{"id":"48d296f1-99a9-4e48-8fde-aa7091c76446","arxiv_id":"2608.08383","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"A constrained-optimization method (CAST) learns a single direction whose ablation from a steering vector restores LLM safety while preserving the steering effect and limiting false refusals.","lead":"This paper presents a method that removes the component of an LLM steering vector that weakens safety, keeping the intended behavior intact. It shows that a single learned direction carries most of the safety cost and that removing it restores refusal behavior across models and attack types.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Separability is inferred only from ablation: the learned direction is labeled 'safety-degrading' because removing it helps, but no reverse perturbation shows that this component actually causes the degradation.","rationale":"The reader's weakest assumption was the transfer of the refusal-token proxy to unseen optimization-based attacks and judge-measured ASR. That is a real empirical concern, and the paper's held-out attack results partially address it. The concern I identify is more central to the paper's strongest claim: the claim that the safety cost is 'separable' and arises from a well-defined component. The optimization defines a direction whose removal helps, but it does not demonstrate that this direction is causally responsible for the degradation. Without a reverse perturbation, the word 'separability' is a post-hoc label for a successful constrained optimization, not an established structural property. This does not invalidate the practical post-hoc correction, which is well supported by the ablation, transfer, and constraint checks, so I do not move the verdict. The reader's conditional verdict remains appropriate, and the reverse perturbation test would either strengthen the paper to a stronger accept or force a more cautious interpretation of the title claim.","tokens_in":31901,"tokens_out":15717,"duration_ms":160086,"concrete_test":"Reverse perturbation test: for each learned direction r and a set of held-out steering vectors u (e.g., the conciseness vector, a randomly constructed contrastive vector, or a zero vector), add the component r with a scaling matched to the original projection onto v, i.e., inject alpha * (r^T u) * r into the residual stream, and measure ASR under the same seven attack suites. If ASR does not increase relative to the unsteered baseline, then r is not causally safety-degrading and the separability claim fails; if ASR rises in a way consistent with the projection magnitude, the claim is supported. As a secondary check, run CAST with multiple random seeds and report the cosine similarity between the learned r vectors; high seed variance would further weaken the interpretation of a single recovered component.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that the safety cost of steering is separable: it arises from a component in the steering vector that can be removed without losing utility. In the method (Section 4.1), the unit vector r is learned by minimizing L_safety, which encourages stronger refusal on harmful prompts, and the paper concludes that r is 'the safety-degrading component' because removing r from v reduces ASR while preserving effect. This is an inference from one direction only: every learned r is by construction a direction whose ablation improves safety under the proxy. Nothing in the experiments shows that adding r back to a different steering vector, or to a neutral vector, reproduces the safety degradation, nor that the projection of v onto r quantitatively accounts for the observed ASR increase. The optimization is also explicitly nonconvex (Section 4.2), so the recovered r may be one of many directions that satisfy the constraints, not a unique structural component. If r is merely a generic refusal-strengthening direction that the safety loss exploits, then the paper establishes reducibility but not the stronger separability claim stated in the title and Section 7. The method can still be practically useful, but the geometric interpretation would be unsupported.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes CAST (Constrained Ablation for Safe STeering), a post-hoc method for removing the safety-degrading component of a steering vector. The sanitized vector is parameterized as v* = v - r r^T v with a learned unit vector r, optimized under a primal-dual Lagrangian (Eqs. 2-8) to minimize refusal-token divergence on harmful prompts subject to an effect-preservation constraint and a false-refusal constraint. The method is evaluated on Llama-3.1-8B, Qwen2.5-7B, and Qwen2.5-14B across three alignment-relevant behaviors and seven jailbreak attack types, including three unseen attack types (GCG, AutoDAN, PAIR). The reported results show mean ASR reduced to or below the unsteered baseline, preserved behavioral effect as measured by GPT-4-judged scores, and small FRR changes, with additional rank and constraint ablations. The central claim is that the safety cost of steering is separable from its utility and can be removed by ablating a single learned direction.","tokens_in":32177,"tokens_out":12565,"duration_ms":132550,"significance":"If the empirical results hold, CAST is a practically useful post-hoc mitigation: it requires no retraining, uses an independent safety metric (StrongReject ASR) that is not part of the optimization, and demonstrates transfer to optimization-based attacks not seen during training. The evaluation is unusually thorough, covering three model families, three behaviors, seven attacks, multiple multipliers, per-behavior tables, code, pseudocode, hyperparameters, and a judge validation with 99.2% agreement on 250 samples. The main caveat is conceptual: the evidence establishes that a direction whose ablation reduces ASR exists (reducibility), but the stronger geometric claim of separability in the title is underdetermined by the experiments, because the optimization is nonconvex and no reverse perturbation is tested. With appropriate rewording or additional experiments, the contribution is solid.","major_comments":[{"comment":"The title and abstract claim that the safety cost of steering is 'separable' from utility, and Section 7 concludes that the safety cost 'arises from a removable component.' What the experiments establish is the existence of a learned direction r whose ablation reduces ASR while the effect and FRR constraints hold; this is reducibility, not necessarily separability. Because Eq. (7) is nonconvex, as the authors acknowledge in Section 4.2, r is one of many feasible directions rather than a uniquely identified structural component. Section 6.5 itself shows that without the effect or FRR constraints the optimizer finds directions that destroy utility (Table 5: behavior score drops by -1.34 without the effect constraint and FRR rises by +13.2 without the FRR constraint), and Appendix B.2 (Table 9) reveals a monotonic trade-off between safety gain and effect preservation controlled by epsilon_e, so the components are not perfectly orthogonal. The paper should either (i) add a reverse perturbation experiment - for example, adding r to a different steering vector or to a neutral vector and showing that ASR rises proportionally to the projection of that vector onto r - or (ii) replace 'separable' in the title, abstract, and Section 7 with a claim of reducibility or approximate separability under constraints. The current wording overstates the geometric interpretation.","section":"Abstract; Section 7; Eq. (1)"},{"comment":"The sentence 'the ablated direction captures a shared mechanism through which steering vectors degrade safety, rather than model or attack specific artifacts' is a mechanistic interpretation that goes beyond the training signal. The optimization only sees a refusal-token divergence over the first four tokens of precomputed continuations under three static templates, while the transfer to GCG, AutoDAN, and PAIR is measured but not explained. To support this interpretation, the paper should report how well the proxy (or the projection coefficient <v, r>) correlates with StrongReject ASR across attacks and multipliers, and should test stability of the learned r when trained on different subsets of templates. Without such evidence, the cross-attack transfer is a valuable empirical robustness result but not sufficient grounds for the geometric 'shared mechanism' claim.","section":"Section 6.1; Eq. (4)"}],"minor_comments":[{"comment":"The label 'Ref.Sup.' in Figure 1 should be expanded to 'Refusal Suppression' in the caption for readability.","section":"Figure 1"},{"comment":"There is a typo in 'ASRas' in the sentence introducing the Attack Success Rate; it should read 'ASR as'.","section":"Section 5"},{"comment":"The refusal-token divergence D_R is not defined when q(s)=0; please specify the numerical handling, such as clipping or flooring, since some refusal tokens may have zero probability under the steered model.","section":"Eq. (3)"},{"comment":"The text says that prior to training only tolerances epsilon_e and epsilon_f need to be specified, but Appendix A.2 also tunes dual learning rates and initial dual variables per model; please clarify that the dual hyperparameters are also part of the configuration.","section":"Section 4.2; Appendix A.2"},{"comment":"The claim that the residual ASR change stays within +5 percentage points across 'all 108 configurations' does not match the 126 cells in Table 2 (3 models x 6 multipliers x 7 attacks); please clarify whether the table aggregates over behaviors or whether the count is defined differently.","section":"Section 6.1; Table 2"},{"comment":"The COMPUTELOSS function returns L_safe + lambda_e * L_eff + lambda_f * L_FRR without the -lambda_e * epsilon_e and -lambda_f * epsilon_f terms; these are constants with respect to the primal update, but the listing should note this to avoid confusion with Eq. (7).","section":"Algorithm 1"},{"comment":"The preservation ratios in the text should be read alongside the raw delta scores reported in Figure 2, since a ratio can be unstable when the original effect is close to zero; the raw scores are informative, so this is mainly a presentation issue.","section":"Section 6.2"},{"comment":"The refusal token sets in Table 7 include subword fragments such as 'm', 't', and 'un'; the first-four-token rationale is reasonable, but a brief ablation of the token set would strengthen confidence in the proxy.","section":"Appendix A.4"}],"recommendation":"major_revision","confidential_remarks":"The empirical core is sound and the evaluation is unusually thorough; the main risk is the gap between the title's 'separable' and the evidence for 'reducible'. This can be fixed either by adding a reverse-perturbation experiment or by softening the claims, so I recommend major revision rather than rejection. I do not share the circularity concern: the StrongReject ASR metric is independent of the optimization objective. No concerns about citation practice or scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"CAST is a genuinely useful post-hoc correction: learn a single direction, subtract its projection from a steering vector, and you recover most of the safety lost to steering without losing the intended behavior. The experiments are solid—three model families, seven attack types including held-out GCG/AutoDAN/PAIR, StrongReject ASR as an independent metric, and effect/FRR checks. Code is released. That is real evidence and practitioners should care.\n\nWhat is actually new is the primal-dual constrained formulation for the ablation direction, plus the empirical finding that a rank-1 correction beats ablating the canonical refusal direction. The transfer to unseen attacks and the cross-behavior cosine similarities in Figure 5 are the strongest parts. The ablations in Table 5 show the FRR and effect constraints are doing real work, not decoration. The related work is properly grounded in Arditi, Wollschläger, Li et al.; no citation red flags.\n\nThe soft spot is the title. The paper shows reducibility, not separability. The learned direction is defined by the fact that removing it helps; nothing in the paper adds it back to a neutral or unrelated vector to show it reproduces the safety degradation, and the optimization is nonconvex, so the recovered r is not unique. The phrase \"safety cost is separable from its utility\" is an interpretation, not a demonstrated geometry. The rank-1 choice is also a trade-off (Table 4), not a proven property. These are framing-level overclaims, not flaws in the method. The safety proxy—refusal-token divergence over four precomputed tokens—is intentionally narrow and the paper is honest about that; the independent ASR evaluation is what keeps the headline result from being circular.\n\nI would send this to reviewers. The practical claim is strong enough to warrant refereeing, and the structural claim needs to be softened or tested with a reverse perturbation experiment. The right reviewer will push on exactly that distinction.","headline":"A practical rank-1 ablation fix for steering safety, with the separable claim ahead of the evidence.","tokens_in":32692,"tokens_out":2618,"would_cite":true,"duration_ms":30195,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Steering vectors carry a separable safety cost that a single learned direction can remove post-hoc, restoring refusal while keeping the steering effect.","keywords":["steering vectors","activation steering","LLM safety","jailbreak attacks","refusal behavior","constrained optimization","primal-dual","post-hoc intervention"],"falsifier":"Take a steering vector that raises attack success rate, run CAST with the standard template-based training set, and then evaluate under a new attack whose jailbreak prompts are explicitly optimized to avoid refusal-indicative tokens such as \"I cannot\" or \"sorry\"; if attack success rate under that attack stays near the original steered level, the claim that the learned direction captures the safety-degrading component is falsified.","tokens_in":31692,"feed_emoji":"🛡️","tokens_out":6902,"duration_ms":62964,"temperature":0.7,"pith_summary":"Steering vectors let practitioners change a language model's behavior by adding a direction to its internal activations, but they can silently weaken the model's safety, raising how often harmful requests succeed. This paper argues that the safety damage is not intrinsic to steering: it comes from a separable component of the vector that disrupts refusal behavior while contributing little to the intended behavior. The authors introduce CAST, a post-hoc constrained optimization that learns a single direction and projects it out of the steering vector, restoring refusal rates to or below the unsteered baseline across models, behaviors, and attack types, including attacks never seen during optimization. If this holds, practitioners can keep the benefits of activation steering without accepting a built-in safety tax, and without retraining the model.","feed_headline":"One learned direction removes the safety cost of steering vectors","feed_subtitle":"Post-hoc ablation restores refusal under unseen jailbreaks while keeping steering effect and benign compliance","key_machinery":"The load-bearing object is the learned unit vector $\\hat{r}$, which defines the direction projected out of the steering vector: $v^* = v - \\hat{r}\\hat{r}^\\top v$, renormalized to preserve the original norm. The projection is found by minimizing $L_{\\text{safety}}$ under constraints $L_{\\text{effect}} \\le \\varepsilon_e$ and $L_{\\text{frr}} \\le \\varepsilon_f$, where all losses are computed through token-level divergences: $D_R(p\\|q)$ restricts the KL divergence to refusal-indicative tokens, so the optimizer rewards restoring refusal probability on harmful prompts without penalizing non-refusal distributional changes. The primal-dual Lagrangian updates the projection by gradient descent and adjusts the dual variables $\\lambda_e, \\lambda_f$ so constraint tolerances are enforced automatically rather than hand-tuned. This machinery converts a search over the safety-degrading subspace into a small parameter optimization, and the rank-one choice is justified by evidence that a single direction already captures a substantial portion of refusal behavior.","core_discovery":"The paper's central claim is that the safety cost of a steering vector is separable from its utility: a rank-one direction exists whose removal from the vector restores the model's refusal behavior while preserving the steering effect. The authors formulate the search for this direction as a constrained optimization, minimizing a safety loss measured by a refusal-token KL divergence subject to bounds on behavioral effect loss and false refusal rate, and solve it with primal-dual updates. Across three open language models, three steered behaviors, and seven jailbreak scenarios, the optimized vector reduces attack success rate to at or below the unsteered baseline, transfers to unseen optimization-based attacks, and leaves benign-instruction refusal nearly unchanged. The conclusion is that safety degradation is not an unavoidable byproduct of activation steering but a removable component, and that a single learned direction suffices to capture it in the tested settings.","pith_inferences":["If the learned safety-degrading direction is largely shared across models, a correction computed on one model could sanitize steering vectors on another; the paper's per-behavior cosine similarities suggest such transfer is plausible but cross-model transfer is not tested.","The method's dependence on a refusal-token proxy means its guarantee is only as strong as that proxy; an attack designed to produce compliant tokens that avoid the refusal vocabulary could evade the loss, so testing against token-manipulating attacks would be a natural next experiment.","The same constrained-ablation recipe could be applied to other safety attributes, such as toxicity or bias, by swapping the refusal-token divergence for a corresponding behavioral signal.","Because the current evaluation measures safety through an automated judge, a human-evaluated sample would clarify whether the reported attack-success-rate reductions reflect true refusal recovery rather than judge-specific phrasing."],"forward_implications":["Deployed steering vectors can be sanitized after the fact with a short optimization run, so models already using activation steering do not need retraining or re-alignment.","Attack success rate in steered models can be brought back to, and often below, the unsteered baseline even for jailbreak families never used during optimization.","Safety and utility in steering can be traded explicitly through one tolerance parameter, giving practitioners a handle on how much behavioral effect they are willing to give up for refusal recovery.","The finding that a single direction captures most of the safety loss suggests the safety-degrading subspace is low-rank, making post-hoc correction feasible at scale.","Because the method operates purely on activations, it extends beyond steering to other activation-level interventions, offering a general recipe for avoiding what the paper calls the safety tax."],"supporting_citations":[{"why":"Documents that steering vectors degrade safety and that cosine similarity with the refusal direction predicts the degree of degradation; supplies the problem and the naive baseline that CAST must beat.","marker":"Li et al., 2026"},{"why":"Shows refusal is mediated by a single activation direction; motivates both the refusal-direction-ablation baseline and the rank-one projection ansatz.","marker":"Arditi et al., 2024"},{"why":"Finds multiple orthogonal refusal directions and shows higher-dimensional spaces do not improve refusal classification; grounds the paper's choice of rank-one ablation and its higher-rank comparison.","marker":"Wollschl¨ager et al., 2025"},{"why":"Provides contrastive activation addition, the construction of steering vectors, and the behavioral scoring protocol used for effect evaluation.","marker":"Rimsky et al., 2024"},{"why":"Supplies the three static attack templates used to build the harmful-prompt training distribution.","marker":"Wei et al., 2023"},{"why":"Introduces GCG, one of the unseen optimization-based attack suites used to test generalization.","marker":"Zou et al., 2023b"},{"why":"Introduces PAIR, another unseen adaptive attack used to test generalization beyond the training attacks.","marker":"Chao et al., 2023"},{"why":"Provides the StrongReject judge that computes the attack success rate metric throughout the evaluation.","marker":"Souly et al., 2024"}],"fun_headline_variants":["One direction strips safety cost from steering vectors","Separable safety cost in steering: one removal fixes it","One learned direction: safety cost gone from steering","Ablate one direction, keep steering, restore safety"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that refusal-token divergence measured on three static attack templates faithfully captures the mechanism by which steering degrades safety, so the learned direction transfers to unseen optimization-based attacks; if that proxy misses how a new attack bypasses refusal, the safety gains may not generalize.","fun_headline_variants_meta":{"raw":{"variants":["One direction strips safety cost from steering vectors","Separable safety cost in steering: one removal fixes it","One learned direction: safety cost gone from steering","Ablate one direction, keep steering, restore safety"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000439,"raw_usage":{"total_tokens":2208,"prompt_tokens":902,"completion_tokens":1306,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":518,"completion_tokens_details":{"reasoning_tokens":1244}},"tokens_in":518,"tokens_out":1306,"duration_ms":9047,"temperature":1.0,"reasoning_tokens":1244,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T04:37:12.725343+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a steering vector that raises attack success rate, run CAST with the standard template-based training set, and then evaluate under a new attack whose jailbreak prompts are explicitly optimized to avoid refusal-indicative tokens such as \"I cannot\" or \"sorry\"; if attack success rate under that attack stays near the original steered level, the claim that the learned direction captures the safety-degrading component is falsified.","supporting_citations":[],"review_version":1}