The question
Can the refusal behavior of different language models share a common geometric structure? And can that structure help identify a model whose safety behavior has been altered?
I investigated shared refusal directions across three language models and 45 harm categories. The work connects representation analysis with causal experiments and a custom tamper-detection evaluation.
Looking inside the model
Across 950 prompts, identified directions explained approximately 72–76% of variance. Rather than treating a correlation as an explanation, I used activation ablation to test whether changing those directions changed refusal behavior.
Engineering approach
- 01Prompt set950 prompts across 45 harm categories
- 02Representation analysisInspect internal model activations
- 03Direction & interventionIdentify directions, then ablate activations
- 04Behavioral evaluationObserve refusals and evaluate tamper detection
Conceptual research workflow. The wireframe cover is illustrative, not measured embeddings.
The research workflow used PyTorch and Transformers to inspect internal activations, NumPy for numerical analysis, and MPS for local acceleration. Hugging Face provided the model tooling.
The central distinction is between identifying a direction and establishing its influence. Activation-ablation experiments supplied the causal intervention; the prompt set supplied the evaluation context.
Results and scope
- Three language models and 45 harm categories investigated.
- Approximately 72–76% of variance explained across 950 prompts.
- Causality evaluated through activation ablation.
- 12/12 achieved in a custom baseline-free tamper detection evaluation.
These are project-specific results. The 12-case evaluation is not a general detection guarantee, and the visual does not imply a published benchmark.
What this work clarified
A useful safety diagnostic needs more than a convincing visualization. The important connection is between a representation, an intervention, and an observable change in behavior. Broader evaluation would be needed before generalizing the detection result.