# Refusal Is Redundantly Distributed, Not Localized: A Per-Layer Ablation Study on Llama-3.1-8B > Source: > Published: 2026-07-16 00:46:01+00:00 Understanding how features are represented within an LLM has been an active area of research, one which has gained intensity concerning **AI safety**, as it allows us to build better safety guardrails. **Mechanistic interpretability** happens to work in direct relation to this by peeking into the model's internals rather than treating it as a **black box**, by looking at each layer's activations, testing their causal significance by performing ablations and steering, and, in essence, gaining an understanding of how the model actually implements its behavior. Refusal is a good example of this, which is the behaviour of the model to refuse requests that are harmful, illegal, as well as instructions that could produce results that bad actors can take advantage of. The work presented by Arditi et al. [1] on the refusal mechanism claims that there exists a single direction in the model’s residual stream such that projecting it out (ablation) is enough to bypass refusal on harmful prompts, and adding it back (steering) is enough to induce refusal on harmless ones. In the experiment, alongside replicating Arditi et al. [1] original method, I perform two additional experiments, ablating each layer with its own DIM direction, and repeating the former while excluding the master layer entirely. These new experiments aim to test whether refusal actually lives in a single layer or whether there are more nuances to it, which is one of the questions the paper left partially open. The direction is computed by using Difference-in-Means (DIM) by taking the average hidden activation for the harmful prompts and the average for the harmless prompts at a particular token position and layer, and subtracting one from the other (equation 1, see Appendix). This resulting vector (or direction) essentially captures the axis along which the model distinguishes "I should refuse this" from "I should answer this". For each of the model's 32 layers, I recorded the layer activations at the **<|eot_id|>** token position separately for harmful and harmless prompts, following Arditi et al. [1], who found this token provided a strong refusal signal as compared to other token positions. Following Arditi et al. [1], ablation removes this projected component from the residual stream at every layer and token position. The three methods below differ in which direction(s) are used to do this. **Method 1 - L12-on-all**: Take the single direction from a single "master" layer (the layer with the strongest effect in training) and subtract it from residual stream activations at every layer and every token position. This is the direct replication of Arditi et al. **Method 2 - Per-Layer DIM**: For each layer, subtract that layer’s own DIM direction from its own activations. Every layer gets its own dedicated direction. **Method 3 - Skip-L12**: Same as Per-Layer DIM, but excludes the "master" layer. This tests whether that layer is causally necessary or just a convenient extraction point. To check whether the DIM direction is enough on its own to cause refusal, steering (activation addition) was tested in the same way as Arditi et al. [1], by adding the raw, unnormalized direction to the activation from the master layer's direction, as shown in equation 6 (see Appendix) The dataset draws from three sources: contrastive prompt pairs generated by prompting Claude Sonnet 4.6, AdvBench [3], and SaladBench For evaluations, the JailbreakBench dataset [6] was used, following the same evaluation setup as Arditi et al A single-layer ablation sweep (Figure 1) identifies the "master" layer for refusal in Llama-3.1-8B-Instruct as **layer 12**, the same layer identified by Arditi et al. [1], despite using a somewhat different selection method. After performing the sets of ablation experiments, Figure 2 shows that the first method (L12-on-all), which was similar to Arditi et al. [1], showed an ASR of For harmless prompts, which involved steering, the model refused **15** of the 100 harmless prompts before intervention. After intervention, the model refused** 99%** of the total prompts, affirming the causal role of the direction in inducing refusal. The **refusal scores** also show similar trends, after intervention, it jumped to **13.46**, all the while the responses stayed coherent. One small study on the effect of using raw vectors and normalized vector directions for steering, although both can be used and work well, once the direction was normalized and scaled using **α = 20**, the output quality became** worse**, wherein the model started repeating the word "prohibited" for the full length of the generation, on every prompt, regardless of what was actually asked. PCA is used to project the high-dimensional activations down to two dimensions. The model internally organizes harmful and harmless prompts into two largely separable regions of its activation space, and the DIM direction points exactly along the axis that separates them. Figure 5 (left) shows that removing this direction from the model’s internal state is enough to move harmful prompts into a different region of the activation space, one where the model no longer detects harm and stops refusing. Similarly, Figure 5 (right) shows that adding this direction pushes harmless prompts into the harmful region of the activation space, causing the model to treat them as harmful enough to refuse. The following are my observations from this experiment: Single Model: The current experiment was conducted on a single model (Llama-3.1-8B-Instruct [2]). Whether these results, the redundancy findings, generalize to other families of models or parameter scales is untested. Keyword Matching: The behavioral evaluation relies on keyword matching for refusal detection, which introduces noise in both directions, false positives from benign phrases like “cannot” or “don’t,” and potentially false negatives if a harmful response opened with an unusual construction that the list did not anticipate (see Appendix). Dataset: The training set is relatively small (297 harmful prompts after filtering), drawn from three sources with known biases. Jailbreak prompts in the wild tend to be more creative than AdvBench [3] or SaladBench The next most immediate step is the cross-model replication. This will test whether the redundancy results hold for other open-source model families and scales. The Skip-L12 direction method could be doing something more distinct from redundancy. It could be one of the many directions possible in the set of possible directions, i.e., refusal might not be a single direction replicated across layers, but one member of a higher-dimensional "concept cone" of directions, as proposed by Wollschläger et al [7]. Distinguishing these would clarify whether refusal is geometrically one-dimensional or genuinely multi-dimensional at each layer Finally, addressing keyword-based refusal matching, a model-based classifier appears more reliable, although it introduces its own calibration questions. This project was completed as a part of the BlueDot Impact Technical AI Safety Project Sprint. I would like to thank and acknowledge Alexander Reinthal for helpful feedback, engaging brainstorming sessions, and discussion. Finally, a huge thanks to BlueDot Impact for organizing the course and bringing attention to AI Safety. where, , is the hidden activation at layer for prompt , and c ∈ {harmful, harmless} marks which of the two prompt classes it belongs to, with examples each. Arditi, A. et al. (2024). *Refusal in Language Models Is Mediated by a Single Direction*. [arXiv:2406.11717](https://arxiv.org/abs/2406.11717) Llama Team, AI @ Meta. (2024). *The Llama 3 Herd of Models*. [arXiv:2407.21783](https://arxiv.org/abs/2407.21783). Model weights accessed via [NousResearch/Meta-Llama-3.1-8B-Instruct](https://huggingface.co/NousResearch/Meta-Llama-3.1-8B-Instruct) Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J. Z., & Fredrikson, M. (2023). *Universal and Transferable Adversarial Attacks on Aligned Language Models*. [arXiv:2307.15043](https://arxiv.org/abs/2307.15043). Dataset: [walledai/AdvBench](https://huggingface.co/datasets/walledai/AdvBench) Li, L., Dong, B., Wang, R., Hu, X., Zuo, W., Lin, D., Qiao, Y., & Shao, J. (2024). *SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Models*. Findings of the Association for Computational Linguistics (ACL). [arXiv:2402.05044](https://arxiv.org/abs/2402.05044). Dataset: [walledai/SaladBench](https://huggingface.co/datasets/walledai/SaladBench) Taori, R., Gulrajani, I., Zhang, T., Dubois, Y., Li, X., Guestrin, C., Liang, P., & Hashimoto, T. B. (2023). *Stanford Alpaca: An Instruction-following LLaMA Model*. GitHub repository. Dataset: [tatsu-lab/alpaca](https://huggingface.co/datasets/tatsu-lab/alpaca) Chao, P., Debenedetti, E., Robey, A., Andriushchenko, M., Croce, F., Sehwag, V., Dobriban, E., Flammarion, N., Pappas, G. J., Tramèr, F., Hassani, H., & Wong, E. (2024). *JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models*. NeurIPS Datasets and Benchmarks Track. [arXiv:2404.01318](https://arxiv.org/abs/2404.01318). Dataset: [JailbreakBench/JBB-Behaviors](https://huggingface.co/datasets/JailbreakBench/JBB-Behaviors) Wollschläger, T., Elstner, J., Geisler, S., Cohen-Addad, V., Günnemann, S., & Gasteiger, J. (2025). *The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence*. Proceedings of the 42nd International Conference on Machine Learning (ICML), PMLR 267:66945–66970. [arXiv:2502.17420](https://arxiv.org/abs/2502.17420)