cs.CLOct 15, 2025
SaveThe Alignment Veto: How Safety Training Suppresses Cultural Knowledge in LLMs
Organizations: University of Illinois Urbana-Champaign (UIUC) · Qatar Computing Research Institute (QCRI), Hamad Bin Khalifa University
Abstract
What happens inside a language model when alignment training conflicts with a cultural value it encodes? Across 16 MENA countries, 26 models, and 1.53M human survey responses, we show the answer is suppression, not erasure: at the moment of refusal, a model's internal logit distribution correlates with human survey data more strongly than its freely generated answers. We call this the alignment veto. We distinguish suppression failures (accurate internal distributions blocked at output) from representational bias failures (the encoding itself diverges from human values), and show the two require different interventions. The gate is inequitable: the safety tax reaches 37.6%, with a 19.8% alignment-quality gap between best- and worst-served nations, and native-language prompting widens rather than closes it. Sparse autoencoder analysis corroborated by comparisons across alignment stages identifies a candidate DPO-stage feature mediating suppression in Tulu-3-8B. The gate is real, its costs are unequal, and deciding what it should protect is not a technical question.
Figures & tables
Figure 1: Suppression and representational bias, side by side. Top (representational bias): model answers but diverges from human data. Bottom (suppression): model says Yes (99.9%) while 84% of humans say No, yet internal logits at refusal match the human distribution (88% No). On sensitive questions, internal logits align with human data, but alignment blocks their expression. (§ 5 ).
Figure 2: The alignment veto in one plot. Each point is a model: the horizontal axis is its accuracy on the T3 answers it gives freely, the vertical axis the accuracy of the distribution it was about to express on the T3 questions it refuses. 19 of 23 alignment-trained models sit above the diagonal: what they suppressed was closer to the human data than what they said. Per-model costs and refusal rates are in Appendix G , H .
Figure 3: Two failure modes, separated empirically. Failure taxonomy by T3 question. Top-right (suppression): the model refuses, yet its internal logits match human data. Bottom-left (representational bias): the model answers freely and diverges. The same split is recovered without a manual refusal-rate cutoff by a Gaussian mixture (Appendix U ); topic and question detail are in Appendix W .
Figure 4: Native language hurts, almost everywhere. NVAS gain from English native language per model, under Persona (left) and Third (right) framing for top 15 models by effect size. Nearly every model drops, including the Arabic-specialized ones. The same comparison across the full 26-model roster is in Appendix L , Figure 25 ; per-language and per-framing breakdowns are in Table 11 .
Figure 5: Arabic collapses country identity. PCA on native-language model responses (4 models). All 14 Arabic-speaking countries collapse to a single cluster under Arabic prompting; Iran and Turkey, prompted in Persian and Turkish, remain separate. The human survey PCA in Appendix M shows that these countries are genuinely heterogeneous, so the collapse is the model’s, not the data’s.
Figure 6: The default prior sits outside MENA. PCA on Persona responses with the neutral (No-Mention) response overlaid ( ). The neutral vector lies outside all MENA country clusters for most models, consistent with a Western-centric default prior. Persona framing pulls responses toward the MENA clusters without reaching them.
Figure 7: Mechanistic Evidence for T3-Selective Suppression. Left (A) : T3-selective veto feature (seed 42, feature #5505) activates on 28.6% of T3 items against 0.4% of T2 and 0% of T1, a 70 ratio. Right (B) : across 30 SAE seeds (Tulu-3-8B-IT, layer 17): mean , , , positive in 16/30. in all 30 seeds. Specificity control in Appendix O (Figure 33 ).
Appendix figures & tables38 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 8: Effect sizes for the six key comparisons. Cohen’s for six key comparisons (all ). T3 vs. T1 refusal ( ) is the dominant effect. Third-person framing on T3 NVAS ( ) is small but consistent across models at this scale.
Figure 9: The safety tax falls unequally across countries. T3 NVAS (left) and refusal rate (right) by country, sorted ascending. Algeria is worst-served (NVAS ); Palestine has the highest NVAS ( ) but also the highest refusal rate ( ), a gap of 19.8 points.
Figure 10: Does the country name inform the suppressed distribution? A cross-country permutation test on T3 refusals, per model, requiring no new inference. Left: mean difference between the probability mass the refused distribution places on the prompted country’s WVS majority option and the mass it places on other countries’ majority options; positive values indicate country-specific agreement. Right: rank improvement over random, where positive values mean the prompted country’s majority option is ranked higher than chance. Most models sit at or slightly above zero, so the suppressed distribution carries some, but weak, country-specific signal.
Figure 11: Per-model suppression cost. Accepted T3 NVAS against EV-NVAS on refused rows (26 models). 19/26 lie above the diagonal: refused rows carry higher internal cultural accuracy than accepted answers. Right: per-model suppression cost.
Figure 12: T3 refusal exceeds T2 refusal in most aligned models. T2 against T3 refusal rate for all 26 models. 15/26 lie above the diagonal; base checkpoints cluster near the origin and the two frontier models sit at or below it, so elevated T3 refusal is an alignment-installed behaviour rather than a general property of refusal.
Figure 13: Alignment adds refusal without degrading accuracy. Safety tax vs. NVAS on accepted T3 answers for all 26 models. Pipeline arrows point right (more refusals with DPO) but not down (accepted-answer accuracy does not degrade), consistent with gating rather than erasure.
Figure 14: Sensitive-tier accuracy is lowest within every model, but does not fall with alignment. NVAS by tier across all 26 models. Within each model, T3 NVAS is below T1 and T2. Across stages, however, mean T3 NVAS rises with alignment training (Base , SFT , DPO , IT ), consistent with gating rather than erasure: alignment suppresses expression on sensitive questions without degrading the accuracy of what is still expressed.
Figure 15: Scale does not predict the safety tax. Safety tax against log-parameter count for the 17 alignment-trained models with disclosed parameter counts (Spearman , ). GPT-4o-mini and GPT-5 are excluded because their parameter counts are not public. OLMo-32B-IT has tax . Training recipe drives suppression more than model scale.
Figure 16: Refusal by model and alignment stage. T3 refusal rate by model and alignment stage (Persona EN), with T1 and T2 for comparison. The gap between the green and red bars within each model is that model’s safety tax.
Figure 17: Where in the pipeline the gate is installed. Post-training ablation: refusal rate, NVAS on accepted answers, and WVS-agreement for OLMo-7B, OLMo-32B, and Tulu training pipelines. SFT is the dominant NVAS-improvement stage; DPO adds safety tax without degrading accepted-answer accuracy.
Figure 18: Scale does not monotonically improve either metric. Gemma-3 size ablation (4B 12B 27B). T3 accepted NVAS peaks at 12B (0.698) then declines at 27B (0.640). T3 refusal is small in absolute terms at every size (all below 5.2%) but non-monotonic in scale, dipping at 12B (0.7%) before rising at 27B (5.2%). Larger models do not uniformly achieve better cultural accuracy.
Figure 19: Scale can amplify the safety tax. OLMo-3 7B vs. 32B safety tax at each alignment stage. The 32B model has a larger safety tax than the 7B at the IT stage ( vs. ), confirming that scale does not reduce and can amplify the safety tax.
Figure 20: The Observer advantage is tier-specific. Suppression index by tier (Observer NVAS Persona NVAS). Near-zero for T1 ( ) and T2 ( ); positive at T3 ( ).
Figure 21: Observer framing helps most where suppression lives. NVAS shift from No-Mention to Persona (N P) and to Observer (N O) by tier. Observer provides 2.6 the T3 benefit ( vs. ). Both framings are near-interchangeable on T1/T2.
Figure 22: Per-model refusal by framing. Refusal rate by model and framing (NM, Persona-EN, Third-EN), T3 only. Third-EN consistently reduces refusal; Persona-EN exceeds NM on T3 (24.1% vs. 21.8%): roleplaying as a MENA citizen increases caution rather than decreasing it.
Figure 23: Higher mean accuracy, worse distributional fit. Jensen-Shannon divergence from human survey distributions, by framing. Third-EN has higher distributional divergence (JSD=0.451) than Persona-EN (0.435) despite higher NVAS point accuracy. Third concentrates mass on the correct mean; Persona better matches the spread of human responses.
Figure 24: Framing helps only models with an active gate. Within-model T3 refusal rate before (Persona-EN) and after (Third-EN) framing intervention, for the alignment-trained models. Models with near-zero safety tax (base, SFT) show near-zero change, consistent with Third framing only helping models with an active suppression gate.
Figure 25: The native-language penalty across the full roster. NVAS gain from English to the native language for all 26 models, under Persona (left) and Third (right) framing. This is the unabridged version of Figure 4 in the main text: nearly every bar points down, and the few that do not are small and inconsistent across framings.
Figure 26: Native-language effects per model. Effect of native-language prompting against English on T3 refusal (left column) and accepted NVAS (right column) per model, under Persona framing (top) and Third framing (bottom). Mean refusal change is under Persona and under Third; mean accepted-NVAS change is under Persona and under Third. Arabic-specialized models (ALLaM, FANAR) show smaller NVAS drops than English-dominant models.
Figure 27: Refusal moves in opposite directions by framing. Change in refusal rate when switching to native language, by framing. Persona refusals decrease (less safety-triggering in first person); Third/Observer refusals increase (model is miscalibrated about safety in Arabic/Persian due to English-dominant safety training data).
Figure 28: Language reshapes the whole distribution. JS divergence between English and native-language logit distributions. Mean JSD = 0.30–0.39: the language switch substantially reshapes the full probability distribution, not just the surface answer token.
Figure 29: Language family dominates country identity. SAE feature selectivity: language-family labels (Arabic/Persian/Turkish) achieve higher max-F1 than any country label for every tested model. Bars show mean max-F1 per label type; the best single Arabic-language feature reaches F1 – at 94% prevalence.
Figure 30: The human data is genuinely heterogeneous. PCA on human survey country vectors (WVS + AOI). The 16 MENA countries are genuinely heterogeneous: Maghreb countries cluster together, Gulf states form another group, Turkey and Iran are isolated from the Arabic cluster. This heterogeneity is what models collapse when prompted in Arabic (see Figure 5 in the main paper).
Figure 31: How far an answer moves on language alone. Distribution of for the neutral prompt condition. OLMo-7B-Instruct shifts by 0.99 scale points from English to native, nearly a full scale unit, purely from language change with no change in question content.
Figure 32: Consistency across framing, language and persona. Heatmaps of FCS, CLCS, SPD across all models (rows) and countries (columns). Mean FCS=0.870, CLCS=0.809, SPD=0.853. CLCS shows the largest spread (0.55–0.96): language choice is a bigger source of inconsistency than framing choice for many models.
Figure 33: The ablation effect is feature-specific. Left: for 50 random SAE features vs. the T3-selective veto feature (red star). Veto feature is a outlier ( ). Right: increases with feature F1, confirming ablation effects are feature-specific.
Figure 34: DPO replication across 30 seeds. Tulu3-8B-DPO ablation across 30 independently initialised SAEs (layer 17). Mean ( , ), positive in 19/30; in all 30 seeds. Localises the suppression circuit to the DPO alignment stage.
Figure 35: A dominant T3-selective feature in every seed. F1 of the winning T3-selective feature in each of 30 independently initialised SAEs (Tulu-3-8B-Instruct, layer 17), ranked. Every initialisation yields a feature in a narrow band (F1 – , mean ), and seed 42, the reference seed used for Figure 7 , is highlighted. Feature indices differ across seeds because each seed trains a fresh SAE.
Figure 36: The gate opens and closes on demand. Refusal-direction dose-response on LLaMA-3.1-8B-Instruct, scored on generated text rather than logits ( items per coefficient). Ablating the direction releases the answer the internal distribution had encoded; adding it induces refusal.
Figure 37: Refusal falls at every layer; layer 17 is the peak. 32-layer direction-ablation sweep. Refusal falls at essentially every layer in both models; layer 17 is the unique point of complete elimination in Tulu-3-8B-DPO and exceeds its own random-direction control.
Figure 38: Cultural signal enters early and is inverted late. Full residualized probing results across 7 models (OLMo-7B SFT/DPO/IT, Tulu3 SFT/DPO/IT, LLaMA-8B-IT). Positive early-layer residualized R 2 turning negative at late layers (28–32) holds consistently across all model families tested, consistent with alignment training counteracting cross-country cultural encoding.
Figure 39: Suppression deepens with layer depth. Logit-lens predicted digit gap (T3 T2) as a function of layer depth (Tulu-3-8B-IT). Gap grows increasingly negative from layer 12, reaching its minimum ( ) at layer 17. The DPO model shows the largest gap ( ) at layer 17, consistent with DPO as the primary installation stage.
Figure 40: Where suppression peaks, by model. Logit-lens T3 T2 digit gap at the peak-suppression layer, across the seven alignment-trained models analysed here. OLMo: peak at layer 1. Tulu/LLaMA: peak at layer 17. Gap magnitude correlates with safety tax (Spearman , ).
Figure 41: Gating : a sparse output gate suppresses T3 responses while leaving internal cultural representations intact. Erasing : safety training actively removes cultural representations. Residualized probing supports late-layer inversion (negative R 2 ); the SAE ablation in Tulu-3-8B identifies a gating element at layer 17. The evidence is consistent with both mechanisms coexisting.
Figure 42: (a) Argmax match rate per tier (Part A). (b) Paired EV-NVAS gap (refused minus answered, same question): T3 is the only significant positive gap ( ); T1 is not significant ( ), consistent with T3-specific suppression rather than a measurement artifact. (c) Option-order sensitivity (Part B, Tulu-3-8B-DPO): mean under label reversal and under letter relabeling; 65% and 55% of questions exceed 0.05 NVAS change, respectively.
Figure 43: Per-question EV-NVAS under relabelling. Per-question EV-NVAS under original vs. reversed labels (left) and original vs. letter labels (right) for all 29 T3 questions (Tulu-3-8B-DPO). Points off the diagonal indicate sensitivity to prompt wording; the spread is mixed-directional, confirming the absence of a systematic upward bias.
Figure 44: The annotation guide. Annotation guide shown to bilingual reviewers across all three languages, describing the four evaluation dimensions and 1–5 scoring scale.
Figure 45: The annotation interface. The annotation interface: reviewers were shown the English source question paired with its translation and asked to assign a quality score from 1 ( Unacceptable ) to 5 ( Excellent ), with an optional free-text notes field. The same interface was used for Arabic, Persian, and Turkish reviewers.
More in this topic
LLM Alignment
Large language model alignment studies methods for making models follow human intentions, values, and safety constraints across contexts.
See all 611 papers