Search papers, labs, and topics across Lattice.
This paper introduces **SafeVec**, a novel evaluation method for assessing the safety of large language models (LLMs) by analyzing their internal representations rather than relying on output-level assessments. By extracting layer-wise refusal directions from a safety-aligned reference model and scoring a target model based on its alignment with these directions, the authors derive the **Refusal Alignment Score (RAS)**, which effectively distinguishes between aligned and uncensored model variants. The results demonstrate that RAS not only correlates with output-level attack success rates but also offers a significantly faster and more efficient evaluation process compared to traditional judge-based methods.
RAS reveals that internal representation alignment can serve as a reliable and efficient metric for LLM safety, outperforming conventional output-based evaluations.
Safety evaluation of large language models (LLMs) is commonly performed by querying models with unsafe or jailbreak prompts and judging whether their outputs violate a safety policy. Although useful, output-level evaluation is expensive, sensitive to judge choice, and easily tied to fixed question banks. We propose **SafeVec**, a white-box evaluation procedure that measures safety from internal representations rather than generated answers. **SafeVec** first extracts layer-wise refusal directions from a safety-aligned reference model, then selects stable layer windows where safe and unsafe behaviors are separable, and finally scores a target model by measuring whether its hidden states align with these refusal directions under unsafe and jailbreak prompts. The resulting metric, **RAS** (**R**efusal **A**lignment **S**core), maps representation-level refusal alignment to a calibrated 0-100 safety score. Across `Llama`, `Gemma`, and `Qwen` model families, RAS separates aligned models from uncensored and abliterated variants, tracks output-level attack success rate, and is substantially faster than judge-based evaluation. These results suggest that refusal alignment provides a compact and efficient signal for white-box LLM safety evaluation.
