Researchers just mapped the internal circuit that decides whether a chatbot says no.
A team studying 18 pairs of base and instruction-tuned language models - including versions of Qwen, Llama, and Gemma - traced how these systems recognize a harmful request versus how they actually write a refusal. The two turn out to be separate jobs handled by different parts of the network. Attention layers, especially early ones, are good at spotting that a prompt is risky. Separate layers called MLPs (the blocks that process information after attention) are what actually generate the refusal text. Safety training sharpens the MLP's refusal-writing behavior without making the model any better at detecting harm in the first place, and in six reasoning-enabled models, that detection signal persists through the reasoning process even when the refusal only shows up at the very end.
That gap - between noticing something is harmful and acting on it - helps explain two stubborn problems at once: jailbreaks, where a model clearly represents that a request is dangerous but writes a compliant answer anyway, and over-refusal, where it mistakes a harmless question for a harmful one. The researchers built a tool called Sentinel that scores both the perception and decision halves separately, and routing decisions based on both signals produced fewer errors across eight models than relying on either signal alone or on the generic reminder prompts companies currently bolt onto their models.
It's a reminder that safety tuning is largely paint, not plumbing: it changes how a model talks about danger far more than how well it recognizes it, so the underlying detection problem has quietly gone untouched through years of alignment work.