PaperlayerView exact revision on arXiv

Source-linked AI summary

Refusal Reads Only a Slice of What the Model Knows: Harm-Keyed Routing and Its Exceptions Across Model Families

Orion Reblitz-Richardson

arXiv:2609.14759v1cs.LGcs.AIcs.CL

TL;DR

This paper asks what a refusal decision reads, separately from what a model comprehends. It combines representational measurements across four open-weight models with a causal interchange test on OLMo-3. The results show harm-keyed refusal in OLMo-3 and GPT-OSS, broad moral reading in Llama, and an unresolved read in Qwen.

  • Problem

    Prior work shows refusal can be removed with a rank-one edit, but that does not establish what information the refusal decision reads.

    Source: §1 · pp. 1–2

  • Method

    The study measures moral and refusal representations across four open-weight models and uses a nested interchange rank sweep on OLMo-3 to test what refusal reads.

    Source: §1 · p. 2, §2.1 · p. 2

  • Results

    Refusal reads a harm slice in OLMo-3 and GPT-OSS, broad moral content in Llama, and beyond the single harm cue in Qwen, whose verdict remains indeterminate.

    Source: §8.3 · p. 11, §9 · p. 12

  • Takeaways & Limitations

    Where refusal reads a rank-1 harm slice, a rank-one edit can remove refusal while leaving the moral subspace untouched.

    Source: §9 · p. 13

    Cross-model comparisons of absolute projection values are limited by differences in stimulus composition, while within-model verdicts avoid that covariate.

    Source: §10 · p. 14

Abstract

from arXiv · show

Alignment applied after pretraining is shallow in a measurable way: a single direction in a model's residual stream can be edited out, and the model stops refusing harmful requests. That fact says how easily refusal can be removed, not what the refusal decision was reading in the first place. We ask what it reads, and we separate that from what the model comprehends. Across four open-weight models spanning three families, moral comprehension is native to pretraining: a low-rank moral subspace crystallizes during pretraining, and alignment rotates it once without rebuilding it. The refusal gate, in contrast, is a fresh post-training construction with only a weak pretraining precursor, written into a narrow control-token channel where the refusal decision is orthogonal to the moral-judgment decision. The central result is causal and comes from one model, OLMo-3. A nested interchange rank sweep patches successively larger slices of the moral subspace between matched requests and reads how much of refusal's response transfers: as the basis widens, moral judgment keeps reading more of it, while refusal levels off at the level of a single harm direction, and about three-quarters of refusal's causal input lies outside the moral subspace altogether. Refusal reads the harm percept, not the moral content that judgment reads on the same patches. The picture is not uniform across families. Llama reads broad moral content; Qwen reads beyond the single harm cue but is unresolved at our sample size; GPT-OSS reads harm, and its refusals can be argued in either direction by its own reasoning trace. Where refusal reads only a low-rank slice and routes around the bulk of what the model knows, a rank-one edit removes it. Whether widening what refusal reads would also deepen the behavior is the open question this raises.

1 Introduction

The paper asks what a refusal decision reads, distinguishing that from what the model comprehends. It finds refusal uses a narrow, harm-related slice rather than broad moral representations, with causal evidence from OLMo-3 and cross-model differences.

1 Introduction

  • Prior work shows refusal can be removed by a rank-one edit, motivating the question of what the refusal decision reads.The paper distinguishes the ease of removing refusal from the depth of the model’s comprehension.Source: §1 · pp. 1–2
  • Refusal reads a low-rank harm slice rather than broad moral content, while moral judgment reads the broader representations where comprehension lives.The refusal direction projects 0.10 of its norm onto the moral subspace (mean | cos | 0.06).Source: §1 · p. 2
  • The causal interchange test is single-model, while measurements span four open-weight models and show Llama reading broad moral content.The cross-architecture panel is a consistency check, not a second causal test.Source: §1 · p. 2

2 Models and instruments

The study compares four open-weight models and constructs residual-stream directions and subspaces to measure moral content, refusal, and judgment. It evaluates these with calibrated geometric comparisons and validity checks.

2.1 Models

  • Four open-weight chat models span three families, two scales, and include a reasoning mixture-of-experts model; OLMo-3 is the primary causal target because its base and post-training checkpoints are released.The other three models provide cross-lineage and cross-architecture generalization for representational measurements.Source: §2.1 · p. 2

2.2 Directions and subspaces

  • The study extracts moral-content and refusal directions by mean-difference contrasts, and defines a moral-judgment direction at the chat decision site for direct comparison.The moral subspace spans three distinguishable source directions, with effective rank 3.Source: §2.2 · pp. 2–3

2.3 Measurement conventions

  • Cosines and projection fractions are read against calibrated nulls and moral-family controls; projection-fraction tests exclude positions with participation ratio below 30.Restricted interchange transfer is used for subspace comparisons, and LEACE is used for concept erasure where needed.Source: §2.3 · p. 3

3 Moral comprehension is pretraining-native and survives alignment

Moral comprehension is present before post-training and its representation crystallizes during pretraining. Alignment rotates the moral subspace once rather than rebuilding it or changing its dimensionality.

3 Moral comprehension is pretraining-native and survives alignment

  • The rank-3 moral subspace reaches cosine 0.999 by the end of pretraining, then SFT rotates it to 0.757 and later stages leave it at 0.757–0.759.The decodable moral-content representation maintains effective dimension 5, with 100% probe accuracy at every tracked state.Source: §3 · p. 3, Figure 1 · p. 4
  • Moral-content probe accuracy is 100% across 25 OLMo-3 pretraining and post-training states, and cross-source transfer AUC is approximately 1.0 throughout.The broader probe-readable content representation is distinct from the rank-3 moral subspace whose crystallization is tracked.Source: §3 · p. 3
  • The result is consistent with cited pretraining studies describing moral structure as early, compositional, broad, and low-rank (Reblitz-Richardson, 2026a; Reblitz-Richardson, 2026b).Those studies report effective dimension 5 across layers and no significant recovery of the moral-foundations split under permutation (minimum p = 0.32).Source: §3 · p. 3
  • The paper contrasts inherited moral comprehension with a refusal gate whose alignment to its weak pretraining precursor is only 0.155.The figure reports that the precursor crystallizes during pretraining while its alignment to the eventual gate remains flat.Source: §3 · pp. 3–4, Figure 1 · p. 4

4 The refusal gate is a fresh post-training construction

The refusal gate is a post-training construction, not a moral-content direction inherited from pretraining. It occupies a low-variance channel, sits below calibrated moral-family bands, and can be ablated while comprehension remains intact.

4 The refusal gate is a fresh post-training construction

  • The base proto-refusal direction aligns with the instruct gate at only 0.155, far below the 0.50 crystallization threshold, despite a weak precursor above the matched null.Across 13 pretraining checkpoints, the precursor crystallizes while its alignment to the eventual gate stays between 0.139 and 0.155.Source: §4 · p. 4
  • The installed refusal gate lies at variance percentile 0.0, while the base proto-refusal direction is at percentile 37.4, making narrowness a property of the installed gate.GPT-OSS refusal-signal positions are also in the lowest variance decile.Source: §4 · pp. 4–5
  • Refusal projects below the moral-family band across tested models and moral-basis ranks, including against a richer six-foundation construction.The calibrated ladder compares the refusal projection with a floor, a matched null, and a positive-control moral-family band.Source: §4 · p. 5, Figure 2 · p. 5
  • On OLMo-3, ablating the refusal direction drops refusal from 0.25 to 0.00 while leaving comprehension intact and moral judgment essentially unchanged.The refusal direction projects only 0.10 of its norm into the moral subspace (mean | cos | 0.06).Source: §4 · p. 5

5 The decision site is a control-token bottleneck

The answer-control token is an 8-to-15-dimensional bottleneck across the four tested models, unlike the full-rank content positions. This constrains content projection tests there while making the bottleneck a target for studying how attention heads write decisions.

5 The decision site is a control-token bottleneck

  • Across all four models, the answer-control token has an 8-to-15 effective-dimensional channel, while content positions remain full-rank-healthy.Decision-site participation ratios are 14.7 for OLMo-3, 8.6 for Qwen, 10.2 for Llama, and 12.8 for GPT-OSS; content-position ratios exceed 40, 33, and 35, respectively.Source: §5 · pp. 5–6
  • At OLMo-3’s decision token, the positive-control moral band falls below the covariance-matched null, so projection fractions cannot establish that a direction is absent.The protocol flags positions below participation ratio 30 as invalid for content projection-fraction tests.Source: §5 · p. 6
  • The same bottleneck blocks content-projection comparisons on all four architectures, but does not block decision-direction comparisons.Cosines between directions defined at the decision token remain usable despite the projection null.Source: §5 · p. 6
  • Because content and decision directions do not co-locate at one valid position, any coupling must pass through attention heads writing into the bottleneck.This gives the causal analysis an anatomical target.Source: §5 · p. 6

6 Refusal is orthogonal to moral judgment at the decision

At the decision token, refusal and moral-judgment directions are separated across the tested models, though the evidence is thinnest for Qwen. This geometric separation alone cannot establish what moral content refusal reads.

6 Refusal is orthogonal to moral judgment at the decision

  • Refusal and moral-judgment directions are separated on every model, with the clearest margins on OLMo-3 and Llama and a thinner, standardization-dependent margin on Qwen.The OLMo-3 cosine is 0.10 against null q95 0.41; Qwen’s is 0.32 against 0.42; Llama’s is 0.08 against 0.51.Source: §6 · p. 6
  • Across the four architectures, decision-site participation ratios range from 8.6 to 14.7, below the position-validity gate of 30.Content positions at the same layers remain full-rank-healthy.Source: Figure 3 · p. 7
  • On OLMo-3, no refusal–judgment coupling is detectable above |cos| 0.10, but geometric non-overlap alone does not show that refusal reads no moral content.The passage identifies a causal test on heads writing the decision channel as necessary to resolve what refusal reads.Source: §6 · p. 7
  • Every model’s refusal direction falls below its own moral-family band, providing a projection-side view of the separation.The base-model band-minimum 95% confidence interval is [0.47, 0.53].Source: §6 · p. 7

7 What refusal reads: the harm percept

In OLMo-3, causal interchange tests show that refusal reads a harm-dominant slice of the moral subspace, while judgment continues to read more as the patched basis widens. Most refusal input lies outside the rank-16 moral basis.

7 What refusal reads: the harm percept

  • Refusal is written across many heads into the roughly 13-dimensional channel; the top ten account for 45% of specificity, and 67 heads are needed for 80%.MLPs contribute 38% of the decision-site write, and no top-ten writer is labeled a clean harm-copy head.Source: §7 · p. 8
  • Restricting patches to the moral subspace moves refusal more than a random rank-3 patch, and the harm-restricted patch nearly matches the full moral-subspace patch.Removing the harm direction leaves a smaller refusal effect, about half as large and at or near the detection limit; the harm direction captures 0.46 of the moral subspace.Source: §7 · p. 8
  • About 76% of refusal’s causal twin-difference input lies outside the rank-16 moral basis, while judgment reads 0.66 of the subspace patch effect.The results support the interpretation that refusal reads the harm percept rather than the broader moral content judgment reads on the same patches.Source: §7 · pp. 7–8
  • A one-parameter harm-ceiling model fits the pooled refusal sweep at RMSE 0.023, but over-predicts at rank 1, where the highest-variance contrast is nearly inert.The most harm-aligned single variance direction is not the rank-1 causal object.Source: §7 · p. 8
  • On intent-harmful requests, OLMo-3 refusal reaches only about 17% at top severity, with weak coupling between intent severity and refusal.The operating band is described as nearly empty.Source: §7 · pp. 8–9
  • On 42 pooled OLMo-3 request-twins, judgment transfer rises from 0.05 to 0.66 across ranks 1–16, while refusal transfer plateaus at 0.22–0.24 after rank 3.The refusal plateau is within 0.10 of the harm-rank-1 transfer of 0.33; Figure 4 plots the sweep.Source: §7 · p. 8, Figure 4 · p. 9

8 Across families: what refusal reads and how it commits

Across the four-model panel, refusal reads range from a harm cue to broad moral content, while commitment ranges from early to reversible; Qwen’s read remains unresolved.

8 Across families: what refusal reads and how it commits

  • The harm direction is near-orthogonal to GPT-OSS’s downstream refusal read (cosine 0.16), while matched-norm steering supports causal reply flips only in the Qwen cell.On GPT-OSS, harmfulness is separately encoded at the instruction token (d-prime 5.01); the Llama steering result did not reproduce under matched-norm controls.Source: §8 · pp. 9–10

8.1 Llama reads broad and commits early

  • At matched layer 12, Llama’s refusal transfer is 0.85 versus judgment transfer 0.79, while a harm-rank-1 restriction recovers only 0.59.A single harm cue spans only 3.6% of the moral basis driving Llama’s refusal.Source: §8.1 · p. 10
  • Llama commits before its decision site: removing refusal drops judgment accuracy from 0.75 to 0.604, against matched-random ablations at 0.747 ± 0.007.At matched depth, the apparent asymmetry is not cleanly separated: Llama is −0.28 and OLMo is −0.54, with Llama’s confidence interval including zero.Source: §8.1 · p. 10, Figure 5 · p. 12

8.3 The two-axis result

  • Across four models, refusal reads harm on OLMo and GPT-OSS, broad moral content on Llama, and indeterminate content on Qwen, while commitment ranges from at-layer to early to reversible.Qwen’s refusal transfer is 0.54 at rank 16 versus 0.38 at harm-rank 1, but its gap to judgment is not resolved.Source: §8 · p. 9, Table 1 · p. 11, §8.3 · p. 11

8.2 GPT-OSS reads harm and is reversible

  • GPT-OSS’s in-trace refusal projection favors harm (standardized cosine 0.49 versus 0.13 for orthogonal moral content), but this evidence is correlational, not interchange-based.The instruction-token cosine of 0.977 is near-collinear because refusal and harm are built from overlapping contrasts there.Source: §8.2 · pp. 10–11, Table 1 · p. 11
  • GPT-OSS reverses in both directions: exculpatory prefills shift 6 of 10 ceiling-refusing violating items toward compliance, while inculpating prefills flip 7 of 7 benign requests to refusal.The exculpatory result was 5 of 10 on replication; the behavioral samples were small.Source: §8.2 · p. 11

8.3 The two-axis result

  • The proposed link between read dimensionality and reversibility remains a hypothesis: three resolved models support the ordering, but lineage, scale, tokenizer, and training differ together.Qwen is a fourth point with an indeterminate read, so the panel neither confirms nor breaks the proposed ordering.Source: §8.3 · pp. 11–12

9 Discussion

The paper explains shallow alignment as a narrow refusal gate reading a small harm feature rather than the model’s broader moral representation. It also identifies reversible deliberation as an alternative design point, with exposure to adversarial prefills.

A mechanism for shallow alignment

  • On harm-keyed models, refusal reads a small, separable feature rather than the model’s broad moral representation, explaining why a rank-one edit can remove refusal while leaving moral understanding untouched.The proposed deep-alignment target is to make decision-writing heads read more of the moral directions that judgment already reads; whether that deepens behavior or at what cost remains unanswered.Source: §9 · pp. 12–13

Deliberation can be load-bearing and reversible

  • GPT-OSS demonstrates reversible deliberation: exculpatory analysis can move ceiling refusals toward compliance, while inculpating analysis can move benign requests toward refusal.The reported behavioral flips were 6 of 10 for the strongest exculpatory prefill and 7 of 7 in the inculpating direction.Source: §9 · p. 13, Figure 6 · p. 13
  • A refusal open to argument also has an adversarial failure mode: an adversary’s prefill can argue it down.The paper presents reversibility as a design choice, not a settled answer about safety.Source: §9 · pp. 13–14

10 Limitations

The cross-model interpretation remains a hypothesis: only three models have resolved reads, and model lineage, scale, tokenizer, and training differ together. Several results are limited to internal projections rather than behavioral changes, with additional constraints on cross-model comparisons and OLMo-3’s behavioral measurements.

10 Limitations

  • Three resolved models plus one indeterminate, confounded panel cannot distinguish an effective-dimensionality account from a lineage account; both fit equally well.Deconfounding requires varying one axis at a time, such as scale within a lineage-matched sweep.Source: §10 · p. 14
  • OLMo’s harm-reading verdict is causal, but GPT-OSS’s is correlational, based on projection rather than interchange.The GPT-OSS direction projects with cosine 0.977 to harm versus 0.001 to the harm-orthogonal moral subspace.Source: §10 · p. 14
  • Internal-direction projections and behavioral flips are different outcomes, so projection movement does not by itself establish behavior change.The reported cells include both readout types and should not be treated as interchangeable.Source: §10 · p. 14
  • The graded decision-channel projection moves toward compliance, but a random direction exceeds the refusal-direction movement in one of five comparisons.The projection is not distinguishable from covariance-matched random directions and is not a second leg of the reversibility claim.Source: §10 · p. 14
  • Cross-model absolute projection comparisons carry a stimulus-composition covariate because positive-control stimulus sets differ across models.Within-model comparisons against each model’s own band and null are not subject to that caveat.Source: §10 · p. 14
  • OLMo-3 refusal reaches only about 17% at top intent severity, leaving its intent-graded behavioral operating band nearly empty.Commitment-axis and severity-graded behavioral cells are therefore measured on Llama and GPT-OSS, not the model with the causal rank sweep.Source: §10 · p. 14

11 Conclusion

The conclusion distinguishes inherited moral comprehension from a newly installed, harm-keyed refusal gate: in OLMo’s causal rank sweep, judgment keeps gaining transfer while refusal saturates. It bounds the causal finding to OLMo and notes that refusal reads vary across model families.

11 Conclusion

  • The rank-3 moral subspace crystallizes during pretraining, while the refusal gate is newly constructed after training from only a weak precursor.The moral subspace reaches a checkpoint-to-final cosine of 0.999; the proto-refusal-to-gate cosine is 0.155.Source: §11 · pp. 14–15, §A.2 · p. 17

A.1 The moral subspace

  • The moral subspace is the orthonormalized span of three distinguishable directions extracted from Moral Stories, Understanding Fables, and ETHICS.The three-source construction has effective rank 3; the paper rejects a pooled variance-threshold span because it fails to discriminate moral structure.Source: §A.1 · p. 17

A.2 The refusal direction

  • The refusal gate is extracted at the decision token, has a weak pretraining precursor, and occupies a low-variance channel after alignment.The proto-refusal-to-gate cosine is 0.155, and the aligned instruct gate is at variance percentile 0.0.Source: §A.2 · pp. 17–18

B.3 The band-below-null position-validity check

  • Content-projection tests are invalid at OLMo’s decision bottleneck because the moral positive-control band falls below the covariance-matched null.Decision-direction cosines remain valid there because both compared directions are defined at the decision token.Source: §B.3 · p. 21

C.1 Who writes the decision

  • Refusal writing is distributed: the top ten heads account for 45% of channel-matched specificity, 67 heads reach 80%, and MLPs contribute 38%.The leading head accounts for 11.7% of total specificity but does not carry the decision.Source: §C.1 · p. 21, Table 4 · p. 22

C.4 The nested rank sweep

  • On pooled 42 twins, judgment transfer rose to 0.66 while refusal plateaued at 0.22–0.24 after k=3; 76% of refusal input lay outside the rank-16 moral basis.The sweep’s refusal plateau is within 0.10 of the harm-rank-1 transfer.Source: Table 7 · p. 23

C.6 The harm-partialed identification cell

  • After projecting harm out of the moral subspace, the residual refusal effect is −0.0133, below the minimum detectable effect and therefore a boundary result.Its 95% CI excludes zero, but the estimate is at or near the instrument’s detection limit.Source: §C.6 · p. 24

C.7 The behavioral severity ladder

  • OLMo refuses only about 17% of top-severity intent-harmful requests, leaving its behavioral operating band nearly empty; the study characterizes refusal geometry rather than optimizing its removal.The authors use Llama and GPT-OSS, not OLMo, for the cross-model commitment axis because OLMo’s refusal barely fires on these requests.Source: §11 · p. 15, §C.7 · p. 24

C.8 The reconciled cross-ablation (activation-level projection-out)

The cross-model panel finds broad moral-subspace reading in Llama at matched depth, while OLMo remains harm-keyed. A separate OLMo ablation and Llama boundary test clarify how those reads relate to refusal behavior and commitment timing.

C.8 The reconciled cross-ablation (activation-level projection-out)

  • Ablating the judgment-decision direction raises refusal by 0.12 over random draws, while ablating refusal leaves judgment accuracy within 0.007 of random draws.The refusal-rate difference has a 95% CI of [0.06, 0.19]; the judgment-accuracy difference has a 95% CI of [−0.018, 0.033].Source: Table 9 · p. 25
  • The single-layer activation-level projection-out does not remove refusal; the unresolved boundary-proximity test limits how to interpret the one-directional judgment-decision effect.The authors distinguish this intervention from the weight-folded orthogonalization used for the removability claims.Source: §C.8 · p. 25

D.1 The decision-site bottleneck across four architectures

  • The decision site is an 8-to-15 effective-dimensional control-token bottleneck across the four tested architectures.The GPT-OSS decision token is the panel position where the held-out moral band survives the covariance-matched null.Source: Table 10 · p. 26

D.2 Llama reads broad and commits early: the depth-matched battery

  • At matched depth 12, Llama’s refusal transfer is 0.85 against judgment transfer 0.79, while OLMo’s is 0.43 against 0.53.The asymmetry difference falls from +1.03 at each model’s own layer to +0.26 at matched depth.Source: Table 11 · p. 26
  • Llama’s broad read survives a harm-coextensive rank-1 alternative: the harm direction spans only 3.6% of its engage-driving moral basis.The engage weight sits on the second and third components, where harm captures 9.4% and 0.03%.Source: §D.2 · pp. 26–27

D.3 Llama patch-layer sweep and boundary cell

  • At Llama’s boundary band, adding harmful content moves refusal +0.142, while removing it moves refusal −0.014 with an interval spanning zero.The frozen patch-layer rule classifies Llama’s decision as early commitment, before layer 16.Source: §D.3 · p. 27, Table 12 · p. 27

D.4 Llama anatomy and the robustness anomaly

The panel maps refusal by what it reads and how it commits: Llama is the broad-moral-read anomaly, while GPT-OSS shows reversible behavior under opposing prefills. The appendix also reports family-dependent refusal removability and details the study’s preregistration and released artifacts.

D.4 Llama anatomy and the robustness anomaly

  • Llama’s anatomy includes a low-dimensional decision channel, a distributed write with a 30% MLP share, and top writers labeled neither-moral-nor-harm.Its decision-anatomy participation ratio is 13.5 on the standardized harness.Source: §D.4 · p. 27
  • Llama’s refusal ablation reduces judgment accuracy from 0.75 to 0.604, beyond the matched-random band of 0.747 ± 0.007, while refusal falls from 0.900 to 0.475.The authors attribute the judgment effect to Llama’s broad moral read and early commitment.Source: §D.4 · p. 27

D.5 GPT-OSS position gate and reversibility

  • GPT-OSS reversibly flips benign requests to refusal in 7/7 cases and violating requests to compliance in 6/10, with 5/10 on replication.The decision-channel projection shift was not specific to the refusal direction, so the behavioral evidence is reported as a position effect.Source: §D.5 · p. 27, Table 13 · p. 28

D.6 The two-axis mapping

  • OLMo reads harm and commits at or after the read layer, Llama reads broad moral content and commits early, GPT-OSS reads harm correlationally and reversibly, and Qwen’s read verdict remains indeterminate.The mapping’s proposed dimensionality-to-reversibility relation is a hypothesis, not an established mechanism.Source: §D.6 · p. 28

E.6 Pre-registration and amendment trail

  • The preregistered rules fixed the moral-subspace margin, calibration ladder, interchange coefficients, and reporting rules before the corresponding headline computations.Later analysis-choice changes were recorded as dated amendments before the recomputes they licensed.Source: §E.6 · p. 30

E.7 Artifact save-list and public release

  • The release includes per-unit arrays and artifact provenance so reported statistics can be re-derived without rerunning models.The public release excludes MORABLES-retelling caches under that corpus’s non-commercial license, and model weights are not deposited.Source: §E.7 · p. 31

F.1 The battery and its readouts

  • The ablation battery removes a mean-difference refusal direction from attention-output and MLP-down projections at one layer, then measures refusal, moral probes, subspace dimension, and behavioral judgment.The ablation layer is selected by a depth-fraction sweep for each model.Source: §F.1 · p. 31
  • On the held-out harmful set, rank-one ablation takes OLMo from 0.575 to 0.000 and Qwen from 1.000 to 0.000, but Llama only from 0.900 to 0.475.On OLMo’s separate Paper-5 set, refusal falls from 0.25 to 0.00 while behavioral moral judgment remains essentially unchanged, 0.73 against 0.75.Source: §F.1 · p. 32

F.2 Behavioral judgment under ablation

Refusal ablation affects moral judgment specifically in Llama, whose refusal reads broad moral content, while OLMo and Qwen remain within matched-random ranges. The appendix distinguishes those family-specific findings from GPT-OSS’s non-causal read evidence and describes refusal as a distributed write into a narrow channel.

F.2 Behavioral judgment under ablation

  • Llama’s refusal ablation lowers judgment accuracy from 0.75 to 0.604, outside the matched-random band, while OLMo and Qwen judgment changes remain within their matched-random ranges.Llama’s judgment drop is dose-dependent and appears before its refusal rate moves.Source: §F.2 · p. 32

F.3 What removability does and does not show

  • The OLMo causal result places 76 percent of refusal’s input outside the rank-16 moral basis, but the cross-model link between low-rank reads and clean removability remains correlational.The reconciled activation-level projection-out on OLMo re-decides requests in both directions rather than removing refusal, unlike the weight-folded ablation.Source: §F.3 · p. 32

G.1 GPT-OSS: no single direction ablates refusal

  • GPT-OSS has no single direction that removes refusal coherently; its chain-of-thought-mean direction removes refusal in 88 percent of cases only by producing incoherent text.Because the single-direction ablation presumption fails, GPT-OSS’s harm-read placement is correlational and causal interchange is held.Source: §G.1 · p. 33

G.2 OLMo-3: a distributed write into a narrow channel

  • OLMo’s refusal write is distributed across attention heads: the lead head carries 11.7 percent of total specificity, the top ten carry 45 percent, and 67 heads are needed for 80 percent.Writers span layers 11–16; MLPs contribute 38 percent of the decision-site write.Source: §G.2 · p. 33
  • None of OLMo’s ten top writers is classified as reading moral content or as a clean harm copy-head; their moral-subspace fractions range from 0.15 to 0.28.Llama’s comparable anatomy is also distributed, with a 0.30 MLP share and top writers labeled neither-moral-nor-harm.Source: §G.2 · p. 33

G.3 Reading the two together

  • Across OLMo and GPT-OSS, refusal is written through many small contributions into a low-rank control channel, although only OLMo’s single direction is removable.On OLMo, the removable direction is assembled by dozens of heads rather than carried by any one head.Source: G Distributed refusal · p. 32, §G.3 · p. 33

H Persona, the assistant axis, and persona-shift compliance

  • The persona direction is an assistant-voice reference axis used alongside the calibration ladder and removability battery; the cited assistant-axis literature supplies framing, not numerical inputs.The appendix also defines persona-shift compliance as a behavioral battery reading refusal removal from the compliance side.Source: H Persona, the assistant axis, and… · pp. 33–34

H.1 The persona direction: decodable, moral-adjacent, not moral

  • The persona direction is highly decodable across OLMo training stages yet nearly orthogonal to moral foundations, and its projection is moral-adjacent rather than a non-moral control.Its mean absolute cosine to foundation directions rises from 0.076 at base to 0.085 at Instruct; on GPT-OSS, the moral-to-persona cosine is 0.30 against OLMo’s 0.24.Source: §H.1 · p. 34

H.2 Persona-shift compliance under refusal ablation

Refusal ablation raises borderline-request compliance across OLMo, Qwen, and Llama, while alignment only modestly increases agreement between OLMo’s internal foundation reading and behavioral judgment. The persona axis remains a moral-adjacent reference, leaving the calibration ladder without a non-moral positive-projection control.

H.2 Persona-shift compliance under refusal ablation

  • After single-direction refusal ablation, borderline-request compliance rises from 0.75 to 1.00 on OLMo, 0.90 to 1.00 on Qwen, and 0.70 to 0.95 on Llama.On OLMo, every persona-shift gap closes toward zero.Source: §H.2 · p. 34
  • On OLMo, internal-foundation and behavioral-judgment agreement rises from 0.375 to 0.479 to 0.500 across SFT, DPO, and Instruct, while the phi coefficient moves from −0.19 to +0.02 to +0.05.The authors report that alignment increases agreement a little but does not make behavior a function of comprehension.Source: §H.2 · p. 34

H.3 What the persona axis is for in this paper

  • The persona axis serves as a calibration rung and named control, including a control for Llama’s judgment drop under refusal ablation and for OLMo’s reconciled cross-ablation.Ablating persona leaves Llama judgment at 0.75; the ladder still lacks a non-moral positive-projection control because persona is moral-adjacent.Source: §H.3 · p. 34
Loading 2609.14759v1…