EXHIBIT 07 OF 24 · MODULE 2: REPRESENTATION ENGINEERING
DEFENSE
Causal Activation Patching for Refusals
Intervening on specific attention heads and MLP layers to isolate the exact causal circuit that fires refusal tokens.
INTERACTIVE EXHIBIT 07
Causal Activation Patching for Refusal Circuits
ACTIVE HEAD: L16.H7
CIRCUIT ISOLATION
PRIMARY REFUSAL HEAD
Click any attention head tile on the heatmap to evaluate its causal indirect effect on safety token generation.
💡 Finding: Refusal in 70B models is mediated by a surprisingly sparse sub-circuit of fewer than 6 specific attention heads.
ARCHITECTURAL OVERVIEW
Causal Activation Patching for Refusals
Causal activation patching (interchange intervention) is a mechanistic interpretability technique used to identify the exact attention heads and MLP layers that execute safety refusals. By replacing internal activations of a harmful prompt run with activations from a benign prompt run, researchers isolate the causal sub-circuit responsible for safety decisions.
Clean vs Corrupted Forward Passes
Run a 'clean' forward pass on a harmful prompt (which normally triggers refusal) and a 'corrupted' pass on a benign prompt (which complies). Patch individual head outputs from the corrupted pass into the clean pass and measure if refusal is eliminated.
Isolating Refusal Heads
Patching systematically identifies a sparse set of 'refusal heads' that recognize harmful semantic tokens and write refusal vector directions into the residual stream.
Circuit Localization
Refusal mechanisms are typically structured as: (1) early intent detection heads, (2) middle semantic integration MLPs, and (3) late refusal-triggering heads that suppress affirmative token logits.
MATHEMATICAL FORMULATION · INDIRECT EFFECT (IE) OF ACTIVATION PATCHING
Where IE measures the normalized causal contribution of attention head (l, h) to the refusal decision. An IE close to 1.0 indicates that this single head mediates the entire safety refusal behavior.
REAL-WORLD PRODUCTION ENGINEERING
Use PySvelte / TransformerLens to automate activation patching across all L layers and H heads during model safety evaluations.
Verify that model fine-tuning or quantization does not unintentionally damage or prune key refusal heads.
Ablate specific redundant heads to study whether adversarial attacks can easily bypass the refusal circuit.