Recognizing a harmful application and writing a refusal: two distinct steps in LLM

A study of 18 model pairs places recognition more in the attention and refusal decision in the MLP. Sentinel combines both signals.

The authors analyze eighteen pairs of models before and after adaptation to instructions, in the Qwen, Llama and Gemma families. Updates to the attention layers expose more information about the harmfulness of a request, while MLPs contribute more directly to producing the refusal.

Causal interventions support this separation. The Sentinel device then combines a perception score and a decision score to better characterize excessive circumventions and refusals. Out of eight models, their combination reduces the aggregate error in the face of the evaluated comparisons. This is an experimental diagnosis of the safety mechanisms.

Preprint filed on arXiv on October 9, 2026; results are those reported by the authors and remain to be independently confirmed.