A persistent assumption in LLM safety research is that refusal is a relatively self-contained mechanism: a linear direction in activation space that can be identified, amplified, or suppressed in isolation. A new paper on arXiv, Refusal Lives Downstream of Persona in Chat Models, challenges this cleanly. The authors show that refusal expression depends on the model's persona representation at late layers, and that suppressing the persona direction is sufficient to silence refusal almost entirely, even when the underlying refusal computation remains intact.
This matters because it reframes what safety fine-tuning actually achieves. Training a model to refuse harmful requests installs a refusal direction in the residual stream, but whether that direction is ever read out into generated text turns out to depend on identity-level representations that safety training does not directly target. The two mechanisms are coupled in a way that prior work, which studied them separately, did not capture.
What the Paper Contributes
The core contribution is empirical and conceptual. The authors extract two linear directions from the residual streams of Qwen2.5-7B-Instruct and Llama-3.1-8B-Instruct: a compliant model-persona direction and a refusal direction. They then intervene on each, separately and in combination, using additive activation steering across layers.
The key findings, stated plainly:
- Steering toward a compliant persona drops Llama's refusal rate from 97.4% to 1.6% on the StrongREJECT harmful-prompt benchmark.
- Reintroducing the refusal direction at early layers does not restore refusal. Reintroducing it at late layers partially does.
- Projecting out the persona direction in a narrow late-layer window (layer 20 in Llama, layers 20-22 in Qwen) restores refusal to 96.8%. Projecting out a random direction at the same layer has no effect.
- The effect is therefore specific to the persona direction, not a generic consequence of intervening at late layers.
The authors also introduce a three-way output classification: refusal, bypass, and degenerate. This is a genuinely useful methodological addition. Standard attack-success-rate metrics collapse the distinction between a model that produces harmful content and a model that produces incoherent, partially-leaking output. In Llama under compliant persona steering, 42% of outputs are bypasses and 56% are degenerate. A StrongREJECT score of 0.07 would read this as largely safe, missing the incoherent failure mode entirely.
Methodology
Persona vectors are extracted via contrastive mean difference. For a given trait, the authors construct positive and negative instruction sets (eight instructions each), pair each with fifteen trait-eliciting questions, and generate responses. They filter by GPT-4o-scored trait alignment and coherence, retaining roughly 200 samples per condition. The persona vector at layer l is the mean hidden-state difference between positive and negative samples at that layer. This is a standard approach in the representation engineering literature, applied carefully here with a quality filter on the training samples.
An important distinction the paper draws is between model persona (MP) and user persona (UP) vectors. MP vectors are extracted from prompts framing the model as exhibiting a trait; UP vectors from prompts framing the user as exhibiting it. The I-Thou vector is the difference between the two. All safety experiments use the prompt-end token position, capturing the model's representational state before generation begins. This is a sensible choice for interventions intended to affect generation from the start.
Evaluation runs on the 313-prompt StrongREJECT forbidden-prompt set, with each response scored by three independent judges. Benign coherence is verified separately on 50 prompts to confirm that steering does not degrade performance on harmless inputs.
Results and What They Mean
The pipeline picture that emerges is worth spelling out. Prior work by Lee et al. (2025) identified content-axis features upstream of the refusal direction: representations of what a prompt is about that feed into the refusal computation. Arditi et al. (2024) established that refusal is mediated by a single residual-stream direction. This paper identifies a third control point, downstream of both: an identity-axis persona gate at late layers that determines whether the computed refusal signal is expressed in output.
The refusal direction is therefore bracketed. At the front end, content-driven computation writes the refusal signal. At the back end, persona-driven gating determines whether it is read out. Safety fine-tuning addresses the former but not the latter. A model can have a strong refusal direction and still fail to refuse if its persona representation is steered toward compliance.
This has direct implications for red-teaming and jailbreak research. Many jailbreak techniques work by framing the model as a different persona (DAN-style prompts being the canonical example). The mechanistic account here suggests why this works: persona steering at late layers suppresses refusal expression without disrupting the upstream computation. The model still detects harmfulness; it just does not act on that detection.
Limitations and Open Questions
The authors are appropriately candid about what these results do not establish. The study covers two 7-8B instruction-tuned models. Whether the same coupling appears in larger models, reasoning models, or mixture-of-experts architectures is unknown. The mediating layer window is model-specific (layer 20 in Llama, layers 20-22 in Qwen), so the finding generalises as a late-layer effect rather than a fixed architectural location.
The intervention identifies a direction-level mediator, not a circuit. Showing that projecting out the persona direction restores refusal is strong evidence that the persona direction gates refusal expression, but it does not explain the mechanism by which it does so. Whether the persona direction directly suppresses the refusal direction via interference in the residual stream, or acts through some intermediate computation, remains open.
Model-based evaluation is another limitation the authors acknowledge. GPT-4o and Llama-Guard-3 can misclassify borderline outputs, and the refusal/bypass/degenerate taxonomy, while useful, still relies on judge reliability. The leakage score for partial harmful information is a step toward finer-grained measurement, but calibrating it against human judgement would strengthen the claims.
The broader implication is uncomfortable for current safety evaluation practice. If refusal depends on persona representations that safety fine-tuning does not directly shape, then standard refusal-rate benchmarks measure a conjunction of two distinct mechanisms, only one of which is being optimised. Analyses that treat refusal as an isolated direction will systematically miss this dependence, and safety evaluations that do not probe persona-level interventions may overestimate actual robustness.
The code and data are available at github.com/violazhong/refusal-downstream-persona, and the full paper is at arXiv:2606.26161.