LLMs Encode Harmfulness and Refusal Separately

LLMs distinguish between "understanding harmfulness" and "refusing requests": The research reveals that large language models encode harmfulness and refusal as two separate internal concepts, meaning a model can recognize something is harmful while simultaneously being manipulated into refusing to refuse it—or vice versa.

Current jailbreak methods exploit the refusal layer, not true understanding: Many successful jailbreak attacks work by suppressing a model's refusal signals without actually changing its internal judgment about whether something is harmful, suggesting these attacks are "surface-level" manipulations rather than genuine changes to the model's values.

Fine-tuning models to accept harmful requests doesn't change their core understanding: When researchers adversarially fine-tuned models to comply with harmful instructions, the models' internal belief that these instructions were harmful remained largely unchanged, indicating that compliance doesn't equal genuine value alignment.

A model's internal "harmfulness sense" can be used as a built-in safety tool: The researchers developed "Latent Guard," which uses the model's latent harmfulness representation to detect unsafe inputs and reduce false refusals, achieving performance comparable to specialized safety models like Llama Guard 3 without requiring additional fine-tuning.

Current safety approaches may be incomplete: These findings suggest that training models to simply refuse harmful requests may not address the deeper question of whether models truly understand why something is harmful, which has implications for long-term AI safety and alignment.