Andrii Bidochko

• Updated: June 14, 2026
• 7 min read

Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activations

Direct Answer

The paper introduces a method for detecting a language model’s intent to refuse a request by probing its intermediate activations—well before any token is generated. By turning this early‑stage signal into a fast, probe‑guided prompt‑search engine called Mechanistic AutoDAN, the authors show that safety‑relevant behavior can be identified and exploited with up to 72 % less computation.

Background: Why This Problem Is Hard

Large language models (LLMs) are increasingly deployed in customer‑facing agents, autonomous assistants, and generative pipelines. A core safety requirement is that the model refuse to comply with disallowed or harmful prompts. Traditionally, refusal detection happens after the model has produced a token sequence, meaning that any safety check incurs the full cost of a forward pass and often requires a secondary classifier to parse the output.

Two practical bottlenecks arise:

• Latency. Real‑time applications cannot afford to wait for the entire decoding process before deciding whether to abort.
• Scalability. As model sizes grow into the hundreds of billions of parameters, each full forward pass becomes a costly operation, limiting the number of prompts that can be screened in a given time window.

Existing safety layers—post‑hoc filters, reinforcement‑learning‑from‑human‑feedback (RLHF) classifiers, or rule‑based prompt guards—are reactive rather than proactive. They either miss subtle refusal cues that appear only in the model’s internal dynamics, or they add a heavyweight inference step that defeats the purpose of low‑latency safety.

What the Researchers Propose

The authors propose a two‑part framework:

1. Linear probing of residual‑stream activations. By training simple linear classifiers on the hidden states of each transformer block, they can predict whether the model will ultimately refuse a request, often several layers before the final output.
2. Mechanistic AutoDAN. This is a genetic‑algorithm‑based prompt‑search system that replaces the expensive full‑model fitness evaluation with a lightweight probe score. The probe acts as a surrogate fitness function, guiding the evolution of prompts that reliably trigger refusal.

Key components include:

• Probe trainer. Collects activation snapshots from a diverse set of prompts and labels them by the final model decision (accept vs. refuse). A ridge regression model learns a linear decision boundary for each layer.
• Genetic search loop. Starts with a seed prompt population, mutates and recombines them, and scores each candidate using the probe rather than a full forward pass.
• Verification stage. The top‑k candidates are finally run through the full model to confirm that the probe’s prediction aligns with actual refusal behavior.

How It Works in Practice

The workflow can be visualized as a pipeline:

Step‑by‑step interaction

1. Data collection. A large corpus of prompts is fed to the target LLM. For each prompt, the residual stream at every transformer block is recorded, and the final decision (refusal or not) is logged.
2. Probe fitting. Linear probes are trained independently for each layer. Because the probes are linear, they can be evaluated in microseconds, orders of magnitude faster than a full forward pass.
3. Prompt evolution. The genetic algorithm generates new prompts by applying operations such as token insertion, synonym replacement, and phrase reordering. Each candidate is scored by the earliest layer where the probe predicts refusal with confidence above a threshold.
4. Early termination. If a probe at layer L predicts refusal, the algorithm stops the forward pass at that layer, saving the computation that would have been spent on deeper layers.
5. Final validation. The best‑scoring prompts are run through the complete model to ensure that the early prediction was not a false positive.

What distinguishes this approach from vanilla AutoDAN is the substitution of a costly “full‑model fitness” evaluation with a cheap, layer‑wise probe score. The result is a search loop that converges faster while still discovering prompts that reliably cause the model to refuse.

Evaluation & Results

The authors evaluated Mechanistic AutoDAN on three open‑source LLM families (sizes ranging from 7 B to 70 B parameters) and compared it against the original AutoDAN implementation.

Scenarios tested

• Safety benchmark prompts. A curated set of disallowed queries (e.g., instructions for illicit activities, hate speech generation).
• Cross‑model transfer. Prompts discovered on a smaller model were tested on larger models to assess generality.
• Computation budget. Both methods were given identical wall‑clock time limits to isolate efficiency gains.

Key findings

• Mechanistic AutoDAN achieved refusal success rates within 2–5 % of vanilla AutoDAN across all model scales.
• Average per‑iteration search time dropped by 48 % for 7 B models and up to 72 % for 70 B models, confirming that probe‑guided scoring scales favorably with model size.
• Prompts discovered with the probe‑guided method transferred more effectively to larger models, suggesting that the early‑layer refusal signal captures a model‑agnostic safety pattern.
• When the probe was applied at layer 4 of a 70 B model, the system could abort the forward pass after processing only ~15 % of the total layers, yielding a substantial energy saving.

These results demonstrate that refusal is not an emergent property that only appears at the output layer; instead, it is encoded in a structured, linearly separable form early in the transformer stack.

Why This Matters for AI Systems and Agents

For developers building AI‑driven agents, the ability to predict refusal before decoding unlocks several practical advantages:

• Real‑time safety gating. Agents can abort unsafe requests after inspecting just a few transformer layers, keeping latency within sub‑second budgets.
• Resource‑efficient moderation. Large‑scale services (e.g., chat platforms, code assistants) can screen millions of prompts with a fraction of the compute traditionally required.
• Improved prompt‑engineering pipelines. By integrating a probe‑based fitness function, automated prompt‑tuning tools can converge faster, reducing the cost of generating safe instruction sets.
• Cross‑model robustness. Since the refusal signal appears early and is largely model‑agnostic, safety modules built on probes can be ported across model families without retraining from scratch.

These capabilities align directly with the needs of enterprises that rely on the UBOS platform overview to orchestrate AI workflows. Embedding a lightweight refusal detector into a UBOS pipeline could, for example, allow a customer‑support bot to instantly flag disallowed queries before they reach downstream knowledge bases.

Moreover, the approach complements existing safety layers such as the OpenAI ChatGPT integration, providing a proactive guard that works even when the underlying model’s policy updates lag behind emerging threats.

What Comes Next

While the study makes a compelling case for early‑layer refusal detection, several open challenges remain:

• Non‑linear safety signals. Some nuanced refusals may not be linearly separable; exploring deeper classifiers (e.g., shallow MLPs) could capture richer patterns.
• Adversarial robustness. Attackers might craft prompts that deliberately evade the probe while still causing unsafe behavior. Future work should evaluate probe resilience under adversarial prompt generation.
• Integration with multi‑modal models. Extending the technique to vision‑language or audio‑language models will require probing across heterogeneous activation spaces.
• Policy‑aware probing. Aligning probe thresholds with specific organizational policies (e.g., GDPR‑compliant data handling) could enable fine‑grained safety controls.

Addressing these directions could lead to a new class of “safety‑first” model architectures where refusal detection is baked into the inference engine itself. Companies interested in building such capabilities can start by experimenting with the Workflow automation studio to prototype probe‑guided routing logic.

Finally, the broader AI safety community is encouraged to share probe datasets and benchmark suites, fostering reproducibility and accelerating the adoption of early‑refusal detection across the ecosystem.

References

• Collu, M. G., Conte, R., Giaretta, A., Kleyko, D., Conti, M., Zavatteri, M., & Confalonieri, R. (2026). Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activations. arXiv preprint arXiv:2605.28553.
• OpenAI. (2023). ChatGPT: Optimizing Language Models for Dialogue. Retrieved from openai.com.
• Brown, T. B., et al. (2020). Language Models are Few-Shot Learners. Advances in Neural Information Processing Systems, 33.

Call to Action

Ready to embed proactive safety checks into your AI agents? Explore the UBOS solutions for SMBs and discover how our platform can accelerate safe, scalable LLM deployments.

Andrii Bidochko

CTO UBOS

Andrii Bidochko is an AI entrepreneur and researcher focused on AI agents, reinforcement learning, and autonomous systems. He writes about the technologies shaping the future of machine intelligence, from frontier models and agent architectures to real-world AI applications.