这篇论文用因果干预实验拆解了LLM拒绝机制，发现答案释放和拒绝恢复不对称，对AI安全审计很有参考价值。
该研究通过受控保留设置，对语言模型拒绝回答时的内部机制进行了因果分析。研究发现，即使模型生成干净拒绝，正确答案仍可从隐藏状态线性恢复。释放被抑制的答案只需单位置补丁，而重新施加抑制则需要跨多个位置的干预。平均答案到拒绝的位移向量不能作为可靠的可逆线性控制开关。这表明拒绝并非简单对称开关，探针可恢复性可能高估真实行为控制能力。
Broken Symmetry in LLM Refusal: Answer Release Is More Local Than Refusal Restoration
When a language model refuses to answer a prompt, it is unclear whether the correct answer is erased from its internal representations, or merely suppressed at the output layer. We investigate this mechanism using a controlled withhold setting, which yields perfectly matched answering and refusal trajectories for bidirectional activation patching. We uncover a causal asymmetry in intervention locality under matched causal interventions, which we term broken symmetry. Even when a model generates a clean refusal, the correct answer remains linearly recoverable from its hidden states. Furthermore, releasing this withheld answer is a highly local operation, requiring only a single-position patch. Conversely, the reverse operation is not equally local: reimposing suppression requires broader interventions across multiple positions, and assembling a coherent refusal sequence is more difficult still. We further demonstrate that while an average answer-to-refusal displacement vector marks the geometric difference between these states, it fails to act as a reliable, reversible linear control toggle between behaviours. Taken together, our findings show that refusal does not function as a simple symmetric switch. For safety and auditing, this implies that probe recoverability can overestimate true behavioural control, and locating refusal-relevant directions does not reliably grant the ability to steer a model from answering to coherent refusal.