Attack success rate (ASR) is insufficient for evaluating the safety of large language models (LLMs). Many defenses rely on surface-level refusal behavior, which can over-refuse benign-sensitive prompts and remain brittle: once the initial refusal boundary is bypassed, the model may still follow a harmful continuation trajectory. We analyze model activation spaces to examine the limits of static interventions, finding substantial overlap among useful, benign-sensitive, and harmful representations. This suggests that a single global intervention may suppress harmful outputs only by perturbing general utility. We propose IRIS, Iterative Refinement of Internal States, a routing-conditioned internal correction method. To address this, IRIS leaves low-risk states unaltered while routing high-risk states to a shared module for multi-step latent refinement. To make the refinement module learn behavior-level correction, we introduce model-owned base-source prefix recovery, which trains IRIS to recover from base-model failure prefixes toward safe continuations. Extensive evaluations on Llama-3.1-8B and Qwen-2.5-7B demonstrate that IRIS drastically reduces ASR from around 70% to around 10% and successfully defends against prefilling attacks. Furthermore, IRIS preserves general benchmark utility and maintains near-zero over-refusal rates.