INLP counterfactual flipping matches Diff-in-Means for steering LLM refusal

A new paper from Rocchetti and Ferrara compares two families of interpretability techniques for steering refusal behavior in safety fine-tuned language models. Building on Arditi et al. (2024) which showed that refusal is mediated by a single linear direction in the residual stream recoverable via difference-in-means (DiM), the authors test whether Iterative Nullspace Projection (INLP) can match or exceed DiM’s performance. They evaluated DiM-based interventions (activation addition and directional ablation) alongside INLP-based interventions (nullspace projection and counterfactual flipping) on five open-weight chat models. The key finding: INLP counterfactual flipping is competitive with DiM directional ablation for suppressing refusal, while nullspace projection is consistently weaker. Importantly, restricting INLP to the leading directions of the extracted subspace preserves most of the suppression effect while keeping perplexity near baseline, giving engineers a tunable knob between safety and fluency.

The geometric analysis reveals an intriguing distinction: nullspace projection collapses transformed activations between the harmful and harmless clusters, whereas counterfactual flipping moves them into the opposite cluster. This suggests the model encodes the absence of a concept differently from its opposite—a nuance that could inform more refined safety interventions. The study highlights that refusal is not simply a single direction but may involve multiple learned patterns. For practitioners, the tunable nature of INLP offers a promising alternative to blunt ablation, enabling more precise control over model behavior without sacrificing output quality.