In vision-language models the early vision layers control refusal in both directions, and steering them moved unsafe rejection from 6 to 96 percent without touching the weights
AspireAI community · arXiv (Karamat, Hassan & Chamon Garcia)
The authors localise where refusal behaviour actually lives inside frozen vision-language models, and find it is not evenly spread. On Qwen3-VL-4B, layer-wise activation divergence analysis shows non-uniform safety geometry across depth, and causal interventions show that early vision layers support strong bidirectional refusal control through activation steering along a learned safety direction, with unsafe rejection spanning 6 to 96 percent, while later layers respond more to activation magnitude scaling and carry a substantial safety-selectivity trade-off. The key distinction is that deeper layers stay well separated along the safety direction yet are largely insensitive to steering, which separates representational separability from causal controllability. InternVL2.5-4B shows qualitatively similar depth-dependent geometry despite a different layer location and magnitude. The work is an inference-time framework with no retraining or parameter modification, and it exposes what the authors call a white-box, representation-level refusal-bypass surface in VLM vision encoders, which they argue motivates inference-time stabilisation of safety-sensitive representations. The scope is two models of about 4B parameters, not the wider VLM population.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.