Researchers dissected how large‑language models refuse harmful requests. Across 13 popular open‑source chat models, up to 72 B parameters, they identified a single one‑dimensional subspace that governs refusal. By erasing this direction from the residual stream, models stop denying unsafe prompts; inserting it triggers refusal even for harmless queries.

Capitalizing on this insight, the team crafted a white‑box jailbreak that surgically disables the refusal vector while preserving general performance. They also dissected how adversarial suffixes suppress the direction’s propagation, revealing a new vector for controlling model behavior. The work underscores the brittleness of fine‑tuning safety modules and suggests a path toward more transparent safeguards for developers and researchers today.

The finding that a single latent direction can toggle refusal raises questions about the robustness of current safety pipelines. By exposing a mechanical lever, the study offers a concrete tool for auditing and refining chat models. Practitioners can now test whether erasing this subspace changes user experience, providing a measurable yardstick for future safety research and deployment strategies today.