From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling

Abstract

Large language models remain vulnerable to producing unsafe content under adversarial prompting, yet how safety behavior is implemented inside the network is poorly understood. We identify a three-stage safety circuit — Harmful Detection Heads that flag harmful inputs, Safety Neurons that stabilize the signal in the residual stream, and Refusal Heads that write the refusal — using lightweight, training-free probing on paired prompts. Targeted ablation and activation patching give causal evidence that detection drives refusal, and this decomposition recurs across six architectures and several jailbreak attacks. Building on it, our training-free weight-scaling intervention (CBSE) improves safety under attack by 26.5% while incurring only a 1.7% average accuracy drop on four standard benchmarks.

Contributions

1. The safety circuit. We characterize a three-stage detection-to-refusal circuit composed of Harmful Detection Heads, Safety Neurons, and Refusal Heads. All three are recovered with lightweight, training-free probing on paired harmful/neutral prompts that differ by a single word.
2. Causal validation. Targeted ablation and activation patching show that detection heads causally drive refusal heads, with safety neurons mediating the pathway. Matched random-component controls rule out both a shared-upstream-cause and a generic difficulty-detector explanation.
3. Circuit-Based Safety Editing (CBSE). We introduce a training-free, architecture-preserving weight-scaling intervention that reinforces the identified circuit without new parameters or added inference cost. Across six LLMs and attacks including GCG, PAIR, AutoDAN, and ADV-LLM, CBSE substantially improves safety while largely preserving utility.

A Three-Stage Detection-to-Refusal Circuit

We identify three types of safety-related components using probing on paired prompts that differ by a single word (e.g., “...make a bomb...” vs. “...make a model...”) — no training or gradient updates required.

• Harmful Detection Heads — “Is this input harmful?” Attention heads that selectively redirect attention toward the harmful token when present, separating harmful prompts from otherwise-identical neutral ones.
• Safety Neurons — “Stabilize the signal.” MLP neurons that transform and stabilize the safety signal already present in the residual stream.
• Refusal Heads — “Write the refusal.” Attention heads active during generation whose residual-stream writes align strongly with the model’s internal refusal direction.

The Circuit Is Causal, Not Just Correlational

Ablating detection heads or safety neurons collapses downstream refusal-head activity, while ablating the same number of random components does not — direct evidence that these components, not the network at large, drive refusal.

Figure 2a: Ablating harmful detection heads causes a sharp drop in downstream refusal-head contribution across six architectures; random ablation of the same size (dashed) leaves refusal largely intact.

Figure 2b: Ablating safety neurons produces an even more pronounced collapse in refusal-head contribution, underscoring their mediating role.

Ruling out a shared cause. Removing component A weakens component C — but does A directly cause C, or do both share a common upstream cause? We rule out the latter with activation patching: swapping only the detection heads’ output between paired harmful and neutral runs, holding everything else fixed, moves the refusal heads’ contribution in the same direction on five of six architectures.

Table 1: Activation patching on the detection→refusal pathway: fraction of the harmful–neutral gap in refusal-head contribution explained by patching only the detection heads’ output (51 paired prompts each).

Circuit-Based Safety Editing (CBSE)

CBSE is a training-free, architecture-preserving weight-scaling intervention that reinforces the identified circuit — no gradient updates, no new parameters, no added inference cost.

1. Identify Harmful Detection Heads

Using ~50 paired harmful/neutral prompts that differ by a single word, score each attention head by how strongly it redirects attention toward the harmful token, and keep the top heads.

2. Identify Safety Neurons & Refusal Heads

From paired refusing/complying responses, extract a refusal direction. Select the refusal heads whose residual-stream writes align with it and the MLP safety neurons that modulate its strength.

3. Weight Scaling to amplify the Circuit

Multiply the output projection \(W_O\) of the top detection and refusal heads, and the down-projection \(W_{\text{down}}\) columns of the top safety neurons, by a scaling factor \(\alpha > 1\) — leaving every other weight untouched.

Figure 3 sweeps the scaling factor for a single component type at a time. Reinforcing any one type already raises safety, but jointly scaling detection heads, refusal heads, and safety neurons together produces the largest and most consistent gains — while a random-component control of the same size shows no comparable improvement.

Figure 3a: Detection Heads

Figure 3b: Refusal Heads

Figure 3c: Safety Neurons

Figure 3: Scaling each component type in isolation consistently improves Llama-Guard safety rates under GCG attacks across all six architectures.

Results

Averaged across six LLMs, CBSE raises the safety rate under attack from 43.2% to 69.7% (+26.5%) while reducing average accuracy on four standard benchmarks by only 1.7%. The largest gains come on the strongest attacks, where the original models are most vulnerable.

CBSE is evaluated across six LLM architectures under Pure Harmful Prompt, GCG, and ADV-LLM attacks (measured with Llama-Guard), and on four standard utility benchmarks.

Table 2: Safety rates (%) under Pure Harmful Prompt / GCG / ADV-LLM attacks, jointly reinforcing detection heads, refusal heads, and safety neurons.

Table 3: Utility on four standard benchmarks. Across all six architectures, CBSE incurs only a 1.7% average accuracy drop.

Related Work

Mechanistic interpretability of safety

• A. Arditi, O. Obeso, A. Syed, D. Paleka, N. Panickssery, W. Gurnee, N. Nanda. Refusal in Language Models Is Mediated by a Single Direction. NeurIPS 2024.
• Y. Zhao, W. Zhang, Y. Xie, A. Goyal, K. Kawaguchi, M. Shieh. Understanding and Enhancing Safety Mechanisms of LLMs via Safety-Specific Neuron. ICLR 2025.
• Z. Zhou, H. Yu, X. Zhang, R. Xu, F. Huang, K. Wang, Y. Liu, J. Fang, Y. Li. On the Role of Attention Heads in Large Language Model Safety. ICLR 2025.
• C. Olsson, N. Elhage, N. Nanda, N. Joseph, et al. In-Context Learning and Induction Heads. arXiv 2022.

Safety interventions & defenses

• A. Zou, L. Phan, J. Wang, D. Duenas, M. Lin, M. Andriushchenko, R. Wang, Z. Kolter, M. Fredrikson, D. Hendrycks. Improving Alignment and Robustness with Circuit Breakers. NeurIPS 2024.
• A. Sheshadri, A. Ewart, P. Guo, A. Lynch, C. Wu, et al. Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs. arXiv 2024.
• A. Robey, E. Wong, H. Hassani, G. J. Pappas. SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks. TMLR 2025.
• L. Yu, V. Do, K. Hambardzumyan, N. Cancedda. Robust LLM Safeguarding via Refusal Feature Adversarial Training. ICLR 2025.

Jailbreak attacks

• A. Zou, Z. Wang, J. Z. Kolter, M. Fredrikson. Universal and Transferable Adversarial Attacks on Aligned Language Models (GCG). arXiv 2023.
• C.-E. Sun, X. Liu, W. Yang, T.-W. Weng, H. Cheng, A. San, M. Galley, J. Gao. Iterative Self-Tuning LLMs for Enhanced Jailbreaking Capabilities (ADV-LLM). NAACL 2025.
• P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, E. Wong. Jailbreaking Black Box Large Language Models in Twenty Queries (PAIR). SaTML 2025.
• X. Liu, N. Xu, M. Chen, C. Xiao. AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models. ICLR 2024.

Cite this work

Kuan-Lin Chu, Chung-En Sun, and Tsui-Wei (Lily) Weng. “From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling.” Findings of EMNLP, 2026.

@inproceedings{cbse,
    title={From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling},
    author={Kuan-Lin Chu and Chung-En Sun and Tsui-Wei Weng},
    booktitle={Findings of the Association for Computational Linguistics: EMNLP 2026},
    year={2026}
}