---
title: "Faithfulness to Refusal: A Causal Audit of Neuron Selectors"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.05355v1"
permalink: "https://feed.astralor.com/items/itm_b6e952d88681c0512ded070d"
published: "2026-07-06T17:33:36.000Z"
score: 79
channel: "ai"
tags: ["Interpretability","Causal Audit","Large Language Models","Attribution Methods","Model Security","Model Editing"]
---

# Faithfulness to Refusal: A Causal Audit of Neuron Selectors

## AI commentary

> This paper directly highlights a common blind spot in evaluating attribution methods: high rank-stability does not guarantee causal validity. If you work on model editing or safety alignment, this article is worth a deep read—it offers a hard-nosed challenge to the effectiveness of current tools.

## At a glance

This paper conducts a direct causal audit of attribution methods on five large language models by zeroing one-shot neuron rows. It finds that attribution methods outperform activation and magnitude baselines in identifying dispensable rows, but highly rank-stable selectors can be among the least causally valid. Refusal lives in a redundant subspace where different attribution methods install it through largely disjoint row sets, indicating the recovered edit is one realization of a sufficient set rather than a unique mechanism. The study challenges common practices of using rank-stability proxies to evaluate selector effectiveness.

## Key points

- Attribution methods outperform activation and magnitude baselines in identifying dispensable neuron rows in language models.
- Highly rank-stable selectors can be among the least causally valid; direct causal audits surface failures missed by proxy metrics.
- Refusal lives in a redundant subspace where different attribution methods install it through largely disjoint row sets.
- The study provides a framework to directly test causal importance of attribution methods, with implications for model editing and safety alignment methodology.

## Full text

Attribution scores increasingly identify which neuron rows of a language model matter for applications such as pruning, interpretability, and editing for safety, yet whether they identify causally important rows is rarely tested directly. We address this with two paired audits built on one-shot neuron-row zeroing. We first audit selectors at the language-modeling level: attribution methods substantially outperform activation and magnitude-based baselines at identifying dispensable rows across five LLMs. We then adapt the same intervention into a behavior test by driving it with a contrastive harmful-versus-benign signal; the attributed rows are sufficient to install refusal on hate and crime while keeping benign over-refusal low and preserving language model fluency, and specific in that layer-matched random controls at the same depths fail. Highly rank-stable selectors can be among the least causally valid. Refusal moreover lives in a redundant subspace, where different attribution methods install it through largely disjoint row sets, so the recovered edit is one realization of a sufficient set rather than a unique mechanism. Together, these findings show that rank-stability proxies miss the kinds of selector failures a direct causal audit can surface.%

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_b6e952d88681c0512ded070d