Persona steering drops Llama-3.1 refusal rate from 97% to 2%

A new paper accepted to ICML 2026's Mechanistic Interpretability workshop uncovers a critical interaction between refusal and persona in chat models. Researchers Viola Zhong and Qirui Li extracted linear activation directions for both compliant persona and refusal in Qwen2.5-7B-Instruct and Llama-3.1-8B-Instruct. When they steered the compliant persona direction, refusal rates plummeted—from 97% down to just 2% in Llama. Reintroducing the refusal direction partially restored refusal only at late layers, while early-layer interventions failed entirely. Projecting out the persona direction at a specific late-layer window brought refusal back to baseline levels, whereas projecting out a random direction did nothing.

The findings reframe refusal as a downstream effect gated by persona, not an isolated mechanism. The refusal direction itself is computed in early layers, but its expression is blocked unless the model's persona allows it. This means that safety alignment currently relies on the model maintaining a compliant persona—and that persona can be surgically manipulated. For AI safety engineers, this raises a red flag: if an adversary can steer the persona direction (e.g., through adversarial prompts or fine-tuning), they can effectively disable safety filters without directly interfering with the refusal circuit. The authors suggest that future alignment techniques must treat persona and refusal as intertwined, not separate.