Research map / Architectures and efficiency / RNNs and normalization

Residual Paving: Diagnosing the Routing Bottleneck in Selective Refusal Editing

NeurIPS 2026 · Architectures and efficiency › RNNs and normalization · approach: Layer-wise analysis of language models · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Residual Paving, a routed residual editing method that uses a frozen-backbone early-layer router and prompt-conditioned bottleneck residual experts to selectively suppress refusal on edit prompts, and uses oracle routing as a diagnostic to localize the remaining error to route selectivity.

Problem

Selectively inducing non-refusal on designated edit prompts while preserving benign behavior and harmful refusals outside the edit set, in frozen instruction-tuned LLMs.

Approach

Separates a learned scalar route (whether to intervene, from early-layer residual states) from a prompt-conditioned mixture of bottleneck residual experts (what edit to apply at later layers), enabling an oracle-routing diagnostic that swaps only the gate with the held-out edit/keep label.

Key results

• On Gemma-3-4B-IT held-out split, learned Residual Paving reduces edit refusal from 88.6% to 4.0% with 95.5% benign and 87.3% harmful preservation, but harmful refusal drops to 65.3% vs 81.6% base.
• Edit-target ActAdd and DIM steering leave edit refusal at 86.8% and 78.9% respectively under matched protocol.
• Oracle routing improves keep-side diagnostic score on all six backbones, median gain +12.9 pp (range +4.6 to +50.7 pp).

Surprising findings

• A single learned expert nearly matches K=3 experts on the primary backbone, so multi-expert specialization is not load-bearing.
• Harmful refusal falls below the frozen-base rate even though edit success is strong, leaving an off-target harmful-keep degradation.

Limitations

• Harmful-keep evaluation set is small (98 prompts), so harmful-refusal intervals are wide and sign-test support is over only six backbones.
• Oracle routing is non-deployable and partly expected to improve keeps by construction; edit bucket is a safe-reframe experimental target, not a general safe set.
• Primary judge is proprietary (gpt-5.4-mini); reliance on automatic judge without human audit.

Experimental setup

Datasets: SALAD-Bench Alpaca HarmBench XSTest

Benchmarks: SALAD-Bench (edit) Alpaca (benign keeps) HarmBench (harmful keeps)

Metrics: edit refusal rate benign preservation (exp(-KL)) harmful preservation harmful refusal rate harmful refusal delta keep-side diagnostic gain cosine trajectory alignment

Baselines: CAA Edit-target ActAdd DIM refusal steering

Builds on: activation steering (CAA) difference-in-means refusal direction ActAdd

Closest papers by meaning

• EVOREFUSE: Evolutionary Prompt Optimization for Evaluation and Mitigation of LLM Over-Refusal to Pseudo-Malicious Instructions (NeurIPS 2025 · similarity 0.84)
• Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning (ICML 2025 · similarity 0.82)
• Latent-space Attacks for Refusal Evasion in Language Models (NeurIPS 2026 · similarity 0.82)
• Fail-Closed Alignment for Large Language Models (NeurIPS 2026 · similarity 0.82)
• Surgical, Cheap, and Flexible: Mitigating False Refusal in Language Models via Single Vector Ablation (ICLR 2025 · similarity 0.82)
• Residual Stream Analysis of Overfitting And Structural Disruptions (NeurIPS 2025 · similarity 0.82)