Knowing without Acting: The Disentangled Geometry of Safety Mechanisms in Large Language Models

Safety alignment is often conceptualized as a monolithic process wherein harmfulness detection automatically triggers refusal. However, the persistence of jailbreak attacks suggests a fundamental mechanistic decoupling. We propose the $\underset{‾}{\mathbf{\text{D}}}$isentangled $\underset{‾}{\mathbf{\text{S}}}$afety $\underset{‾}{\mathbf{\text{H}}}$ypothesis $\mathbf{\text{(DSH)}}$, positing that safety computation operates on two distinct subspaces: a $\mathit{\text{Recognition}}\mathit{\text{Axis}}$ (${\mathbf{v}}_H$, Knowing'') and an \textit{Execution Axis} ($\mathbf{v}_R$, Acting’‘). Our geometric analysis reveals a universal Reflex-to-Dissociation'' evolution, where these signals transition from antagonistic entanglement in early layers to structural independence in deep layers. To validate this, we introduce \textit{Double-Difference Extraction} and \textit{Adaptive Causal Steering}. Using our curated \textsc{AmbiguityBench}, we demonstrate a causal double dissociation, effectively creating a state of Knowing without Acting.’’ Crucially, we leverage this disentanglement to propose the $\mathbf{\text{Refusal}}\mathbf{\text{Erasure}}\mathbf{\text{Attack}}\mathbf{\text{(REA)}}$, which achieves State-of-the-Art attack success rates by surgically lobotomizing the refusal mechanism. Furthermore, we uncover a critical architectural divergence, contrasting the $\mathit{\text{Explicit}}\mathit{\text{Semantic}}\mathit{\text{Control}}$ of Llama3.1 with the $\mathit{\text{Latent}}\mathit{\text{Distributed}}\mathit{\text{Control}}$ of Qwen2.5. The code and dataset are available at https://anonymous.4open.science/r/DSH.