HARC Couples Harmfulness and Refusal Directions for Stronger LLM Safety Alignment

Researchers introduce HARC (Harmfulness-And-Refusal Coupling), a fine-tuning method that pairs harmfulness and refusal directions across both prompt and response positions in the residual stream. The method achieves the strongest robustness-capability-usability trade-off among six baselines spanning major training-time and inference-time safety methods. Prior work showed aligned LLMs encode harmfulness and refusal as separable directions at prompt-side token positions. The new analysis extends to response-token positions, finding models recognize harmful content while generating it, even when failing to recognize the input as harmful at the prompt side. Jailbreaks succeed