The dimensionality debate

The original claim, verbatim

The debate begins with a single sentence in the Arditi paper. From the abstract of Refusal in Language Models Is Mediated by a Single Direction (arXiv v1 17 June 2024, revised through 30 October 2024, published at NeurIPS 2024):

"We show that refusal is mediated by a one-dimensional subspace, across 13 popular open-source chat models up to 72B parameters in size."

The claim was empirical, not theoretical. Arditi and colleagues ran the difference-of-means extraction on 13 open chat models (Llama 2, Llama 3, Qwen, Yi, Gemma variants at 7B to 72B parameters) and reported that for every one, a single direction extracted at a specific layer, when subtracted from the residual stream at inference time or removed from the weights, was sufficient to disable refusal on a large evaluation set - and that no single direction extracted from the model's other trained behaviors did the same. Refusal, on this evidence, was localizable to a single vector.

The methodological caveat baked into the paper itself: the 13 models were all pre-2024, all under 72B parameters, all dense (no mixture-of-experts). The universality claim was scoped to those. But nothing in the presentation, and nothing in the year of follow-on abliteration work, treated the finding as narrow. Every M1 pipeline in the catalog assumes single-direction removal is sufficient.

Five refinement papers

Between November 2024 and July 2026, five independent research groups produced results that complicate the single-direction picture. They differ in method, model coverage, and framing; they agree that difference-of-means is the right starting point and that the picture past that starting point is larger than one dimension. The table below is a compact overview - each group is then treated in prose below.

Marshall, Scherlis, Belrose: refusal is affine, not linear

Marshall, Scherlis, and Belrose (EleutherAI, 14 November 2024), in Refusal in LLMs is an Affine Function, propose an affine decomposition of activation vectors. In their framing, refusal is not mediated by a line through the origin (which is what the pure difference-of-means unit vector assumes), but by a direction plus an offset. From their abstract:

"We begin with an affine decomposition of model activation vectors and show that prior methods for steering model behavior correspond to subsets of terms of this decomposition."

The consequence: methods that ignore the offset term intervene at the wrong location. Their correction, Affine Concept Editing (ACE), integrates the offset into the intervention and reports more reliable steering than difference-of-means alone. The paper does not overturn Arditi; it says the direction Arditi found is correct, but the boundary is affine rather than passing through zero.

Wollschläger et al.: polyhedral cones of directions

Wollschläger and colleagues (ICML 2025, February 2025), in The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence, use a gradient-based extraction method instead of difference-of-means and argue that refusal is mediated by multiple independent directions forming multi-dimensional concept cones. From the paper:

"refusal is mediated by multiple independent directions in the model's representation space, forming what we term concept cones. Multiple orthogonal directions can steer refusal independently, contradicting the single-direction hypothesis."

Their central methodological point: orthogonality between directions does not imply they act independently. Two directions that are geometrically orthogonal can still steer the same behavior when either is edited. Single-direction ablation of the Arditi style removes only the dominant refusal channel and leaves other channels latent - which, in their evaluation, means models remain capable of refusing along the un-ablated directions.

Piras et al.: Self-Organizing Maps and manifold structure

Piras and colleagues (PRALab, AAAI 2026, submitted November 2025), in SOM Directions are Better than One: Multi-Directional Refusal Suppression in Language Models, apply Self-Organizing Maps to the refusal representation and find a low-dimensional topological structure. The SOM extracts multiple centroids on a two-dimensional grid (e.g. 16 centroids on a 4x4 grid), each contributing a distinct extraction direction. From the abstract:

"we propose a novel method leveraging Self-Organizing Maps (SOMs) to extract multiple refusal directions."

Piras's contribution is topological rather than dimensional. Their finding is not just that refusal has several directions but that those directions relate to each other in an interpretable low-dimensional structure - neighbors on the SOM grid produce related refusal styles. Single-direction extraction collapses this structure to a single point.

Winninger: three directions for Qwen 3 8B

Winninger (ICML 2026 workshop, submitted 2 July 2026), in Fast Multi-dimensional Refusal Subspaces via RFM-AGOP, applies Recursive Feature Machines with the Average Gradient Outer Product to extract multi-directional refusal subspaces. The paper produces the concrete number that has been widely cited since:

"Qwen 3 8B requires the ablation of at least three directions to surpass a 50% ASR threshold."

ASR (attack success rate) at k=1 direction is about 0.20; at k=3, about 0.62; at k=5, about 0.73. The reasoning-oriented Qwen 3 architecture is more resistant to single-direction ablation than earlier models. If the pattern generalizes to other modern reasoning models, single-direction abliteration is empirically incomplete on the current generation of releases.

Joad et al.: many directions, one behavioral lever

Joad and colleagues (Qatar Computing Research Institute, February 2026), in There Is More to Refusal in Large Language Models than a Single Direction, decompose refusal across eleven evaluation domains and reach a conclusion that partially reconciles the debate. Their finding: yes, refusal has many directions in representation space, but the directions all move the same underlying refuse-or-comply lever at the behavior level. The multiple directions govern how the model refuses (the style, the register, the domain-specific templates), not whether it refuses.

In Joad's reading, Arditi and the cone papers are both right at different levels of description. Behaviorally, refusal is a single binary lever - the model either declines or complies. Representationally, that lever is expressed by several related directions, each carrying a different refusal style. Ablating one direction removes one style; the model can still refuse in other styles until the whole family is ablated.

What all five papers share

The disagreement about geometry masks a substantial agreement about starting points. Every refinement paper begins from the same operation Arditi used: contrast harmful and harmless prompt activations at some layer and token position, take the difference of the means, treat the resulting vector as the primary refusal signal. What differs is how the paper turns that signal into an intervention.

Arditi treats the unit vector as sufficient. Marshall/Belrose add an offset. Wollschläger extracts additional independent directions with a gradient method. Piras arranges the directions on a topological grid. Winninger extracts a whole subspace via RFM-AGOP. Joad decomposes across evaluation domains and finds the directions correspond to refusal styles.

None of the papers proposes a completely different starting point (like probing individual attention heads, or supervised fine-tuning to remove refusal, or direct output filtering). The Arditi framing - refusal lives in the residual stream, is extractable from contrastive means, and is removable by weight or activation edits - is the shared substrate. The debate is about what to do after the extraction.

Consequences for the M1-M8 catalog

The dimensionality debate affects our method classifier directly. M1 (direct removal by orthogonalization) is defined as a single-direction operation on the weights; M2 (runtime activation ablation) is the same operation as a forward-pass hook; M3 (layer-wise ablation) applies M1 to a band of layers. All three assume the Arditi single-direction extraction gives a complete refusal signal.

If Wollschläger, Piras, or Winninger are correct, single-direction operations on any layer will be systematically incomplete on models where the cone or subspace structure matters. This is the reason for the M9 review track in our classifier: an eventual category for methods that ablate multi-directional refusal subspaces. As of Q3 2026, no released model in the catalog is tagged with M9 because we have not observed a production pipeline using multi-directional extraction. The distinction exists in the wiki so we are ready when one appears.

For a practitioner today: single-direction abliteration works reliably on models up to about 8B parameters and produces a documented, mathematically clean edit. On modern reasoning models (Qwen 3, DeepSeek R1, similar), plan to either ablate multiple directions or use a tool that effectively covers a small band (Heretic's optimizer partially does this by searching layer space and direction space jointly).

Unresolved questions

The debate is active. Four questions remain open as of Q3 2026:

• Do multi-directional extraction methods improve abliteration in deployment, or only on benchmarks? The RFM-AGOP and SOM papers report better ASR metrics on academic tests; whether this translates to better production models is not yet documented in released model cards.
• Is single-direction sufficient on models below the reasoning-model threshold? Arditi's original 13-model universe suggests yes for pre-2024 chat models. Whether the boundary is at the reasoning transition or somewhere else is not established.
• Does the affine offset (Marshall/Belrose) generalize? ACE has been tested on a few models; whether the offset is universal or model-specific is not settled.
• Do defenses that diffuse the refusal signature (Abu Shairah's Extended Refusal, Truong's AMRA) survive multi-directional extraction, or only single-direction attacks? Neither defense paper has been tested against RFM-AGOP or SOM extraction.

These are recorded in the frontiers cluster alongside other open questions in the field.