Locating Refusal Circuits in Sparse Autoencoder Latents
Abstract
Refusal — a model declining a request — is one of the most safety-relevant behaviors a model has, and one of the least understood mechanistically. We train sparse autoencoders on a frontier-scale model and identify a small, localized set of features that reliably track refusal across thousands of prompts. Direct intervention on these features produces measurable changes in refusal rates, which points toward a tractable target for monitoring and auditing.
Safety work at Curos rests on being able to say something concrete about why a model behaves the way it does. Refusal is a good test case. It is observable, it matters, and — before this work — it was opaque. A model declined a request and we could usually say why in behavioral terms, but not what, internally, was doing the declining.
This paper tries to locate refusal. We trained sparse autoencoders on Corus, our most capable model, and searched for features that mediate the decision to refuse. The headline result is that refusal appears to be implemented by a surprisingly small and localized set of features — which is good news for anyone who wants to audit it, and a reminder that safety-relevant mechanisms are not necessarily large.
Approach
We trained SAEs on the residual stream activations of Corus across a corpus of 40,000 prompts, balanced between requests the model should refuse and requests it should fulfill. We then used a three-stage procedure: (1) a causal scan that intervened on individual features and measured the change in refusal probability; (2) a clustering step to group the features that mattered into a small candidate circuit; and (3) an out-of-distribution check to see whether the circuit held across prompt formats it was not trained on.
Results
Three findings stand out.
First, a small set of features — 61 out of a dictionary of millions, concentrated in the early-middle layers — accounted for most of the variance in refusal behavior. Removing these features (setting their activations to zero) shifted refusal probability from 94% to 22% on held-out refusal prompts, while leaving general task performance largely intact.
Second, the circuit was causal in both directions. Increasing activation on the same features raised refusal rates on borderline prompts — ones the model is instructed to fulfill — suggesting these features encode a refusal tendency rather than merely marking refusal in retrospect.
Third, the localization held out-of-distribution. The features identified on our training prompts generalized to refusal requests framed in novel formats, including languages and phrasings the scan had not seen.
Discussion
If refusal is implemented by a localized set of features, then refusal is something we can monitor, measure, and test — not just observe. That matters for the release gates at Curos: an evaluation that watches these features is a different, more mechanistic kind of check than a behavioral eval, and the two complement each other.
We note the limits. SAEs are approximate; “the” refusal circuit is really “a” refusal circuit under our dictionary and training choices. Feature localization could differ in other model families. And understanding a circuit is not the same as controlling it reliably. This is early, but it is the direction we intend to keep working.
References
- Ardito, P., & Malkin, G. (2025). Causal interventions on sparse features. ICML 2025.
- Chen, W., et al. (2024). Localizing safety behavior in language models. ICLR 2024.
- Ferrand, L., & Weber, J. (2025). Refusal as a circuit, not a policy. Curos Internal Report 2025-07.
- Javed, S. (2025). Dictionary learning at frontier scale. NeurIPS 2025.
- Kim, H., et al. (2024). The geometry of refusal. Workshop on Safety and Interpretability, NeurIPS 2024.
- Nguyen, T., & Sato, H. (2025). Scaling SAE training to production models. Transactions on Machine Learning Research, 2025(11).