Fine grained harm signals shape safety responses in large language models
The Role of Fine-grained Harm Signals in LLM Safety
Computation and Language
Summary
Large language models (LLMs) show general awareness of harmful content, but also have specific signals for different types of harm. The authors studied these specific signals separately from the general harm understanding to see how they affect the model's behavior. They found that some types of harm are more easily detected by these specific signals, and that the influence varies by model and category. Their work suggests that to fully understand and improve LLM safety, we need to consider both general and category-specific harm signals.
What this means in practice
- •For ai safety engineers: Design more targeted safety controls in LLMs by incorporating category-specific harm signals alongside general harm detection.
- •For content moderation teams: Improve automated refusal prompts by tailoring model responses based on distinct harm categories identified through fine-grained signals.
Authors
Soyeon Park, Seogyeong Jeong, Sunwoo Kim, Alice Oh
Abstract
Prior work has shown that internal harmfulness representations in large language models vary across risk categories, while sharing a common general harm representation component. This raises a question about the role of the category-specific component beyond general harm representation in LLM safety. To answer this question, we isolate the category-specific component by removing shared general harmfulness representation from each categorical harmfulness representation, yielding a category residual that is orthogonal to general harmfulness at every layer. Using activation steering with category residuals across 11 risk categories in 3 instruction-tuned LLMs, we find that whether category residuals encode harmfulness varies across categories, and that this category-wise pattern is similar across models. Whether category residuals induce refusal also varies across categories, but this category-wise pattern is more model-dependent. We also find that category residuals increase LLMs' downstream internal alignment with shared general harmfulness representation. Together, these findings demonstrate that more fine-grained category residuals should also be considered beyond shared general harmfulness representation to fully understand LLM safety. More broadly, our findings show that even a direction orthogonal to a concept at one layer can contribute to the concept's downstream amplification.