Refusal Beyond a Single Direction: A Preliminary Comparison of Diff-in-Means and INLP

The evolution of interpretability in language models has focused on identifying influential directions in activation space, with techniques like PCA, LAT, and supervised steering vectors. Early concept erasure methods such as INLP demonstrated the ability to remove biases by projecting onto nullspaces of classifiers. Recent work by Wu et al. (2025) confirmed the effectiveness of simple linear methods like Diff-in-Means for concept detection and control. Arditi et al. (2024) extended this understanding by showing that refusal behavior is mediated by a single linear direction, which can be manipulated to control model responses. However, the complexity of internal representations suggests that multi-dimensional approaches like INLP could offer finer control, but systematic comparisons remain scarce. This research aims to fill this gap by evaluating the efficacy of INLP’s multi-dimensional subspaces versus DiM’s single direction in the context of refusal behavior, providing geometric and empirical insights into their mechanisms.

While single linear directions like DiM are effective and simple, they may oversimplify the internal encoding of refusal behavior, limiting flexibility and nuance. INLP’s multi-dimensional subspaces promise more refined control but lack comprehensive evaluation in this context. The core challenge is to determine whether multi-dimensional interventions can match or outperform single directions in refusal suppression while preserving model performance. Additionally, understanding how different interventions geometrically reshape activation space and encode concepts versus their opposites remains unresolved. These issues hinder the development of precise, scalable, and interpretable safety interventions in language models.

This work introduces a systematic comparison between DiM and INLP for concept control, emphasizing INLP’s multi-dimensional subspace and the α-parameterized interventions. It demonstrates that counterfactual flipping (α=2) can effectively invert concepts, providing a tunable mechanism for model behavior. The geometric analysis reveals that nullspace projection collapses activations into an intermediate region, while flipping moves them into the opposite class, uncovering different internal encoding strategies. These insights extend the understanding of concept representations, enabling more flexible and precise control strategies beyond traditional single-direction methods.

• �� Extract residual stream activations at various layers and positions for harmful and harmless prompts. • Construct linear directions via mean differences (DiM) and evaluate their effectiveness through activation addition and ablation. • Train multiple linear classifiers iteratively to identify concept subspaces (INLP), stopping when classifiers reach a threshold accuracy. • Generate interventions by applying nullspace projection (α=1) to erase concepts, and counterfactual flipping (α=2) by reflecting activations across the subspace. • Select optimal layers and positions based on suppression metrics, ensuring fair comparison across methods. • Visualize activation space changes with PCA, analyze the geometric distribution, and evaluate the semantic fidelity of transformed activations.

The experimental setup involves five open-source models, with datasets including harmful and harmless instruction sets from Arditi et al. (2024). Metrics include refusal rates (substring matching, LlamaGuard, LLM judge), perplexity, and accuracy on MMLU and ARC. Interventions are applied at selected layers and positions, with k-values ranging from full (n) to partial (0.8). The evaluation assesses refusal suppression effectiveness, model performance preservation, and geometric changes in activation space. Ablation studies examine the impact of direction number and intervention parameters, ensuring robustness and generality of findings.

The results confirm that INLP’s counterfactual flipping achieves refusal suppression comparable to DiM’s directional ablation, with some models exceeding DiM. Nullspace projection shows weaker and inconsistent effects. Limiting the number of directions (k=0.8) maintains most suppression while reducing perplexity degradation. Geometrically, nullspace projection collapses activations into an intermediate region, while flipping moves them into the opposite class, indicating different internal representations. These findings validate the richer control capacity of INLP and highlight the importance of multi-dimensional interventions for nuanced model behavior regulation.

The methods can be employed to improve safety in dialogue systems by fine-tuning refusal behaviors, reducing harmful content generation. They also facilitate interpretability by revealing how concepts are encoded and manipulated internally. The tunability of INLP interventions supports adaptive safety measures, enabling dynamic control in real-world deployment. Long-term, these techniques could underpin scalable frameworks for multi-concept disentanglement and multi-task safety interventions, fostering more transparent and reliable AI systems.

Current validation is limited to small-scale models; scalability to larger architectures remains untested. The linear assumption may oversimplify complex internal representations, necessitating non-linear extensions. Layer and position selection strategies influence results, requiring further optimization. Additionally, the focus on a single concept (refusal) limits generalization; multi-concept scenarios pose additional challenges. Future work should address these limitations to develop more comprehensive and robust control frameworks.