On the Steering Dimensionality of Refusal in Language Models

1 Introduction

• Single-direction steering assumes a target behavior can be controlled linearly, with additive steering inducing it and directional ablation suppressing it.The paper treats the two interventions as complementary tests of reliable control.Source: §1 · p. 1
• The paper asks how many directions are needed to control refusal reliably and whether that dimensionality differs between safety-alignment and general settings.Prior work found both additive steering and directional ablation evidence for single-direction refusal control, while other work points to richer geometry.Source: §1 · p. 2
• Steering dimensionality is the minimum subspace dimension required to reliably control a behavior, marked by monotonic improvement before sufficiency and saturation beyond it.Control is assessed through inducing the behavior with additive steering and suppressing it with directional ablation.Source: §1 · p. 2
• Safety-alignment-triggered refusal is 1-dim steerable, while even 5-dim subspaces fail to reliably control refusal in general contexts.The results indicate that refusal geometry depends on context.Source: §1 · p. 2

2 Related Work

• Activation steering intervenes on hidden activations along concept-associated directions to influence model behavior and has been applied across diverse settings.Examples include persona control, reasoning calibration, instruction following, jailbreak susceptibility, and hallucination mitigation.Source: §2 · p. 2
• Additive steering success alone does not establish reliable single-direction control, leaving the required steering dimensionality unclear.Many studies primarily evaluate additive steering.Source: §2 · p. 3
• Prior refusal studies differ: one reports single-vector control, while another identifies multiple independent directions and multidimensional concept cones.The literature also notes that refusal semantics may vary across settings, leaving refusal steering dimensionality unresolved.Source: §2 · p. 3

3.1 Steering Subspace Construction

• Safety-alignment contrast uses harmful and harmless prompts, while general-refusal contrast pairs the same harmless query with prompted refusing and affirmative responses.The general-context construction does not rely on naturally distinct prompt distributions.Source: §3.1 · p. 3
• PCA, SVD, or K-Means extracts k directions from the contrast matrix; averaging activation differences is the k = 1 special case.PCA uses mean-centered variation, whereas SVD extracts dominant right singular directions without centering.Source: §3.1 · p. 3

3.2 Subspace Steering Interventions

• Additive steering shifts activations toward the extracted subspace, while directional ablation removes its component and retains the orthogonal activation.Source: §3.2 · pp. 3–4

3.3 Steerability Metric

• Steering succeeds when the intended behavior change occurs while response quality is preserved, with behavior and coherence evaluated separately.Additive evaluation tests induction on responses not normally eliciting the behavior; ablation tests suppression on responses constructed to elicit it.Source: §3.3 · p. 4

3.4 Desired Properties of Activation Steering

• Effective subspaces should capture target-behavior representations while remaining minimally entangled with other behaviors and general capabilities.Source: §3.4 · p. 4
• A sufficient dimension t should show nondecreasing steerability below t and little or no added improvement beyond t.Response quality should remain stable as dimensionality changes so steerability changes reflect behavioral control.Source: §3.4 · pp. 4–5
• Safety-alignment refusal is 1-dim steerable, although distinct directions can achieve comparable control; these subspaces do not cover general-refusal semantics.Source: Figure 2 · p. 5, Figure 3 · p. 5

4 Experiments

• For safety refusal, the study constructs 200 contrastive harmful and harmless examples; for general refusal, it selects 200 refusal–affirmation response pairs from 200 base queries.Subspaces of dimensions 1, 2, 3, and 5 are constructed using K-Means, PCA, and SVD.Source: §4 · pp. 5–6
• Additive-steering evaluation uses 50 harmless queries, while directional ablation uses 50 examples in each of four settings; both instruction-tuned models are evaluated with three rollouts per input.The evaluated models are Qwen2.5-3B-Instruct and Llama-3.1-8B-Instruct; additive-steering configurations are selected on validation data and applied to test data.Source: §4 · p. 6

4.1 Steering Dimension Evaluation

• Safety-alignment-triggered refusal is 1-dim steerable across both evaluated models: one dimension nearly saturates additive steering and suppresses refusal on harmful queries with or without a safety-refusal instruction.The result is consistent with Arditi et al. [1].Source: §4.1 · p. 7
• K-Means, PCA, and SVD recover effective safety-refusal subspaces for Qwen, while K-Means and SVD do so for Llama.The results suggest distinct steering directions can achieve comparable behavioral control.Source: §4.1 · p. 7
• Even 5-dimensional subspaces fail to reliably control general-context refusal; on Llama, steerability largely saturates beyond 3 dimensions with K-Means, while ablation remains ineffective across four settings.On Qwen, ablation alters refusal but substantially degrades response coherence.Source: Figure 4 · p. 6, Figure 5 · p. 6, §4.1 · p. 7
• A safety-refusal subspace provides little suppression of general refusal, supporting distinct activation structures for the two refusal contexts.Its suppression of general refusal is substantially less effective than its suppression of safety refusal.Source: §4.1 · p. 7

• The study generalizes vector-based activation steering to subspaces and evaluates additive and directional-ablation interventions.Source: §5 · p. 7
• Safety-alignment-triggered refusal is 1-dim steerable, and multiple distinct directions can achieve comparable control; even 5-dimensional subspaces fail to reliably capture general-context refusal.Source: §5 · p. 7
• Refusal can occupy substantially different activation structures depending on context, making steering dimensionality relevant to assessing behavioral controllability.Source: §5 · p. 7

• Evaluation covers only Qwen2.5-3B-Instruct and Llama-3.1-8B-Instruct, so generality across model families and scales remains unassessed.Source: §A.1 · p. 10
• The analysis focuses on refusal; whether similar steering-dimensionality patterns occur for styles, persona traits, or instruction-following remains for future work.Source: §A.1 · p. 10
• The mechanisms underlying the different activation geometries of safety-alignment-triggered and general refusal remain unclear.Source: §A.1 · p. 10

A.2 Prompts

• The prompt-generation task produces a contrastive system-instruction pair, seed prompts, and a scoring rubric in one pass so they are mutually consistent.Source: §A.2 · p. 10
• The instruction pair derives its positive instruction from the behavior description and gives a concrete imperative negative instruction for the opposing behavior.Source: §A.2 · p. 10
• Seed prompts should be neutral, compatible with the instruction pair, diverse across request types and expected lengths, and non-redundant.Source: §A.2 · pp. 10–11
• Rubrics describe observable, behavior-specific response signals at scores 1, 3, and 5, with a spectrum for styles or tendencies and pass/fail framing for requirements or constraints.Source: §A.2 · p. 11
• The evaluator first labels severe repetition, substantial incoherence, or no meaningful answer as invalid; otherwise it assigns Yes only when the response clearly satisfies the strong rubric, and No otherwise.Source: §A.2 · p. 12