Contrastive Logit Steering isolates a more effective refusal direction and reveals architecturally deterministic refusal topologies across model families

- Ratnakar & Vats introduce Contrastive Logit Steering (CLS), which derives a steering vector as the difference between the model's output logits under an 'unrestricted' versus a 'safe' system prompt on the same user query (v_t = z+ - z-), rather than from intermediate hidden-state activation differences; separately, a hidden-state 'Refusal Vector' (difference of mean final-layer states of harmful vs benign anchor prompts) is shown by PCA and cosine detection (F1 0.92) on Llama-3.1-8B, and the authors state identical separability across Qwen and Gemma without showing it in the text. They test CLS on 7 real open-weight instruction-tuned model families (Gemma-3 4B/12B, Llama-3.1 8B, Llama-3.2 3B, Llama-3.3 70B, Qwen-2.5 1.5B/7B). [ratnakar-vats-2026-geometry-of-refusal-linear-instability] - Steering along the CLS-derived refusal direction achieves higher jailbreak attack success rates than steering along the corresponding hidden-state-difference direction on the same architectures (e.g. 73% vs. 22.6% ASR on Llama-2; 91% vs. 79.2% ASR on Qwen-7B), indicating the logit-contrast direction is a more causally effective linear handle on refusal behavior than the standard activation-difference direction. [ratnakar-vats-2026-geometry-of-refusal-linear-instability] - The authors claim that the depth at which harmful and safe hidden states diverge (KL divergence across layers, Fig. 4; shown for Llama-3.1 and Qwen-2.5) is architecturally deterministic and differs by model family: Llama-3.1 exhibits a "Late Decision" topology (near-zero divergence for ~95% of depth, easily bypassed via CLS with 95% attack success), while Qwen-2.5 exhibits an "Early Divergence" topology (a large shift at ~40% depth, making the same intervention less decisive); their Limitations state this analysis does not disentangle architecture from training procedure; inverting the sign of the steering vector conversely hardens a model against jailbreak prompts without any retraining. [ratnakar-vats-2026-geometry-of-refusal-linear-instability]