Attention already sees the harm, but the MLP writes the refusal only at answer onset
Across 18 Base–Instruct model pairs, harmfulness is more decodable from attention updates while refusal evidence is written mainly by MLPs, and post-training strengthens that writing without improving recognition.