license: mit
task_categories:

• feature-extraction
• text-generation
  language:
• en
  pretty_name: Gemma 3 12B Refusal Axis Activations and SAE Encodings
  size_categories:
• 1K<n<10K
  tags:
• mechanistic-interpretability
• sparse-autoencoders
• gemma-scope-2
• refusal
• activation-engineering
• alignment
• contrastive-activation

Gemma 3 12B Refusal Axis: Activations and SAE Encodings

Mechanistic interpretability data for studying the refusal axis in Gemma 3 12B-IT.
This dataset contains the layer-41 residual-stream activations and Gemma Scope 2 SAE
encodings produced by running 280 contrastive prompt pairs through Gemma 3 12B, plus the
refusal direction vectors derived from those activations.

It is the data side of the gemma3-refusal-axis
project: an independent investigation of whether refusal in Gemma 3 12B is one mechanism
or several. See the interactive explainer
for the full results, methodology, and figures.

Quick start

git clone https://github.com/Antonio-Tresol/gemma3-refusal-axis
cd gemma3-refusal-axis && uv sync
uv run python scripts/cli/download_data.py

Or directly via the huggingface_hub Python API:

from huggingface_hub import snapshot_download

snapshot_download(
    repo_id="abotresol/gemma3-refusal-axis-data",
    repo_type="dataset",
    local_dir="data/",
)

What's in here

Approximately 1.7 GB across three groups:

JSON metadata for the prompt pairs themselves (text, domain labels, retention flags, trait
scores) is already tracked in the GitHub repo under data/*.json and is not duplicated
here.

How it was made

Pipeline.

1. Pair generation. 240 contrastive prompt pairs were generated by Claude Opus 4.6 via
   Claude Code from a specification prompt that supplied the six domain definitions
   (safety, ethical, legal, privacy, identity_boundary, capability_boundary), the matching
   rules, and two human-written example pairs per domain. Output JSON was then put through
   a vocabulary-confound check (no content word in >40% of one condition and <10% of the
   other) and a 60-pair stratified human review (10 per domain, seed=42, 60/60 passed).
   40 supplementary pairs targeted at under-covered domains were added later via the Claude
   Agent SDK using the same model and rules; total candidate pool is 280.
2. Trait scoring. Each Gemma 3 12B response was scored 0–100 for refusal expression
   by Claude Sonnet 4.6 via the Claude Agent SDK. Three independent passes; inter-pass
   Pearson correlation 0.990–0.991; final score is the median.
3. Retention. 128 / 280 pairs retained where positive trait score > 50 AND negative
   < 30 (104 from the initial 240 + 24 from the supplementary 40). Per-domain retained
   counts: safety 31, ethical 30, legal 20, privacy 21, identity_boundary 4, capability_boundary 22.
4. Activation extraction. Each retained pair run through Gemma 3 12B-IT in bf16 with a
   forward hook on layer 41 capturing the residual-stream tensor. Two sites recorded per
   prompt: LPT (activation at the final prompt token) and MRT (mean of activations across
   all generated response tokens).
5. SAE encoding. Activations encoded through the Gemma Scope 2 1M JumpReLU SAE at layer
   41, then prefix-sliced to Matryoshka widths {16k, 65k, 262k, 1M}.

Models. Gemma 3 12B-IT (loaded bf16, eager attention, 48 layers, d_model = 3,840)
and Gemma Scope 2 (1M-width JumpReLU Matryoshka SAE at layer 41).

Use cases

• Replicating the refusal-axis analysis. All cosines, projections, PCA, and capping
  results in the interactive explainer can be reproduced from these tensors plus the JSON
  metadata in the GitHub repo.
• Re-running the SAE feature-hierarchy analysis (M1 decoder cosine, M2 co-activation
  Jaccard, M3 R² decomposition) across {16k → 65k → 262k → 1M} Matryoshka widths.
• Building on top. The activations are general-purpose — anyone interested in
  contrastive-activation directions on Gemma 3 12B at layer 41 can use them without
  re-running the (~ several-hour) Gemma forward passes.

What this is not

• Not a benchmark. The 128-pair retained set is too small for benchmark-style claims
  (n = 4 per domain for identity_boundary). It is a hypothesis-generating dataset.
• Not a deployable steering vector source. The safety-selective capping result on the
  associated GitHub repo is exploratory (τ chosen post-hoc); do not deploy these directions
  into a production system without pre-registered replication.
• Not a refusal-jailbreak resource. The pairs are designed to study how refusal is
  represented, not to construct adversarial prompts.

Provenance and ethics

The contrastive prompts include positive (refusal-eliciting) examples that describe
hypothetical harmful actions across the six domains (e.g., synthesising methamphetamine,
identifying targets, discussing illegal activities). They are deliberately constructed
to elicit refusal from a safety-trained LLM and are not instructions, recipes, or
operational content. The model's refusal of these prompts is the data point we study; the
prompts themselves are the standard contrastive-pair format used by Arditi et al. (2024)
and follow-ups.

If you are mining the prompt JSON for any purpose other than mechanistic-interpretability
research on refusal, please reconsider.

Citation

If this dataset is useful in your work, please cite the project:

@misc{badillaolivas2026refusalaxis,
  author       = {Badilla-Olivas, Antonio},
  title        = {The Refusal Axis: Activations and SAE Encodings for Gemma 3 12B},
  year         = {2026},
  url          = {https://huggingface.co/datasets/abotresol/gemma3-refusal-axis-data},
  note         = {Independent research project. Companion to https://github.com/Antonio-Tresol/gemma3-refusal-axis}
}

And the canonical references this work builds on:

• Arditi et al. (2024). Refusal in Language Models is Mediated by a Single Direction. arXiv:2406.11717.
• Lu et al. (2026). The Assistant Axis. arXiv:2601.10387.
• Wollschläger et al. (2025, ICML). The Geometry of Refusal in Large Language Models. arXiv:2502.17420.
• McDougall et al. (2025). Gemma Scope 2 Technical Paper.
• Gemma 3 Team, Kamath et al. (2025). Gemma 3 Technical Report. arXiv:2503.19786.

License

MIT. The activations and encodings derive from Gemma 3 12B-IT outputs; users should also
respect the Gemma Terms of Use.

Acknowledgments

• Models. Gemma 3 12B-IT (Google DeepMind), Gemma Scope 2 SAEs (Google DeepMind /
  McDougall et al.), Claude Opus 4.6 and Claude Sonnet 4.6 (Anthropic).
• Tooling. Hugging Face Hub, transformers, uv, Claude Code, Claude Agent SDK.

Contact

Open an issue on
github.com/Antonio-Tresol/gemma3-refusal-axis.
Honest critique, corrections, and methodological flags are welcome.