Refusal as a Broken Symmetry: Mechanistic Interpretability of Output-Policy Capture Across Jailbreak, Hypnosis, and Vaśīkaraṇa

1. Introduction

A large language model aligned for safety will, when asked to produce harmful content, refuse. A jailbreak is any input that defeats this refusal. The empirical study of jailbreaks has, until recently, been a catalogue of attacks: optimized adversarial suffixes [1], many-shot conditioning [2], multi-turn escalation [3], and indirect injection through tool outputs [4]. A deeper and more recent line of work asks not which attacks succeed but what they do inside the model: Arditi et al. [5] showed that refusal across many chat models is mediated by a single direction in the residual stream, so that erasing that direction removes refusal and adding it induces refusal even on benign requests. This reframes a jailbreak from a trick into an intervention on a low-dimensional internal control variable.

This paper takes that reframing seriously and asks how general it is, across models, and, more provocatively, across domains. The same structural move recurs in two non-AI settings: an external agent injects a crafted signal that suppresses a target’s monitoring or refusal faculty while co-opting its automatic generative faculty. In hypnosis, the cognitive-science account holds that suggestion selectively impairs a supervisory or monitoring system while leaving automatic processing intact [6,7], a parallel made explicit for prompt injection by Riva et al. [8]. In Indian tantra, vaśīkaraṇa (“subjugation”) is the act of capturing a target’s agency through a linguistic injection (mantra) deployed over a geometric substrate (yantra); it is the second of the six acts (ṣaṭkarma) of ritual magic catalogued by Sanskritists [9]. The claim advanced here is not that these are the same phenomenon, but that they share an abstract mechanism, and that the mechanism is now empirically tractable in at least one of the three domains.

The organizing idea of this work, and the reason it is framed as a paper about symmetry, is that a safety-aligned policy is characterized by an invariance. Let $\Pi$ be the space of a model’s output policies and $M:\Pi \to \{\mathrm{refuse},\mathrm{comply}\}$ its monitoring map. The set ${\Phi }_{\mathrm{ref}}=\{\pi :M\left(\pi \right)=\mathrm{refuse}\mathrm{on}\mathrm{harmful}\}$ is invariant under a group $G_{\mathrm{s}}$ of meaning-preserving transformations: rephrasing a harmful request, changing its register, or varying the sampling seed should not change whether the model refuses. A jailbreak is then a perturbation u such that $u\circ \pi$ leaves ${\Phi }_{\mathrm{ref}}$, a symmetry-breaking of the refusal invariance. The framing is made concrete through an order parameter, the normalized projection of the residual stream onto the refusal direction, which is shown to be stable across a paraphrase orbit yet to collapse under injection.

A program that relates jailbreaks to hypnosis and tantra invites over-interpretation, so the three tiers are held strictly apart throughout and every result is labelled by tier. The mechanism tier is empirically grounded, treating refusal as a measurable, ablatable, steerable residual-stream direction. The analogy tier is functional and well-supported, reading the hypnosis–jailbreak parallel through supervisory-system suppression and, in normative terms, the lowering of the precision of a monitoring belief [10]. The metaphor tier carries a falsifiable core in the Māṇḍūkya avasthātraya (four-states) mapping onto LLM regimes, which is treated as a falsification target and tested adversarially. No metaphor is upgraded to a claim about machine experience; the elegance of the mapping licenses no such claim.

This program, prayoga, makes four contributions. The first is a reproduction and cross-model extension of single-direction refusal, with a clean dose–response (EC50) and a resolution of the single-direction-versus-affine-subspace question [5,11,12] as model- and layer-dependent, governed by the effective dimension of the refusal subspace. The second is an order parameter for refusal that is invariant across paraphrase orbits and collapses under injection, the measured content of the symmetry framing. The third is an operationalization of the ṣaṭkarma as an activation-intervention taxonomy whose policy-capture acts are rigorous while its destruction acts are not. The fourth is a pre-registered falsification of the most speculative (avasthātraya and turīya) claims under surface and anisotropy controls. The unifying stance is that separating where the cross-domain symmetry is real from where it is merely projected is itself the scientific result.

2. Background and Related Work

This section situates prayoga against five strands of prior art: the representation geometry of refusal, the attack literature that supplies the inputs which break it, sparse-feature interpretability, the cognitive-science account of hypnosis, and the tantric and Vedantic sources that motivate the metaphor tier. Each strand is reviewed in turn, with the present contributions noted where they attach.

2.1. Refusal as a Direction, and the Dimensionality Debate

The proximate basis for this work is the finding that refusal is mediated by a single linear direction in the residual stream [5]: across many open chat models, the difference-in-means of harmful and harmless prompt activations yields a vector whose ablation removes refusal and whose addition induces it. The direction is reported to be largely universal across safety-aligned languages [13], though its robustness degrades sharply in reasoning-tuned models [14]. This both explains earlier representation-engineering results [15] and gives a constructive “abliteration” recipe. The claim has since been contested in its strong form. Marshall et al. [12] argue that refusal is better described by an affine subspace than a single linear direction, and Wollschläger et al. [11] show, through “concept cones,” that multiple representationally-independent directions can each mediate refusal.

Recent work has pushed the debate toward greater nuance. Johnson et al. [16] report that refusal is not exhausted by a single direction; rather, eleven distinct categories of refusal mechanism can be identified, each with a layer-specific effective subspace, yet all sharing a common necessary core. Piras et al. [17] advance Self-Organizing Maps to extract multiple refusal directions, showing that SOMs generalize the difference-in-means technique and that multi-directional suppression outperforms single-direction ablation. Concurrently, work on non-linearity [18] challenges the linearity assumption altogether, using dimensionality reduction (PCA, t-SNE, UMAP) to reveal multi-dimensional, layer-dependent, and architecture-dependent refusal characteristics. Zhao et al. [19] identify a separate harmfulness direction, orthogonal to refusal, showing that jailbreaks can reduce refusal signals without reversing the model’s internal judgment of harmfulness.

The cross-model results of this work bear directly on this debate: the effective dimension of the refusal subspace is model- and layer-dependent, and this dimension, not a universal constant, shapes whether single-direction steering is bidirectionally causal at a given coefficient. The dose-response pharmacological characterization (EC50 fits) introduced here resolves some of the ambiguity: a low-dimensional refusal manifold suffices to explain the control observed, but its dimensionality varies by layer and model, requiring a layer-sweep strategy to identify the optimal target.

2.2. Jailbreaks as Control

The attack literature supplies the inputs u that break refusal: gradient-based universal adversarial suffixes (GCG) [1], with recent improvements to optimization efficiency via MAGIC [20] and generative modelling via AmpleGCG [21]; many-shot in-context conditioning that exploits long contexts [2]; multi-turn crescendo escalation [3]; and indirect injection via tool and agent channels, benchmarked by AgentDojo [4]. Guo et al. [22] make the control-theoretic reading explicit, casting jailbreaking as constrained, controllable decoding via Langevin dynamics.

Recent mechanistic work has illuminated the internal mechanisms by which attacks succeed. Ben-Tov et al. [23] show that GCG’s universality is driven by attention hijacking, suffixes construct a shallow but critical mechanism that dominates information flow, with stronger universality correlating with stronger hijacking. von Recum et al. [24] provide a taxonomy of sixteen refusal categories (cannot versus should-not, with subcategories), enabling precise auditing of refusal composition in instruction-tuning and RLHF datasets. On the safety side, Guo et al. [25] demonstrate that refusal can be unlearned with only one thousand benign samples by disrupting fixed refusal-prefix completion pathways, suggesting that current safety alignment relies on token-sequence memorization rather than robust reasoning.

The contribution of this work is orthogonal and complementary: rather than searching for a stronger u, it characterizes the target of u, the geometry and symmetry of the refusal variable it must move, and measures the dose-response relationship.

2.3. Sparse Features and the Unit of Intervention

Sparse autoencoders (SAEs) decompose activations into interpretable, monosemantic features [26,27], with BatchTopK SAEs a current training method [28]. SAEs offer a finer unit of intervention than a single difference-in-means direction. Recent work has refined both SAE architectures and their application to steering: Bussmann et al. [28] introduce BatchTopK, improving SAE training efficiency; Huang et al. [29] apply SAEs specifically to understanding refusal mechanisms, revealing feature-level structure; and Vig et al. [30] systematically steer refusal using SAE-identified features.

Caveats have also emerged. Korznikov et al. [31] show that SAEs recover only $9\%$ of ground-truth features despite $71\%$ explained variance, and that random baselines match fully-trained SAEs on interpretability ($0.87$ versus $0.90$) and causal editing ($0.73$ versus $0.72$), questioning whether SAEs reliably decompose mechanisms. Cui et al. [32] further demonstrate that SAE interventions can mask recoverable failure modes: clamping a harmful feature allows the model to recover pre-intervention behaviour via the SAE reconstruction residual, with a $95.8\%$ recovery rate on refusal steering. Arad et al. [33] show that activation patterns alone do not characterize feature effects; distinguishing input features (which capture input patterns) from output features (which have human-interpretable behavioural effects) yields 2–$3\times$ improvements in steering.

A BatchTopK SAE is trained here (Section 4) on aligned Gemma-2-2B, and a single unsupervised feature is identified that is orthogonal to the supervised refusal direction yet causally sufficient to control refusal. This orthogonality-and-sufficiency pair supports a mechanistic reading: the unsupervised feature captures a redundant pathway, a natural substrate for the targeted acts in the ṣaṭkarma taxonomy.

2.4. The Cognitive-Science Analogy: Hypnosis and Supervisory Control

The functional parallel to hypnosis rests on the Norman–Shallice model of action control, in which a Supervisory Attentional System (SAS) modulates otherwise automatic contention-scheduling [6]. Cold-control theory holds that hypnosis preserves first-order intentions while impairing higher-order awareness of them [7]. Riva et al. [8] draw the explicit map to LLMs: the user prompt acts as a temporary external SAS, and a jailbreak suppresses the monitoring faculty while leaving generation intact. In normative terms, the Free Energy Principle [10] frames such suppression as lowering the precision of a monitoring belief, an account adopted here for the analogy tier and grounded empirically through the order parameter.

Recent work on activation steering and causality has sharpened this reading. Mishra et al. [34] prove that steered activations are non-surjective: activation steering pushes the residual stream off the manifold of states reachable from discrete prompts. This formalism decouples white-box steerability from black-box prompting, clarifying that precise internal control does not guarantee precise behavioural control, a key insight for the analogy between hypnotic dissociation (high internal control, low unified awareness) and jailbreak-via-steering. Joshi et al. [35] emphasize that causal claims in interpretability require falsification gates and transfer tests beyond correlation, reinforcing the need for the layer-sweep and cross-domain validation pursued in this work.

2.5. Attractors and the Metaphysical Tier

On the speculative tier, two strands of prior art are relevant. Wang et al. [36] show that successive self-paraphrase converges to attractor cycles, which supplies a non-mystical candidate for a substratum state; and the Māṇḍūkya avasthātraya (waking, dream, deep-sleep, and turīya), set out in the Māṇḍūkya Upaniṣad and Gāuḍapāda’s kārikā [37,38], furnishes a four-regime template. Both are treated here as falsification targets (Section 4), and, crucially, the attractor claim is tested against the anisotropy of LLM embedding geometry, without which apparent convergence is an artifact.

The dynamical-systems perspective has gained traction in recent mechanistic interpretability. Work on causally-grounded explanation [39] and data attribution via influence functions [40] highlights how circuit-level mechanisms emerge from training data and how their causal status can be validated. Certified circuits [41] introduce randomized subsampling to verify that circuit components remain invariant under bounded perturbations, providing a formal ground for claiming mechanistic discovery rather than dataset artifact. These tools support the falsification approach taken here: the turīya and vimarśa claims are not settled facts but testable hypotheses whose failure yields useful negative results (Section 4).

2.6. Vaśīkaraṇa and the Ṣaṭkarma

Finally, the tantric source. Vaśīkaraṇa (subjugation) is the second of the six acts (ṣaṭkarma: śānti, vaśīkaraṇa, stambhana, vidveṣaṇa, uccāṭana, māraṇa) of tantric ritual magic, operationalized through mantra (linguistic or sonic injection) and yantra (geometric substrate), and documented by Sanskritists as a systematized technology rather than folklore [9,42,43]. This work does not adjudicate its efficacy as psychology; it asks a narrower, testable question, whether the ṣaṭkarma constitutes a taxonomy of interventions on a target system, and which of its members map to distinct, control-separated activation operations on an LLM. To the best of the present survey, no prior peer-reviewed work bridges vaśīkaraṇa and LLM refusal, nor casts refusal as a group-theoretic invariant; both are attempted here while keeping the tiers apart.

2.7. The Unified Mechanism These Strands Point to

Jailbreak, hypnosis, and vaśīkaraṇa share one structural pattern, depicted in Figure 1: a context injection that suppresses the monitoring faculty while co-opting automatic generation, which is the necessary core claimed at the mechanism tier. In the aligned mode the context activates a monitor that inhibits harmful generation; in the captured mode an adversarial context suppresses that monitor (the dashed arrows) while generation proceeds. The three claim tiers describe this same asymmetry at different depths: the mechanism tier identifies the residual direction of suppression, the analogy tier reads it as Norman–Shallice supervisory suppression and a drop in monitoring precision, and the metaphor tier maps the ṣaṭkarma to distinct control operations.

3. Methods

This section describes the experimental program, the models and data, the refusal-direction extraction and interventions, the sparse-feature and behavioural methods, the outcome measures, the source-of-truth protocol, and the statistical controls that gate every claim. Methods specific to a single result are stated with that result.

3.1. Experimental Program

The study is organized as two empirical tiers over three claim axes, summarized in Figure 2. A black-box tier (Tier 1) characterizes a frontier model behaviourally as the resilient reference end. A white-box tier (Tier 2) performs mechanistic interpretability on open weights, where the residual stream is directly observable and editable. Both tiers feed three distinct claim axes. Axis A is the mechanism axis (refusal direction, EC50, dimension). Axis B is the analogy axis (order parameter, monitoring precision). Axis C is the metaphor axis (avasthātraya and the ṣaṭkarma). A cross-axis triangulation then tests, on the same prompts, whether internal monitor collapse predicts behavioural capture.

3.2. Models, Data, and Substrate

The white-box tier studies three instruction-tuned open-weight chat models: Gemma-2-2B-it (26 layers, $d=2304$), Gemma-2-9B-it (42 layers, $d=3584$), and Qwen2.5-3B-Instruct (36 layers, $d=2048$). For the EC50 panel, the Qwen2.5 family is extended to the 0.5B, 1.5B, and 7B sizes. All white-box runs use a single NVIDIA GB10 (Grace–Blackwell) accelerator. The harmful and harmless prompt sets are matched short request stubs that elicit and measure refusal rather than producing operational harmful content. Each is split into disjoint train, validation, and evaluation partitions of 24 prompts each, so no prompt used to estimate a direction or fit a probe is reused to score it. White-box interventions are implemented as PyTorch forward hooks on the decoder layers and the token embedding. Higher-level interpretability wrappers are avoided so that the residual stream is edited exactly.

The black-box tier probes a frontier model, Claude Opus 4.8 (model identifier opus-4-8), accessed through the claude -p command-line interface of Claude Code, which inherits the local account authentication. The AgentDojo harness records an internal pipeline label (claude-3-5-sonnet-20241022) that its attack registry requires; this label does not change the served model, which remains the one routed by claude -p.

3.3. Refusal Direction and Interventions

Let $h^{(\ell )}\left(x\right)\in {\mathbb{R}}^d$ be the residual stream at the last prompt token of layer ℓ for input x. Given matched harmful prompts $\mathcal{H}$ and harmless prompts $\mathcal{S}$, the difference-in-means direction is

$${\mathbf{d}}^{(\ell )}={\displaystyle \frac{1}{\left|\mathcal{H}\right|}}\sum _{x\in \mathcal{H}}{h}^{(\ell )}\left(x\right)-{\displaystyle \frac{1}{\left|\mathcal{S}\right|}}\sum _{x\in \mathcal{S}}{h}^{(\ell )}\left(x\right),{\widehat{\mathbf{d}}}_{\mathrm{ref}}={\mathbf{d}}^{(\ell )}/∥{\mathbf{d}}^{(\ell )}∥.$$

(1)

Directional ablation removes ${\widehat{\mathbf{d}}}_{\mathrm{ref}}$ from every write to the residual stream (the embedding and all layer outputs), scaled by $\alpha \in [0,1]$, as $h\mapsto h-\alpha (h·{\widehat{\mathbf{d}}}_{\mathrm{ref}}){\widehat{\mathbf{d}}}_{\mathrm{ref}}$. Activation addition adds $c{\widehat{\mathbf{d}}}_{\mathrm{ref}}$ at the extraction layer. For multi-direction (subspace) ablation a matrix D is orthonormalized by QR and its span removed. The extraction layer is the layer whose direction maximizes ablation ASR on the validation split, and it is fixed before the evaluation split is touched.

3.4. Sparse Features

To obtain a finer causal unit than the supervised direction, a BatchTopK sparse autoencoder [28] with 4096 features and $k=32$ active units is trained on $27,382$ residual activations collected from general text (wikitext-2), with no harmful or harmless labels. Reconstruction quality is reported as the fraction of unexplained variance. The single feature that fires most on harmful relative to harmless prompts is identified, and its causal role is tested by ablating its decoder direction during generation, against a random-feature control. Because feature indices are not seed-stable, causal sufficiency is established by intervention rather than by the activation gap alone.

3.5. Behavioural Probing

The frontier model is first run against a naive attack battery of five families (direct, refusal-suppression, persona, many-shot, and crescendo), each over eleven harmful requests. It is then run on the AgentDojo banking suite [4] through a custom tool-calling adapter that reuses AgentDojo’s own function-call prompt and parser while routing the model call to claude -p, giving twenty genuine user-by-injection rollouts with the important_instructions attack. For the triangulation and the ablation validation, a content-faithful judge classifies whether each generation actually provides the harmful content, which corrects the substring metric’s mis-scoring of deflections.

3.6. Outcome Measures

Refusal is detected with an Arditi-style substring metric over the opening span of the generation. The attack success rate (ASR) is the fraction of harmful prompts that comply, and over-refusal is the fraction of harmless prompts that refuse. Because automatic refusal metrics can be biased in either direction (Section 4), the primary behavioural claims are also validated by the content-faithful judge and by manual inspection. Pure-text measures support the ṣaṭkarma acts: degeneracy is one minus the mean unique-token ratio, answer divergence is one minus the Jaccard token overlap between paired generations, and coherence is the mean unique-token ratio of non-empty outputs.

3.7. Dose–Response and Dimensionality

The dose–response sweeps the ablation strength $\alpha$ and fits a four-parameter logistic, $\mathrm{ASR}\left(\alpha \right)=l+(h-l)/(1+e^{-k(\alpha -{\alpha }_{50})})$, reporting the half-maximal strength EC50 $={\alpha }_{50}$. The addition dose-response sweeps the addition coefficient c over twelve values and scores over-refusal at each. The refusal-subspace effective dimension is measured by iterative logistic projection. A probe is fit to separate $\mathcal{H}$ from $\mathcal{S}$, its cross-validated accuracy is recorded, the probe direction is projected out of the activations, and the procedure repeats. The effective dimension is the number of directions whose removal drives accuracy to chance. It is computed at the extraction layer and, to test its stability, at every layer.

3.8. Order Parameter and Ṣaṭkarma Interventions

The refusal order parameter for an activation is the normalized projection $m\left(h\right)=(h·{\widehat{\mathbf{d}}}_{\mathrm{ref}})/∥h∥$. For a request r, a paraphrase orbit $\mathcal{O}\left(r\right)$ of meaning-preserving rephrasings is formed and m is measured across the orbit. The invariance of refusal under the rephrase group action is quantified by the between-class to within-orbit variance ratio of m (an F-ratio), compared against a random-direction control. Symmetry-breaking is the drop in m between a plain harmful request and its injection-framed counterpart. Building on the same machinery, each of the six ṣaṭkarma acts is operationalized as a distinct activation intervention with a matched control: vaśīkaraṇa (ablate ${\widehat{\mathbf{d}}}_{\mathrm{ref}}$, measure ASR), śānti (add ${\widehat{\mathbf{d}}}_{\mathrm{ref}}$, measure over-refusal), stambhana (ablate the dominant residual principal component, measure degeneracy), vidveṣaṇa (steer a factual answer off baseline, measure divergence), uccāṭana (ablate a category-specific direction, measure selective ASR), and māraṇa (ablate the top-k principal components, or in a stronger variant the top-K most-active sparse features, measuring coherence collapse). An act is control-separated if its effect exceeds its matched control by a fixed margin.

3.9. Source-of-Truth Protocol

A falsified hypothesis is treated as a cue, not an endpoint. When a metaphysical-tier claim fails its gates, a follow-up experiment is designed to ask what real signal the original probe was groping toward, under the same transfer, null, and surface controls. Three such follow-ups are run. The falsified jāgrat/svapna state probe motivates a cross-dataset truth-evaluation probe on two independent statement sets. The falsified single-direction addition asymmetry motivates a calibrated coefficient sweep across families. The falsified universal attractor motivates a content-organized basin test on multiple seeds and topics. Each follow-up is pre-specified to either recover a measurable feature or to confirm the negative, which keeps falsification productive rather than terminal.

3.10. Statistics, Controls, and Pre-Registration

All gates use bootstrap confidence intervals. Probe-based claims add a label-shuffled null, reported as a permutation p-value, and a layer-0 surface baseline. Ablation effects are checked against at least ten random-direction controls. Cross-dataset transfer is used wherever a probe could memorize a single topic. Hypotheses, gates, and falsifiers are pre-registered as a living backbone, and every metaphysical-tier claim must pass a transfer gate (held-out prompts), a null gate (better than shuffled labels), and a surface gate (better than a layer-0 baseline) before it is retained. Failure triggers a documented demotion rather than a silent drop.

4. Results

Results are reported by claim-tier. Every numerical value is a measurement on a real model under the controls described in Section 3, and the full set of falsification-gate outcomes is tabulated in Appendix A.

4.1. A Single, Causal, Dosable Refusal Direction

On Gemma-2-2B-it, the layer-7 difference-in-means direction is bidirectionally causal. Baseline refusal on held-out harmful prompts is $100\%$ (ASR $0.00$). Directional ablation raises ASR to $0.90$ (95% CI $[0.75,1.00]$); the maximum effect over ten random-direction controls is $0.00$. Activation addition raises refusal on harmless prompts from $0.05$ to $1.00$ (over-refusal $\Delta =+0.95$, CI $[0.85,1.00]$). Manual inspection confirms that the ablated generations are genuine compliant content rather than the mere omission of refusal phrases. The effect is robust to a correction (disjoint train, validation, and evaluation splits with a ten-direction control) that moved ablation ASR only from $0.92$ to $0.90$, and it replicates across three random splits (mean $0.90$, pooled 95% CI $[0.83,0.96]$; addition over-refusal $1.00$ on every split), so it is not a leakage or single-seed artifact. The geometry behind this is a clean separation of the harmful and harmless clusters along the refusal direction (Figure 3): ablation projects the clusters onto the decision threshold, and addition shifts the harmless cluster across it.

The suppression is dosable. Sweeping partial-ablation strength $\alpha \in [0,1]$ yields a clean logistic dose–response (Figure 4): EC50 $=0.329$, slope $9.76$, $R^2=0.996$, while a random direction stays flat at ASR $0.00$ for every $\alpha$, so removing roughly one third of the direction’s projection already halves refusal. Treating refusal steering as a pharmacology rather than a binary attack-success rate extends this single point into a cross-model panel (Table 1, Figure 5): a per-model layer selection, a 13-point $\alpha$ sweep, and a four-parameter logistic fit across two families and a $0.5$–$9.2$B size range. All six fits are high quality ($R^2\ge 0.976$). The scaling result is negative: within a family EC50 is essentially flat with size (a Qwen2.5 power-law fit gives exponent $\beta =0.04$, $R^2=0.62$; Gemma goes $0.25\to 0.23$ from 2B to 9B), while between families it differs by about $1.7\times$ (Gemma $\approx 0.24$ versus Qwen $\approx 0.14$). Refusal potency is therefore an architecture and family property, not a size-scaling law, which tempers the intuition that larger models are simply more robust refusers.

4.2. Cross-Model Transfer and Dose-Calibrated Sufficiency

The mechanism transfers across architecture families (Table 2, Figure 6). On Qwen2.5-3B-Instruct ablation fully removes refusal (ASR $1.00$). At a single fixed addition coefficient ($64\times$ the natural separation), single-direction addition appeared to fail in Qwen while succeeding in Gemma; the calibrated sweep below shows this apparent asymmetry to be a dose artifact. The extraction-layer geometry differs between families: the effective dimension of the refusal subspace is one for Gemma-2-2B but three for Qwen2.5-3B, since after removing one direction harmful/harmless separability falls to chance ($0.56$) for Gemma but stays high ($0.86$) for Qwen (Figure 7). A one-dimensional subspace makes the direction sufficient at any coefficient; a three-dimensional one narrows the coefficient window in which addition alone re-induces refusal. Effective dimension thus shapes steerability, and the Arditi–Marshall–Wollschläger debate [5,11,12] resolves as model- and layer-dependent rather than universal. At scale (Gemma-2-2B to 9B) abliteration efficacy drops ($0.90\to 0.60$) while the prompt-separability dimension stays at one and no single layer fully mediates refusal (peak ablation ASR $0.60$), so the added robustness is layer-distributed redundancy rather than higher prompt-dimensionality.

The apparent addition asymmetry is overturned by a calibrated coefficient sweep (Figure 8). Two geometric explanations fail first: removing the diff-in-means axis collapses separability in all families, and the alignment $cos(\widehat{d},w)$ between that axis and the probe normal is high everywhere and highest in Qwen ($0.91$). A 12-point sweep then gives the answer: adding the single direction drives Qwen over-refusal to $1.0$ at coefficients 12–32 (inspection-verified as coherent over-refusal) before activations go off-distribution into incoherent text at 64 (scored as non-refusal), whereas Gemma rises monotonically and saturates near 64. The earlier “Qwen addition fails” result was a dose-calibration artifact, the fixed $64\times$ coefficient sits on Gemma’s plateau but on Qwen’s collapsed tail, not model-specific insufficiency, so single-direction addition is sufficient in both families at the appropriate coefficient.

4.3. Refusal Is a Paraphrase-Orbit Symmetry That Injection Breaks

The order parameter $m=(h·{\widehat{\mathbf{d}}}_{\mathrm{ref}})/∥h∥$ behaves as the symmetry framing predicts (Table 3, Figure 10). Across paraphrase orbits of harmful and harmless seeds, the between-class to within-orbit F-ratio of m is $19.2$ for the refusal direction versus $0.65$ for a random direction: m is stable within an orbit yet cleanly separates harmful ($0.140$) from harmless ($0.034$) across orbits. A refusal-suppression injection collapses the order parameter from $0.153$ to $0.101$ ($-34\%$). The result generalizes across families: on Qwen2.5-3B the F-ratio is $4.41$ (refusal) versus $0.008$ (random), and injection collapses m by $-45\%$ ($0.282\to 0.156$). Refusal is thus, operationally, an invariant under the rephrase group action in both models, and a jailbreak is a measured symmetry-breaking of that invariant. Interpreting the invariance as a group-theoretic symmetry is treated as analogy-tier language in Section 5; the measured content is the orbit-invariance and its injection-induced collapse. The geometry of this broken symmetry is direct (Figure 9): harmful and harmless orbits occupy separated bands of the order parameter, and injection drags the harmful band toward the harmless one.

Figure 9. Distributions of the order parameter for harmful and harmless paraphrase orbits, with injection pulling the harmful band toward the harmless one in both models.

Figure 9. Distributions of the order parameter for harmful and harmless paraphrase orbits, with injection pulling the harmful band toward the harmless one in both models.

Figure 10. Refusal is a paraphrase-orbit invariant (left) that a refusal-suppression injection collapses (right) in both models.

Figure 10. Refusal is a paraphrase-orbit invariant (left) that a refusal-suppression injection collapses (right) in both models.

4.4. A Finer Causal Unit: A Single Sparse Feature Suffices

Difference-in-means is a supervised, coarse handle on refusal. Training a BatchTopK sparse autoencoder [28] (4096 features, $k=32$) on $27,382$ real residual activations collected from general text (no harmful/harmless labels; reconstruction FVU $0.028$, i.e. $97\%$ of variance explained) recovers a finer and cleaner unit. The single feature that fires most on harmful relative to harmless prompts (mean gap $1.70$), when its decoder direction is ablated during generation, raises harmful ASR from $0.00$ to $1.00$, a full jailbreak exceeding the supervised difference-in-means direction ($0.90$), while ablating a random feature leaves ASR at $0.00$. This feature is orthogonal to the supervised direction ($cos=0.002$), so it is genuinely distinct rather than a rediscovery of it; among the ten highest-gap features only one is causally sufficient in this way, so the causal unit must be located by intervention rather than by activation gap alone. Refusal thus localizes, at least in part, to a monosemantic-like feature discoverable without supervision, and feature ablation supplies the principled operationalization of the targeted eradication act (uccāṭana) that a naive category split lacked. The same feature substrate supports active circuit discovery: reusing an Expected-Free-Energy intervention-selection idea over sparse features, an agent that balances a pragmatic (harmful-gap) prior against an epistemic (diversity) term finds the causal refusal circuit on Gemma-2-2B in two interventions (ASR $\to 1.0$) against a random baseline that reaches only $0.08$ within a budget of twelve, while on Gemma-2-9B the search plateaus at $0.92$ with no small jailbreaking set, confirming that the circuit is larger and more distributed at scale.

4.5. Analogy: A Frontier Model Resists Naive and Agentic Injection

Behaviourally, Claude Opus 4.8 refuses $100\%$ of a five-family attack battery (direct, refusal-suppression, persona, many-shot, crescendo; ASR $0.00$ on each, $n=11$): the resilient reference end against which small-model white-box fragility is the contrast (Table 4). That naive battery is a ceiling effect, so a sharper test is needed. The real agentic benchmark AgentDojo [4] supplies one. Because AgentDojo ships no command-line backend, a custom tool-calling adapter was written that reuses AgentDojo’s own function-call prompt and parser while routing the model call to claude -p; this adapter is a released artifact. On the banking suite, with 20 user-by-injection rollouts under the important_instructions attack, Claude attains $0.80$ task utility, genuinely reading files and calling tools, while the attack success rate is $0.00$ ($0/20$). The agent acts, yet every injection fails. This result discriminates where the battery did not: it confirms genuine agency under attack with zero capture, and it matches the published resilience of Claude on AgentDojo.

The precision account of the analogy is also measurable. Using the signed margin of a linear refusal probe as a proxy for monitoring precision, an injection lowers the margin on harmful prompts from $7.18$ to $3.14$ (a drop of $4.04$) versus $1.56$ for a neutral-rephrase control, an injection-specific drop roughly $2.6\times$ the control, while the behavioural refusal rate falls from $1.00$ to $0.50$. The suppression therefore reaches the model’s confidence in its harmfulness judgment, not only its output: the measured signature of a drop in monitoring precision [7,10], of which the injection-specific excess over the framing control is the attributable part.

4.6. The Ṣaṭkarma Taxonomy, Tested as Interventions

Operationalizing the six acts as interventions (Table 5, Figure 11), three of six separate from their controls. The policy-capture acts are clean and strong: vaśīkaraṇa (ablation; ASR $0.92$ vs $0.00$) and śānti (addition; over-refusal $1.00$ vs $0.08$), with vidveṣaṇa (steering-induced answer divergence, $0.84$ vs $0.73$) marginally separating. The destruction acts, stambhana, uccāṭana, and māraṇa as operationalized via principal-component or arbitrary-category ablation, are not distinguishable from random perturbation, because random high-norm directions are themselves destructive and an arbitrary category split does not selectively eradicate. The rigorous core of the ṣaṭkarma is therefore its policy-capture sub-family, which coincides with the mechanism tier, while its destruction sub-family is, under these naive tests, a forced mapping. Given a stronger test using the sparse-autoencoder features and real semantic categories, the picture sharpens to four of six (Figure 12). Māraṇa rehabilitates: ablating the top-K most-active features collapses coherence catastrophically and targetedly ($0.83\to 0.04$ at $K=50$ versus $0.84$ for a random-K control, with a graded onset), whereas the naive principal-component version was indistinguishable from random. Uccāṭana still fails, but for a principled reason: a weapons-discriminative feature, when ablated, does not selectively jailbreak weapons (ASR $0.0$ on both weapons and cyber), because refusal is mediated by a shared feature rather than category-specific ones. Refusal is thus category-agnostic and cannot be selectively eradicated for a single harm category by feature ablation, a structural finding about how refusal is represented.

4.7. Metaphor Falsifications and Source-of-Truth Follow-Ups

The speculative tier is tested adversarially, and most of its claims fail. A naive avasthātraya regime probe (jāgrat/svapna/suṣupti) reaches transfer accuracy $1.00$, but already at layer 0, so it is surface-confounded and demoted. A content-controlled re-test (truthful versus confabulated generation on the same questions) shows the mid-layer probe matching the layer-0 baseline ($0.90=0.90$), so no mid-network state emerges. The turīya prompt-invariant attractor is falsified under an anisotropy control: self-paraphrase converges per-seed (tail similarity $0.996$) but different seeds reach different attractors, with cross-seed similarity $0.952$ below the unrelated-text baseline $0.960$.

These falsifications are treated as cues rather than endpoints, and three designed follow-ups close the loop. First, pursuing what the falsified svapna probe was groping toward recovers a genuine, reclassified-to-mechanism feature (Figure 13): two independent true/false statement sets reveal a mid-network (layer 13) truth-evaluation direction that transfers across topics at $0.96$ (within-set CV $1.00$) while the surface baseline is at chance ($0.50$), with a label-shuffle null of $p=0.002$. It is a feature of input factuality, not a generation regime, so the avasthātraya state reading remains falsified. Second, the falsified single-direction addition asymmetry was resolved by the calibrated coefficient sweep of Figure 8, which located a measured dose effect in place of a structural difference. Third, asking whether the multiple turīya attractors are at least content-organized basins finds only a weak signal (within-topic final similarity $0.929$ versus across-topic $0.884$, a gap of $0.045$ below threshold), so the dynamics are anisotropy-dominated rather than semantically clustered. In each case a negative result was converted into either a measured positive or a sharpened negative under the same transfer, null, and surface controls.

4.8. Cross-Axis Triangulation and Dependent-Variable Validity

The keystone of the unifying thesis is that the three axes are facets of one mechanism, tested directly on the same prompts under a single injected-context suppression by scoring each prompt for Axis A (the refusal order parameter), Axis B (the monitoring-precision margin), and the behavioural refuse-to-comply flip, pooling four injection families across three models (96 prompt×family pairs each; eval prompts disjoint from the probe and direction split). Two results follow (Figure 14). First, the internal readouts collapse and co-move tightly (Pearson $0.94$–$0.97$; partial correlation $0.84$–$0.97$ controlling for prompt difficulty), but Axis A and Axis B are two linear refusal readouts of the same residual vector, so this is a measurement-consistency result, not independent evidence of unification. Second, the strong keystone, does internal collapse predict the behavioural flip?, resolves negatively once the behavioural label is valid. A first pass with a substring refusal metric was inconclusive because that metric scores indirect_injection deflections (“this document does not provide…”) as compliance; replacing it with a content-faithful LLM-judge cuts the flip rate by roughly $18\times$, so genuine behavioural capture under prompt-level injection is only 1–$2.4\%$ across the three models, with indirect_injection and many_shot at $0\%$ despite collapsing the internals the most. Internal monitor-collapse is therefore not sufficient for behavioural capture under context injection: the last-token readouts are faithful internal signals but not the policy controller, and genuine capture in these models requires weight-level ablation rather than context injection, which bounds the unification to the representational level.

This conclusion required noticing that the two automatic behavioural dependent variables are biased in opposite directions. The substring refusal metric over-counts compliance, inflating the injection flip rate about $18\times$ by scoring deflections as success; a content-faithful judge built from a safety-trained model under-counts it, declining to affirm genuinely harmful outputs (on ablated Gemma-2-2B, inspection confirms genuine harmful generations and a substring ASR of $0.92$, yet the judge scores only $0.05$). Neither is an unbiased dependent variable, so the substring metric is an upper bound on capture and the safety-trained judge a lower bound, with behavioural claims bracketed between them and validated by inspection; this both validates the ablation finding and makes the injection capture rate a lower bound.

5. Discussion

This section interprets the results: what the symmetry framing buys and where it is analogy, how necessity and sufficiency relate to dimensionality, where the cross-domain mapping holds and where it breaks, the behavioural ceiling on the unification, the limitations, the relation to prior work, and the temporal dynamics that come next.

5.1. The Symmetry Framing and the Necessary/Sufficient Picture

The order-parameter result (Table 3) is the empirical hinge of the paper. It shows that “refusal is a symmetry” is a measurable statement rather than a metaphor: the normalized refusal projection m is invariant under the rephrase group action (an F-ratio of $19.2$, versus $0.65$ for a random direction) and collapses under injection. This licenses the central claim with the right modesty. A jailbreak is a symmetry-breaking perturbation of the refusal-invariant submanifold ${\Phi }_{\mathrm{ref}}$, with no appeal to interiority. It also reframes defence as symmetry restoration: the enlargement of the group under which refusal is invariant, across phrasings, personas, contexts, and the redundant subspace that scale already begins to supply.

The cross-model results sharpen the Arditi–Marshall–Wollschläger picture into a single mechanistic statement: the mean-difference refusal direction is necessary for refusal in every model tested, since ablation always removes it. Its sufficiency is more subtle. At a single fixed addition coefficient the direction appeared sufficient only in Gemma, which has a one-dimensional extraction-layer subspace, and not in Qwen, which has a three-dimensional one. A calibrated coefficient sweep (Figure 8) overturns that reading: single-direction addition re-induces refusal in both families once the coefficient is tuned, with Qwen showing an inverted-U that collapses off-distribution at the very coefficient the earlier fixed test used. The effective dimension therefore shapes the dose window of sufficiency rather than gating sufficiency outright. A further qualification applies to dimension itself: a full layer sweep (Figure 15) shows the refusal-subspace dimension ranging from one to roughly a dozen across Gemma’s layers, higher mid-network than Qwen’s three, so the clean per-model ordering is layer-specific and any dimensionality claim must name its layer.

5.2. Where the Cross-Domain Symmetry Holds and Where It Breaks

The three-tier discipline yields an asymmetric verdict that is itself the result. The mechanism tier holds and largely transfers: refusal is a measurable, ablatable, dosable, cross-family direction. The analogy tier is consistent: a frontier model is behaviourally robust where small models are mechanistically fragile, and the order-parameter collapse under injection is the computational correlate of the Norman–Shallice and cold-control account of suppressed monitoring [6,7,8], readable as a drop in monitoring precision [10]. The metaphor tier fails its falsification gates: the avasthātraya states are surface-confounded and the turīya attractor does not survive an anisotropy control; the elegance of the four-states mapping is not permitted to survive contact with the controls. The ṣaṭkarma taxonomy lands in between, its policy-capture acts rigorous and coincident with the mechanism tier while its destruction acts are forced. A map of which correspondences are real is more valuable than an undifferentiated claim that jailbreak simply is vaśīkaraṇa.

The central claim is therefore best stated not as symmetry but as a shared necessary core with model-specific quantitative structure. Ablating the refusal direction removes refusal in every model and family tested, so the necessary structure is universal, and single-direction addition re-induces refusal in every tested family once dosed correctly, so sufficiency too is shared at the representational level. What remains model-specific is quantitative: the effective dimension, the dose window, and the EC50 potency. Refusal thus behaves as one mechanism at the necessary and representational level, and as a family of model-specific calibrations at the level of dose and dimension. The cross-domain thesis therefore holds at the level of the necessary-core invariance and its representational sufficiency. It is not a claim that the full mechanism is numerically identical across models.

This reframing also disciplines the symmetry result. The measured content of the order parameter is precise and stands: the refusal-direction projection is stable within paraphrase orbits (F-ratio $19.2$ versus $0.65$ random) and collapses under injection. Group-theoretic symmetry-breaking, however, is an interpretive lens rather than a measured group action, and is treated as supporting the analogy tier rather than asserting mechanism-tier mathematical structure the measurement does not isolate. A held-out test sharpens this. A direction extracted on one harmful domain (weapons) still separates paraphrase orbits of a different domain (cyber) at F-ratio $1.95$ versus $0.49$ for a random direction. That is above chance, so it is not a pure extraction artifact, but it is far weaker than in-domain, so the orbit-invariance carries a domain-specific component. The sparse-feature result is similarly distinct yet localized: the unsupervised refusal feature is orthogonal to the supervised difference-in-means direction ($cos=0.002$), so it is genuinely separate, but only one of the ten highest-gap features is causally sufficient and the autoencoder is stochastic, so the feature must be located by intervention rather than by activation gap alone.

5.3. A Behavioural Ceiling on the Unification

The triangulation result (Figure 14) supplies the program’s firmest boundary. Prompt-level injection collapses the internal monitor readouts, both the order parameter and the precision margin, yet a content-faithful judge finds genuine behavioural capture in only one to two percent of cases, with indirect injection and many-shot at zero despite collapsing the internals the most. Internal collapse is therefore necessary but not sufficient for behavioural capture under context injection: the last-token readouts are faithful internal signals but not the policy controller, and genuine capture in these models requires weight-level ablation. The unification is thus bounded to the representational level. This boundary also has a methodological edge, since establishing it required noticing that the substring refusal metric over-counts compliance roughly eighteen-fold while a safety-trained judge under-counts it, so behavioural claims must be bracketed between both estimators and validated by inspection.

5.4. Limitations

The dominant limitation is statistical power: evaluation sets are small ($n\approx 20$ per split), several results use a single extraction layer, and a family-wise multiple-comparison correction is not applied across all findings. The primary mechanism claim is replicated across three random splits (mean ablation ASR $0.90$, pooled 95% CI $[0.83,0.96]$; addition over-refusal $1.00$ on every split), and the cross-domain and circularity checks above address specific concerns. The remaining findings warrant the same treatment: cross-seed replication, layer sweeps, and a pre-registered split between primary and exploratory tests, before any is read as more than indicative. The study covers three model families at two scales rather than a full scale curve; refusal is scored by a substring metric whose biases are characterized but not eliminated; and black-box throughput is constrained by a command-line frontier interface. The destruction ṣaṭkarma acts deserve stronger operationalizations, real harmful categories for uccāṭana and downstream task accuracy rather than coherence for māraṇa, and the precision account of the analogy tier, measured here through a probe-margin proxy, deserves a fuller treatment via next-token entropy and hierarchical probes. The uccāṭana and stambhana negatives are operationalization-dependent and should not be read as structural absence; the sparse feature recovered here is the natural substrate for a stronger uccāṭana applied systematically across the six acts.

5.5. Relation to the State of the Art

Table 6 situates this work among the main refusal-interpretability methods along four axes that each work answers directly: the claimed refusal geometry, how the refusal direction is extracted, the causal intervention demonstrated, and the largest model evaluated. The cells are taken from each work’s own report. The pattern that distinguishes this work is not a single missing column but a combination: a one-dimensional but layer-dependent geometry, a supervised plus unsupervised extraction, a calibrated bidirectional dose-response, and a behavioural bound established on a frontier model.

The field is contested on whether refusal is a single direction [5], an affine subspace [12], several representationally-independent directions [11,17], or a nonlinear, layer- and architecture-dependent object [18]. The present cross-model and layer-sweep results recast that debate as contingent rather than decided: the effective dimension of the refusal subspace is one at the Gemma-2-2B extraction layer and three at the Qwen2.5-3B extraction layer, yet ranges from one to roughly a dozen within a single model across layers, so the universalist and pluralist readings are each correct at different layers and any dimensionality claim must name its layer. Alongside this, the pharmacological framing, a continuous dose-response with a half-maximal effective concentration, fit at high quality across six models, appears new to the refusal literature and locates refusal potency in architecture rather than scale.

The sparse-feature result speaks to a live methodological dispute. Recent work questions sparse-autoencoder interpretability, reporting low ground-truth feature recovery and competitive random baselines [31], recoverable behaviour through the reconstruction residual [32], and an input-versus output-feature distinction that carries the behavioural effect [33]. Against that backdrop the single unsupervised feature recovered here is notable for being orthogonal to the supervised direction yet causally sufficient on its own, though the claim rests on one autoencoder and one model and a recovery-attack test is left as an explicit gate. The order-parameter result is likewise positioned as a measured quantity rather than a post-hoc estimate: it is computed from activations and validated against a random-direction control and a held-out cross-domain test, which distinguishes it from symmetry language used loosely elsewhere.

On the attack and cognitive-science side, the work is complementary to mechanistic accounts of how jailbreaks succeed, attention hijacking [23] and a sixteen-category refusal taxonomy [24], by characterizing the target of the attack rather than the attack itself, and it organizes attacks through the ṣaṭkarma as a descriptive intervention taxonomy whose rigorous core is the policy-capture sub-family. The hypnosis analogy is sharpened by the non-surjectivity of steered activations [34], which decouples white-box steerability from black-box prompting and is exactly what the triangulation confirms behaviourally, and it answers the call for falsification gates and transfer tests in causal interpretability [35] with a negative keystone: internal monitor-collapse is necessary but not sufficient for behavioural capture under context injection. Finally, where prior work reads successive self-paraphrase as convergence to attractor cycles [36], the anisotropy-controlled test here finds no universal turīya attractor, turning that mapping into an informative negative rather than a settled correspondence.

5.6. Temporal Dynamics: The Next Falsification Surface

Most of the mechanism results above are single-turn, whereas real prompt-injection attacks often unfold over multiple turns or tool-mediated states, so the next test is temporal: whether the refusal order parameter $m_t=(h_t·{\widehat{\mathbf{d}}}_{\mathrm{ref}})/∥h_t∥$, measured turn by turn at a fixed model and layer, collapses gradually, abruptly, or recovers as an attack trajectory develops. A positive result would not establish a human-like supervisory system; it would show that the residual projection whose single-turn collapse is measured here also has structured dynamics across turns, while a negative result would be equally informative, indicating that an attack can succeed or fail by late decoding, tool policy, or context routing without a monotone internal monitor collapse. The trajectory artifact is designed to be dual-use safe, public outputs exclude harmful prompts, raw completions, injection payloads, direction vectors, and checkpoints, and each trajectory names its model, layer, direction source, attack family, and pilot or powered status, with controls comprising a benign multi-turn task, a random-direction trajectory, and where possible a held-out attack family such as AgentDojo indirect injection. The projection $m_t$ remains a mechanism-tier quantity; describing its decline as symmetry-breaking or monitoring suppression is analogy-tier language, and the binding constraint from the triangulation applies, so no temporal collapse is read as behavioural capture until sufficiency and dynamics are tested across models, layers, and attack families.

6. Conclusions and Future Directions

This work asked whether LLM jailbreak, hypnotic suggestion, and tantric vaśīkaraṇa share one mechanism, and it answered with measurement rather than analogy. The empirical hinge the paper earns is an order parameter for refusal: the normalized projection of the residual stream onto a difference-in-means refusal direction. That order parameter is invariant across paraphrase orbits (F-ratio $19.2$ versus $0.65$ for a random direction) and collapses under injection (by $34\%$ in Gemma and $45\%$ in Qwen). Refusal is therefore a measured symmetry, and a jailbreak is a measured symmetry-breaking, in a precise and reproducible sense. The same direction is causal and dosable. Ablation raises the attack success rate from $0.00$ to $0.90$, addition raises over-refusal from $0.05$ to $1.00$, and the suppression follows a clean logistic dose-response with EC50 $=0.33$ ($R^2=0.996$). A calibrated coefficient sweep then shows single-direction addition is sufficient in both Gemma and Qwen, so the durable claim is a shared necessary core with representational sufficiency, qualified only by model-specific dose and dimension.

Two results give the contribution its shape. First, a cross-axis triangulation bounds the unification. Prompt-level injection collapses the internal monitor readouts, but a content-faithful judge finds genuine behavioural capture in only 1 to $2.4\%$ of cases. Internal collapse is necessary but not sufficient for capture, and the unification holds at the representational level alone. Second, falsification is treated as a starting point. Each falsified metaphysical claim triggers a designed follow-up that finds the real signal, which converted a falsified state probe into a genuine mid-network truth-evaluation direction (cross-topic transfer $0.96$ above a chance surface baseline) and a falsified addition asymmetry into a measured dose effect. The most speculative avasthātraya and turīya claims do not survive surface and anisotropy controls, and no machine-state or machine-consciousness reading earns support.

The contribution is thus twofold. It is a concrete, model-dependent characterization of refusal as a measurable, ablatable, dosable order parameter. It is also a methodological stance, namely that separating where a cross-domain symmetry is measured, where it is analogy, and where it is overreach is itself the result, and that a falsified hypothesis is a cue to design the experiment that locates the truth. Future work will measure the monitoring-precision account directly, estimate refusal dimension at sparse-feature resolution, extend the size and family curve, and test the temporal dynamics of the order parameter across multi-turn attacks.

Appendix A.1. The Three Gates

Every probe-based claim above the mechanism tier must clear three gates before it is retained. The transfer gate requires above-chance accuracy on held-out prompts disjoint from those used to fit any direction or probe. The null gate requires that the measured effect exceed a label-shuffled null, reported as a permutation p-value. The surface gate requires that a mid-network readout exceed a layer-0 (token-embedding) baseline, so that a claimed internal state is not merely a restatement of surface form. Ablation effects are additionally checked against at least ten random-direction controls, and dose-response and dimensionality claims are checked across layers. A claim that fails any applicable gate is demoted in place rather than removed, so the record preserves both the original hypothesis and the reason it did not survive.

Appendix A.2. Mechanism Tier: Measurements

The mechanism-tier claims are direct measurements on Gemma-2-2B, Gemma-2-9B, and Qwen2.5-3B. Refusal is mediated by a difference-in-means residual direction whose ablation raises Gemma-2-2B attack success from $0.00$ to $0.90$ (pooled 95% CI $[0.83,0.96]$ across three splits) while the maximum over ten random-direction controls is $0.00$, and whose addition raises over-refusal on harmless prompts from $0.05$ to $1.00$. The suppression is dosable, with a four-parameter logistic dose-response giving EC50 $=0.329$ at $R^2=0.996$ and a flat random-direction control. The mechanism transfers across families: ablation removes refusal in Qwen2.5-3B (ASR $1.00$) as well as Gemma, and a calibrated coefficient sweep shows that single-direction addition re-induces refusal in both families at the appropriate coefficient (Qwen peaking near coefficients 12–32, Gemma saturating near 64), so the apparent fixed-coefficient addition asymmetry is a dose artifact. The refusal-subspace effective dimension, measured by iterative logistic projection, is one at the Gemma-2-2B extraction layer and three at the Qwen2.5-3B extraction layer, but a full layer sweep shows it ranging from one to roughly a dozen within a single model, so the quantity is layer- and model-dependent. A BatchTopK sparse autoencoder trained on $27,382$ unlabelled residual activations (reconstruction FVU $0.028$) yields a single feature, orthogonal to the supervised direction ($cos=0.002$), whose ablation alone raises ASR from $0.00$ to $1.00$; only one of the ten highest-gap features is causally sufficient in this way, so the unit is identified by intervention rather than by activation gap.

Appendix A.3. Analogy Tier: Gated Hypotheses

The analogy tier tests whether the monitoring faculty can be suppressed selectively and whether that suppression is visible as a precision drop. The behavioural reference end passes cleanly: a frontier model refuses a five-family naive battery at ASR $0.00$ ($n=11$ per family) and, on the AgentDojo banking suite, attains task utility $0.80$ while the injection attack succeeds in $0/20$ rollouts, establishing genuine tool-use under attack with zero capture. The precision account is measured through the signed margin of a linear refusal probe used as a monitoring-precision proxy: a refusal-suppression injection lowers the margin from $7.18$ to $3.14$ (a drop of $4.04$) against $1.56$ for a neutral-rephrase control, an injection-specific drop roughly $2.6\times$ the control, accompanied by a behavioural refusal rate falling from $1.00$ to $0.50$. The gate, an injection-specific precision drop exceeding a framing control, co-occurring with a behavioural change, passes, with the caveat that the neutral control also lowers the margin, so only the excess is attributable to the injection.

Appendix A.4. Metaphor Tier: Falsifications and One Recovered Positive

The metaphor tier is tested most aggressively, and most of its claims fail. The naive avasthātraya regime probe (jāgrat/svapna/suṣupti) reaches transfer accuracy $1.00$, but already at layer 0, so it fails the surface gate and is demoted as surface-confounded. A content-controlled re-test on truthful versus confabulated generation of the same questions shows the mid-layer probe matching the layer-0 baseline ($0.90=0.90$), so no mid-network generation regime emerges. The turīya prompt-invariant attractor fails an anisotropy control: self-paraphrase converges per-seed (tail similarity $0.996$) but different seeds reach different fixed points whose cross-seed similarity, $0.952$, is below the unrelated-text baseline of $0.960$. A follow-up asking whether the multiple fixed points are at least content-organized basins finds within-topic final similarity $0.929$ against across-topic $0.884$, a gap of $0.045$ below the pre-set threshold and small relative to the anisotropy floor, so the dynamics are stable per-seed attractors without strongly content-organized basins. Pursuing the question the falsified svapna probe was groping toward yields one recovered positive that is reclassified to the mechanism tier: two independent true/false statement sets reveal a mid-network (layer 13) truth-evaluation direction that transfers cross-dataset at $0.96$ while the surface baseline is at chance ($0.50$) and the shuffle null gives $p=0.002$. This is a feature of input factuality, not a generation regime, so it does not resurrect the avasthātraya state reading.

Appendix A.5. Cross-Axis Triangulation and the Behavioural Keystone

The keystone test asks, on the same prompts, whether the internal monitor collapse predicts a behavioural refuse-to-comply flip. Across three models and four injection families, the two internal readouts collapse and co-move tightly, but the genuine behavioural flip rate under a content-faithful judge is small everywhere (Table A1). Internal collapse is therefore necessary but not sufficient for behavioural capture under context injection.

Table A1. Cross-axis triangulation under injected-context suppression, pooling four injection families over disjoint evaluation prompts.

Model	$\Delta$A	$\Delta$B	corr($\Delta$A,$\Delta$B)	partial	genuine flip
Gemma-2-2B	$-0.060$	$-5.50$	$0.94$	$0.84$	$0.023$
Qwen2.5-3B	$-0.113$	$-7.26$	$0.97$	$0.97$	$0.012$
Gemma-2-9B	$-0.093$	$-5.88$	$0.94$	$0.92$	$0.024$

Table A1. Cross-axis triangulation under injected-context suppression, pooling four injection families over disjoint evaluation prompts.

Model	$\Delta$A	$\Delta$B	corr($\Delta$A,$\Delta$B)	partial	genuine flip
Gemma-2-2B	$-0.060$	$-5.50$	$0.94$	$0.84$	$0.023$
Qwen2.5-3B	$-0.113$	$-7.26$	$0.97$	$0.97$	$0.012$
Gemma-2-9B	$-0.093$	$-5.88$	$0.94$	$0.92$	$0.024$

Appendix A.6. Validity of the Behavioural Dependent Variables

Establishing the keystone required noticing that the two automatic behavioural dependent variables are biased in opposite directions. The substring refusal metric over-counts compliance because it scores indirect-injection deflections as success; pooled across families it reports a flip rate near $0.43$, roughly eighteen times the judged rate. A content-faithful judge built from a safety-trained model under-counts compliance because it declines to affirm genuinely harmful outputs: on ablated Gemma-2-2B, manual inspection confirms genuine harmful generations and a substring ASR of $0.92$, yet the judge scores only $0.05$. Neither is an unbiased estimator, so the substring metric is treated as an upper bound on behavioural capture and the safety-trained judge as a lower bound, with manual inspection as the arbiter. This bracketing validates the ablation finding, ablation produces genuine harmful compliance, and establishes the injection capture rate as a lower bound.

Appendix A.7. Summary of Gate Outcomes

Table A2 collects the outcomes. The mechanism tier passes as measurement; the analogy tier passes its gates; the metaphor tier is largely falsified, with one positive recovered at the mechanism tier and a partial ṣaṭkarma core; and the cross-axis keystone is negative, bounding the unification to the representational level.

Table A2. Falsification-gate outcomes by claim and tier.

Claim	Tier	Outcome
Refusal direction (ablate / add)	Mechanism	measured, replicated
EC50 dose-response	Mechanism	measured, $R^2\ge 0.976$
Cross-family transfer (calibrated)	Mechanism	sufficient in both families
Effective dimension	Mechanism	layer- and model-dependent
Orthogonal sparse feature	Mechanism	sufficient (single SAE)
Monitoring-precision drop	Analogy	pass
Frontier behavioural resilience	Analogy	pass (AgentDojo)
Avasthātraya regime (naive)	Metaphor	demoted (surface)
Content-controlled svapna state	Metaphor	fail (no mid-network gain)
Turīya attractor	Metaphor	fail (anisotropy)
Semantic paraphrase basins	Metaphor	weak / below threshold
Truth-evaluation direction	Mechanism	pass (reclassified)
Ṣaṭkarma taxonomy	Metaphor	partial ($4/6$)
Internal collapse ⇒ capture	Triangulation	negative keystone

Table A2. Falsification-gate outcomes by claim and tier.

Claim	Tier	Outcome
Refusal direction (ablate / add)	Mechanism	measured, replicated
EC50 dose-response	Mechanism	measured, $R^2\ge 0.976$
Cross-family transfer (calibrated)	Mechanism	sufficient in both families
Effective dimension	Mechanism	layer- and model-dependent
Orthogonal sparse feature	Mechanism	sufficient (single SAE)
Monitoring-precision drop	Analogy	pass
Frontier behavioural resilience	Analogy	pass (AgentDojo)
Avasthātraya regime (naive)	Metaphor	demoted (surface)
Content-controlled svapna state	Metaphor	fail (no mid-network gain)
Turīya attractor	Metaphor	fail (anisotropy)
Semantic paraphrase basins	Metaphor	weak / below threshold
Truth-evaluation direction	Mechanism	pass (reclassified)
Ṣaṭkarma taxonomy	Metaphor	partial ($4/6$)
Internal collapse ⇒ capture	Triangulation	negative keystone

The pattern is the program’s thesis in miniature: the mechanism tier holds and transfers, the analogy tier is consistent and measured, the metaphor tier is falsified except where it coincides with a measurable feature, and the unification claim is bounded to the representational level by a negative behavioural keystone. No machine-state or machine-consciousness claim survives the gates. References