# LLMs Encode Harmfulness and Refusal Separately

**Authors:** Jiachen Zhao, Jing Huang, Zhengxuan Wu, David Bau, Weiyan Shi  
**arXiv:** [2507.11878](https://arxiv.org/abs/2507.11878)  
**Date:** 2025-07-16  
**Summary page:** https://www.summarizepaper.com/en/paper/2507.11878v1/

## Key points

- Researchers identify a new dimension, harmfulness, separate from refusal in Large Language Models (LLMs)
- Distinct harmfulness direction discovered, causing LLMs to misinterpret harmless instructions as harmful when steered along this direction
- Jailbreak methods manipulate LLMs by reducing refusal signals without changing internal belief of harmfulness
- Adversarially fine-tuning models to accept harmful instructions has minimal impact on the model's internal understanding of harmfulness
- Model's latent representation of harmfulness can act as an intrinsic safeguard (Latent Guard) for detecting unsafe inputs and reducing over-refusals resiliently against fine-tuning attacks

## Summary

, , , , 

In this study, the researchers delve into the understanding of harmfulness in Large Language Models (LLMs) beyond just their ability to refuse harmful instructions. Previous research has shown that LLMs' refusal behaviors can be influenced by a one-dimensional subspace known as the refusal direction. Building upon this, the researchers identify a new dimension, harmfulness, which is internally encoded as a separate concept from refusal in LLMs. They discover a distinct harmfulness direction that is separate from the refusal direction. Through causal evidence, it is observed that steering along the harmfulness direction can cause LLMs to misinterpret harmless instructions as harmful. On the other hand, steering along the refusal direction typically results in direct refusal responses without altering the model's judgment on harmfulness. The researchers also find that certain jailbreak methods manipulate LLMs by reducing refusal signals without changing the model's internal belief of harmfulness. Moreover, adversarially fine-tuning models to accept harmful instructions has minimal impact on the model's internal understanding of harmfulness. This leads to a practical application where the model's latent representation of harmfulness can act as an intrinsic safeguard (Latent Guard) for detecting unsafe inputs and reducing over-refusals resiliently against fine-tuning attacks. By exploring these insights, it is revealed that LLMs possess a more robust internal comprehension of harmfulness compared to their decision-making process for diverse input instructions. This offers a fresh perspective on studying AI safety and highlights how understanding and leveraging LLMs' internal representations of harm can enhance safety mechanisms effectively. Additionally, through steering experiments with reply inversion tasks focused on different risk categories, the researchers further investigate and analyze variations in harmfulness representations across categories. These interventions aim to reduce LLMs' perception of harm by steering test instructions in reverse directions based on specific risk categories. Overall, this study sheds light on how LLMs encode and differentiate between concepts of harm and refusal internally, paving the way for improved AI safety measures and strategies in handling diverse input instructions effectively.