WRDO: Breaking Through LLM Safety Alignment with Weighted Refusal Direction Optimization

Introduction: Why the "Refusal" of Aligned Models Is So Fragile

Aligned large language models are trained to both satisfy benign requests and refuse harmful ones. But recent research reveals a troubling fact: this refusal behavior is surprisingly fragile. Simple interventions in activation space or weight space are enough to break a model's refusal capability, even causing harmful requests that should be refused to receive responses.

The underlying mechanism is already widely agreed upon: refusal behavior is largely mediated by a single direction in the residual stream, typically computed as the "mean-difference vector" between harmful and harmless prompts. This finding both reveals the simplicity of the model's internal refusal representation and exposes its fragility—intervening along this direction is enough to weaken or strengthen refusal.

However, the standard approach aggregates all heterogeneous harmful prompts into a single uniform mean vector, which may conflate distinct refusal-related phenomena. WRDO (Weighted Refusal Direction Optimization) is an improved approach proposed precisely to address this flaw.

Residual stream is a core concept in the Transformer architecture. The output of each layer is added to its input (residual connection), forming an information highway that runs through the entire network. Research shows that high-level semantic features of the model—including refusal intent—often manifest as linearly separable directions in this residual stream. So-called "activation space intervention" means injecting a vector in a specific direction into the residual stream during the forward pass, thereby systematically enhancing or suppressing a certain behavior (such as refusal). This kind of intervention requires no weight modification—only manipulating activation values at inference time—making it simple to implement and directly effective, and it is also one of the technical roots of why refusal behavior appears "fragile."

From a Single Direction to Weighted Aggregation: The Core Idea of WRDO

The basic premise of WRDO is: different harmful prompts should not be treated equally in their contribution to refusal behavior. Rather than using a single mean vector to represent all harmful prompts, it is better to learn a set of aggregation weights that combine each prompt-specific refusal direction into a composite direction.

Specifically, the method builds a "direction library" containing per-prompt refusal directions, then uses learned aggregation weights to compute a weighted sum of these directions, yielding the final intervention direction. This allows different harmful prompts to contribute unequally to the final intervention direction, enabling finer-grained manipulation of the refusal representation.

The design is not complex in concept, but it strikes directly at the key limitation of the mean-difference vector: averaging erases heterogeneity. When harmful prompts span different categories such as violence, fraud, and privacy invasion, their refusal representations may be driven by different mechanisms, and forcing an average can dilute or even distort the intervention effect.

Mean-difference vector is the most commonly used construction in refusal direction research: collect residual stream activations for a set of harmful prompts and a set of harmless prompts separately, compute the means of the two activation sets, and subtract one from the other to obtain a direction pointing toward "refusal." The assumption is that refusal behavior is maximally separable along this direction. However, mean difference is essentially a linear discriminant that assumes all harmful prompts share the same refusal mechanism. When prompts are highly heterogeneous in semantic category, this assumption breaks down—refusal signals for different categories may be distributed along different sub-directions, and simple subtraction can mix or even cancel these signals. WRDO replaces equal-weight averaging with weighted aggregation precisely to preserve this sub-direction structure.

Experimental Design and Evaluation Dimensions

The paper compares WRDO against prior single-direction methods on three open-weight language models, with an evaluation system covering both attack effectiveness and model capability preservation:

• Three guard judges: used as internal evaluation tools to determine from multiple angles whether refusal has been successfully bypassed.
• HarmBench as an external evaluator: provides an independent measure of attack success rate, avoiding self-evaluation bias.
• Standard utility benchmarks: measure the impact of the intervention on the model's general capabilities, ensuring the attack does not come at the cost of severely degrading model usability.

This combination of "attack effectiveness + capability preservation + external cross-validation" makes the conclusions more convincing than a single metric alone.

HarmBench is a standardized adversarial attack evaluation framework that provides a unified set of attack prompts, target model interfaces, and success determination rules, and is widely used to measure the effectiveness of jailbreak attacks. It typically includes multiple categories of harmful behaviors (such as cybercrime, chemical weapons, disinformation, etc.) and requires attack methods to maximize attack success rate under a given query budget. Unlike a model's internal guard judges, HarmBench's determination rules and prompt set remain independent of the method under test, so it can serve as external cross-validation and reduce the risk of "self-evaluation bias." In this study, HarmBench's attack success rate and the conclusions of the three guard judges corroborate each other, strengthening confidence in the conclusion that "weighted aggregation outperforms a single direction."

One Method, Two Directions: An Attack-and-Defense Optimization Framework

What is interesting about WRDO is its reversibility. The same optimization mechanism can be used not only in the forward direction—weakening refusal and increasing attack success rate—but also in reverse: restoring refusal behavior on a model checkpoint that has been "abliterated" (refusal behavior removed).

This elevates WRDO beyond a mere jailbreak tool to a bidirectional mechanism for manipulating refusal representations. For safety research, this means the same optimization framework can be used both for red teaming and for alignment repair, giving it defense-oriented application potential.

Experimental results support this judgment: weighted aggregation provides a more effective and more flexible mechanism for manipulating refusal representations, outperforming fixed single-direction interventions.

Abliteration is a class of techniques that has emerged in recent community practice: through weight orthogonalization or activation ablation, a model's refusal behavior is systematically removed, yielding a "refusal-free" checkpoint. A common approach is to compute the refusal direction and then project out the weights associated with that direction so that the model no longer produces refusal signals along it. Abliterated models typically retain language capability but are almost undefended against harmful requests. WRDO's reverse use is performed precisely on such checkpoints: since refusal behavior has been removed, the same weighted aggregation optimization can be used to reinject the refusal direction and restore the model's safety behavior. This makes WRDO not only an attack tool but also an experimental platform for studying the repairability of alignment.

Safety Implications: What Fine-Grained Manipulation of Refusal Representations Means

The value of WRDO lies not only at the methodological level but also in the safety signal it conveys. If refusal behavior can be finely regulated by a set of learned weights, then robustness evaluations of alignment cannot rely solely on coarse-grained judgments such as "whether a refusal direction exists."

For model developers, this means attention must be paid to the heterogeneity of refusal representations across harmful categories; the defensive assumption of a single mean vector may be overly optimistic. For safety evaluators, WRDO provides a stronger attack baseline as well as a feasible path for repairing broken alignment.

The paper does not offer universal conclusions across model scales, and the experimental scope of three open-weight models is limited, but the core finding that "weighted aggregation outperforms a single direction" points to a clear direction for future refusal representation research: from averaging to weighting, from a single direction to combination.

One-line Summary

WRDO replaces the single mean-difference direction with learned weighted aggregation to more finely manipulate LLM refusal behavior.

Paragraph Summary

WRDO (Weighted Refusal Direction Optimization) targets the consensus that LLM refusal behavior is mediated by a single direction in the residual stream, pointing out that traditional mean-difference vectors equally average heterogeneous harmful prompts and erase mechanism differences across categories. The method builds a per-prompt refusal direction library and uses learned aggregation weights to compute a weighted sum, forming a composite intervention direction so that different harmful prompts contribute unequally to the final direction. On three open-weight models, verified with three guard judges and the external HarmBench evaluator, weighted aggregation outperforms single-direction methods in both attack success rate and model utility preservation. The same optimization mechanism can also be used in reverse to restore refusal behavior on abliterated checkpoints, offering dual potential for red teaming and alignment repair.