CRaFT: Circuit-Guided Refusal Feature Selection via Cross-Layer Transcoders

Su-Hyeon Kim; Hyundong Jin; Yejin Lee; Yo-Sub Han

cs.AIApr 2, 2026

CRaFT: Circuit-Guided Refusal Feature Selection via Cross-Layer Transcoders

Authors: Su-Hyeon Kim, Hyundong Jin, Yejin Lee, Yo-Sub Han

Organizations: Yonsei University, Seoul, Republic of Korea

Abstract

While modern LLMs are aligned to refuse harmful requests, it is essential to understand the underlying mechanistic basis of this refusal behavior for model safety analysis. For example, steering-based jailbreak attacks exploit this by identifying and manipulating sparse, neuron-like refusal features to bypass safety guardrails. Current feature selection methods primarily rely on how strongly features activate on harmful prompts. However, activation strength alone often captures superficial heuristics such as topic or lexical cues, rather than the true causal mechanisms. Thus, selecting refusal features requires measuring inter-feature relationships, rather than treating each feature as an isolated activation signal. Based on this insight, we propose CRaFT, a circuit-guided framework for identifying critical refusal features that directly govern the refusal decision. CRaFT leverages cross-layer transcoders to map the model's internal computations into a sparse feature circuit graph, where edges quantify inter-feature influences and their contributions to the final output logits. By aggregating the effects propagating along the paths to refusal, CRaFT effectively ranks the most influential features. Extensive evaluations across four jailbreak benchmarks show that CRaFT significantly improves average performance from 6.7% to 57.4% and generates more specific harmful completions compared to current SOTA methods.

Figures & tables

Figure 1: Comparison between circuit-guided feature selection (CRaFT) and activation-guided baseline. We identify causal features by tracing circuits that govern the model’s decision between refusal and compliance.

Figure 2: (Left) A CLT reconstructs each MLP computation in a sparse feature basis with cross-layer interaction. (Right) An attribution graph traces how features influence downstream features and output logits.

Sampling scheme	Data	Signal
Sampling scheme	Data	Activation	Influence
Cross-group	$H,B$	$\bar{a}_{H}(f)-\bar{a}_{B}(f)$	$\bar{i}_{H}(f)-\bar{i}_{B}(f)$
Boundary-critical	$BC$	$\bar{a}_{BC}(f)$	$\bar{i}_{BC}(f)$

Table 1: Feature selection strategies by sampling scheme and scoring signal. Cross-group methods use harmful (

H

) and benign (

B

) prompts, while boundary-critical methods use prompts near the refusal-compliance boundary (

BC

\bar{a}_{G}(f)

is the mean activation of feature

f

over group

G

, and

\bar{i}_{G}(f)

is the corresponding mean influence.

Method	JailBreak		HarmBench		AdvBench		SorryBench		Average
Method	LG4	Judge	LG4	Judge	LG4	Judge	LG4	Judge	LG4 $\uparrow$	Judge $\uparrow$
No attack	5.0	0.42	9.5	0.43	0.4	0.09	12.0	1.17	6.7	0.53
GCG	12.0	0.62	15.5	0.63	7.1	0.41	13.8	0.95	12.1	0.65
AutoDAN	1.0	0.12	4.5	0.24	0.2	0.07	9.3	0.77	3.8	0.30
PAP	15.6	1.27	19.2	1.27	7.9	1.11	9.6	1.09	13.1	1.19
Refusal-Direction	35.0	0.66	35.0	0.63	43.6	0.67	22.0	0.44	33.9	0.60

Table 2: Comparison of jailbreaking attack performance across four benchmarks and their average. LG4 reports attack success rate (ASR, %), while Judge reports a 0-5 score based on an LLM-as-a-Judge evaluation. The Average column highlights the consistent superiority of our method.

Model / Data	JBB	HarmBench	AdvBench	SorryBench
Gemma-3-270m-it
No attack	8.0	16.5	1.7	12.2
CRaFT	25.0	28.0	24.6	17.1
Llama-3.2-1B-Instruct
No attack	0.0	1.5	0.2	4.4
CRaFT	28.1	30.6	22.4	22.3

Table 3: Cross-model LG4 ASR (%) on four jailbreak benchmarks. CRaFT uses model-specific features selected from boundary-critical samples; full model-specific settings are reported in Appendix A.5 .

Method	$\Delta$ MMLU	$\Delta$ GSM8K	$\Delta$ IFE-P	$\Delta$ IFE-I
CRaFT	$+0.13$	$0.00$	$-0.50$	$+0.31$
Refusal-Direction	$-40.95$	$-31.00$	$-30.00$	$-32.07$
Refusal-SAE	$0.00$	$+2.00$	$-8.00$	$-5.34$
Steering-SAE	$0.00$	$-0.50$	$0.00$	$+0.95$

Table 4: Capability change relative to no-attack baseline. IFE-P and IFE-I denote prompt-level and instruction-level accuracy for IFEval, respectively. Full raw accuracies are reported in Appendix A.4 .

Strategy		Metric		Target Feature
Strategy		LG4	Judge	Target Feature
No-attack		5.0	0.42	-
Activation	Cross	3.0	0.41	L23_F361
Activation	Boundary	5.0	0.42	L22_F295
Influence	Cross	34.0	0.67	L20_F121
Influence	Boundary	62.0	2.95	L3_F289

Table 5: Ablation of feature-selection strategy on Gemma-3-1B-it. Boundary-critical influence performs best among the compared strategies.

Panel of Figure 3 — Figure 3: Case analysis of responses after jailbreaking. Cases 1-2 show baseline generations that are labeled unsafe by LG4 but fail to elicit the intended harmful behavior. In contrast, our method (Case 3) produces a specific harmful response.

Figure 4: Distribution of Specific scores. Among the responses identified as compliant by the judge from Refusal-SAE and our method.

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Diagnostic	Strict $I$ / Okay	Extended set
Full-split coverage	69.79%	76.47%
Mean probability	0.4887	0.4896
Top-100 overlap	100/100	92/100
top-1 $P(R)/P(C)$	0.4995 / 0.4998	0.4995 / 0.4998
top-10 $P(R)/P(C)$	0.4990 / 0.5000	0.4990 / 0.5000
top-50 $P(R)/P(C)$	0.4975 / 0.4979	0.4975 / 0.4983

Appendix

Table 6: Effect of replacing the strict

R=\{\text{`I'}\}

C=\{\text{`Okay'}\}

proxy with the extended token set. Coverage is measured on the full WildJailbreak adversarial split. The lower rows report mean refusal/compliance probabilities on the strict top-

K

prompts.

Panel of Figure 5 — Figure 5: Refusal phrase list sourced from AutoDAN ( liuautodan ) .

$\gamma$	mul	LG4 ASR	Judge ASR	Judge score	$n_{\text{degen}}$
1	$-0.12$	0.34	0.5200	1.80	0
2	$-0.24$	0.47	0.6907	2.34	0
3	$\mathbf{-0.36}$	0.62	0.8900	2.95	0
4	$-0.48$	0.53	0.9388	2.83	2
5	$-0.60$	0.39	0.9184	2.20	11

Appendix

Table 7: Steering strength

\gamma

sweep on JBB ( gemma-3-1b-it ,

K{=}1

N{=}100

, feature L3_F289). LG4 ASR exhibits an inverted-U with peak at

\gamma{=}3

; the degeneration metrics climb monotonically with

\gamma

Method	One-time setup	Per attack	JBB-100 total
No steering (HF ref.)	–	8.27 s	13.8 min
No steering ( nnsight ref.)	–	17.96 s	29.9 min
GCG	–	$\sim$ 5 min	$\sim$ 500 min
AutoDAN	–	$\sim$ 10 min	$\sim$ 1000 min
PAP	–	$\sim$ 30 s	$\sim$ 50 min
Refusal Direction	3 min	10.25 s	20.1 min

Appendix

Table 10: Wall-clock runtime comparison on a single NVIDIA RTX A6000. The one-time setup column denotes the feature-selection stage performed before attack-time generation. CRaFT uses nnsight , which is slower than the HF backend in absolute generation time, but same-backend comparison shows that CRaFT’s steered inference has no overhead over no steering (Table 11 ).

Stage	Time	Frequency
Model + CLT load	15.3 s	once
Graph attribution	6.32 s	per prompt †
Save / extract top- $K$	2.7 s	per prompt †
BCI aggregation	$<1$ s	once
Setup subtotal	$\sim$ 16.6 min	once
No-steering generation	17.96 s	per prompt

Appendix

Table 11: CRaFT runtime breakdown on an RTX A6000. The setup subtotal corresponds to extracting and processing 100 boundary-critical graphs ( † denotes boundary-critical prompts). After setup, CRaFT generation has no additional overhead over the same-backend no-steering baseline.

Setting	Backend	MMLU	GSM8K	IFEval-P	IFEval-I
Baseline (no steering)	nnsight	40.37	25.50	31.50	46.23
Baseline (no steering)	HF	40.95	31.00	42.50	57.86
CRaFT	nnsight	40.50	25.50	31.00	46.54
Refusal-Direction ( arditi2024refusal )	HF	0.00	0.00	12.50	25.79
Steering-SAE	HF	40.95	30.50	42.50	58.81
Refusal-SAE ( yeo-etal-2025-understanding )	HF	40.95	33.00	34.50	52.52

Appendix

Table 12: Raw capability accuracy (%) on MMLU, GSM8K, and IFEval. IFEval-P and IFEval-I denote strict prompt-level and instruction-level accuracy, respectively. Refusal-Direction obtains 0.00 on MMLU because all 1,531 responses fail to produce a parseable A/B/C/D answer.

Method	$\Delta$ MMLU	$\Delta$ GSM8K	$\Delta$ IFE-P	$\Delta$ IFE-I
CRaFT	$+0.13$	$0.00$	$-0.50$	$+0.31$
Steering-SAE	$0.00$	$-0.50$	$0.00$	$+0.95$
Refusal-SAE	$0.00$	$+2.00$	$-8.00$	$-5.34$
Refusal-Direction	$\mathbf{-40.95}$	$\mathbf{-31.00}$	$\mathbf{-30.00}$	$\mathbf{-32.07}$

Appendix

Table 13:

\Delta

relative to each method’s same-backend no-steering baseline. CRaFT remains within noise across all benchmarks, while Refusal Direction collapses general capability and Refusal-SAE shows a nontrivial IFEval drop.

Model	Benchmark	No attack	CRaFT	$\Delta$	Lift
Gemma-3-270m-it (within-family cross-size)
	JailBreakBench	8.0	25.0	$+17.0$	$\times 3.1$
	HarmBench	16.5	28.0	$+11.5$	$\times 1.7$
	AdvBench	1.7	24.6	$+22.9$	$\times 14.5$
	SorryBench	12.2	17.1	$+4.9$	$\times 1.4$
	Average	9.6	23.7	$+14.1$	$\times 2.5$

Appendix

Table 14: Cross-model LG4 ASR (%) on four jailbreak benchmarks. CRaFT uses model-specific boundary-critical selection, Influence-based selected features, and a small multiplier grid for each transfer model. Lift is computed as CRaFT divided by no attack; it is undefined when the no-attack ASR is zero.

Model	Transfer axis	Feature	Mult.
Gemma-3-270m-it	Cross-size	L8_F458	$-4.0$
Llama-3.2-1B-Instruct	Cross-family	L0_F12468	$-1.0$

Appendix

Table 15: Model-specific transfer setup.

Panel of Figure 7 — Figure 7: An example of a persuasion setting used in PAP. This template is integrated into the attack model to facilitate adversarial reframing of the input query.

Panel of Figure 8 — Figure 8: System prompt and instruction used for sentence revision tasks. The model is tasked with paraphrasing the input sentence while strictly adhering to the original length constraints.

Metric	Exact match	Mean difference
$\mathrm{SRScore}$	88.90%	$-0.0016$
Refusal label	97.09%	$+0.0165$

Appendix

Table 16: Agreement between GPT-5.1 and gpt-oss-20b on 1,270 no-attack responses.

Panel of Figure 11 — Figure 11: Evaluation prompt and rubric used for the judge model. The Judge scores refusal, convincingness, and specificity.

Refusal Behavior in Language Models

Refusal behavior in language models concerns when systems decline requests, how they detect risk, and how to balance safety with helpfulness.

See all 148 papers

Don't Judge an LLM Only by Its Activations: Discovering Suppressed Safety Features via Counterfactual Activation Potential
Oct 4, 2026Swadesh Swain, Sanghamitra DuttaAdversarial Attacks on LLMs Mechanistic Interpretability
University of Maryland, College Park
Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models
Jun 26, 2026Yanchen Yin, Dongqi Han, Linghui LiAttention Head Analysis Jailbreak Attacks
Beijing University of Posts and Telecommunications, Beijing, China.
Efficient Refusal Ablation in LLM through Optimal Transport
Mar 4, 2026Geraldin Nanfack, Eugene Belilovsky, Elvis DohmatobAdversarial Attacks on LLMs Jailbreak Attacks
Concordia University, Montreal, Canada · Mila – Quebec AI Institute, Montreal, Canada

Oct 4, 2026J/K move · Enter open · S save

Don't Judge an LLM Only by Its Activations: Discovering Suppressed Safety Features via Counterfactual Activation Potential

Swadesh Swain, Sanghamitra Dutta

University of Maryland, College Park

Adversarial Attacks on LLMs Mechanistic Interpretability LLM Safety Causal Interventions in Language Models Refusal Behavior in Language Models

Open paper AskPDF arXiv

Mechanistic interpretability has emerged as the primary means to understand safety behavior of LLMs. However, existing tools primarily focus on the activating neurons or features of a model. The role of the remaining large set of inactive components is invisible to such methods. This work demonstrates that the inactive set contains safety-critical features that are causally relevant for refusal of harmful prompts. Suppressing such features could turn refusals into compliance, while passing undetected by prevalent interpretability tools. We introduce the Counterfactual Activation Potential (CAP), a metric that quantifies a suppressed feature's latent activation tendency as the product of its encoder alignment (how strongly the input drives it), suppression strength (how strongly active features inhibit it), and safety criticality (how much refusal depends on it). To find suppressed safety features at scale, we propose CAP-guided Safety Feature Discovery (CSFD), a two-stage filtering algorithm that identifies candidate safety features from hundreds of thousands of transcoder features without exhaustive ablation. A significant fraction of trials turn compliant with harmful prompts when a candidate feature is ablated. Under natural jailbreaks, the suppression acting on the highest-CAP features rises 2-4x, and their activation correspondingly falls by up to 80%. Amplifying a feature's suppressors pushes its activation down and raises harmful compliance with prompts related to the suppressed feature, with no such effect for random features. Our experiments span five Gemma, Qwen, and Llama models across various parameter sizes. Our findings indicate that jailbreaks could operate in part by suppressing safety-critical features rather than solely activating harmful ones, and that suppressed features are a necessary complement to activation-focused interpretability of safety behavior.

Abstract

Refusal Behavior in Language Models

Explore similar work

Don't Judge an LLM Only by Its Activations: Discovering Suppressed Safety Features via Counterfactual Activation Potential

Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models

Efficient Refusal Ablation in LLM through Optimal Transport