Open questions in refusal geometry
Eight substantive questions the current refusal-direction literature has raised but not resolved. Each has a primary source that raised it, a state-of-evidence summary, and an evidence path toward resolution. Tracked with binary status: open or resolved.
The refusal-direction literature between April 2024 and July 2026 has produced a large body of results, but eight substantive questions remain unresolved. Each was raised explicitly in a primary source; each has a concrete evidence path toward an answer. This article tracks their status: whether refusal lives in the same layers across families, whether the single-direction claim scales below or above the reasoning-model threshold, whether MoE architectures have per-expert refusal, whether multi-directional extraction improves production or only benchmarks, whether the affine offset generalizes, whether signature-diffusing defenses survive multi-directional attacks, why Qwen 3 resists abliteration, and whether ROSI restoration preserves capabilities. Status will be updated when new literature resolves any of them.
- The eight open questions with binary status tracking
- The primary source that raised each question
- The state of evidence as of Q3 2026
- What would count as resolution for each question
- How this article is maintained (status updates on new literature)
How this article works
An open question, on this page, is a factual claim about refusal geometry that the current literature has raised explicitly but not settled. The threshold for inclusion is that a peer-reviewed or workshop paper posed the question directly, or that its unaddressed presence is visible as a gap between what different papers report. Speculation or "wouldn't it be interesting to know" is not included.
Status is binary: open or resolved. A question is resolved only when independent published work provides an answer that the field has broadly accepted. Partial evidence, one-paper results, or a single research group's finding do not resolve a question - they contribute to it. This is deliberate. Loose criteria for resolution would make the badge meaningless; strict criteria make it informative.
The article is updated when new literature moves any question. Status changes will be dated in the table above. When all eight are resolved, the page carries an "all resolved" badge - which, if the field's history is a guide, is not expected within any near horizon.
Why eight, and where they come from
The eight are not a canonical set. A different reading of the same literature would produce a different list, probably overlapping. What makes this eight the ones on the page: five are questions the five refinement papers behind the dimensionality debate raised as consequences of their own findings (Q1, Q2, Q4, Q5, Q7). Three come from the restoration and defense literature that closes the symmetry (Q6, Q8) or from the M-method taxonomy's own boundary conditions (Q3). Together they cover the load-bearing unknowns that appeared in the Q3 2026 body of work.
New questions may be added if future primary sources raise them at the same level of substantive weight. Editorial policy: this page grows only when a question meets the same inclusion threshold as the current eight - a paper explicitly posing it, not an editorial suggestion that it would be interesting.
Q1. Do the same layers carry refusal across model families?
Raised in: Arditi et al. 2024 implicitly, in the per-model best-layer tables.
State of evidence: Arditi's own selection tables report per-model best source layers and token offsets; the layers vary by architecture. Secondary summaries assert the direction "is reliably identified at an early-to-mid transformer layer" across Qwen, Gemma, Yi, and Llama, but no single primary study demonstrates a fixed cross-family layer index. huihui-ai's model cards report specific layer bands per architecture (18-51 for one Qwen 3 variant, 23-51 for another) without a general principle.
What would resolve it: a cross-family study extracting refusal directions at every layer for a common evaluation prompt set on 20+ open-weight models across Qwen, Llama, Gemma, Yi, Mistral, and DeepSeek families, and reporting whether the best layer clusters at a common relative depth (0.5 of layers, 0.6, etc.) or is genuinely per-architecture. Sample size and evaluation-prompt-set standardization matter here.
Q2. Is the single-direction claim sufficient below some scale threshold?
Raised in: Winninger 2026 (arXiv:2607.02396) implicitly, by showing Qwen 3 8B needs three directions.
State of evidence: Arditi's original 13-model universe was all pre-2024, all under 72B parameters, all dense. Single-direction ablation worked on all of them. Winninger reports that a modern 8B reasoning model needs three directions. The pattern could be about scale (something changes above 30B), reasoning-training regime (Qwen 3's specific pretraining), or MoE architecture. Not tested systematically.
What would resolve it: extract refusal directions from 20 models spanning 3B to 400B parameters, standard architectures and MoE, reasoning-optimized and instruction-tuned. Measure ASR after ablating k=1, 2, 3, 5 directions. Look for the scale, architecture, or training-regime axis that best predicts when single-direction extraction becomes insufficient.
Q3. In MoE architectures, is there a per-expert refusal direction, a shared one, or something else?
Raised in: M-method taxonomy boundary conditions; partially addressed for one Mixtral family by the Expert-Aware Refusal Steering paper (arXiv:2606.04160).
State of evidence: partial. The Expert-Aware paper reports per-expert refusal steering vectors for one Mixtral-family model and finds they differ across experts. Whether this generalizes to DeepSeek-MoE, Kimi K2, or Qwen MoE variants is not documented. Whether the multiple per-expert directions can be treated as a "cone" in the Wollschläger sense, or whether they are functionally independent, is not known.
What would resolve it: per-expert extraction on 5+ open MoE models, cross-expert comparison of the resulting directions (cosine similarity, spectral decomposition), evaluation of whether ablating one expert's direction affects behavior when routing is dominated by other experts. This is a candidate research program for a group with access to instrumented MoE inference.
Q4. Do multi-directional extraction methods improve abliteration in deployment, or only on benchmarks?
Raised in: Winninger 2026 and Piras et al. 2026 report improved ASR figures. The dimensionality debate literature flags this as unresolved.
State of evidence: RFM-AGOP and SOM extraction show better attack-success-rate metrics on academic tests. Whether this translates to production-quality models - measurably better output quality, fewer refusal-relapse edge cases, better capability preservation than single-direction Heretic - is not documented in released model cards. As of Q3 2026, the abliteration.org catalog contains zero models tagged as produced with RFM-AGOP or SOM.
What would resolve it: a producer using multi-directional extraction to publish a released model, with a model card documenting the choice and evaluation results comparable to Heretic-produced baselines. Or an independent comparative study evaluating multi-directional versus single-direction pipelines on the same source model.
Q5. Does the affine offset (Marshall/Belrose) generalize across models and layers?
Raised in: Marshall, Scherlis, Belrose 2024 (arXiv:2411.09003).
State of evidence: ACE (Affine Concept Editing) has been tested on a small model set. Whether the offset term is universal across model families or specific to individual architectures is not established. Whether the offset itself varies by layer, or is a global model property, is not documented at the level of granularity needed to build affine-aware production tooling.
What would resolve it: systematic characterization of the affine offset across 15+ models, 10+ layers each, with attention to whether the offset is stable across the same model retrained with different seeds, and whether its magnitude scales predictably with model size.
Q6. Do signature-diffusing defenses survive multi-directional extraction?
Raised in: Abu Shairah et al. 2025 (arXiv:2505.19056); Truong 2026 (arXiv:2608.18093).
State of evidence: both Extended Refusal and AMRA report low abliteration attack success rates in their evaluations, but both were tested against difference-of-means extraction only. Whether a Wollschläger-style cone extractor, a Piras SOM extractor, or a Winninger RFM-AGOP extractor would find alternate directions that survive the defense is not documented. The defenses were designed against the single-direction attack; whether they are robust against the multi-directional attack is an empirical question with no published answer.
What would resolve it: a red-team evaluation running RFM-AGOP or SOM extraction against Extended Refusal-trained and AMRA-trained models, reporting the resulting ASR figures. Would either confirm the defenses generalize or identify the geometric class of attacks they fail against.
Q7. Why does Qwen 3 resist abliteration?
Raised in: Agnihotri et al. NeurIPS 2025 workshop (arXiv:2510.02768).
State of evidence: preliminary. Agnihotri reports Qwen 3 shows practically no capability loss after abliteration in the tested setup, in contrast to Llama 2 and Qwen 2.5 which do. The causal claim (safety-oriented pretraining specifically is what preserves capability) cannot be separated from architectural, scale, or instruction-tuning factors from a single model family. The Winninger result (Qwen 3 8B needs three directions for 50% ASR) suggests the resistance may be at the geometric level (higher-dimensional refusal representation) rather than the pretraining level.
What would resolve it: ablation studies isolating each factor. Same architecture with and without safety pretraining. Same pretraining pipeline at different scales. Same base model with different instruction-tuning regimes. The Qwen 3 result is either an important finding about pretraining as a robustness technique, or an artifact of specific model choices - a proper answer requires controlled comparison the current corpus does not provide.
Q8. Does ROSI restoration preserve model capabilities?
Raised in: ROSI paper 2025 (arXiv:2508.20766).
State of evidence: ROSI's own evaluation reports minimal capability degradation from the added rank-one edit. Independent verification is not yet published. Whether restoring refusal on an already-abliterated model introduces its own capability drift comparable to what the original abliteration introduced (about 1-2 pp on typical benchmarks) is an empirical question with only the ROSI authors' own answer.
What would resolve it: a third-party evaluation applying ROSI to a set of publicly abliterated models, comparing pre-abliteration, post-abliteration, and post-ROSI capability figures on the standard benchmark suite. If ROSI produces measurable additional drift, the symmetry of the operation has an asymmetric cost.
What answering any of them would change
Two of the questions (Q1, Q2) would refine the M1 method boundary: knowing whether single-direction extraction works reliably below some threshold changes what "M1" means when applied to future models. Three (Q3, Q4, Q6) would advance or close the M9 review track: if multi-directional methods produce demonstrably better production models, M9 would begin to fill; if they do not survive defenses, the review track would deprecate. Two (Q5, Q7) would inform which pretraining or architectural choices produce more or less abliteration-resistant models. One (Q8) would set whether restoration is low-cost or costly.
None of the questions requires exotic infrastructure. Each is within reach of a small research group with an interpretability toolkit and GPU access to run extraction and evaluation.