Because directional orthogonality does not guarantee architectural independence. Two behaviours can rely on the same layers, projections, and residual stream capacity even when their vectors point in different directions. When an intervention changes that shared machinery, adjacent refusal behaviours can degrade together despite low similarity scores.
Why refusal directions can appear independent without being independent
Two refusal directions can look separate because they are expressed as different linear directions in representation space, but the model’s behaviour is produced by shared circuitry, not by the vector alone. If those refusals depend on overlapping layers, attention heads, MLP features, or residual stream capacity, an intervention that disturbs the shared machinery can weaken both at once.
That is why low similarity scores do not prove operational independence. They only suggest that the directions are not the same feature. A model can still use common upstream and downstream pathways to produce both behaviours, so perturbing one pathway can collapse adjacent refusals together.
What shared machinery means in practice
In LLMs, a refusal is usually not a single switch. It is an emergent behaviour assembled from multiple features that steer token probabilities toward a safe response, and those features may be reused across several refusal patterns. If two behaviours both draw on the same representational bottleneck, they may diverge in direction but still depend on the same capacity budget.
This is why interpretability work must distinguish geometric separation from causal separation. A direction can be orthogonal in embedding terms and still sit on top of the same hidden-state infrastructure. The practical question is not just whether the directions point differently, but whether the model can preserve one behaviour when the other shared components are edited, compressed, or fine-tuned.
In adjacent failure cases, the model may lose one refusal first and then appear to lose the other as collateral damage. That pattern often signals shared representations, shared decision thresholds, or a common safety wrapper rather than two robustly isolated behaviours. The right interpretation is structural coupling, not independent control.
Why this distinction matters for evaluation and intervention
When teams test an intervention, they often overread directional measurements and under-test behavioural coupling. A probe that shows two refusal vectors are far apart may still miss the fact that both behaviours depend on the same latent features. The safer evaluation is behavioural: test each refusal before and after the intervention, across prompts, contexts, and nearby variants.
This matters most when the change is architectural or representational, such as pruning, quantisation, adapter insertion, logit steering, or safety-layer fine-tuning. If the intervention touches shared residual capacity, the apparent independence of the refusal directions becomes less important than the shared substrate they both ride on.
For AI security and governance, this is a reminder that model controls can fail in correlated ways. One control can degrade another if both are built from the same mechanism. A design that looks modular on paper may still behave like a coupled system under perturbation.
Risk and Threat Considerations
The main risk is false confidence in separability. If a safety team assumes two refusal behaviours are independent because their vectors differ, it may deploy a change that silently weakens both. The same issue can matter in red-teaming, jailbreak resistance, and post-training safety interventions, where shared internal machinery creates correlated failure modes.
Failure mechanism: An intervention alters the shared layers, residual stream, or feature budget that both refusal behaviours rely on, so the model loses both behaviours even though the measured directions remain distinct.
Impact: Safety coverage degrades in a way that is easy to miss if validation checks only geometry or single-prompt tests, which can leave adjacent unsafe behaviours exposed after deployment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | Govern | Shared-model safety behaviour requires governance over testing, validation, and risk controls. |
| Recommendation — Require causal validation for safety behaviours before approving model changes. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Behavioral degradation after intervention is a monitoring and detection concern for model controls. |
| RA-5 — Vulnerability Monitoring and Scanning | Interventions that weaken multiple refusals create a testing gap that needs systematic assessment. | |
| Recommendation — Monitor post-change model behaviour for correlated refusal failures. Scan safety-critical model changes for shared-mechanism regressions. | ||
| OWASP Agentic AI Top 10 | ASI08 — Cascading Failures | Shared refusal machinery can cause one intervention to break multiple adjacent behaviours. |
| Recommendation — Design evaluations to detect correlated failures across adjacent behaviours. | ||
| MITRE ATLAS | Adversarial Machine Learning Threat Techniques | The question concerns model behaviour under perturbation and shared internal representation failure. |
| Recommendation — Map refusal collapse scenarios to adversarial ML test cases. | ||
Practitioner Guidance
What to verify: Treat vector separation as a hypothesis, not evidence of independence. Verify whether each refusal survives after ablations, adapter swaps, fine-tuning, or steering changes, and test on prompt families rather than one-off exemplars.
What practitioners underestimate: The model can preserve directional distance while losing behavioural resilience. If two refusals fail together under the same intervention, the likely problem is shared infrastructure, so the fix is to evaluate and harden the mechanism, not just the measured direction.
Practitioner takeaway: In LLMs, orthogonality is a geometric property, but independence is a causal one, and only causal testing tells you whether two refusal behaviours are truly separate.
Related resources from NHI Mgmt Group
- Why do shallow refusal controls fail in long LLM interactions?
- Why do computer vision models that look strong in a test set still fail in production?
- Why can a container policy look correct but still fail to stop application access to a sensitive binary?
- Why does two-factor authentication still fail when attackers target the human behind the login?