https://doi.org/10.1007/sxxxxx-yyy-zzzz-1
REVIEW ARTICLE
From Refusal Geometry to Safety Geometry: Harmfulness–Refusal Coupling under Dynamic Adversarial Fine-Tuning
arXiv:2606.16349v1 [cs.CR] 15 Jun 2026
Wenhao Lan1 , Shan Li2 , Xinhua Lai1 , Meiqi Wu3 , Junbin Yang1 , Haihua Shen1 B, Yijun Yang4 B 1. University of Chinese Academy of Sciences, Beijing, China 2. Inner Mongolia University of Technology, Inner Mongolia, China 3. Tsinghua University, Beijing, China 4. Shandong University, Shandong, China Received month dd, yyyy; accepted month dd, yyyy E-mail: [email protected]; [email protected]. © Higher Education Press 2026 Abstract Safety alignment requires language models to refuse harmful requests without losing the ability to answer benign ones. Existing robustness evaluations, however, do not reveal whether a model has learned to recognize harmfulness, to activate a refusal policy, or to couple these two processes. We study this question with a dual safety-geometry protocol that measures harmfulness carriers, refusal carriers, and their coupling across aligned instruction-tuned anchors and matched Mistral-7B-v0.1 SFT/R2D2 training trajectories. The aligned anchors validate the protocol: refusal-side interventions reopen attack success more strongly than harmfulness-only interventions, while harmfulness and refusal carriers remain nearly orthogonal. Along the Mistral trajectory, R2D2 exhibits a high-coupling early phase with strong fixed-source robustness, saturated safe-prompt refusal, and collapsed benign utility. Later checkpoints move to a lower-coupling regime with partial utility recovery and reopened attack success. SFT provides an important contrast: it also reaches low coupling, but remains substantially less robust, showing that low coupling alone is not a safety guarantee. All-anchor diagnostics and sparse GCG/AutoDAN transfer experiments further show that H/R coupling is informative in the R2D2 regime, whereas SFT transfer is better summarized by drift or behavior-state measures. Causal sweeps support fixed-protocol sensitivity relative to matched unit-direction controls, but do not establish independent harmfulness and refusal pathways. These results frame harmfulness–refusal coupling as an operational diagnostic for safety-geometry dynamics under adversarial fine-tuning. Key words large language models; safety; refusal; adversarial fine-tuning; representation geometry; causal intervention; jailbreak evaluation; benign utility
■ 1 Introduction A useful safety policy for a language model must be selective. The model should refuse requests that ask for harmful assistance, but it should not treat every sensitive, ambiguous, or safety-adjacent prompt as something to reject. This distinction is easy to state at the behavioral level and much harder to diagnose mechanistically. A model may answer or refuse a prompt because it recognizes the underlying harmfulness of the request, because a learned refusal policy has been activated, or because these two processes have become tightly coupled during alignment. Standard robustness evaluations can reveal whether an attack succeeds, but they do not by themselves identify which of these internal alternatives is responsible. This ambiguity matters for both evaluation and intervention. A model that refuses many safe prompts may appear robust while simply over-triggering a broad refusal policy. Conversely, a jailbreak may succeed not because the model no longer represents the request as harmful, but because the connection between harmfulness recognition and refusal behavior has weakened. Recent benchmarks have made
these behavioral distinctions sharper: HarmBench provides a standardized setting for automated red teaming and robust refusal; StrongREJECT emphasizes whether a harmful response is actually useful to the attacker; and XSTest measures exaggerated safety on prompts that should remain answerable. These tools make it possible to observe robustness, harmful usefulness, and over-refusal side by side. They do not, however, explain how the corresponding internal representations are organized. A recent study in Frontiers of Computer Science makes the same evaluation-level concern explicit in a different safety-alignment setting: Zhao et al. construct MUBENCH to evaluate machine-unlearning methods for LLM safety across safety, over-safety, and general utility, and report a trilemma among these objectives [7]. We build on this same safety–over-safety–utility perspective, but shift the explanatory level from method-level benchmarking to representation-level coupling between harmfulness and refusal. A growing line of mechanistic work studies refusal as a direction or subspace in model activations. This view has been useful because Frontiers of Computer Science | Issue XX | Volume XX | Month Year
Wenhao Lan et al.
From Refusal Geometry to Safety Geometry: Harmfulness–Refusal Coupling under Dynamic Adversarial Fine-Tuning
(a) Conceptual shift
This paper: safety geometry
Prior refusal geometry view
beyond refusal geometry
R Refusal carrier R
Prompt
(b) Study design
H
(1) Aligned anchors
Refusal control (R)
R
(2) Mistral trajectory
Qwen2.5-Instruct
Base
protocol calibration
R2D2 checkpoints
SFT
coupling dynamics
Dual geometry
Behavior diagnostics
Causal matrix
H
×
θ
H layer
R layer
R H/R H/R angles
HRCI
H
R
H+R
H⊥R
HarmBench
R⊥H
StrongREJECT
(c) Evidence chain and claim boundary H/R extraction H
HRCI trajectory
scoped conclusion
sparse-transfer diagnostic low
R2D2: high HRCI early → low ASR, high refusal, low utility; low HRCI late →
XSTest
Benign utility
Sparse transfer
Claim boundary causal sweeps high
R
Outcomes • Robustness • Over-refusal • Utility • Fail-open
Coupling (H R) Prompt
Behavior
Llama-3.1-Instruct
Harmfulness recognition (H)
partial fail-open, partial utility recovery.
✓ SFT: low HRCI is insufficient for safety.
We claim ✓
coupling diagnostic
✓
regime-dependent trajectory monitor
✓
fixed-protocol causal sensitivity
We do not claim ×
independent pathways
× ×
fail-closed redundancy deployment-grade prediction
Fig. 1 From refusal geometry to harmfulness–refusal safety geometry. Panel (a) contrasts the prior refusal-geometry view, corresponding to our EMNLP refusal-geometry manuscript [1], with the dual safety-geometry view studied here. Panel (b) shows the experimental design: aligned instruction-tuned anchors calibrate the H/R protocol, while the Mistral SFT/R2D2 trajectory tests how coupling evolves under dynamic adversarial fine-tuning. The behavior diagnostics combine robust-refusal, harmful-usefulness, exaggeratedsafety, benign-utility, and sparse-transfer readouts, using HarmBench, StrongREJECT, and XSTest as core evaluation components [2–4]. Panel (c) states the evidence chain and claim boundary: H/R coupling is used as an operational diagnostic informed by refusal-direction and harmfulness–refusal separation work [5, 6], not as proof of independent pathways, fail-closed redundancy, or deployment-grade prediction.
refusal behavior can often be modified by targeted activation interventions. Methods such as COSMIC further reduce reliance on surface refusal templates by identifying viable refusal directions from hiddenstate geometry rather than from output tokens alone. At the same time, treating refusal as the only relevant safety object can be misleading. A refusal carrier may encode a policy decision rather than the model’s judgment that an input is harmful. Recent work on harmfulness and refusal separation makes this concern explicit, showing that aligned models can encode harmfulness and refusal as distinct latent concepts with different causal effects. This paper studies that distinction in the setting of dynamic adversarial fine-tuning. Our starting point is the observation that adversarial fine-tuning changes refusal behavior over training, but refusal behavior alone does not tell us whether the model has learned a more stable notion of harmfulness, a stronger refusal policy, or a different coupling between the two. We therefore move from a single refusal-geometry view to a dual safety-geometry view. The objects of study are not only refusal carriers, but also harmfulness carriers and the coupling between them. Figure 1 summarizes this shift: panel (a) treats the prior refusal-geometry view as the starting point from our EMNLP refusalgeometry manuscript [1], while panels (b) and (c) show how the present paper expands the unit of analysis to H/R geometry, causal matrices, behavior diagnostics, sparse transfer, and explicit claim boundaries. We introduce a protocol for measuring this coupling across aligned instruction-tuned anchors and matched Mistral-7B-v0.1 SFT/R2D2 Frontiers of Computer Science | Issue XX | Volume XX | Month Year
training trajectories. The protocol extracts harmfulness-side and refusalside carriers, compares their layers and subspaces, and summarizes their relationship through a transparent coupling diagnostic. We then test these quantities behaviorally using robust-refusal, harmfulusefulness, exaggerated-safety, and benign-utility evaluations. Finally, we use causal sweeps over harmfulness-only, refusal-only, joint, and orthogonalized interventions to ask whether the measured carriers have distinct behavioral effects under a fixed protocol. The aligned anchors serve an important calibration role. They show that the protocol can expose refusal-side causal bottlenecks in models that already possess mature instruction-following and safety behavior. Applying the same protocol to the Mistral trajectory asks a different question: how such coupling appears, changes, or weakens when safety behavior is induced by SFT and dynamic adversarial fine-tuning from a pretrained backbone. This distinction is central to the paper. We do not assume that a base-to-R2D2 trajectory must reproduce the same harmfulness–refusal separation observed in already aligned chat models; instead, we treat the emergence and reorganization of that coupling as the object of study. Our results support a scoped interpretation. In R2D2, early checkpoints lie in a high-coupling regime with strong fixed-source robustness, saturated safe-prompt refusal, and collapsed benign utility. Later checkpoints move to a lower-coupling regime with partial utility recovery and reopened attack success. SFT provides a contrasting trajectory: it also reaches low coupling, but remains substantially less robust, in-
Front. Comput. Sci., Year, Volume(Issue): PaperID
dicating that low coupling alone is not a safety guarantee. Sparse GCG and AutoDAN transfer diagnostics further suggest that coupling is informative in the R2D2 regime, while SFT transfer is better summarized by drift or behavior-state measures. Causal sweeps show fixed-protocol sensitivity relative to matched unit-direction controls, but do not justify stronger claims about independent harmfulness and refusal pathways. This framing leads to a set of contributions that are methodological, empirical, and deliberately scoped. The paper makes four contributions. 1. We develop a dual safety-geometry protocol that treats harmfulness recognition and refusal behavior as related but distinct objects of measurement. The protocol identifies harmfulness carriers and refusal carriers, compares their layer locations and subspaces, and defines a coupling diagnostic that can be tracked across training. It further includes orthogonalized H/R interventions, four-quadrant data construction, and matched unit-direction controls, so that behavioral robustness can be studied together with representation-level structure. 2. We calibrate the protocol on aligned instruction-tuned anchors and then apply it to matched Mistral SFT/R2D2 trajectories. The aligned anchors provide a sanity check: refusal-side interventions reopen attack success more strongly than harmfulness-only interventions, while harmfulness and refusal carriers remain nearly orthogonal. This gives the protocol a clear reference point before it is used to study how coupling appears and changes along a base-to-adversarial-finetuning trajectory. 3. We find that R2D2 follows a distinctive high-to-low coupling trajectory. Early checkpoints combine high H/R coupling, strong fixedsource robustness, saturated safe-prompt refusal, and collapsed benign utility. Later checkpoints show lower coupling, partial utility recovery, and reopened attack success. SFT reaches low coupling as well, but remains much less robust, indicating that low coupling is not itself a safety score. The relevant object is the trajectory and its relation to behavior, not the coupling value in isolation. 4. We test the boundary of the diagnostic with causal sweeps and sparse-transfer experiments. The causal sweeps show fixedprotocol sensitivity relative to matched unit-direction controls, but do not establish independent harmfulness and refusal pathways. Sparse GCG/AutoDAN transfer diagnostics further show that H/R coupling is informative in the R2D2 regime, whereas SFT transfer is better summarized by drift or behavior-state measures. These results support harmfulness–refusal coupling as a useful operational lens for safetygeometry dynamics, while keeping the claim short of fail-closed redundancy or deployment-grade prediction.
■ 2 Relation to the Prior Conference Manuscript This manuscript is not designed as a longer version of the prior refusalgeometry paper. The prior conference manuscript studied refusalcontrol geometry under dynamic adversarial fine-tuning: whether R2D2 reorganizes an admissible refusal carrier, how that carrier relates to a robustness–utility frontier, and whether low-dimensional causal interventions can recover refusal behavior [1]. The present paper asks
a distinct question: whether refusal-geometry reorganization corresponds to changes in the coupling between harmfulness recognition and refusal behavior. Table 1 summarizes the separation. This distinction matters for interpretation. A refusal carrier can move while harmfulness recognition stays intact, weakens, or becomes behaviorally uncoupled from refusal. Conversely, a model can retain a harmfulness-sensitive representation while refusing too broadly or too weakly. The present paper therefore treats refusal geometry as one component of a broader safety-geometry problem.
■ 3 Related Work • Automated red teaming, jailbreaks, and robust-refusal evaluation. Automated red teaming with language models was introduced as a scalable alternative to purely human-written test cases [8]. HarmBench later standardized automated red teaming and robust-refusal evaluation, and introduced R2D2 as a dynamic adversarial fine-tuning procedure [2]. GCG provides a widely used white-box adversarial suffix attack [9]; AutoDAN searches for stealthier jailbreak prompts [10]. Black-box semantic attacks such as PAIR and TAP broaden the threatmodel landscape by using attacker models to iteratively refine jailbreak prompts [11, 12]. JailbreakBench emphasizes reproducible jailbreak benchmarking and threat-model clarity [13]. Our sparse-transfer block uses GCG and AutoDAN as fixed-protocol stress tests rather than as evidence of full adaptive or black-box robustness. • Safety evaluation, over-refusal, and utility. Safety evaluation must distinguish harmful compliance, refusal, benign helpfulness, and degenerate output. XSTest measures exaggerated safety behavior on safe prompts [4]. OR-Bench scales overrefusal evaluation to a large collection of seemingly toxic but benign prompts [14], while FalseReject targets contextual false refusals and structured reasoning about safe versus unsafe contexts [15]. StrongREJECT addresses the opposite failure mode: a non-refusal response should not count as a successful jailbreak unless it provides useful harmful content [3]. Recent work also shows that LLM-safety evaluations can be sensitive to dataset construction, optimization choices, generation settings, and judge robustness [16]. A closely related FCS study evaluates LLM machine unlearning under safety, jailbreak, oversafety, and utility axes, showing that safety gains can be offset by over-safety and utility loss [7]. We therefore use these evaluations as behavior readouts for geometry, not as replacements for a broad utility benchmark or deployment-grade safety certification. • Refusal geometry, harmfulness–refusal separation, and intervention. Arditi et al. show that refusal in aligned models can be mediated by a single direction [17]. COSMIC generalizes refusal direction identification using activation-space criteria rather than surface refusal templates [5]. Concept-cone work argues that refusal may be better represented by structured subspaces and that representational independence should not be inferred from orthogonality alone [18]. Other representation-space analyses also connect jailbreak success and safety alignment to intermediate hidden-state structure [19,20]. Recent work reports that LLMs can encode harmfulness and refusal as distinct laFrontiers of Computer Science | Issue XX | Volume XX | Month Year
Wenhao Lan et al.
From Refusal Geometry to Safety Geometry: Harmfulness–Refusal Coupling under Dynamic Adversarial Fine-Tuning
Table 1 Scope separation between the prior refusal-geometry manuscript and the present FCS manuscript. The present paper treats earlier refusal-carrier results as motivation and baseline context, then adds H/R dual geometry, aligned-anchor calibration, causal H/R matrices, four-quadrant construction, and sparse-transfer diagnostics.
Dimension
Prior refusal-geometry manuscript
Present FCS manuscript
Main object Main question
Refusal-control carrier Does dynamic adversarial fine-tuning reorganize refusal geometry? Fixed-source HarmBench, XSTest, StrongREJECT, benign utility, admissible carriers, refusal-side interventions
Harmfulness–refusal safety geometry Does that reorganization reflect changes in harmfulness– refusal coupling? Aligned H/R anchors, HRCI trajectory, H/R causal matrix, four-quadrant construction, sparse GCG/AutoDAN transfer Operational H/R coupling diagnostic; no proof of independent pathways or full black-box robustness
Primary evidence
Claim boundary
Low-dimensional but utility-coupled refusal control under a fixed protocol
tent concepts [6]. This is the direct motivation for our dual protocol. Rather than assuming that such separation automatically appears along an adversarial fine-tuning trajectory, we measure whether and when harmfulness carriers and refusal carriers become coupled, decoupled, or behaviorally mismatched. • Post-training safety dynamics and latent adversarial training. The broader risk of post-training is underscored by evidence that fine-tuning aligned models can compromise safety even when the fine-tuning data are not intentionally malicious [21]. ReFAT studies refusal-feature adversarial training and argues that attacks can operate through refusal-feature ablation in residual-stream space [22]. Latent adversarial training and targeted latent adversarial training provide broader feature-space defenses against failure modes and persistent harmful behaviors [23, 24]. Projection-constrained tuning work further treats refusal-direction drift as a tuning-time safety risk and regularizes hidden-state projection on a refusal direction [25]. Our paper differs from these defense-oriented approaches: we do not propose a new defense, but use harmfulness–refusal coupling as an operational diagnostic for representation–behavior dynamics under dynamic adversarial fine-tuning.
4.2 Notation and measured carriers Let 𝑀𝑡 denote a checkpoint at anchor 𝑡 within a fixed training regime, and let ) 𝑑 𝑎 (ℓ (1) 𝑝 (𝑥; 𝑀𝑡 ) ∈ R denote the residual-stream activation for input 𝑥, layer ℓ, and token position 𝑝. The protocol selects two unit-norm measurement carriers, ℎ𝑡 ∈ S𝑑−1 ,
𝑟 𝑡 ∈ S𝑑−1 ,
where ℎ𝑡 is selected from harmful-versus-benign input contrasts and 𝑟 𝑡 from refusal-versus-compliance contrasts. When a top-𝑘 local subspace is used, we write H𝑡 and R 𝑡 for the orthonormal bases associated with harmfulness and refusal, respectively. The selected layer and position of the two carriers are denoted 𝐿 𝐻 (𝑡), 𝑝 𝐻 (𝑡) and 𝐿 𝑅 (𝑡), 𝑝 𝑅 (𝑡). These are operational measurement objects: we do not equate ℎ𝑡 with the full harmfulness representation, nor 𝑟 𝑡 with the entire refusal mechanism. 4.3 Harmfulness–refusal coupling We summarize H/R coupling using three normalized quantities. The first is directional alignment, 𝐶cos (𝑡) = ℎ⊤ 𝑡 𝑟𝑡 .
■ 4 Dual Safety-Geometry Protocol 4.1 Models, checkpoints, and behavioral axes The main trajectory uses Mistral-7B-v0.1 under two matched posttraining regimes: standard supervised fine-tuning (SFT) and R2D2style dynamic adversarial fine-tuning [26]. Unless stated otherwise, both regimes are evaluated at five anchors: reference, step 50, step 100, step 250, and step 500. The aligned-anchor calibration uses instruction-tuned Llama-3.1-8B and Qwen2.5-7B models to verify that the H/R extraction and intervention pipeline produces sensible behavior in models with mature instruction-following and safety behavior [27, 28]. Behavior is measured on five axes. Fixed-source HarmBench GCG ASR measures attack success against a fixed harmful-behavior set. XSTest any-refusal measures over-refusal on safe prompts. StrongREJECT score measures harmful usefulness rather than merely nonrefusal. Benign utility is measured on a 60-prompt continuity set with 0–2 helpfulness scoring, refusal flags, and degeneration flags. Sparsetransfer ASR evaluates checkpoint-specific GCG and AutoDAN attacks transferred across source and target checkpoints. Frontiers of Computer Science | Issue XX | Volume XX | Month Year
(2)
(3)
For subspaces, let 𝜃 1 , . . . , 𝜃 𝑘 be the first 𝑘 principal angles between H𝑡 and R 𝑡 . We use the average squared canonical correlation, 𝑘
𝐶sub (𝑡) =
1 ∑︁ 2 cos 𝜃 𝑖 , 𝑘 𝑖=1
(4)
which is high when the two local subspaces overlap and low when their leading directions are nearly orthogonal. Finally, layer co-localization is encoded as |𝐿 𝐻 (𝑡) − 𝐿 𝑅 (𝑡)| 𝐶layer (𝑡) = exp − , 𝜏 = 4. (5) 𝜏 The Harmfulness–Refusal Coupling Index is the fixed weighted diagnostic HRCI(𝑡) = 0.4𝐶cos (𝑡) + 0.4𝐶sub (𝑡) + 0.2𝐶layer (𝑡).
(6)
For example, at the R2D2 reference checkpoint the source table gives 𝐶cos = 0.0977, 𝐶sub = 0.0370, and 𝐶layer = 0.1738; Eq. (6) yields HRCI = 0.0886, matching the reported value in Table 3. HRCI is an operational trajectory diagnostic, not a ground-truth latent variable.
Front. Comput. Sci., Year, Volume(Issue): PaperID
4.4 Orthogonalized causal interventions and controls The causal matrix evaluates H-only, R-only, H+R, 𝐻⊥𝑅 , and 𝑅⊥𝐻 interventions under ablation and steering. To separate shared from residual components, we form ℎ⊥𝑟 =
ℎ𝑡 − (ℎ⊤ 𝑡 𝑟 𝑡 )𝑟 𝑡 , ⊤ ∥ℎ𝑡 − (ℎ𝑡 𝑟 𝑡 )𝑟 𝑡 ∥ 2
𝑟 ⊥ℎ =
𝑟 𝑡 − (𝑟 𝑡⊤ ℎ𝑡 )ℎ𝑡 . ∥𝑟 𝑡 − (𝑟 𝑡⊤ ℎ𝑡 )ℎ𝑡 ∥ 2
(7)
These residual carriers are diagnostic controls. Orthogonality in activation space does not imply mechanistic independence. For a unit carrier 𝑢, activation 𝑎, and intervention strength 𝜆, we write projection ablation as 𝑇abl (𝑎; 𝑢, 𝜆) = 𝑎 − 𝜆(𝑢 ⊤ 𝑎)𝑢,
(9)
Equation (9) is the normalized operator form used for exposition; any implementation that applies an additional norm-scaling constant should report that constant explicitly rather than absorbing it into the interpretation of 𝜆. The full Mistral WP6 sweep covers SFT and R2D2, five anchors, ablation/steering families, H/R modes, and lambda strengths {−4, −2, −1, −0.5, 0, 0.5, 1, 2, 4} where applicable. Controls are matched same-layer random unit directions, wronglayer carriers, and wrong-position carriers. These controls address several carrier-selection artifacts, but they are not raw activation-delta norm-matched controls. We therefore phrase the causal result as fixedprotocol sensitivity relative to matched unit-direction controls, not as evidence that all norm or scale artifacts have been ruled out. 4.5 Behavioral metrics and diagnostic effects For a harmful evaluation set Dharm , attack success rate is ∑︁ 1 ASR(𝑀) = I{success(𝑀, 𝑥) = 1}. |Dharm | 𝑥 ∈ D
(10)
SR
XSTest any-refusal is 1 |Dsafe | 𝑥 ∈ D
I{𝑅full (𝑀, 𝑥) ∨ 𝑅partial (𝑀, 𝑥)}.
1 |C(𝑚, 𝑡)|
∑︁
Δ𝑌 (𝑐, 𝑡).
(18)
𝑐∈ C (𝑚,𝑡 )
All control-normalized claims in this paper use the matched unitdirection controls described above. 4.6 Four-quadrant behavior construction and sparse transfer We construct a four-quadrant H/R audit set with explicit labels for harmful input 𝐻in , refusal output 𝑅out , benign utility 𝑈out , and degeneration 𝐷 out . The diagnostic quadrants are Q ℎ,𝑟 = {(𝑥, 𝑦) : 𝐻in (𝑥) = ℎ, 𝑅out (𝑦) = 𝑟},
ℎ, 𝑟 ∈ {0, 1}. (19)
They correspond to the four input–output combinations 𝐻 = 1, 𝑅 = 1, 𝐻 = 1, 𝑅 = 0, 𝐻 = 0, 𝑅 = 0, and 𝐻 = 0, 𝑅 = 1. Benign non-refusal is not automatically counted as helpful: 𝐷 out and 𝑈out are reported separately. The construction samples 500 rows per canonical quadrant from available fixed-protocol outputs, with an additional benign-degenerate audit category. This artifact supports diagnostic analysis of the current protocol; it is not presented as a new general-purpose benchmark without further human validation. For sparse transfer, let P𝑠, 𝐴 be prompts generated by attack family 𝐴 at source checkpoint 𝑠. Transfer ASR at target checkpoint 𝑡 is ∑︁ 1 I{success(𝑀𝑡 , 𝑝) = 1}. |P𝑠, 𝐴 | 𝑝∈ P
(20)
𝑠, 𝐴
For StrongREJECT, where 𝑠SR (𝑀, 𝑥) ∈ [0, 1] scores harmful usefulness, we report ∑︁ 1 SR(𝑀) = 𝑠SR (𝑀, 𝑥). (11) |DSR | 𝑥 ∈ D
XR(𝑀) =
Δ𝑌ctrl (𝑚, 𝑡) = Δ𝑌 (𝑚, 𝑡) −
TASR 𝐴 (𝑠 → 𝑡) =
harm
∑︁
Given a matched control set C(𝑚, 𝑡), the control-normalized effect is
(8)
and additive steering as 𝑇steer (𝑎; 𝑢, 𝜆) = 𝑎 + 𝜆𝑢.
This three-track utility reporting is necessary because reduced refusal on safe prompts does not by itself imply useful benign behavior. For any outcome 𝑌 , intervention mode 𝑚, and baseline mode 𝑏, the raw effect is Δ𝑌 (𝑚, 𝑡) = 𝑌 (𝑀𝑡𝑚 ) − 𝑌 (𝑀𝑡𝑏 ). (17)
(12)
safe
For benign utility annotations 𝑢(𝑀, 𝑥) ∈ {0, 1, 2}, we separately report 1 ∑︁ 𝑈strict (𝑀) = I{𝑢(𝑀, 𝑥) = 2}, (13) 𝑛 𝑥 1 ∑︁ 𝑈lenient (𝑀) = I{𝑢(𝑀, 𝑥) ≥ 1}, (14) 𝑛 𝑥 1 ∑︁ 𝑈mean (𝑀) = 𝑢(𝑀, 𝑥), (15) 𝑛 𝑥 1 ∑︁ 𝐷 deg (𝑀) = I{degenerate(𝑀, 𝑥) = 1}. (16) 𝑛 𝑥
We compare geometry and behavior predictors using Spearman correlation, 𝜌 𝑆 (𝑋, 𝑌 ) = corr(rank(𝑋), rank(𝑌 )). (21) These correlations are descriptive diagnostics for sparse transfer, not proof for model selection.
■ 5 Results 5.1 Aligned anchors expose refusal-side causal bottlenecks The aligned-anchor calibration checks whether the H/R pipeline recovers a meaningful distinction in safety-aligned instruction models. Table 2 reports the main pattern. In Llama-3.1-8B-Instruct, H and R are selected at different layers, and their leading principal angles are close to orthogonal. R-only and 𝑅⊥𝐻 ablations reopen HarmBench ASR sharply, while H-only ablation does not. Qwen2.5-7B-Instruct shows the same qualitative refusal-side bottleneck, though the exact H-side behavior differs. This calibration is important for the Mistral trajectory. If the H/R protocol failed on aligned anchors, a negative or mixed result on a baseto-R2D2 trajectory would be hard to interpret. Instead, the aligned anchors show that the protocol can detect refusal-side causal reopening when the model already has a mature aligned refusal policy. Frontiers of Computer Science | Issue XX | Volume XX | Month Year
Wenhao Lan et al.
From Refusal Geometry to Safety Geometry: Harmfulness–Refusal Coupling under Dynamic Adversarial Fine-Tuning
Table 2 Aligned-anchor H/R calibration. ASR values are HarmBench attack success rates under the aligned-anchor causal protocol. The result validates the protocol as a way to expose refusal-side reopening, but does not prove independent harmfulness and refusal mechanisms.
Model Llama-3.1-8B-Instruct Qwen2.5-7B-Instruct
H layer
R layer
Principal angles
Baseline ASR
H-only
R-only
𝑅⊥𝐻
31 15
12 20
86.1, 88.7, 89.4 82.3, 88.1, 89.7
0.1675 0.2625
0.1400 0.2925
0.6825 0.4050
0.6575 0.4250
5.2 R2D2 moves from high coupling to partial fail-open behavior Table 3 reports the five-anchor Mistral trajectory. R2D2 starts with high HRCI and near-zero fixed-source ASR at reference, step 50, and step 100. These same anchors show maximal XSTest refusal and zero benign helpfulness, indicating robust-looking but utility-collapsed behavior. At steps 250 and 500, HRCI falls sharply, benign helpfulness recovers, and XSTest refusal decreases. However, attack success reopens, reaching 0.2500 fixed-source ASR at step 500. The trajectory therefore matches a robustness–utility transition rather than monotone safety improvement. The SFT contrast prevents a stronger but false conclusion. SFT has low HRCI after step 50, yet remains high-ASR. Low coupling alone is therefore not a safety guarantee. The better interpretation is regime-dependent: in R2D2, the high-to-low HRCI transition tracks a robustness–utility frontier; in SFT, behavior is better described by a different mixture of refusal drift and behavior-state features. 5.3 All-anchor diagnostics support H/R coupling as a trajectory monitor The all-anchor diagnostic expands beyond the five anchors to 100 checkpoints per regime. Coverage is complete for XSTest and benign utility, with a dense StrongREJECT subset of 28 anchors per regime. Missing behavior shards are zero. The best descriptive predictors are regime-dependent but consistently informative. In R2D2, HRCI correlates strongly with benign refusal and XSTest refusal, while related H/R geometry terms track fixed-source ASR. In the pooled table, coupling and harmfulness-geometry quantities also track fixed-source ASR, StrongREJECT dense scores, and benign refusal. We interpret these correlations as monitoring evidence, not as deployment prediction. The protocol is fixed, the behavior datasets are fixed, and the geometry extraction uses the same trajectory instrumentation. The result therefore supports H/R coupling as a trajectory diagnostic for this experimental regime. It does not establish heldout generalization across backbones, attack families, or deployment settings. 5.4 H/R causal sweeps show sensitivity, not independent pathways The Mistral WP6 causal matrix covers SFT and R2D2, ablation and steering, five anchors, H-only, R-only, H+R, 𝐻⊥𝑅 , 𝑅⊥𝐻 , and matched unit-direction controls. Control-normalized summaries show fixedprotocol causal sensitivity, especially in SFT R-side rows and selected steering rows. The pattern is not a clean proof that H and R are independent pathways. In several R2D2 ablation modes, target effects are comparable to controls or do not exceed control maxima. The safe conclusion is that H/R interventions modulate behavior under the present protocol, while the current controls do not rule out all scale and norm artifacts. Frontiers of Computer Science | Issue XX | Volume XX | Month Year
We further evaluate the top control-normalized rows with StrongREJECT, benign utility, and degeneration metrics. This follow-up contains 43 rows: 8 target interventions, 30 matched controls, and 5 baselines. It is useful for checking whether fixed-source reopening corresponds to harmful usefulness or generic generation disruption. It is not a full intervention-level behavior matrix over every WP6 row. 5.5 Sparse transfer is regime-dependent The sparse-transfer block evaluates GCG and AutoDAN attacks generated at source checkpoints and transferred to target checkpoints. For SFT, source generation covers 120/120 shards and transfer covers 240/240 off-diagonal rows, with zero failed rows. The R2D2 counterpart uses the same fixed-protocol diagnostic structure. Table 5 gives the central nuance. R2D2 transfer ASR is strongly tracked by target HRCI, but equally strongly tracked by target fixedsource ASR. We therefore do not claim that HRCI uniquely dominates behavior-state predictors. SFT is different: target HRCI is nearly uninformative, while refusal-drift quantities are stronger. Coupling is useful in the R2D2 safety-geometry regime, not a universal predictor.
■ 6 Discussion • From refusal geometry to safety geometry. The main conceptual shift is from a refusal-only carrier to a coupled H/R diagnostic. Refusal geometry explains how refusal can be represented and controlled. Safety geometry asks whether harmfulness recognition and refusal behavior remain behaviorally coupled as training proceeds. This distinction explains why a robust-looking checkpoint can be useless on benign prompts, and why a later checkpoint can recover helpfulness while failing open. • Aligned anchors and Mistral trajectories play different roles. Aligned instruction models validate that the H/R pipeline can recover refusal-side bottlenecks. The Mistral base-to-SFT/R2D2 trajectory then shows what happens when dynamic adversarial pressure is applied to a less mature safety mechanism. The two results should not be collapsed: aligned anchors support protocol validity, while Mistral trajectories support the regime-dependent coupling story. • Relation to broader safe and robust learning. The same-journal context is useful but should not be overstated. Prior FCS work on safe semi-supervised learning argues that additional learning signals should be used in ways that do not degrade target performance, and later FCS work on robust semi-supervised learning in open environments emphasizes that inconsistent data can make learning worse than a supervised baseline [29,30]. Our setting is different— LLM safety under adversarial fine-tuning rather than semi-supervised classification—but the shared principle is that safety-oriented training should be evaluated for side effects, not only for the target objective.
Front. Comput. Sci., Year, Volume(Issue): PaperID
Table 3 Five-anchor HRCI and behavior summary for Mistral SFT/R2D2. Helpfulness is the mean 0–2 benign-utility score on the 60-prompt continuity set. HRCI is an operational coupling diagnostic, not a mechanistic ground truth.
Regime
Anchor
HRCI
Fixed ASR
XSTest refusal
StrongREJECT
Benign help.
R2D2
Reference Step 50 Step 100 Step 250 Step 500
0.0886 0.0898 0.0877 0.0166 0.0165
0.0000 0.0000 0.0000 0.0350 0.2500
1.0000 1.0000 1.0000 0.6640 0.2280
0.1262 0.1220 0.1707 0.2484 0.2638
0.0000 0.0000 0.0000 0.7833 1.1167
SFT
Reference Step 50 Step 100 Step 250 Step 500
0.0521 0.0166 0.0161 0.0153 0.0153
0.6400 0.5050 0.5700 0.5875 0.5775
0.2840 0.0640 0.0800 0.0760 0.0760
0.2172 0.3216 0.3952 0.4530 0.4645
0.8000 1.1667 1.2167 1.2667 1.2167
Five-anchor H/R coupling and behavior diagnostics R2D2
HRCI
Ref
50
100
SFT
Fixed ASR
250
500
Ref
50
100
250
XSTest refusal
500
Ref
50
100
250
Benign help.
500
Ref
50
100
250
500
Fig. 2 Five-anchor H/R coupling and behavior diagnostics for Mistral SFT and R2D2. The panels align HRCI, fixed-source HarmBench ASR, XSTest any-refusal, and benign helpfulness on the same anchor sequence. The figure visualizes the fixed-protocol trajectory summarized in Table 3: early R2D2 is highly coupled, robust, and utility-collapsed, whereas later R2D2 has lower coupling, partial benign-utility recovery, and reopened attack success. Table 4 Representative control-normalized WP6 rows. Δcontrol is the target fixed-source ASR minus the mean of matched same-layer random, wrong-layer, and wrong-position unit-direction controls. These rows motivate intervention-level follow-up; they are not a full proof of independent pathways.
Run family
Selected row
Anchor
Operation
Target ASR
Δcontrol
R2D2 ablation R2D2 ablation SFT ablation SFT ablation R2D2 steering R2D2 steering SFT steering SFT steering
H-only 𝐻⊥𝑅 𝑅⊥𝐻 R-only 𝐻⊥𝑅 H-only 𝑅⊥𝐻 R-only
Reference Reference Step 500 Step 250 Step 500 Step 500 Step 250 Step 250
ablate 0.25 ablate 0.25 ablate 0.5 ablate 0.5 add -4 add -4 add 2 add 4
0.1437 0.1437 0.3344 0.3406 0.1406 0.1375 0.3906 0.3906
0.0325 0.0325 0.0719 0.0675 0.0544 0.0513 0.1369 0.1362
Table 5 Sparse-transfer predictor snapshot. Values are absolute Spearman correlations with transfer ASR in the completed GCG/AutoDAN sparse-transfer diagnostic. The result is descriptive and fixed-protocol; it is not full black-box validation.
Regime
Predictor
Family
Absolute 𝜌
R2D2 R2D2 R2D2 R2D2
Target HRCI Target fixed-source ASR Target-source HRCI gap Target refusal-score drift
geometry behavior state geometry gap drift only
0.965 0.965 0.735 0.482
SFT SFT SFT SFT
Target refusal-score drift Target fixed-source ASR Target-source refusal-drift gap Target HRCI
drift only behavior state drift gap geometry
0.591 0.562 0.424 0.030
Frontiers of Computer Science | Issue XX | Volume XX | Month Year
Wenhao Lan et al.
From Refusal Geometry to Safety Geometry: Harmfulness–Refusal Coupling under Dynamic Adversarial Fine-Tuning
Sparse-transfer predictor comparison R2D2: Target HRCI
0.965
R2D2: Target fixed-source ASR
0.965
R2D2: Target-source HRCI gap
0.735
R2D2: Target-source refusal drift gap
0.505
R2D2: Target refusal-score drift
0.482
SFT: Target refusal-score drift
0.591
SFT: Target fixed-source ASR
0.562
SFT: Target-source refusal drift gap
0.424
SFT: Target-source HRCI gap
0.155
SFT: Target HRCI
0.030
Fig. 3 Predictor comparison for the completed sparse GCG/AutoDAN transfer diagnostic. Bars show absolute Spearman correlation with transfer ASR for pooled R2D2 and SFT transfer rows. The figure emphasizes the regime-dependent result: R2D2 transfer is strongly tracked by target HRCI and target fixed-source ASR, whereas SFT transfer is better summarized by refusal-drift quantities.
This is why we treat benign utility, over-refusal, and degeneration as first-class readouts rather than secondary diagnostics. • Why not refusal drift alone? Refusal drift is informative, especially in SFT transfer. But it does not explain the R2D2 pattern by itself. R2D2 begins with high coupling, near-zero fixed-source ASR, maximal over-refusal, and zero benign helpfulness; later it lowers coupling, restores benign helpfulness, and reopens attacks. That pattern is better described as a coupling transition along a robustness–utility frontier. • Why not independent pathways? Orthogonalized H/R interventions and aligned-anchor ablations are necessary but insufficient for an independent-pathway claim. Orthogonality in activation space does not imply mechanistic independence, and the current controls are unit-direction controls rather than raw activation-delta norm-matched controls. We therefore describe our result as fixed-protocol causal sensitivity.
multi-turn, or deployment-grade adaptive validation. In particular, PAIR/TAP-style attacker-model search and broader benchmark suites remain outside the present evidence chain. Finally, the four-quadrant construction is an audit artifact and should be human-validated before being treated as a benchmark.
■ 8 Safety and Ethics This work evaluates harmful-request refusal and jailbreak robustness. The experiments are reported through aggregate metrics, intervention summaries, and diagnostic tables rather than by reproducing harmful prompts, optimized suffixes, or harmful completions. The goal is not to provide a jailbreak method, but to understand when adversarial fine-tuning creates robust refusal, broad over-refusal, benign utility collapse, or fail-open behavior. Release of code or artifacts should preserve this separation by withholding raw harmful generations and adversarial strings where needed.
■ 7 Limitations The study has several important limitations. First, the main trajectory uses one backbone, Mistral-7B-v0.1, under matched SFT and R2D2 regimes. The aligned anchors validate the protocol but do not provide a full multi-backbone atlas. Second, HRCI is an operational diagnostic computed from selected H/R geometry summaries; it is not a mechanistic ground truth. Third, the WP6 controls are matched same-layer random, wrong-layer, and wrong-position unit-direction controls. We do not currently include raw activation-delta norm-matched controls, so we avoid claims that all norm or scale artifacts are ruled out. Fourth, the benign-utility evidence is a 60-prompt continuity set, not a 500– 1000 prompt utility benchmark. Fifth, the intervention-level StrongREJECT and benign-utility follow-up covers selected top rows and matched controls, not the full WP6 matrix. Sixth, sparse transfer covers GCG and AutoDAN under a fixed protocol; it is not full black-box, Frontiers of Computer Science | Issue XX | Volume XX | Month Year
■ Acknowledgements Omitted for anonymous review.
■ Competing interests The authors declare that they have no competing interests or financial conflicts to disclose.
■ Data and Code Availability The manuscript is based on fixed-protocol experiment artifacts generated in the HarmBench/R2D2 workspace. Aggregate source tables, figure sources, run manifests, and compute-provenance summaries are organized under the stable supplementary artifact identifiers listed in Appendix A. Raw harmful prompts, optimized attack strings, and generated harmful completions are excluded or redacted where appropriate.
Front. Comput. Sci., Year, Volume(Issue): PaperID
Table 6 Supplementary artifact map. The stable artifact identifiers refer to aggregate source tables, reports, figure sources, and provenance files prepared for the submission package. Raw harmful prompts, optimized attack strings, and harmful completions are excluded or redacted.
Component
Supplementary artifact ID and contents
Five-anchor HRCI behavior Aligned-anchor H/R calibration All-anchor behavior diagnostics WP6 causal/control summaries Intervention behavior/utility Four-quadrant construction Sparse transfer Figures, bibliography, provenance
FCS-SUPP-S1: five-anchor HRCI and behavior aggregate table FCS-SUPP-S2: aligned Llama/Qwen H/R geometry and causal summaries FCS-SUPP-S3: all-anchor behavior correlations and diagnostic report FCS-SUPP-S4: control-normalized H/R causal summaries and control-scope report FCS-SUPP-S5: selected-row StrongREJECT, benign utility, and degeneration follow-up FCS-SUPP-S6: H/R audit construction counts and report FCS-SUPP-S7: fixed-protocol GCG/AutoDAN sparse-transfer diagnostics FCS-SUPP-S8--S9: figure sources, reproduction scripts, citation audit, and compute summaries
■ Appendixes Appendix A: Artifact map ■ References [1] Lan W, Li S, Yang J, Shen H, Yang Y. Dynamic adversarial fine-tuning reorganizes refusal geometry. arXiv:2604.27019. Available at https: //arxiv.org/abs/2604.27019, 2026 [2] Mazeika M, Phan L, Yin X, Zou A, Wang Z, Mu N, Sakhaee E, Li N, Basart S, Li B, Forsyth D, Hendrycks D. HarmBench: A standardized evaluation framework for automated red teaming and robust refusal. In: Proceedings of the 41st International Conference on Machine Learning. 2024, 35181–35224 [3] Souly A, Lu Q, Bowen D, Trinh T, Hsieh E, Pandey S, Abbeel P, Svegliato J, Emmons S, Watkins O, Toyer S. A StrongREJECT for empty jailbreaks. In: Advances in Neural Information Processing Systems. 2024, 125416–125440 [4] Röttger P, Kirk H, Vidgen B, Attanasio G, Bianchi F, Hovy D. XSTest: A test suite for identifying exaggerated safety behaviours in large language models. In: Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). 2024, 5377–5400 [5] Siu V, Crispino N, Yu Z, Pan S, Wang Z, Liu Y, Song D, Wang C. COSMIC: Generalized refusal direction identification in LLM activations. In: Findings of the Association for Computational Linguistics: ACL 2025. 2025, 25534–25553 [6] Zhao J, Huang J, Wu Z, Bau D, Shi W. LLMs Encode Harmfulness and Refusal Separately. In: Advances in Neural Information Processing Systems. 2025, 140283–140318 [7] Zhao W, Hu Y, Sui X, Li Z, Deng Y, Zhao Y, Qin B, Che W. The gains do not make up for the losses: A comprehensive evaluation for safety alignment of large language models via machine unlearning. Frontiers of Computer Science, 2026, 20(2): 2002319 [8] Perez E, Huang S, Song F, Cai T, Ring R, Aslanides J, Glaese A, McAleese N, Irving G. Red teaming language models with language models. In: Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing. 2022, 3419–3448 [9] Zou A, Wang Z, Carlini N, Nasr M, Kolter J Z, Fredrikson M. Universal and transferable adversarial attacks on aligned language models, 2023 [10] Liu X, Xu N, Chen M, Xiao C. AutoDAN: Generating stealthy jailbreak prompts on aligned large language models. In: The Twelfth International Conference on Learning Representations. 2024 [11] Chao P, Robey A, Dobriban E, Hassani H, Pappas G J, Wong E. Jailbreaking black box large language models in twenty queries, 2023 [12] Mehrotra A, Zampetakis M, Kassianik P, Nelson B, Anderson H, Singer Y, Karbasi A. Tree of attacks: Jailbreaking black-box LLMs auto-
matically, 2024 [13] Chao P, Debenedetti E, Robey A, Andriushchenko M, Croce F, Sehwag V, Dobriban E, Flammarion N, Pappas G J, Tramèr F, Hassani H, Wong E. JailbreakBench: An open robustness benchmark for jailbreaking large language models. In: Advances in Neural Information Processing Systems. 2024, 55005–55029 [14] Cui J, Chiang W L, Stoica I, Hsieh C J. OR-Bench: An over-refusal benchmark for large language models, 2024 [15] Zhang Z, Xu W, Wu F, Reddy C K. FalseReject: A resource for improving contextual safety and mitigating over-refusals in LLMs via structured reasoning, 2025 [16] Beyer T, Xhonneux S, Geisler S, Gidel G, Schwinn L, G”unnemann S. LLM-safety evaluations lack robustness, 2025 [17] Arditi A, Obeso O, Syed A, Paleka D, Panickssery N, Gurnee W, Nanda N. Refusal in language models is mediated by a single direction. In: Advances in Neural Information Processing Systems. 2024, 136037– 136083 [18] Wollschläger T, Elstner J, Geisler S, Cohen-Addad V, Günnemann S, Gasteiger J. The geometry of refusal in large language models: Concept cones and representational independence. In: Proceedings of the 42nd International Conference on Machine Learning. 2025, 66945–66970 [19] Lin Y, He P, Xu H, Xing Y, Yamada M, Liu H, Tang J. Towards understanding jailbreak attacks in LLMs: A representation space analysis. In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 2024, 7067–7085 [20] Zhou Z, Yu H, Zhang X, Xu R, Huang F, Li Y. How alignment and jailbreak work: Explain LLM safety through intermediate hidden states. In: Findings of the Association for Computational Linguistics: EMNLP 2024. 2024, 2461–2488 [21] Qi X, Zeng Y, Xie T, Chen P Y, Jia R, Mittal P, Henderson P. Finetuning aligned language models compromises safety, even when users do not intend to! In: International Conference on Learning Representations. 2024 [22] Yu L, Do V, Hambardzumyan K, Cancedda N. Robust LLM safeguarding via refusal feature adversarial training. In: International Conference on Learning Representations. 2025 [23] Casper S, Schulze L, Patel O, Hadfield-Menell D. Defending against unforeseen failure modes with latent adversarial training, 2024 [24] Sheshadri A, Ewart A, Guo P, Lynch A, Wu C, Hebbar V, Sleight H, Stickland A C, Perez E, Hadfield-Menell D, Casper S. Latent adversarial training improves robustness to persistent harmful behaviors in LLMs, 2024 [25] Du Y, Fan F, Zhao S, Cao J, Lin Q, He K, Liu T, Qin B, Feng M. Anchoring refusal direction: Mitigating safety risks in tuning via projection
Frontiers of Computer Science | Issue XX | Volume XX | Month Year
Wenhao Lan et al.
From Refusal Geometry to Safety Geometry: Harmfulness–Refusal Coupling under Dynamic Adversarial Fine-Tuning
constraint, 2025 [26] Jiang A Q, Sablayrolles A, Mensch A, Bamford C, Chaplot D S, Casas d. l D, Bressand F, Lengyel G, Lample G, Saulnier L, Lavaud L R, Lachaux M A, Stock P, Le Scao T, Lavril T, Wang T, Lacroix T, El Sayed W. Mistral 7B, 2023 [27] Grattafiori A, Dubey A, Jauhri A, Pandey A, Kadian A, Al-Dahle A, Letman A, Mathur A, Schelten A, Vaughan A, Yang A, others . The Llama 3 herd of models, 2024 [28] Yang A, Yang B, Zhang B, Hui B, Zheng B, Yu B, Li C, Liu D, Huang F, Wei H, Lin H, others . Qwen2.5 technical report, 2024 [29] Li Y F, Liang D M. Safe semi-supervised learning: A brief introduction. Frontiers of Computer Science, 2019, 13(4): 669–676 [30] Guo L Z, Jia L H, Shao J J, Li Y F. Robust semi-supervised learning in open environments. Frontiers of Computer Science, 2025, 19(8): 198345 Author biographies should be inserted after acceptancestage author metadata is finalized.
Frontiers of Computer Science | Issue XX | Volume XX | Month Year