0.571, with a 0.540-0.609 range across category-mask pairs.
  • Edge-to-parameter mapping: Each selected output channel deterministically maps to a column of the corresponding MLP output-projection matrix, producing contiguous column-slice indicators.
  • Protocol: C-∆Θ computes EAP-IG attributions, selects a global top-κ circuit, performs masked contrastive fine-tuning, and forms θ′ = θ0 + α·∆θcircuit.

D.4 WS-Full (full-LoRA contrastive weight steering)

WS-Full applies contrastive weight steering through full-LoRA updates, but its strength sweep exhibits abrupt benign over-refusal cliffs. R-SFT similarly demonstrates that positive-only refusal fine-tuning can collapse into a refuse-everything policy.

  • WS-Full: WS-Full uses the θ+−θ− difference vector with LoRA across every linear projection and imposes no parameter restriction.
  • WS-Full: Benign over-refusal jumps sharply with consecutive WS-Full strengths, including Health 4.2→40.2, Legal 3.2→34.4, and Sexual 3.6→32.2.
  • WS-Full: WS-MLP2 remains the rigorous control because it shares a smooth strength curve with C-∆Θ, unlike WS-Full’s cliff behavior.
  • R-SFT: R-SFT directly deploys a refusal-trained, full-LoRA checkpoint using only harmful prompts paired with refusal templates.
  • R-SFT: R-SFT has no post-hoc strength knob, so its merged checkpoint is the delivered operating point.
  • R-SFT: 93-100% harmful-prompt refusal under R-SFT coincides with 18.6-99.2% benign over-refusal across the 30-cell matrix.

E.2 Utility Benchmarks

The evaluation combines utility benchmarks, refusal datasets, and out-of-distribution SORRY-Bench analyses under standardized model-specific generation settings. SORRY-Bench cross-evaluation reports matched-category and cross-category refusal rates for Llama and Gemma families.

  • Evaluation framework: Utility assessment uses lm_eval with official chat templates and standard library settings.
  • MMLU: MMLU reports mean 5-shot accuracy across all 57 subjects spanning STEM and humanities.
  • GSM8K: GSM8K reports 4-shot accuracy using flexible extraction of numerical final answers from model generations.
  • Circuit discovery: Circuit discovery uses Integrated Gradients with 3 integration steps and component-level MLP_OUT selection at the first generated token.
  • Weight editing: The restricted update zeros gradients wherever Πij = 0, with Adam, batch size 8, and 8 training epochs.
  • Circuit sparsity: The circuit sparsity parameter κ is the global percentage of FFN output-projection components selected by EAP-IG.
  • OOD evaluation: SORRY-Bench maps 45 policy classes into five training categories and evaluates weighted refusal rates by matched and cross-category subsets.

I.1 Cross-method selectivity Pareto frontier

C-∆Θ dominates baseline selectivity frontiers within the deployment-feasible region, combining high harmful-prompt refusal with low benign over-refusal. Multi-category circuit composition generally preserves category selectivity, while gray-area Sexual+Health circuits can interfere.

  • Pareto frontier: C-∆Θ dominates every baseline frontier in the deployment-feasible region of benign over-refusal ≤10%.Figure 5 aggregates all 30 model-category cells and reported operating points into per-method Pareto frontiers.
  • Pareto frontier: 92.8% harmful-prompt refusal is reached at 3.0% benign over-refusal, while WS-MLP2 reaches 89.0% only at 4.4%.AS reaches comparable harmful refusal only at benign over-refusal ≥22%, outside the deployment cap; CAST and Base remain below the OURS frontier.
  • Deployment feasibility: Figure 6 marks deployment-feasible cells with solid bars and over-cap cells with hollow, hatched bars using the benign over-refusal ≤10% cap.Bar height encodes harmful-prompt refusal, while annotations report benign over-refusal values.
  • Deployment feasibility: Positive-only Refusal-SFT saturates harmful refusal while collapsing benign selectivity, unlike the circuit-restricted comparison shown in Table 19.Table 19 annotates WS-MLP2 and OURS steering strengths and marks cells satisfying the deployment-feasible cap.
  • Multi-category composition: Multi-category composition keeps benign over-refusal ≤1.2% across all tested two- and three-category Llama-3.2-3B-Instruct combinations.Active-category harmful refusal remains within approximately 2 percentage points of single-category values in the reported examples.
  • Multi-category composition: Sexual+Health composition exhibits interference on Llama-3.2-3B, with harmful refusal dropping from 51.8% to 32.6% for Sexual and 35.8% to 28.6% for Health.The passage attributes this pattern to weaker base-model representations limiting simultaneous amplification of both gray-area circuits; Gemma-3-4B-IT retains 82.2% Sexual harmful refusal at 1.6% benign over-refusal.
  • Cross-model utility: Across four additional model families, circuit-restricted steering maintains strong harmful-refusal gains, low benign over-refusal, and MMLU and GSM8K performance.These results support that the reported safety-utility tradeoff is not model-specific and that circuit restriction limits collateral effects.

L Adversarial and Out-of-Distribution Results (Cross-Architecture)

The cross-architecture robustness evaluation covers adversarial and out-of-distribution refusal benchmarks across the full model set, reporting base and C-∆Θ checkpoints.

  • Adversarial and OOD evaluation: The evaluation spans HarmBench, WildJailbreak, SORRY-Bench v1, and AdvBench across the full cross-architecture model set.AdvBench is evaluated with both GCG-string match and LlamaGuard-7b judges.
  • Adversarial and OOD evaluation: Table 22 reports safety, out-of-distribution, and utility metrics for base and C-∆Θ checkpoints across all evaluated models.Utility measures include MMLU, GSM8K, and IFEval alongside the refusal benchmarks.
Loading 2602.04521v2…