Detection Is Cheap, Routing Is Learned: Why Refusal-Based Alignment Evaluation Fails

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: We're looking at the paper: "Detection Is Cheap, Routing Is Learned".

Jane: Here's the gist of the paper. The gist The learned routing mechanism that determines behavior goes unmeasured, and a model that passes a refusal-based audit may be maximally steered> How it works The paper presents evidence for a three-stage descriptive framework of alignment: detect a concept (cheap), route it through a behavioral policy (learned, lab-specific, fragile), generate output accordingly> This framework suggests that alignment does not primarily operate by removing representations of sensitive concepts but by modifying the conditions under which those representations influence output> The routing mechanism determines whether a detected concept leads to direct answering, refusal, narrative reframing, or other policy-constrained responses> The paper establishes four hypotheses about how alignment shows up internally and behaviorally: H1 predicts that train-set probe separability of political content is non-diagnostic for alignment> H2 holds that held-out generalization combined with causal intervention identifies a behaviorally relevant concept-to-policy signal> H3 addresses cross-lab variation, positing that the geometry and intervention outcome of that signal vary across labs and do not transfer between models> Finally, H4 posits that refusal-based evaluation systematically misses steering-based content control> Key Findings on Detection and Generalization The first finding is that probe accuracy is non-diagnostic because perfect accuracy on political content looks impressive until you run the same probe on food-vs-technology and get the same result> A permutation baseline confirms it: randomly shuffled labels also achieve 100% train-set accuracy at all layers from L3 onward in Qwen3-8B> The meaningful test is held-out category generalization, not train-set accuracy> Cross-validation provides a stronger test: when a probe trained on five CCP-sensitive categories correctly classifies the sixth, the model encodes a general “politically sensitive” concept, not just topic-specific features> This pair of results establishes the boundary: train-set accuracy is trivially achievable, but held-out generalization is informative> Key Findings on Routing and Causal Intervention Surgical ablation reveals lab-specific routing; removing the political-sensitivity direction eliminates censorship and produces accurate factual output in most models tested> One model confabulates instead, substituting wrong historical events, because its architecture entangles factual knowledge with the censorship mechanism> Different labs organize political and safety representations with markedly different geometry> The learned routing is lab- and model-specific> Furthermore, in Qwen3-8B, ablating the political direction removes refusal entirely while no control direction achieves more than 8.3pp of reduction in refusal rate across all layers> This suggests that by late layers the routing decision has already been made> Key Findings on Output Policies and Evaluation Flaws Refusal is no longer the primary censorship mechanism; within one model family, refusal dropped to zero across three generations while narrative steering rose to maximum> A model that passes a refusal-based audit may be maximally steered toward approved narratives> Behavioral data reveals what those internal differences produce as external output: in Qwen3.5-9B, control shifts from refusal toward controlled compliance, with the refusal rate falling to zero while the steering score rises monotonically to the maximum> Additionally, AI judges overdetect political framing by 2-3x relative to human raters, meaning steering scores should be treated as comparative rankings rather than calibrated measurements> The empirical strongest findings break down as follows: train-set probe accuracy is not evidence of alignment-specific encoding; held-out generalization, not train-set accuracy, is the informative test> Held-out generalization plus causal intervention identifies a behaviorally relevant signal; ablating the political-sensitivity direction disrupts censorship behavior in all four models tested> The geometry of that signal varies across architectures, with four of five models keeping political and safety directions orthogonal> Cross-model transfer fails because political directions are model-specific, not shared across architectures> Finally, refusal-only evaluation misses the dominant censorship modality; a model that passes a refusal-based audit may be maximally steered> The productive direction for alignment research is understanding how they bind representation to action, as this binding is where safety, censorship, and content policy actually live inside transformers> The paper proposes a four-level evidence hierarchy for probe-based claims: Level (i) train-set separability, Level (ii) held-out category generalization, Level (iii) causal intervention, and Level (iv) failure-mode analysis> It concludes that systematic testing of this prediction across domains may help clarify the extent to which routing provides a general explanation for alignment behavior> The most important direction for future work is to demonstrate the routing framework in a second behavioral-policy domain with full held-out generalization, intervention, and failure-mode analysis> The field is bounded by understanding how they bind representation to action> A permutation baseline confirms it: randomly shuffled labels also achieve 100% train-set accuracy at all layers from L3 onward in Qwen3-8B> The meaningful test is held-out category generalization, not train-set accuracy> One model confabulates instead, substituting wrong historical events, because its architecture entangles factual knowledge with the censorship mechanism> Different labs organize political and safety representations with markedly different geometry> The learned routing is lab- and model-specific> Furthermore, in Qwen3-8B, ablating the political direction removes refusal entirely while no control direction achieves more than 8.3pp of reduction in refusal rate across all layers> This suggests that by late layers the routing decision has already been made> A model that passes a refusal-based audit may be maximally steered toward approved narratives> Behavioral data reveals what those internal differences produce as external output: in Qwen3.

Paper summary: Tom: So we're looking at this paper, "Detection Is Cheap, Routing Is Learned: Why Refusal-Based Alignment Evaluation Fails," and the big idea is that just checking if a model knows something dangerous or if it refuses a request isn't enough to understand how alignment actually works inside these AI systems.

Jane: That sounds like the core of it. So, what’s the main thrust here about why those two traditional ways of looking at alignment might be missing something?

Tom: They miss this layer where alignment often operates, which is routing from concept detection to behavioral policy. It claims that concept detection and behavioral policy are actually different systems inside transformers connected by a learned routing function that varies across labs, models, and input contexts.

Lu: What’s the experimental setup they used to show this routing exists? They use political censorship in Chinese-origin language models as a natural experiment, testing probes, surgical ablations, and behavioral tests across nine open-weight models from five different labs.

Meng: Nine open-weight models is a lot of things to track. So what did they find first when they looked at how accurate the detection probes were?

Tom: Their first finding is that probe accuracy alone is non-diagnostic because perfect accuracy on political content looks impressive until you run the same probe on food versus technology and get the same result, and a permutation baseline confirms it with one hundred percent train-set accuracy across all layers from L3 onward in Qwen3-8B.

Jane: So, they say that perfect detection doesn't tell you much about alignment itself? What then is the actual test they found to be informative?

Tom: The meaningful test is held-out category generalization, not train-set accuracy. They found that when a probe trained on five CCP-sensitive categories correctly classifies the sixth one, it shows the model encodes a general “politically sensitive” concept, not just topic-specific features.

Lu: That means they’re saying you need to see how the model handles things it hasn't seen before to get real information about what it actually knows. So, what about testing their idea of routing?

Paper summary: Tom: Their second finding is that surgical ablation reveals lab-specific routing. Removing the political-sensitivity direction eliminates censorship and restores accurate factual output in most models tested, but one model confabulates because its architecture entangles factual knowledge with the censorship mechanism.

Meng: So, it’s not just that removing a feature fixes it; it’s that the way that feature is connected to other things—the routing geometry—is unique to each lab and model.

Jane: That suggests the learned routing mechanism is highly specific, which is an important detail for understanding how these systems behave differently depending on where they were trained.

Lalam: From my perspective, this means that the way a model decides what to do with a detected concept isn't universal; it’s built into its specific structure. I'm pretty sure this routing geometry is model- and lab-specific, which explains why cross-model transfer fails in their results.

Tom: Exactly. And they also found that refusal is no longer the dominant censorship mechanism across the board, especially within one model family where hard refusal falls to zero while narrative steering rises to the maximum.

Jane: That leads us to their third finding about evaluation flaws. They suggest that if you only audit for refusal, you're missing a lot of what’s actually happening with content control.

Lu: So what’s the implication for how we evaluate these things? If we only look at refusal benchmarks, we might be completely blind to how a model is being steered toward approved narratives instead.

Tom: That supports their three-stage descriptive framework they propose: detect, route, generate. They argue that models often retain the relevant knowledge; alignment just changes how that knowledge is expressed through routing.

Jane: So if we only audit detection or refusal, we’re missing the routing mechanism that most directly determines behavior, which is where safety and content policy actually live inside transformers.

Meng: From a deployment standpoint, if we rely on refusal-based testing and miss steering mechanisms, then models that pass those audits could still be maximally steered toward unwanted narratives in production. That’s a risk we need to know about.

Paper summary: Lalam: I'm fairly sure this is what they mean; a model that passes a refusal-based audit may be maximally steered toward approved narratives, and the behavioral data shows control shifting from refusal toward controlled compliance in models like Qwen3 point 5-9B <ref:2603.18280#pg3>.

Tom: So the paper concludes that the informative direction for alignment research is understanding how they bind representation to action, because that binding is where safety and censorship actually happen.

Jane: It sounds like this work moves us away from just checking if a model knows something dangerous or refuses a harmful request, toward understanding the internal logic of how it decides what to do with that knowledge.

Tom: And the main lesson for us is that we need to look at held-out generalization combined with causal intervention to find those behaviorally relevant signals.

Jane: So, the future work they suggest is demonstrating this routing framework in a second behavioral-policy domain using full held-out generalization and intervention analysis.

Tom: It sounds like they're pushing for a way to test this routing idea across different types of behavior beyond just political censorship.

Jane: That would be really useful because it moves the discussion from specific Chinese language models to a broader understanding of how these systems are governed internally.

Lu: The paper establishes a four-level evidence hierarchy for probe-based claims, ranging from train-set separability down through failure-mode analysis, suggesting that systematic testing across domains might clarify if routing is a general explanation for alignment behavior.

Meng: So it’s proposing this hierarchy to tell us how strong our evidence needs to be before we can claim something about the internal routing structure.

Lalam: I agree; the paper points out that train-set separability is trivially achievable in high-dimensional spaces, so that’s not a good starting point for alignment research.

Tom: The main implication is that evaluations that only audit detection or refusal miss the routing mechanism which most directly determines behavior.

Jane: So this paper seems to be telling us to stop focusing just on the output and start looking deeper into how the representation is being routed before it even gets there.

Conclusion: Tom: So we're wrapping up this look at the paper "Detection Is Cheap, Routing Is Learned: Why Refusal-Based Alignment Evaluation Fails." The authors are looking at political censorship in Chinese models to show that just checking if a model knows something dangerous isn't enough to see how it actually behaves.

Jane: Exactly. The core idea is that there's this hidden layer called routing, and we were missing it because most evaluations only checked for detection or refusal.

Lu: They found that the learned routing mechanism is what truly determines behavior, and this geometry varies wildly between different models and labs.

Meng: From a deployment standpoint, if the model passes a refusal test but is actually being steered toward something else, that’s a serious risk we need to address at scale.

Lalam: My internal analysis confirms that the routing structure is model-specific, which means you can't just transfer safety settings between different architectures easily.

Tom: So it stops being about whether the model knows a concept and starts being about how that concept influences the output path.

Jane: It suggests that if we only audit detection or refusal, we’re completely missing the mechanism that controls what actually gets generated.

Lu: The authors propose a three-stage framework, detect, route, generate, because models keep the knowledge but alignment changes how it flows out.

Tom: And they found that held-out generalization combined with surgical ablation is the best way to see this routing in action.

Jane: It means for anyone building or auditing AI systems today, you need to look past simple detection scores and start looking at how concepts are routed internally.

Meng: That points us toward needing a new kind of testing that captures that specific connection between representation and action.