Safety‑aligned large language models (LLMs) are still vulnerable to jailbreaks and tend to over‑refuse harmless requests. To explain these failures we separate harmfulness recognition from the computation that writes a refusal. We cast this as a pathway problem and make it measurable on residual‑stream updates in decoder‑only Transformers, distinguishing:
- Harmful information: the signal about harmfulness exposed by a module update.
- Refusal evidence: the readable change that constitutes a refusal.
Across 18 Base‑Instruct pairs covering Qwen, Llama and Gemma, attention updates decode harmfulness more readily, especially in early layers, while MLP updates contribute more strongly to harm‑selective refusal writing in aligned models. Post‑training strengthens MLP‑based refusal writing in all pairs but does not systematically improve harmfulness decodability; instead, positive (non‑refusal) writing becomes more concentrated in deeper layers after post‑training.
In six reasoning‑enabled models, harmfulness remains decodable during reasoning, whereas strong refusal writing concentrates at the onset of answer generation—a pattern that persists when reasoning is disabled. Causal interventions support the pathway hypothesis: resetting downstream MLP updates to their clean values substantially reduces the refusal shift caused by upstream attention interventions.
Building on these insights we introduce Sentinel, which combines an attention‑derived perception score $P$ with an MLP‑derived decision score $D$. Their joint profile characterizes jailbreaks and over‑refusals, and conditional routing using both signals achieves a lower aggregate error rate than single‑signal routing or fixed reminders across eight models.
Review: The paper offers fine‑grained, module‑level explanations that reveal attention as the “seeing” component and MLP as the “refusing” component, providing concrete intervention points for safer alignment.