Attention already sees the harm, but the MLP writes the refusal only at answer onset

A model's safety behavior splits into two stages: one that recognizes a request as harmful, and one that turns that recognition into a refusal. Behavioral benchmarks record jailbreak success or over-refusal outcomes, but cannot say whether a failure came from not recognizing harm or from recognizing it without writing a refusal. Across 18 Base–Instruct pairs spanning six Qwen, Llama, and Gemma families from 1B to 27B parameters, the harmfulness probe AUC of attention updates exceeds that of MLP updates in all 36 checkpoints, with the largest gap in early layers.

Recognition and writing sit in different modules: early attention exposes harmfulness, and late MLPs write refusal that is selective for harmful inputs. Earlier work located refusal-related directions, features, and safety-relevant attention heads, but did not show how that information is transformed into safe behavior. In all 18 Instruct checkpoints, MLP net refusal writing exceeds attention net writing; after intervening on upstream attention, restoring clean downstream MLP updates removes most of the refusal-readout shift, removing 26.5% to 82.8% in the held-out comparison versus at most 19.2% for matched attention restoration.

Post-training changes the writing rather than the recognition: harmfulness is already decodable in Base models, and post-training makes MLP refusal writing stronger and more concentrated late in the network. It was unclear whether alignment training supplies the recognition ability or the computation that converts recognition into refusal. MLP net writing rises in 18/18 pairs while attention net writing rises in only 12/18; the median share of positive MLP writing contributed by the final quarter of the network climbs from 23.01% to 63.86%, while probe AUC does not systematically increase for either module.

Combining a recognition score with a writing score lets the model predict, before decoding, whether a request will end in a jailbreak or an over-refusal, and pick a different reminder accordingly. Fixed reminders trade safety against helpfulness: strengthening safety constraints raises over-refusal, while emphasizing helpfulness weakens protection against harmful requests. Across eight models, joint routing lowers jailbreak ASR from 95.97% with no reminder to 35.17% and over-refusal false refusal from 88.73% to 55.72%, while benign false refusal rises only from 0.00% to 0.13%, giving an average of 30.34% versus 38.09% and 34.96% for the recognition-only and writing-only routers.

The scope is residual-stream updates in decoder-only Transformers: harmfulness decodability and refusal writing are compared between attention and MLP across 18 Base–Instruct pairs, tracked over generation in six Qwen3/Qwen3.5 models, and tested with joint interventions in seven model–mode configurations. It suits researchers studying internal mechanisms and safety alignment, and engineering readers who need a request-level judgment before decoding. Layer windows are calibrated and frozen per model, and high or low perception and decision scores are relative to that model's own calibration and reference states, so zero is not a universal behavioral threshold.

Post-training strengthens MLP writing in all 18 pairs, but how that writing is distributed over depth is context-sensitive: under matched inputs and positions, the final-quarter positive-mass share rises in only 2/6 pairs, and peak depth moves later in three pairs and earlier in two. The fraction of the upstream attention effect blocked by downstream MLP restoration varies substantially across architectures, reaching only 19% and 11% for Qwen3.5-9B in the non-reasoning setting. With reasoning enabled, strong refusal writing concentrates at answer onset, and the same temporal structure appears with reasoning disabled, so it does not depend on a generated reasoning span.