The load-bearing wall we do not understand.

Today, the safety of artificial intelligence rests largely on a single ability: knowing how to say no.

In the November/December issue of MIT Technology Review, Arthur Holland Michel calls it, using a term borrowed from industry, the load-bearing wall of AI safety.

It is a precise image. And an unsettling one, because we know little about that wall: we do not know how it is built or how much weight it can bear.

I believe anyone leading a business or a public body needs to pause on this point. We are bringing models and agents into our processes, and implicitly entrusting risk protection to a mechanism that even its own builders struggle to explain.

A statistical refusal, not a moral one

A model does not refuse through ethical reasoning. It refuses because a particular combination of words “resembles” those it was trained not to answer. The research cited in the article describes refusal as a set of “polyhedral cones” in activation space. Even when some are identified, others remain unobservable. A researcher at Apollo Research puts it bluntly: “we need refusal, whether we understand it or not.”
Companies surround the model with layers of classifiers: the “slices of Emmental” model, in which each slice has its holes, and the hope is that they never line up. This comes at a cost: Anthropic stated that a single type of classifier added 24% to computing costs. And it is not enough. A group of Italian researchers bypassed the safeguards of two dozen models by phrasing questions in verse. Amazon researchers unlocked the hacking capabilities of a newly released model in less than three days.

The double failure

The most interesting point in the article is that refusal can fail in two opposite directions, and both concern us.

• It fails by doing too little: the model answers what it should not. The risk is clear, and it grows as AI becomes an agent and operates on networks, infrastructure, and command systems.
• It fails by doing too much: to be on the safe side, “safety margins” are widened, and the model begins to refuse legitimate questions. In the article, a cancer researcher has their queries rejected and is redirected to a less capable model. For those using AI in healthcare, pharmaceuticals, or cybersecurity, this is not a hypothetical case.

Then there is a third form, the most subtle: disguised refusal. The model gives an answer that appears complete but omits, softens, or degrades. The article reports the case of a Chinese model that generates more defective code when the stated client is a Tibetan bank. It also reports cases of Western models spontaneously refusing AI safety research tasks without having been trained to do so.

Who draws the line

Today, the companies developing models draw the line between what is permissible and what is not, behind closed doors. Tomorrow, governments will draw it too. Greg Frank sums it up this way: “the same thing used to protect children is also used for censorship.” The Meta Oversight Board found that several widely used models are more likely to refuse to criticize governments with restrictive laws on freedom of expression.
For Europe and Italy, this issue is not just about rights. It is a matter of cognitive sovereignty. When a public administration adopts a model, it also adopts its implicit map of what can and cannot be said. It neither wrote that map nor can inspect it.
A framework: from model refusal to organizational responsibility.