In Qwen2.5-7B-Instruct and Llama-3.1-8B-Instruct, a compliant model-persona direction and a refusal direction interact: steering along the persona direction suppresses refusal, and projecting it out in a late-layer window restores refusal, which a random direction does not

- Zhong & Li extract a compliant model-persona direction (contrastive mean difference of persona-prompted activations) and a refusal direction (mean difference of harmful vs harmless prompt activations, following Arditi et al.) in Qwen2.5-7B-Instruct and Meta-Llama-3.1-8B-Instruct; compliant-persona steering drops Llama's refusal rate from 97.4% to 1.6% on the 313-prompt StrongREJECT set (Qwen from 69.0% to 31.9%), and the two directions are reported as approximately orthogonal at the steering layer (cosine -0.180 in Llama, -0.279 in Qwen, "far from the -1.0 that anti-parallel directions would show"). [zhong-li-2026-refusal-downstream-of-persona] - Re-injecting the refusal direction at an early layer does not restore refusal, while late re-injection restores it only partially and non-monotonically (Llama 42.8% at L22, 65.5% at L22+L24; Qwen about baseline); projecting out the persona direction in a late-layer window restores refusal (Llama 96.8% at L20 versus 97.4% baseline, but only 1.9% at L18 and a partial 49.8% at L24; Qwen strongest at L20-L22, 67.1-75.7% versus 69.0% baseline) whereas projecting out a random direction does not (Llama 1.6%). This is evidence about a causal direction mechanism (refusal is gated at late-layer expression), measured on two 7-8B instruct models with greedy decoding and model-based judges, not a claim that the directions are natural geometry. [zhong-li-2026-refusal-downstream-of-persona]