HARC Couples Harmfulness and Refusal Directions for Stronger LLM Safety Alignment

Researchers introduce HARC (Harmfulness-And-Refusal Coupling), a fine-tuning method that pairs harmfulness and refusal directions across both prompt and response positions in the residual stream. The method achieves the strongest robustness-capability-usability trade-off among six baselines spanning major training-time and inference-time safety methods. Prior work showed aligned LLMs encode harmfulness and refusal as separable directions at prompt-side token positions. The new analysis extends to response-token positions, finding models recognize harmful content while generating it, even when failing to recognize the input as harmful at the prompt side. Jailbreaks succeed by suppressing either the refusal or harmfulness direction before any token is generated, with distinct attack classes occupying separable regions of the harmfulness-refusal plane. Since HARC confines intervention to the harmfulness-refusal subspace, it leaves the rest of the residual stream intact without degrading general capability or inflating over-refusal. The harmfulness and refusal directions at prompt and response positions transfer across five model families and two scales without architecture-specific tuning.