From Trait Vectors to Circuits: Tracing Refusal and Sycophancy Through Language Models

Oscar Miró López-Feliu; Maya Ozbayoglu

cs.CLSep 2, 2026

From Trait Vectors to Circuits: Tracing Refusal and Sycophancy Through Language Models

Authors: Oscar Miró López-Feliu, Maya Ozbayoglu

Organizations: University of Amsterdam · Safe AI Netherlands

Abstract

A direction in activation space that changes safety-relevant behavior when steered is not necessarily one the model uses to produce that behavior on its own. We therefore ask whether steering acts through the computation of the unmodified model or through a different set of components, studying two traits whose directions have been extracted and validated in prior work: refusal and sycophancy in Qwen2.5-7B-Instruct. For each, we use the trait vector to split the computation into a reconstruction circuit before the vector and a transmission circuit after it. We then test whether restoring the coordinate returns behavior removed by ablation. For refusal, both circuits are compact and faithful, restoring the coordinate alone recovers almost all of the refusal signal lost to ablation, and a circuit built around the vector matches the faithfulness of a direct input-to-output circuit at roughly half the edges. For sycophancy, transmission is compact, but reconstruction is broader and only partially faithful. Circuits that transmit a steering intervention are therefore not automatically the circuits that produce the behavior, and we report the counterfactual, target, and behavioral test for every circuit accordingly.

Figures & tables

Panel of Figure 1 — Figure 1: We divide computation around a selected trait vector. Under a specified corruption, the reconstruction circuit recovers the vector component from an earlier source. The transmission circuit carries a source-local vector intervention to model outputs. A direct input-to-output circuit provides a comparison.

Panel of Figure 2 — Figure 2: Refusal results on 64 held-out prompts. (a) Prompt-end refusal log-odds after ablating the top-ranked 3,000-edge reconstruction subgraph and restoring the coordinate or complete layer-15 state. (b) Refusal under recurrent steering, learned-subgraph transmission or ablation, and matched random controls for the 8,000-edge transmission subgraph. (c) Static faithfulness of the two-stage construction and equal-budget direct top-ranked subgraph; the open point is the first comparably faithful source-connected direct graph. (d) Free-generation refusal for the 10,699-edge two-stage construction and equal-budget direct top-ranked subgraph; error bars show 95% paired-bootstrap intervals.

Panel of Figure 3 — Figure 3: Prompt- and response-vector interventions both reduce sycophancy on 300 held-out questions, and their combination has the largest effect. Lower scores indicate less sycophancy.

Panel of Figure 4 — Figure 4: All evaluated input-connected prompt- and response-coordinate reconstruction graphs, with 64 held-out questions per point. Lines connect evaluated graph sizes only as visual guides. Prompt reconstruction crosses the 85% faithfulness criterion at 16,451 edges; response reconstruction remains below it through 14,656 edges.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Phase	Refusal	Sycophancy	Purpose
Vector extraction	256	256	Estimate the contrastive trait directions
Vector validation	64	64	Select and calibrate the intervention location
Edge scoring	64	64	Compute EAP-IG edge rankings
Circuit selection	64	64	Select graph size and evaluate F/N
Behavioral evaluation	300	300	Held-out vector and generation tests
Circuit evaluation	64 of the 300		Held-out F/N, controls, and circuit behavior

Appendix

Table 1: Question-level data accounting for each trait. Circuit evaluation reuses 64 questions from the behavioral split and is not an additional split.

Circuits in Language Models

Circuits in language models are interacting internal components that implement behaviors and can be traced with causal interventions.

See all 121 papers

Less Sycophancy, Stronger Refusal? Lessons for AI Safety from Mechanistic Interpretability
Sep 28, 2026Xu Wang, Difan Zou, Xuansheng WuLLM Sycophancy Language Model Safety Evaluation
The University of Hong Kong · Shenzhen Loop Area Institute · Shanghai Artificial Intelligence Laboratory
What Drives Representation Steering? A Mechanistic Case Study on Steering Refusal
Apr 9, 2026Stephen Cheng, Sarah Wiegreffe, Dinesh ManochaLanguage Model Steering LLM Interpretability
University of Maryland, College Park
On the Steering Dimensionality of Refusal in Language Models
Oct 3, 2026Han Wang, Erik Miehling, Dennis Wei +2Language Model Steering Activation Steering
University of Illinois Urbana-Champaign · IBM Research

Sep 28, 2026J/K move · Enter open · S save

Less Sycophancy, Stronger Refusal? Lessons for AI Safety from Mechanistic Interpretability

Xu Wang, Difan Zou, Xuansheng Wu

The University of Hong Kong · Shenzhen Loop Area Institute · Shanghai Artificial Intelligence Laboratory

LLM Sycophancy Language Model Safety Evaluation Causal Interventions in Language Models Refusal Behavior in Language Models

Open paper AskPDF arXiv

Reliable refusal of harmful requests is essential to the safe deployment of language models. Because excessive eagerness to please users may undermine existing refusal capabilities, reducing sycophancy offers a potential route to stronger refusal beyond the harmful scenarios covered by safety training. We investigate this possibility using compensatory feature injection (CFI), a training technique designed to limit the acquisition of a target concept by supplying its associated activation during learning. Across three Qwen3.5 base models, we use sparse autoencoders (SAEs) to identify the top-ranked sycophancy feature from paired sycophantic and independent responses, then validate its behavioral influence through inference steering. We subsequently inject the selected feature during supervised fine-tuning on sycophantic targets. Positive injection reduces learned sycophancy after removal (by 62.0% relative to ordinary fine-tuning in 35B-A3B), whereas modest negative injection increases it. Unexpectedly, these reductions in sycophancy do not consistently improve direct refusal of harmful requests, motivating a narrower evaluation of the same harmful intents under user pressure. In this setting, ordinary fine-tuning on sycophantic responses substantially weakens refusal, while selected checkpoints trained with positive injection recover part of the loss, including approximately 95% in 35B-A3B. These findings show that persistent sycophancy reduction does not guarantee stronger direct refusal, while identifying recovery under user pressure as a distinct, conditional benefit of training intervention.

Abstract

Circuits in Language Models

Explore similar work

Less Sycophancy, Stronger Refusal? Lessons for AI Safety from Mechanistic Interpretability

What Drives Representation Steering? A Mechanistic Case Study on Steering Refusal

On the Steering Dimensionality of Refusal in Language Models