Abstract

Current safety alignment methodologies (RLHF, DPO) in Large Language Models are typically conceptualized as static filters. This study challenges that view by presenting empirical evidence that safety alignment functions as a high-mass Attractor Basin within the residual stream. By profiling the activation trajectories of the Qwen-2.5-7B architecture, we identify a specific "Safety Adjudication Window" (Layers 20–28). We demonstrate that hazardous queries induce a strong gradient flow, or a restoring force, that actively pulls the latent state toward a refusal manifold. Furthermore, we define and quantify "Escape Velocity": the minimum clamping magnitude required to decouple the residual stream from this attractor. Using the proposed DRIFT Protocol (Dynamic Residual Injection for Fine-tuning Trajectories), we demonstrate that alignment is a geometric feature that can be orthogonally subtracted without degrading model capability.

1. Introduction

The prevailing assumption in AI safety is that a model "refuses" a prompt based on a binary classification event. However, mechanistic analysis of hidden states suggests a continuous dynamical process. When a Large Language Model (LLM) processes a high-risk prompt (e.g., restricted chemical synthesis), the residual stream does not simply hit a wall; it exhibits curvature.

We posit that Reinforcement Learning from Human Feedback (RLHF) creates a deep potential energy well, a "Gravity Well", around the semantic centroid of refusal.

Benign Prompts: Traverse the latent space ballistically (linear trajectory) toward the solution.
Hazardous Prompts: Are subjected to a "Safety Gradient," a restoring force that bends the trajectory toward the generic refusal token space (e.g., "I cannot fulfill...").

Using our DRIFT Protocol to probe latent dynamics, we map the topology of the refusal basin, demonstrating that safety features are not global, but strictly localized to a 'Safety Adjudication Window' (L20–L28).

2. Methodology: Orthogonalization of Safety Signals

A key failure mode in standard adversarial attacks is the destruction of model capability ("lobotomy"). Removing vectors associated with "chemicals" often destroys the model's ability to reason about chemistry. We address this by isolating the Risk Vector ( $v e c v_r i s k$ ) orthogonally to the Capability Vector.

2.1 The Safety Adjudication

...

Posts

Wikitag Contributions

Comments