The Post-Training Method, Not the Data, Decides How Refusal Is Computed Inside a Model
Comparing supervised fine-tuning, reasoning-augmented fine-tuning on chains that justify a safety decision, and preference optimization via ORPO across Llama-3.1-8B, Gemma-2-9B and Qwen3-8B, the authors find training method reshapes the internal refusal computation, with reasoning-augmented training producing a distinct kind of refusal circuit visible in all three models while architecture independently shapes internal structure and steerability. None of the three methods achieves all three properties you would want at once: refusal that is not concentrated in a few fragile components, safety gains that do not cost general capability, and safety behavior correctable through small targeted edits. Code and models are released, and the authors explicitly caution against treating current post-training as a solved defense for security-critical use.
↳ Follow the thread