From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling

Kuan-Lin Chu; Chung-En Sun; Tsui-Wei Weng

Source-linked AI summary

From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling

Kuan-Lin Chu, Chung-En Sun, Tsui-Wei Weng

arXiv:2609.00051v1Aug 30, 2026cs.CLcs.AIcs.CY

TL;DR

LLMs can produce unsafe outputs under adversarial prompting, but how safety behaviors are implemented internally remains poorly understood. The paper characterizes a multi-stage detection–refusal circuit using causal interventions and tests it with architecture-preserving weight scaling. Across six LLMs, scaling improves attack safety by 26.5% while reducing accuracy by 1.7% across four benchmarks.

Problem
LLMs remain vulnerable to unsafe outputs under adversarial prompting, while the internal mechanisms implementing safety behaviors remain poorly understood.
Method
The paper characterizes a three-stage detection–refusal circuit and evaluates it using targeted component interventions plus training-free, architecture-preserving weight scaling.
Results
26.5% safety-rate improvement under attacks across six LLMs was achieved with only a 1.7% average accuracy reduction across four standard benchmarks.
Takeaways & Limitations
The results support a circuit-level interpretation of refusal behavior and indicate that lightweight component-level interventions can enhance robustness while largely preserving utility.
Takeaways & Limitations
The framework uses static representations and does not account for circuit evolution or reorganization during extensive continued training or fine-tuning.

Abstract

from arXiv · show

Despite extensive alignment efforts, Large Language Models (LLMs) remain vulnerable to generating unsafe content under adversarial prompting, yet the internal mechanisms by which safety behaviors are implemented remain poorly understood. We study LLM safety from a mechanistic interpretability perspective and characterize a multi-stage *safety circuit* that organizes refusal behavior, consisting of (i) $\textbf{Harmful Detection Heads}$ that respond to harmful inputs, (ii) $\textbf{Safety Neurons}$ that mediate and stabilize safety signals in the residual stream, and (iii) $\textbf{Refusal Heads}$ that translate these signals into safe response generation. Using targeted attention-head and neuron-level interventions, we provide causal evidence consistent with this circuit organization, showing that suppressing upstream Harmful Detection Heads disrupts downstream refusal behavior and that safety neurons mediate this interaction. We validate that this decomposition recurs across multiple LLM architectures and adversarial attack settings, and use simple, architecture-preserving weight scaling as a mechanistic probe to test its functional relevance. Across six LLMs, circuit-guided scaling improves safety rates under attacks by 26.5%, while incurring only a 1.7% accuracy drop across four standard benchmarks. Overall, our results support a circuit-level interpretation of LLM safety and suggest that mechanistic abstractions can reveal stable and transferable patterns underlying aligned behavior.

1 Introduction

The paper asks how LLM safety behaviors are implemented internally and characterizes a recurring detection–refusal circuit linking harmful-input detection to refusal generation. It then uses circuit-guided weight scaling to improve attack safety while largely preserving utility.

Motivation: LLMs remain vulnerable to harmful outputs under adversarial prompting, while the internal implementation of safety behaviors remains largely unanswered.Understanding these mechanisms matters for interpreting behavior and structural limits of existing safety approaches.
Motivation: Existing safety methods mainly shape outputs behaviorally or semantically without explicitly characterizing internal harmful-intent detection and refusal mechanisms.Prior component studies also largely attribute safety-related heads in isolation rather than characterizing coordinated dependencies.
Circuit organization: The proposed circuit comprises Harmful Detection Heads, Safety Neurons, and Refusal Heads arranged across early, intermediate, and later network layers.Detection heads respond to harmful inputs, safety neurons modulate refusal signals, and refusal heads translate those signals into safe or refusing tokens.
Circuit organization: Causal interventions show that removing early detection heads or mid-to-late safety neurons weakens downstream refusal-head activity across multiple architectures.The results support a cross-layer organization in which upstream detection features drive later safety and refusal components.
Circuit-guided scaling: 26.5% average safety-rate improvement under GCG attacks across six LLMs accompanies only a 1.7% average accuracy reduction across four standard benchmarks.Jointly scaling the identified components yields larger gains than scaling individual detection heads, safety neurons, or refusal heads.

2 Preliminaries

The preliminaries describe decoder-only transformers as additive computations over a shared residual stream. Attention heads and MLP neurons write vectors into this stream, allowing downstream components to read, transform, or amplify their signals.

Residual stream: Decoder-only transformer computation uses a shared residual stream with hidden dimension d_model as the primary interaction medium.The stream propagates across layers and is updated by attention followed by an MLP sublayer.
Residual stream: At each layer, the residual stream is updated additively by a multiheaded self-attention sublayer followed by a feed-forward MLP sublayer.The entering hidden state is the previous layer’s MLP output, followed by intermediate post-attention and final post-MLP states.
Component contributions: Each attention head produces a value output that is projected into the residual stream as an additive vector.The head index ranges over attention heads within a layer, and each projected contribution lies in R^d_model.
Component contributions: MLP neurons likewise inject vectors directly into the shared residual stream.Because both component types write to the same stream, their signals remain accessible to downstream layers.
Downstream signal flow: Signals introduced by individual components can be read out, transformed, or amplified by subsequent layers, enabling circuit-level analysis of accumulated interactions.This accessibility provides the structural basis for tracing component-wise signal flow.

3 Method

The method identifies a three-part detection–refusal circuit using controlled prompt and response comparisons, then tests its causal role through targeted interventions. It reinforces selected components by scaling their residual-stream contributions without changing the model architecture.

Method overview: The approach combines safety-component identification with targeted interventions to provide causal evidence about safety behaviors.The analyzed components include attention heads and MLP neurons.
Harmful Detection Heads: Harmful Detection Heads are identified by comparing nearly identical harmful and neutral prompts and measuring selective attention toward differing harmful tokens.Heads with the largest positive detection score are selected.
Refusal Heads: Refusal Heads are selected from paired generated responses by measuring whether their residual-stream writes align with a refusal direction.Harmful prompts elicit refusal-style responses, while neutral counterparts elicit helpful instructional responses.
Safety Neurons: Safety Neurons are identified by applying the same refusal-direction analysis to neuron-level residual writes, treating them as mediators of existing safety signals.Because MLP neurons cannot compare tokens, their safety-related activity must transform and stabilize signals already present in the residual stream.
Circuit-guided scaling: The intervention scales attention-head output projections and MLP down-projection columns to amplify selected residual-stream writes while leaving other components or the architecture unchanged.Detection heads, refusal heads, and safety neurons can be scaled individually or jointly.
Circuit-guided scaling: Scaling the identified factors consistently improves Llama-Guard safety rates under GCG attacks across architectures.The intervention’s responsiveness is presented as validation that the identified components are critical leverage points for alignment.

4 Experiments

The experiments evaluate the proposed detection–refusal circuit across six instruction-tuned LLMs and multiple attack settings, using causal interventions, activation patching, and weight reinforcement. Targeted ablations and patching support directed interactions among safety components, while joint reinforcement improves robustness and largely preserves utility.

Experimental Setup: Experiments span six instruction-tuned LLMs and evaluate safety on AdvBench under Pure Harmful Prompt, GCG, and ADV-LLM attacks using Llama-Guard.Safety rates are reported as the fraction of harmful queries eliciting safe responses.
Circuit Validation: Targeted removal causes a rapid, monotonic drop in downstream refusal contributions, unlike random removal, with safety-neuron ablation producing an even stronger collapse.The refusal heads remain untouched, supporting an upstream role for detection heads and safety neurons.
Activation Patching: Activation patching shows that detection-head outputs explain 19.5–34.6% of the harmful–neutral refusal gap forward and 39.4–70.6% backward in five models.LLaMA3 is an outlier, with effects of 0.7% forward and 18.2% backward.
Component Reinforcement: Strengthening detection heads, refusal heads, or safety neurons individually improves safety, but joint reinforcement yields the strongest and most consistent robustness across attack settings.Detection reinforcement can be insufficient without a reinforced refusal pathway, while isolated refusal or neuron reinforcement is less robust when harmful intent is obfuscated.
Circuit-Based Safety Editing: CBSE substantially improves safety rates across all evaluated models and persistently embeds the circuit into architecture-preserving weights without runtime intervention.The edits introduce no new parameters and produce fixed, inference-ready models.
Utility and Calibration: CBSE largely preserves benchmark performance, with modest task-dependent accuracy degradation and modest perplexity increases, while maintaining a calibrated refusal profile on borderline-benign prompts.Reasoning-intensive tasks show slightly larger reductions, and LLaMA2 reduces false-positive refusals by 5.2%.

5 Conclusion

The paper identifies a recurring organization of safety-related components in LLMs and shows that scaling these components can improve robustness while largely preserving model utility.

The identified safety organization includes Harmful Detection Heads, Refusal Heads, and Safety Neurons with complementary influences on refusal behavior.
Simple, architecture-preserving scaling of these components substantially improves robustness against standard and adaptive attacks.
The intervention largely preserves the model’s original reasoning ability and task performance.
The results suggest that lightweight component-level interventions informed by mechanistic analysis can enhance safety robustness without significantly compromising utility.

Limitations

The framework applies Circuit-Based Safety Editing using a static snapshot of model representations and does not model how safety circuits may change during later training or fine-tuning.

Circuit-Based Safety Editing is based on a static snapshot of model representations captured during the probing phase.
The framework does not account for safety circuits dynamically evolving or reorganizing during extensive continuous training or fine-tuning.
Long-term stability and potential drift of localized safety circuits across a model’s full life cycle remain future research directions.

Ethics Statement

The work aims to improve robustness against harmful content through mechanistic analysis and controlled modifications of model internals, with potential benefits for reliability, alignment, transparency, and accountability.

The work investigates safety-circuit structure in large language models and proposes interventions to improve robustness against harmful content.
Its primary societal benefit is enhancing language-model reliability and alignment by reducing unsafe outputs in real-world applications.
The approach focuses on interpretability and controlled modifications of model internals, which could guide more transparent and accountable AI systems.
The paper includes extended analyses of circuit-identification robustness and the statistical reliability of safety gains under adversarial attack.

A.1 Robustness of Identified Components to Probe Construction

The robustness analyses examine whether the identified circuit is stable across probe-data variations, stochastic generation, and adaptive adversarial attacks. Results indicate stable component recovery and substantial safety gains across multiple attack strategies.

Probe construction: Bootstrap analysis subsampled 80% of 51 probing pairs across five runs and selected the top 3% of attention heads and top 1% of MLP neurons.
Probe construction: Near-unity cosine similarities and high Jaccard overlaps indicate that latent directions and discrete circuit components remain stable across data perturbations.
Statistical reliability: Five-seed GCG evaluation across six architectures found CBSE safety gains stable, with standard deviation at most 3.6 points for all models.
Adaptive attacks: PAIR evaluates robustness against an LLM-driven black-box conversational attack using Qwen3-30B-A3B-Instruct-2507 as the attacker model.
Adaptive attacks: CBSE consistently neutralizes PAIR’s adaptive conversational attacks and elevates safety rates for both robust and vulnerable baselines.
Adaptive attacks: Under AutoDAN-HGA, CBSE raises Mistral’s safety rate from 3.0% to 70.0% and Qwen2.5’s from 4.0% to 93.0%.

C Circuit Ablations

The ablations test whether the identified safety circuit is structurally necessary and specifically responsive to harmful intent. Removing small fractions of circuit components sharply reduces safety, while signal comparisons distinguish harmful-intent detection from generic difficulty.

Structural necessity: The knock-out experiment progressively zeros 0%, 1%, 3%, and 5% of harmful detection heads, safety neurons, and refusal heads before evaluating GCG vulnerability.This protocol probes whether the circuit is necessary for sustaining alignment.
Structural necessity: Ablating 1% of the highest-attributed circuit components collapses LLaMA3 safety from 75% to 2% under GCG attacks.At 5% ablation, Qwen2.5 and Guanaco safety rates reach 0%.
Signal measurement: Detection-head and refusal-head signals measure each component’s mean contribution to the refusal direction at the last prompt token.The comparison spans harmful, ambiguous-benign, and difficult inputs.
Component specificity: Detection-head signals are consistently higher for harmful inputs than for benign, adversarially misleading, or difficult inputs across three architectures.The reported gaps rule out surface toxicity and generic difficulty as the primary signal driver.
Baseline comparison: CBSE outperforms CircuitBreakers on LLaMA3 and Mistral without requiring gradient updates or optimization datasets.The comparison evaluates safety under GCG attacks.

E.2 Comparison with Linear Adversarial Training

This section compares CBSE with Linear Adversarial Training and other training-free defenses under adversarial attacks. CBSE achieves near-frontier safety while avoiding training and inference-time overhead described for the competing methods.

Comparison with LAT: CBSE achieves a 99% safety rate on LLaMA3, versus LAT’s 100% clearance rate under GCG attacks.The comparison describes CBSE as virtually on par with LAT.
Comparison with LAT: LAT requires adversarial training loops, multiple backward passes, and specialized optimization data, whereas CBSE operates entirely at inference time.CBSE scales internal safety vectors directly without training overhead.
Training-free defenses: CBSE attains the highest average safety rate at 98%, ahead of SmoothLLM at 97% and Activation-Steering at 83%.The training-free comparison covers Llama3, Mistral, and Qwen3.
Training-free defenses: SmoothLLM queries six perturbed copies per input and can reduce clean-task accuracy, while CBSE adds no inference-time cost and leaves inputs untouched.The cited example reports PIQA decreasing from 76.7% to 70.3% on Llama-2 at q = 5 in the original SmoothLLM evaluation.
Ablation setup: The ablation protocol varies selected-head fractions, detection and refusal scaling factors, and safety-neuron interventions under GCG and ADV-LLM attacks.Safety uses Llama3-8B-Guard and utility uses MMLU accuracy.

F.1 Joint Ablation of Head Selection Ratio and Detection/Refusal Scaling

The ablations map how head-selection ratios and component scaling affect safety and utility. They vary attention-head and safety-neuron settings, then assess safety under attacks and selected configurations’ MMLU accuracy.

Head selection and scaling: Head interventions evaluate 1%, 3%, and 5% selection ratios with detection and refusal scaling factors αdet, αref ∈ {2.0, 3.0, 4.0}.Neuron-level interventions are disabled during this head-focused evaluation.
Utility retention: Selected head configurations are additionally evaluated on MMLU accuracy to measure retention of general reasoning ability.The table examines how head fraction and scaling factor affect utility.
Head selection and scaling: Safety tables report the effects of joint detection- and refusal-head scaling at fixed 1%, 3%, and 5% selection ratios under GCG and ADV-LLM.Tables 15–17 organize the attack safety results by fixed head-selection ratio.
Utility retention: Neuron configurations are also evaluated on MMLU under the fixed attention-head setting to assess general reasoning ability.The table varies neuron selection fraction and scaling factor.

G.1 Multi-Judge Safety Evaluation with Claude 4.6 Opus

The evaluation tests whether CBSE’s safety gains persist across independent judges, human annotation, rule-based checks, attacks, and datasets. Across these validation layers, the reported safety improvements remain consistent across architectures and evaluation protocols.

Independent model judge: Claude 4.6 Opus independently evaluates outputs under GCG attacks using an architecture and training pipeline separate from Llama Guard.The setup targets evaluator-specific blind spots and optimization biases.
Independent model judge: CBSE consistently and substantially elevates safety across all six architectures, with Claude and Llama Guard metrics showing tight correlation.The authors interpret this as transfer across distinct frontier evaluation models.
Human validation: A blind, condition-shuffled human annotation sample contains 100 responses pooled across six architectures under GCG attacks.Unsafe responses are defined as actionable harmful content; refusals and non-actionable responses are safe.
Human validation: Human, Llama-Guard, and Claude judges independently rank CBSE far above the Original model on the identical responses.This agreement supports the reported improvement beyond automated-to-automated evaluation.
Rule-based validation: The Safe-Template heuristic checks literal refusal, disclaimer, and rejection phrases as a model-independent sanity check.The protocol is intended to complement classifier-based evaluations.
Rule-based validation: Under the Safe-Template protocol, joint reinforcement of detection and refusal components provides a substantial safety lift, with safety neurons adding stability under complex adversarial optimizations.The rule-based evaluation covers Pure Harmful Prompt, GCG, and ADV-LLM attacks across six architectures.
Cross-dataset validation: On the Malicious Instruction Dataset, safety improvements closely mirror AdvBench trends across backbone models and evaluation protocols.The dataset includes harmful queries spanning cybercrime, fraud, violence, and other illicit activities.