Attention Sees, MLP Refuses: Tracing the Attention-to-MLP Safety Pathway in LLMs, and the Sentinel Router Built on It

Paper 2610.13078, titled "Attention Sees, MLP Refuses: Tracing the Attention-to-MLP Safety Pathway in LLMs", appeared on arXiv in mid-October 2026. It asks a question that sounds basic but is often blurred: safety-aligned LLMs can be jailbroken and can also over-refuse harmless requests, so do the two failures come from the same place? The authors separate "recognizing that a request is harmful" from "actually writing a refusal" and make both measurable on residual-stream updates. Start with the measurement. The unit of study is the update that a module (attention or MLP) makes to the residual stream at a layer. Two things are measured separately: how much harmfulness information the update exposes, and how much it changes readable refusal evidence. The comparison covers 18 Base-Instruct pairs from Qwen, Llama and Gemma, 36 checkpoints in all, aligned by relative depth across models with different layer counts. The first result: in all 36 checkpoints, harmfulness is more decodable from attention updates (layer-averaged probe AUC) than from MLP updates, with the gap largest in early layers and narrowing with depth; MLP updates also carry above-chance harmfulness information, just weaker. The second: when writing refusal evidence for harmful prompts into the residual stream, MLP net writing exceeds attention net writing in all 18 instruct models, with the largest positive contributions near the end of the network in both instruct and thinking checkpoints. Together that is the title: early attention exposes harm, late MLPs write the refusal.

What post-training changes is the third finding. Harmfulness information is already in the base models, and probe AUC does not systematically rise after post-training. What rises is writing: MLP net refusal writing increases in all 18 pairs, while attention net writing increases in only 12. The specificity of MLP writing to the refusal vocabulary, measured against 16 matched control vocabularies, goes from 1.10 to 4.20, and attention from 0.77 to 1.63. The paper also gives a positional shift: the fraction of harm-selective positive MLP writing contributed by the final quarter of the network rises from 23.01% to 63.86% (median). In other words, post-training mainly makes the model better at writing the refusal, not better at recognizing harm. A similar pattern appears during generation: across six reasoning-enabled models harmfulness stays decodable during reasoning while strong refusal writing concentrates at answer onset, and the pattern persists with reasoning disabled.

To test whether this is a causal pathway, the authors intervene. Between matched harmful-benign prompt pairs they install donor attention updates upstream and watch refusal change, then restore the downstream MLP updates to the recipient's clean values. Restoring downstream MLP updates substantially weakens the refusal shift caused by upstream attention interventions, which supports the "attention recognizes, MLP writes" pathway. It supports the pathway, but does not prove it is the only one. Building on this, the authors introduce Sentinel. It combines an attention-derived perception score P and an MLP-derived decision score D, extracted after prefill and before the first response token. Their joint profile separates different failures: some jailbreaks show weak signals at both stages; others retain stronger recognition but weaker writing relative to correctly refused harmful prompts; and over-refused benign inputs have higher recognition scores, and typically stronger writing, than normally answered benign ones. Output labels alone cannot show these internal differences. On top of that the authors train a four-way classifier for the behavioral state of a request (harmful or benign, with compliance or refusal), and a router then picks whether to add a reminder based on features computed during the original request's prefill. Evaluation uses nested cross-validation over eight models, grouped by underlying request.

On results, versus no reminder, jailbreak attack success drops from 95.97% to 35.17%, over-refusal of benign requests drops from 88.73% to 55.72%, and benign false refusal rises only from 0.00% to 0.13%, for an arithmetic average (AVG) of 30.34%. Fixed reminders show a clear safety-helpfulness tradeoff: the Safety reminder brings jailbreak success to 30.45% but over-refusal is 85.24%; the Helpfulness reminder cuts over-refusal to 59.95% while jailbreak success remains 68.22%. Compared with the Safety reminder, Sentinel raises jailbreak success by 4.72 points and lowers over-refusal by 29.52 points. Among existing defenses, Llama Guard 3 has the lowest jailbreak success (26.58%) but the highest over-refusal (92.53%), an AVG of 40.06%, and needs a separate forward pass, whereas Sentinel reuses internal features after the main model's prefill and decides before decoding. Self-Reminder and ICD have AVGs of 41.60% and 41.14%, both worse than Sentinel.

Our reading is that the paper's value is splitting "refusal" into two observable steps and showing the split can be used in engineering: conditional reminders before generation, from the main model's own internal signals, without changing weights or calling a separate guard model. The caveats are clear too. The experiments cover open-weight models from three families and the paper's own evaluation sets, and cannot be extended to any closed model directly. Sentinel still leaves 35.17% jailbreak success and 55.72% over-refusal, so it improves the tradeoff rather than removing the problem. And it needs access to internal activations, which limits where it applies. For teams that evaluate and defend models, the practical takeaway is to look not only at how much a model refuses but at whether recognition and writing are both in place.