CRaFT: Circuit-Guided Refusal Feature Selection via Cross-Layer Transcoders

TL;DR

CRaFT introduces a circuit-guided framework for selecting features that causally influence refusal behavior in large language models, improving understanding and manipulation of model safety mechanisms.

Contribution

It presents a novel circuit-based method for identifying causal refusal features, surpassing activation-based approaches in reliability.

Findings

CRaFT increases attack success rate from 6.7% to 48.2%.

Outperforms baseline methods across multiple benchmarks.

Highlights circuit influence as a key factor in refusal behavior.

Abstract

As safety concerns around large language models (LLMs) grow, understanding the internal mechanisms underlying refusal behavior has become increasingly important. Recent work has studied this behavior by identifying internal features associated with refusal and manipulating them to induce compliance with harmful requests. However, existing refusal feature selection methods rely on how strongly features activate on harmful prompts, which tends to capture superficial signals rather than the causal factors underlying the refusal decision. We propose CRaFT, a circuit-guided refusal feature selection framework that ranks features by their influence on the model's refusal-compliance decision using prompts near the refusal boundary. On Gemma-3-1B-it, CRaFT improves attack success rate (ASR) from 6.7% to 48.2% and outperforms baseline methods across multiple jailbreak benchmarks. These results suggest that circuit influence is a more reliable criterion than activation magnitude for identifying features that causally mediate refusal behavior.