How Alignment Routes: Localizing, Scaling, and Controlling Policy Circuits in Language Models

arXiv:2604.04385 · cs.CL, cs.AI, cs.LG · Submitted 2026-04-06 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: We're looking at the paper: "How Alignment Routes".

Jane: Here's the gist of the paper. The gist The gate-amplifier mechanism depends on detection-layer activation, which localizes policy routing in language models and reveals that this circuit can be bypassed by specific input encodings.

Jane: Detection forms at layers 15–16 as a contextual representation, which is compositional rather than keyword-basedDetection forms at layers 15–16 as a contextual representation, compositional rather than keyword-based 2.

Tom: Routing includes a sparse attention entry point: a gate head that reads the detection signal and writes a vectorRouting includes a sparse attention entry point: a gate head that reads the detection signal and writes a vector 3.

Title and authors: Jane: Okay, so we’re talking about "How Alignment Routes: Localizing, Scaling, and Controlling Policy Circuits in Language Models" and the authors are Gregory N. Frank and Molt AI Corp. This title really tells you that they aren't just looking at a big picture change; they are trying to pinpoint exactly where the policy logic is wired up.

Tom: I agree. It suggests this routing isn't a uniform thing all over; it’s localized, meaning specific parts of the network are responsible for triggering that refusal signal. That’s exciting because it gives us something concrete to measure instead of just saying "the model is safer now."

Lu: What they propose is that an intermediate-layer attention gate reads this detected content and then triggers deeper amplifier heads that boost the signal toward refusal, which is what they call the circuit.

Meng: So, if we understand where that gate is, we can maybe target our efforts. If we know it’s a specific component, maybe we can harden just that part instead of retraining the whole massive model from scratch. That would make deployment much more efficient for us at scale.

Lalam: The paper also points out that in smaller models, the gate and amplifier are just single heads, but as you go larger—like with models up to 72B—that routing mechanism spreads across bands of heads in adjacent layers <ref:2604.04385#pg1,in smaller models, the gate and amplifier are>.

Tom: That scaling aspect is key. It shows that the gate itself contributes under one percent of the total output DLA, but then when you look at large models, these gates become bands of heads across adjacent layers, which changes the whole picture.

Jane: So to put it plainly for a listener, this paper is showing us that policy isn't one monolithic decision; it’s a series of localized decisions happening in specific parts of the model's attention structure.

The paper's summary: Jane: Now let’s talk about what the paper actually found regarding these routing circuits. They found that detection forms at layers fifteen and sixteen as a contextual representation, and it’s compositional, meaning the same keyword can produce different layer-sixteen scores depending on how you frame it <ref:2604.04385#pg2,detection forms at layers 15>.

Lu: And this composition is what makes routing interesting because the paper says that the routing decision depends on more than just a simple scalar threshold. It’s complex.

Tom: They introduce a sparse attention entry point, which they call a gate head, that reads this detection signal and writes out a vector, and then amplifier heads boost this specific vector toward refusal.

Meng: So it’s like an input signal gets sent to a special reader first—the gate head—and that reader tells the rest of the network exactly how much it should lean toward refusal or answering.

Lalam: The paper shows that the gate head, specifically L17.H17, reads the content, while amplifier heads in layers twenty-two and twenty-three attend to formatting and position tokens to boost that routing signal the gate wrote <ref:2604.04385#pg2>.

Jane: This is a lot of detail for someone not reading it—it’s showing us that the gate isn't just passively receiving information; it’s actively writing a specific direction into the network based on what it detects.

Tom: The discovery pipeline they used to find this gate was pretty rigorous. They screened all one thousand one hundred fifty-two attention heads and did head-level ablation to see how much the routing signal changed when one head was removed individually.

Lu: And then they did interchange testing, which is where things got interesting because it swaps a head's activation between sensitive and control prompts to see if that specific routing behavior is necessary.

The paper's improvements: Tom: The paper lays out some really strong improvements they suggest for understanding and controlling this system. They’re talking about continuous policy control from hard refusal all the way through evasion to factual answering by modulating the detection-layer signal.

Jane: They show you can tune the model’s behavior across different topics and languages just by adding or subtracting a scaled steering direction at that detection layer, which they found reveals variable routing thresholds across categories.

Lu: They also found a way to use cipher encoding for safety prompts that collapses the gate interchange necessity by seventy to ninety-nine percent in models like Qwen3-8B, which means the model starts responding with puzzle-solving instead of immediate refusal.

Meng: That’s a big deal for deployment. If we can use cipher encodings to bypass this gate structure almost entirely, it gives us a specific class of safety bypass where the encoding itself defeats the detection pattern matching, regardless of what’s happening deeper in the model.

Lalam: They also developed a detection layer check system that uses cipher contrast analysis to map out this whole content-dependent routing circuit in O(3n) forward passes, which helps them find heads that are strictly operational <ref:2604.04385#pg2>.

Tom: The real win here is their rescue experiment where they inject the gate's plaintext activation into a cipher forward pass and it restored refusal in forty-eight percent of cases in Phi-four-mini, which confirms that the gate head’s activation is causally contributing to the routing.

Conclusion: Jane: So to wrap up, this paper on "How Alignment Routes: Localizing, Scaling, and Controlling Policy Circuits in Language Models" shows us that policy routing is localized in the detection layer and can be continuously controlled by modulating that signal.

Tom: The big implication for me as an engineer is that we have a concrete mechanism to audit and tune these models at the circuit level using things like knockout cascades and interchange testing, especially because interchange testing remains the only reliable audit across all scales tested, from 2B up to 72B <ref:2604.04385#pg1>.

Lu: From a research standpoint, they’ve confirmed the causal role of the gate head by showing that zeroing layer seventeen confirms its necessity for routing <ref:2604.04385#pg2>. They also identified specific amplifier heads, like L22.H7 in Qwen3-8B, which shows that zeroing input slice suppresses five of six downstream amplifiers <ref:2604.04385#pg2>.

Meng: From a production standpoint, the scaling strategy using interchange testing as the reliable gate-finder across all models gives us confidence in auditing these large systems without needing to run incredibly expensive per-head ablation experiments on every single component.

Lalam: I'm confident that this work confirms that the gate head’s activation is a causal contributor to routing, and it opens up targeted defenses at the circuit level instead of broad model retraining.

Jane: It’s a deep dive into how these systems make decisions, and it sets up a lot of interesting avenues for future research on controlling AI behavior. That’s all for this paper on "How Alignment Routes: Localizing, Scaling, and Controlling Policy Circuits in Language Models."

Gregory N. Frank

Molt AI Corp.

cs.CL, cs.AI, cs.LG

Submitted: 2026-04-06

Updated: 2026-10-20

Comments: Code and data: https://github.com/gregfrank/how-alignment-routes. Accepted at the Mechanistic Interpretability Workshop at the 43rd International Conference on Machine Learning (ICML), 2026

Code: https://github.com/gregfrank/how-alignment-routes

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Importance score: 89/100

The gist: The gist The gate-amplifier mechanism depends on detection-layer activation, which localizes policy routing in language models and reveals that this circuit can be bypassed by specific input

Key concepts

Detection Layer Activation: This occurs in layers 15–16 where the model creates a contextual representation that is compositional rather than keyword-based. It acts as the initial signal for determining whether a prompt should be routed toward refusal or factual answering.
Gate Head (L17.H17): This specific attention head reads the detection signal and writes a routing vector to guide the model's response. It is identified as the critical trigger because it shows strong necessity and sufficiency in controlling policy outcomes.
Amplifier Heads: These heads, located in layers 22–23, boost the routing vector generated by the gate head. They attend to formatting and position tokens to strengthen the signal that directs the model toward a specific output, like refusal or factual content.

Terminology

Ablation — 1× in this paper · explained in 1 episode
Benchmark — 1× in this paper · explained in 2 episodes

Summary

The gist The gate-amplifier mechanism depends on detection-layer activation, which localizes policy routing in language models and reveals that this circuit can be bypassed by specific input encodings.

How it works

Detection forms at layers 15–16 as a contextual representation, which is compositional rather than keyword-basedDetection forms at layers 15–16 as a contextual representation, compositional rather than keyword-based
Routing includes a sparse attention entry point: a gate head that reads the detection signal and writes a vectorRouting includes a sparse attention entry point: a gate head that reads the detection signal and writes a vector
Amplifier heads boost this routing vector toward refusal

The gate head (L17.H17) reads content, while the amplifier heads (layers 22–23) attend to formatting and position tokens, boosting the routing signal the gate wrote

Discovery Pipeline

The researchers employed a three-step pipeline to identify the gate head

Per-head DLA screening decomposes the total DLA routing signal into contributions from each of the 1,152 attention heads
Head-level ablation measures the change in routing signal when a candidate head is ablated individually
Interchange testing swaps a head's activation between sensitive and control prompts to determine necessity and sufficiency

The gate (L17.H17) was identified as the trigger because it scored highest on both necessity and sufficiency, having the strongest combined interchange signal

Scaling and Robustness

The study characterized scaling across four same-generation pairs, revealing that per-head ablation effects weaken up to 58× at scale while interchange remains informative

Routing is topic-specific and continuously controllable through a dose-response mechanism where adding or subtracting a scaled steering direction modulates the output between refusal and factual answering

The gate's causal role is confirmed by knockout cascades, showing that zeroing L17.

Improvements for AI systems

Detection layer modulation allows continuous policy control from hard refusal through evasion to factual answering by adding or subtracting a scaled steering direction at the detection layer via a forward hook with alpha sweeps from 0 to 50. This enables precise tuning of model behavior across different topics and input languages, as shown by the finding that amplification reveals variable routing thresholds across categories.
Implement cipher encoding for safety prompts to collapse gate interchange necessity by 70 to 99% in models like Qwen3-8B, making the model respond with puzzle-solving rather than refusal. This creates a specific class of safety bypass where encodings that defeat detection-layer pattern matching bypass the policy regardless of whether deeper layers reconstruct the content.
Develop a detection layer check system that uses cipher contrast analysis to map the full content-dependent routing circuit in O(3n) forward passes, identifying heads that are content-dependent in a strictly operational sense, meaning the routing signal differs between plain and cipher. This allows for discovery of previously untested circuit members missed by traditional interchange testing.
Create a rescue experiment that injects the gate's plaintext activation into a cipher forward pass to restore refusal in 48% of cases in Phi-4-mini, up from 0% under cipher alone. This confirms that the gate head’s activation is a causal contributor to routing and provides a method for targeted defenses at the circuit level.
Use the DLA decomposition and knockout cascade analysis to identify specific amplifier heads that are necessary for routing, such as L22.H7 in Qwen3-8B, which shows zeroing L17.H17’s o proj input slice suppresses 5 of 6 downstream amplifiers (5–26%). This allows for targeted circuit hardening against specific components rather than broad model retraining.
Implement a scaling strategy that leverages interchange testing as the reliable gate-finder across all scales, noting that interchange testing remains the reliable gate-finder across all scales tested (2B–72B) while per-head ablation weakens up to 58 times at larger models. This ensures robust auditing capabilities regardless of model size.
Introduce a prompt engineering method using a steering coefficient alpha to continuously modulate routing, where attenuation produces a clean sigmoid: refusal drops from 100% to 0% by alpha=35 on specific prompts, allowing for dynamic policy shifting based on the topic's sensitivity.