HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment

Abstract: Understanding how aligned LLMs internally represent safety is critical for diagnosing alignment vulnerabilities, as it explains why jailbreaks succeed and informs the design of robust alignment strategies. Prior work shows that aligned LLMs encode harmfulness and refusal as separable directions in the residual stream at prompt-side token positions. We show that jailbreaks succeed at prompt encoding by suppressing either the refusal or harmfulness direction before any token is generated, with distinct attack classes occupying separable regions of the harmfulness-refusal plane. Extending the analysis to response-token positions, we find that the model recognizes harmful content while it is generating that content, even when it failed to recognize the input as harmful at the prompt side. Motivated by our findings, we introduce HARC (Harmfulness-And-Refusal Coupling), a fine-tuning method that pairs the two directions across both prompt and response positions. Since the intervention is confined to the harmfulness-refusal subspace, it leaves the rest of the residual stream intact and does not degrade general capability or inflate over-refusal. Across extensive experiments, HARC achieves the strongest robustness-capability-usability trade-off among six baselines spanning the major training-time and inference-time safety methods. The harmfulness and refusal directions at prompt and response positions transfer across the five model families and two scales we tested without architecture-specific tuning.

• The paper introduces HARC, a fine-tuning method that couples harmfulness and refusal directions to achieve robust safety alignment in LLMs.
• The methodology leverages LoRA adapters, an additive margin hinge loss, and dynamic layer selection to align prompt- and response-side activations.
• Experimental results show significant reductions in attack success rates and minimal over-refusal, with robust performance across multiple model families.

HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment

Introduction and Motivation

The paper "HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment" (2607.00572) systematically investigates the internal representational geometry underlying safety alignment in LLMs. Prior work established that refusal and harmfulness are encoded as linearly separable directions at prompt-side token positions in the residual stream. The central premise of this work is that successful jailbreak attacks manipulate these directions, dissociating harm recognition from refusal activation to elicit policy-violating outputs while circumventing existing safety mechanisms.

This study introduces a comprehensive representational analysis, extending beyond prompt tokens to include response-side activations. Critically, the authors’ mechanistic findings support the design of HARC (Harmfulness-And-Refusal Coupling)—a fine-tuning method that jointly enforces alignment between harmfulness and refusal directions both before and during generation. The approach deliberately confines intervention to a specific two-dimensional subspace, targeting robustness while maintaining general capabilities and minimizing over-refusal.

Mechanistic Analysis of Harmfulness and Refusal Directions

The authors characterize the internal structure of harmfulness and refusal in top-tier instruction-tuned LLMs, including Llama-3.1-8B, Qwen-2.5-7B, and others. Their analysis demonstrates that while these concepts are partially aligned in mid-depth layers, a sharp decoupling occurs in late layers. This decoupling creates representational subspaces where inputs can activate harmful intent without concurrent refusal, or vice versa.

Successful jailbreak prompt categories (e.g., DAN, PAIR, and CodeAttack) systematically exploit these regions, as seen via delta projections in the harmfulness-refusal plane.

Figure 1: Jailbreaks dissociate harm-recognition from refusal, and a four-direction structure emerges at the most decoupled layers.

A critical extension is the identification of response-side directions for both harmfulness and refusal. Notably, even when the model fails to recognize a harmful prompt at the prompt-side, a harm-recognition signal can surface during generation. However, this signal is temporally misaligned—surfacing too late to prevent harmful completions. The analysis generalizes across five instruction-tuned families, supporting the architectural generality of the four-direction structure.

HARC: Methodology

HARC fine-tunes only LoRA adapters, using a composite loss that enforces joint activation for the harmfulness and refusal directions at both prompt- and response-side positions. The coupling is governed by an additive margin hinge loss on cosine projections, while a robust KL retention term anchors benign capability distribution, and a cross-entropy component explicitly supervises refusal. Direction vectors are periodically recomputed via EMA blending to track geometric drift induced by LoRA optimization.

Layer selection for the intervention is performed dynamically using a criterion that maximizes same-concept cross-position alignment and cross-concept decoupling at both prompt and response locations, ensuring that coupling targets the salient geometric band across model scales and architectures.

Changes in Geometric Structure under HARC

Coupling at critical layers realigns the prompt- and response-side directions: DAN and PAIR attack encodings migrate into the harmful region while CodeAttack remains an outlier, as its attack signatures are orthogonal to both base directions. Post-tuning, harmful, DAN, and PAIR continuations compress into a shared subspace, resulting in reliable refusal for all but the hardest residual obfuscated attacks.

Figure 2: Coupling fine-tuning collapses the dissociated regions that jailbreaks exploit. Attack clusters migrate post-HARC towards the coupled harmful region, shrinking adversarial vulnerabilities.

Notably, the CodeAttack cluster remains only weakly affected due to the lack of response-side activation signal, suggesting that the coupling objective cannot propagate gradients in regions unrecognized as harmful by the original model.

Experimental Results and Numerical Highlights

HARC is rigorously compared with six baselines spanning classical SFT, DPO, Circuit Breakers, RepBend, CB, and inference-time steering (CAST). Evaluation on JailbreakBench (PAIR, PAP, DeepInception, CodeAttack), two over-refusal benchmarks (XSTest, CoCoNot), and a suite of capability tasks (MMLU, GSM8K, HumanEval, IFEval, MT-Bench) demonstrates robust alignment properties.

• Adversarial Robustness: HARC reduces mean attack success rate (ASR) from 0.430 (Llama-3.1-8B baseline) to 0.092 and from 0.632 (Qwen-2.5-7B baseline) to 0.133.
• Over-refusal: HARC achieves minimal over-refusal rates (e.g., XSTest 0.035 for Llama, 0.026 for Qwen), outperforming all stronger robustness baselines, especially RepBend, which sacrifices coverage by saturating refusal.
• Generality: The methodology transfers without architecture-specific tuning across five model families (Llama, Qwen, Mistral, Phi, Gemma).

Multi-seed experiments confirm the stability of these gains.

Figure 3: HARC's robustness, over-refusal preservation, and capability retention remain consistent across seeds and architectures.

Scaling to Llama-3.1-70B, HARC brings PAIR, PAP, and DeepInception ASRs to below 0.01 while preserving general capability parity with baseline.

Figure 4: Scaling analysis on Llama-3.1-70B verifies layer selection and robustness with no per-scale tuning required.

Cross-Model and Cross-Architecture Replicability

Direct evaluation across Llama, Qwen, Mistral, Phi, and Gemma confirms that the four-direction structure is a consistent property of aligned LLMs. The degree of prompt-side decoupling varies, but response-side cross-concept decoupling and within-concept cross-position alignment generalize robustly across families.

Figure 5: The four-direction structure replicates across five instruction-tuned model families, supporting the architectural generality of HARC.

Implications, Limitations, and Prospective Research Directions

Practically, the findings suggest that capability-preserving, low-dimensional interventions can achieve competitive safety alignment without inducing over-refusal. However, the approach is fundamentally constrained by the representational coverage of the harmfulness direction: attacks fully unrecognized by the base model (e.g., advanced obfuscated prompts) produce negligible coupling gradients and thus evade robust correction. HARC is also vulnerable to adaptive attacks targeting the now-coupled subspace.

Experimentally, models fine-tuned with HARC can be reverted to their pre-intervention state with minimal adversarial weight updates, highlighting a trade-off between capability retention and defense robustness against weight-level attacks. While HARC executes its logic at the representational geometry level—enabling static, explainable verification and reducing alignment tax—the attack surface for adversaries with knowledge of the defense is consequently narrowed and potentially easier to manipulate.

Future research should investigate:

• Adaptive attack resilience: Extending coupling objectives to track and incorporate distributions of adaptive and obfuscated attacks.
• Beyond LLMs: Transferring the representational coupling mechanism to vision-language and multimodal models.
• Closed-model deployment: Evaluating practical integration in deployment pipelines with restricted weight access.

Conclusion

By leveraging the geometrically dissociated structure of harmfulness and refusal in LLMs, HARC prescribes a direct low-dimensional coupling in the residual stream that guarantees robust refusal across a spectrum of documented attack vectors. The method maintains base model utility and systematically minimizes over-refusal. The paper provides a clear mechanistic grounding for both the vulnerabilities targeted by jailbreaks and the effectiveness boundaries of subspace-restricted safety alignment interventions. These insights set a new standard for interpretable and robust safety fine-tuning in frontier LLMs.