No retraining, fewer harmful compliances: scaling three internal component groups lifts attack-time safety from 43.2% to 69.7%
Synopsis
The work decomposes an LLM's refusal behavior into a cross-layer pathway: harmful detection heads in early and middle layers pick out harmful tokens, safety neurons in mid-to-late layers carry and stabilize that signal in the residual stream, and refusal heads turn it into a refusal. Scaling the weights of these three component groups without changing architecture raised average safety under GCG attacks from 43.2% to 69.7% across six models, with a 1.7% average accuracy drop on four standard benchmarks.
Interpretation
An LLM's refusal behavior can be decomposed into a cross-layer pathway with distinct roles rather than a set of unrelated parts. Earlier safety methods shape outputs at the behavioral or semantic level, such as RLHF, adversarial training and post-hoc filtering, without characterizing where harmful intent is detected or where refusal is triggered inside the model. Across six models, swapping only the detection heads' attention output between paired harmful and neutral prompts produced a bidirectional effect in five: patching neutral output into the harmful run lowered refusal-head contribution and the reverse raised it, explaining 19.5% to 34.6% of the gap forward and 39.4% to 70.6% backward.
Amplifying the writes of the components along this pathway raises resistance to harmful prompts without retraining. Scaling detection heads, refusal heads or safety neurons alone each improves safety, but is often insufficient under adversarial attacks. On AdvBench, scaling the top 3% of detection and refusal heads by 2.0 and the top 1% of safety neurons by 1.5 raised average safety under GCG attacks from 43.2% to 69.7% across six models, with a 1.7% average accuracy drop on four standard benchmarks.
Folding the same scaling into the weights leaves a model that is still safer under attacks re-optimized against it. Inference-time intervention must be applied on every run, whereas the permanent edit adds no new parameters and preserves the architecture. With GCG suffixes regenerated against each edited model, safety rates were higher than the original on all six models, for example Mistral from 36% to 62% and Qwen2.5 from 30% to 70%.
Perspective
The findings rest on six instruction-tuned models, AdvBench and a malicious-instruction dataset, and attack settings including pure harmful prompts, GCG, ADV-LLM, PAIR and AutoDAN, with safety judged separately by Llama-Guard, Claude, a rule-based template and one annotator. It suits researchers working on alignment and mechanistic interpretability.
The authors note that the pathway is characterized from a static snapshot of model representations captured during probing, and does not account for how safety circuits might evolve or reorganize under further continuous training or fine-tuning. Separately, LLaMA3 shows a forward effect of only 0.7% and a backward effect of 18.2% in activation patching, which the authors describe as a more diffuse or partially bypassed detection-to-refusal pathway in that architecture.