CRaFT: Circuit-Guided Refusal Feature Selection via Cross-Layer Transcoders

2026-04-02

AI Summary

Existing methods for selecting refusal behavior features rely on activation strength under harmful prompts, often capturing superficial correlations rather than causal mechanisms. This work proposes CRaFT, a novel framework that prioritizes circuit-level influence as the core criterion for feature selection. By analyzing prompts near the refusal boundary and integrating cross-layer transformer analysis with circuit intervention techniques, CRaFT ranks features based on their causal contribution to the model’s decisions to refuse or comply. The approach substantially enhances the causal representativeness of selected features, increasing jailbreak attack success rates from 6.7% to 48.2% on Gemma-3-1B-it and significantly outperforming existing baselines across multiple benchmarks.

Abstract

As safety concerns around large language models (LLMs) grow, understanding the internal mechanisms underlying refusal behavior has become increasingly important. Recent work has studied this behavior by identifying internal features associated with refusal and manipulating them to induce compliance with harmful requests. However, existing refusal feature selection methods rely on how strongly features activate on harmful prompts, which tends to capture superficial signals rather than the causal factors underlying the refusal decision. We propose CRaFT, a circuit-guided refusal feature selection framework that ranks features by their influence on the model's refusal-compliance decision using prompts near the refusal boundary. On Gemma-3-1B-it, CRaFT improves attack success rate (ASR) from 6.7% to 48.2% and outperforms baseline methods across multiple jailbreak benchmarks. These results suggest that circuit influence is a more reliable criterion than activation magnitude for identifying features that causally mediate refusal behavior.

Problem

• refusal behavior
• feature selection
• causal mechanisms
• large language models
• safety

Innovation

• circuit-guided
• refusal feature selection
• cross-layer transcoders
• causal mediation
• jailbreak robustness