From Refusal Geometry to Safety Geometry: Harmfulness--Refusal Coupling under Dynamic Adversarial Fine-Tuning

2026-06-15

AI Summary

Current evaluations struggle to distinguish whether language models genuinely recognize harmfulness or merely reject requests mechanically. This work proposes “harmfulness–refusal coupling” as a core diagnostic metric of safety geometry and employs bilateral representation analysis, causal intervention sweeps, sparse adversarial transfer, and anchor-point diagnostics to trace the evolution of Mistral-7B-v0.1 during SFT and R2D2 training. The study finds that early-stage R2D2 exhibits high coupling, conferring strong robustness at the cost of general capabilities, whereas later stages show reduced coupling, restoring functionality but expanding the attack surface. In contrast, SFT maintains low coupling yet demonstrates significantly weaker robustness. These results indicate that the degree of coupling serves as a critical indicator for assessing alignment safety.

Abstract

Safety alignment requires language models to refuse harmful requests without losing the ability to answer benign ones. Existing robustness evaluations, however, do not reveal whether a model has learned to recognize harmfulness, to activate a refusal policy, or to couple these two processes. We study this question with a dual safety-geometry protocol that measures harmfulness carriers, refusal carriers, and their coupling across aligned instruction-tuned anchors and matched Mistral-7B-v0.1 SFT/R2D2 training trajectories. The aligned anchors validate the protocol: refusal-side interventions reopen attack success more strongly than harmfulness-only interventions, while harmfulness and refusal carriers remain nearly orthogonal. Along the Mistral trajectory, R2D2 exhibits a high-coupling early phase with strong fixed-source robustness, saturated safe-prompt refusal, and collapsed benign utility. Later checkpoints move to a lower-coupling regime with partial utility recovery and reopened attack success. SFT provides an important contrast: it also reaches low coupling, but remains substantially less robust, showing that low coupling alone is not a safety guarantee. All-anchor diagnostics and sparse GCG/AutoDAN transfer experiments further show that H/R coupling is informative in the R2D2 regime, whereas SFT transfer is better summarized by drift or behavior-state measures. Causal sweeps support fixed-protocol sensitivity relative to matched unit-direction controls, but do not establish independent harmfulness and refusal pathways. These results frame harmfulness--refusal coupling as an operational diagnostic for safety-geometry dynamics under adversarial fine-tuning.

Problem

• safety alignment
• harmfulness-refusal coupling
• adversarial fine-tuning
• language model robustness
• refusal policy

Innovation

• harmfulness-refusal coupling
• safety geometry
• adversarial fine-tuning
• robustness evaluation
• language model alignment