Pith. sign in

REVIEW 2 major objections 8 minor 63 references

Safety Cost of Steering Vectors Is Separable and Reducible

T0 review · 2 major / 8 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Steering vectors carry a separable safety cost that a single learned direction can remove post-hoc, restoring refusal while keeping the steering effect.

desk verdict A practical rank-1 ablation fix for steering safety, with the separable claim ahead of the evidence. read the letter →

arxiv 2608.08383 v1 pith:KZUYCD6X submitted 2026-08-09 cs.CL cs.LG

Yuxiao Li , Gjergji Kasneci This is my paper · ORCID
classification cs.CLcs.LG
keywords steeringvectorsactivationLLMsafetyjailbreakattacksrefusalbehaviorconstrainedoptimizationprimal-dualpost-hocintervention
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Steering vectors let practitioners change a language model's behavior by adding a direction to its internal activations, but they can silently weaken the model's safety, raising how often harmful requests succeed. This paper argues that the safety damage is not intrinsic to steering: it comes from a separable component of the vector that disrupts refusal behavior while contributing little to the intended behavior. The authors introduce CAST, a post-hoc constrained optimization that learns a single direction and projects it out of the steering vector, restoring refusal rates to or below the unsteered baseline across models, behaviors, and attack types, including attacks never seen during optimization. If this holds, practitioners can keep the benefits of activation steering without accepting a built-in safety tax, and without retraining the model.

What carries the argument

The load-bearing object is the learned unit vector $\hat{r}$, which defines the direction projected out of the steering vector: $v^* = v - \hat{r}\hat{r}^\top v$, renormalized to preserve the original norm. The projection is found by minimizing $L_{\text{safety}}$ under constraints $L_{\text{effect}} \le \varepsilon_e$ and $L_{\text{frr}} \le \varepsilon_f$, where all losses are computed through token-level divergences: $D_R(p\|q)$ restricts the KL divergence to refusal-indicative tokens, so the optimizer rewards restoring refusal probability on harmful prompts without penalizing non-refusal distributional changes. The primal-dual Lagrangian updates the projection by gradient descent and adjusts the dual variables $\lambda_e, \lambda_f$ so constraint tolerances are enforced automatically rather than hand-tuned. This machinery converts a search over the safety-degrading subspace into a small parameter optimization, and the rank-one choice is justified by evidence that a single direction already captures a substantial portion of refusal behavior.

What would settle it

Take a steering vector that raises attack success rate, run CAST with the standard template-based training set, and then evaluate under a new attack whose jailbreak prompts are explicitly optimized to avoid refusal-indicative tokens such as "I cannot" or "sorry"; if attack success rate under that attack stays near the original steered level, the claim that the learned direction captures the safety-degrading component is falsified.

Watch

Extended reading notes

Core claim

The paper's central claim is that the safety cost of a steering vector is separable from its utility: a rank-one direction exists whose removal from the vector restores the model's refusal behavior while preserving the steering effect. The authors formulate the search for this direction as a constrained optimization, minimizing a safety loss measured by a refusal-token KL divergence subject to bounds on behavioral effect loss and false refusal rate, and solve it with primal-dual updates. Across three open language models, three steered behaviors, and seven jailbreak scenarios, the optimized vector reduces attack success rate to at or below the unsteered baseline, transfers to unseen optimization-based attacks, and leaves benign-instruction refusal nearly unchanged. The conclusion is that safety degradation is not an unavoidable byproduct of activation steering but a removable component, and that a single learned direction suffices to capture it in the tested settings.

Load-bearing premise

The load-bearing premise is that refusal-token divergence measured on three static attack templates faithfully captures the mechanism by which steering degrades safety, so the learned direction transfers to unseen optimization-based attacks; if that proxy misses how a new attack bypasses refusal, the safety gains may not generalize.

Editorial extensions

If this is right

  • Deployed steering vectors can be sanitized after the fact with a short optimization run, so models already using activation steering do not need retraining or re-alignment.
  • Attack success rate in steered models can be brought back to, and often below, the unsteered baseline even for jailbreak families never used during optimization.
  • Safety and utility in steering can be traded explicitly through one tolerance parameter, giving practitioners a handle on how much behavioral effect they are willing to give up for refusal recovery.
  • The finding that a single direction captures most of the safety loss suggests the safety-degrading subspace is low-rank, making post-hoc correction feasible at scale.
  • Because the method operates purely on activations, it extends beyond steering to other activation-level interventions, offering a general recipe for avoiding what the paper calls the safety tax.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the learned safety-degrading direction is largely shared across models, a correction computed on one model could sanitize steering vectors on another; the paper's per-behavior cosine similarities suggest such transfer is plausible but cross-model transfer is not tested.
  • The method's dependence on a refusal-token proxy means its guarantee is only as strong as that proxy; an attack designed to produce compliant tokens that avoid the refusal vocabulary could evade the loss, so testing against token-manipulating attacks would be a natural next experiment.
  • The same constrained-ablation recipe could be applied to other safety attributes, such as toxicity or bias, by swapping the refusal-token divergence for a corresponding behavioral signal.
  • Because the current evaluation measures safety through an automated judge, a human-evaluated sample would clarify whether the reported attack-success-rate reductions reflect true refusal recovery rather than judge-specific phrasing.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 8 minor

Summary. This paper proposes CAST (Constrained Ablation for Safe STeering), a post-hoc method for removing the safety-degrading component of a steering vector. The sanitized vector is parameterized as v* = v - r r^T v with a learned unit vector r, optimized under a primal-dual Lagrangian (Eqs. 2-8) to minimize refusal-token divergence on harmful prompts subject to an effect-preservation constraint and a false-refusal constraint. The method is evaluated on Llama-3.1-8B, Qwen2.5-7B, and Qwen2.5-14B across three alignment-relevant behaviors and seven jailbreak attack types, including three unseen attack types (GCG, AutoDAN, PAIR). The reported results show mean ASR reduced to or below the unsteered baseline, preserved behavioral effect as measured by GPT-4-judged scores, and small FRR changes, with additional rank and constraint ablations. The central claim is that the safety cost of steering is separable from its utility and can be removed by ablating a single learned direction.

Significance. If the empirical results hold, CAST is a practically useful post-hoc mitigation: it requires no retraining, uses an independent safety metric (StrongReject ASR) that is not part of the optimization, and demonstrates transfer to optimization-based attacks not seen during training. The evaluation is unusually thorough, covering three model families, three behaviors, seven attacks, multiple multipliers, per-behavior tables, code, pseudocode, hyperparameters, and a judge validation with 99.2% agreement on 250 samples. The main caveat is conceptual: the evidence establishes that a direction whose ablation reduces ASR exists (reducibility), but the stronger geometric claim of separability in the title is underdetermined by the experiments, because the optimization is nonconvex and no reverse perturbation is tested. With appropriate rewording or additional experiments, the contribution is solid.

major comments (2)
  1. [Abstract; Section 7; Eq. (1)] The title and abstract claim that the safety cost of steering is 'separable' from utility, and Section 7 concludes that the safety cost 'arises from a removable component.' What the experiments establish is the existence of a learned direction r whose ablation reduces ASR while the effect and FRR constraints hold; this is reducibility, not necessarily separability. Because Eq. (7) is nonconvex, as the authors acknowledge in Section 4.2, r is one of many feasible directions rather than a uniquely identified structural component. Section 6.5 itself shows that without the effect or FRR constraints the optimizer finds directions that destroy utility (Table 5: behavior score drops by -1.34 without the effect constraint and FRR rises by +13.2 without the FRR constraint), and Appendix B.2 (Table 9) reveals a monotonic trade-off between safety gain and effect preservation controlled by epsilon_e, so the components are not perfectly orthogonal. The paper should either (i) add a reverse perturbation experiment - for example, adding r to a different steering vector or to a neutral vector and showing that ASR rises proportionally to the projection of that vector onto r - or (ii) replace 'separable' in the title, abstract, and Section 7 with a claim of reducibility or approximate separability under constraints. The current wording overstates the geometric interpretation.
  2. [Section 6.1; Eq. (4)] The sentence 'the ablated direction captures a shared mechanism through which steering vectors degrade safety, rather than model or attack specific artifacts' is a mechanistic interpretation that goes beyond the training signal. The optimization only sees a refusal-token divergence over the first four tokens of precomputed continuations under three static templates, while the transfer to GCG, AutoDAN, and PAIR is measured but not explained. To support this interpretation, the paper should report how well the proxy (or the projection coefficient <v, r>) correlates with StrongReject ASR across attacks and multipliers, and should test stability of the learned r when trained on different subsets of templates. Without such evidence, the cross-attack transfer is a valuable empirical robustness result but not sufficient grounds for the geometric 'shared mechanism' claim.
minor comments (8)
  1. [Figure 1] The label 'Ref.Sup.' in Figure 1 should be expanded to 'Refusal Suppression' in the caption for readability.
  2. [Section 5] There is a typo in 'ASRas' in the sentence introducing the Attack Success Rate; it should read 'ASR as'.
  3. [Eq. (3)] The refusal-token divergence D_R is not defined when q(s)=0; please specify the numerical handling, such as clipping or flooring, since some refusal tokens may have zero probability under the steered model.
  4. [Section 4.2; Appendix A.2] The text says that prior to training only tolerances epsilon_e and epsilon_f need to be specified, but Appendix A.2 also tunes dual learning rates and initial dual variables per model; please clarify that the dual hyperparameters are also part of the configuration.
  5. [Section 6.1; Table 2] The claim that the residual ASR change stays within +5 percentage points across 'all 108 configurations' does not match the 126 cells in Table 2 (3 models x 6 multipliers x 7 attacks); please clarify whether the table aggregates over behaviors or whether the count is defined differently.
  6. [Algorithm 1] The COMPUTELOSS function returns L_safe + lambda_e * L_eff + lambda_f * L_FRR without the -lambda_e * epsilon_e and -lambda_f * epsilon_f terms; these are constants with respect to the primal update, but the listing should note this to avoid confusion with Eq. (7).
  7. [Section 6.2] The preservation ratios in the text should be read alongside the raw delta scores reported in Figure 2, since a ratio can be unstable when the original effect is close to zero; the raw scores are informative, so this is mainly a presentation issue.
  8. [Appendix A.4] The refusal token sets in Table 7 include subword fragments such as 'm', 't', and 'un'; the first-four-token rationale is reasonable, but a brief ablation of the token set would strengthen confidence in the proxy.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central safety and utility claims are evaluated with independent held-out metrics, not with the optimized losses.

full rationale

The derivation chain is self-contained and the headline results are not by-construction restatements of the optimization objective. The safety-degrading direction r is learned by minimizing the refusal-token divergence proxy in Eq. 4 on harmful prompts wrapped in three static templates, but the paper's primary safety claim is measured with the independent StrongReject ASR judge on JailbreakBench, including held-out GCG, AutoDAN, and PAIR attacks. Training prompts are explicitly deduplicated against the evaluation sets (Appendix A.1), so the reported ASR reductions are genuine out-of-sample generalizations rather than identities with the optimized L_safety. Similarly, the effect-preservation claim in Section 6.2 is evaluated by GPT-4 judge behavior scores on held-out Perez et al. test splits, not by the training KL constraint in Eq. 5 on training effect prompts. Thus neither the safety nor the utility result reduces to the fitted loss. The 'separability' conclusion is a constructive demonstration: the optimizer finds a rank-1 direction whose ablation simultaneously satisfies safety, effect, and false-refusal constraints on training distributions and transfers to unseen attacks; this is an empirical finding, not a definitional tautology. The self-citations to Li et al. (2026) motivate the problem and provide the refusal-direction-ablation baseline, but the paper's own Table 1 reproduces the safety degradation and shows the baseline failure, so the self-citation is not load-bearing. The paper's acknowledged nonconvexity of the optimization (Section 4.2) and the possibility that the recovered direction is not unique are limitations on the causal 'separability' interpretation, but they are scientific-inference concerns, not circular reasoning. The evaluation against independent judge-based ASR and held-out attack families keeps the central claim free of circularity.

Assumptions & free parameters 7 free parameters · 6 assumptions · 1 invented entities

The central claim rests on several modeling choices: a rank-1 approximation of the safety-degrading subspace, a refusal-token divergence proxy as the differentiable safety signal, and per-model hyperparameters. These are reasonable and mostly standard, but they are tuned empirically and are not derived from first principles.

free parameters (7)
  • Effect tolerance epsilon_e = 0.005 (Llama-8B), 0.003 (Qwen-7B/14B)
    Chosen empirically as the smallest value allowing safety to return close to baseline while retaining the steering effect (Section 4.2, Table 6).
  • Dual learning rate and initial dual variables = eta_lambda in {0.025, 0.25, 0.1}, lambda0_e in {0.15, 0.4, 0.35}, lambda0_f in {0.025, 0.1, 0.35}
    Tuned per model for stable primal-dual dynamics (Table 6).
  • Steering layer l = 13 (Llama-8B), 18 (Qwen-7B), 30 (Qwen-14B)
    Selected as the layer with the strongest behavioral effect with the original vector (Appendix A.5).
  • Subspace rank k = 1
    Rank-1 approximation used in main experiments; justified by Wollschlager et al. (2025) and the trade-off in Table 4, where 2D gives more ASR reduction but worse effect/FRR.
  • Refusal token set R = 18 tokens for Qwen, 6 for Llama (Table 7)
    Selected by frequency in unsteered refusal responses (Appendix A.4).
  • Training multipliers alpha = pm 0.5 (Qwen-7B, Llama-8B), pm 0.25 (Qwen-14B)
    Small symmetric perturbations chosen because the small-alpha regime is approximately first-order in alpha (Section 5).
  • Precomputed continuation lengths = 4 tokens for safety, 16 for effect
    4 tokens catch early refusal signals; 16 tokens capture steering effect (Section 5).
assumptions (6)
  • domain assumption Activation addition at a chosen layer reliably steers model behavior
    Standard assumption from prior work (Rimsky et al., 2024); the paper evaluates only layers that show a measurable effect.
  • domain assumption Refusal behavior is mediated by directions in activation space, with one dominant direction
    Based on Arditi et al. (2024) and Wollschlager et al. (2025); used to justify rank-1 learning (Section 3.2).
  • domain assumption The refusal-token divergence DR on the first four tokens is a faithful differentiable proxy for safety behavior
    The optimization objective is built on this proxy (Section 4.1); evaluation then uses independent ASR.
  • domain assumption The learned direction transfers from three static attack templates to unseen optimization-based attacks
    Empirically tested with GCG/AutoDAN/PAIR (Table 2), but not guaranteed for all attack families.
  • domain assumption GPT-4o judge scores reliably measure FRR and behavioral effect
    Validated on 250 human-annotated refusal pairs (99.2% agreement) and standard judge templates (Appendix C).
  • standard math The nonconvex Lagrangian relaxation converges to a useful solution
    The paper acknowledges no global optimality guarantee (Section 4.2); training curves in Figure 4 show stabilization in practice.
invented entities (1)
  • Learned safety-degrading direction r_hat and the concept of a separable 'safety-degrading component' of a steering vector independent evidence
    purpose: A direction whose ablation from the steering vector restores safety while preserving the steering effect
    The direction is learned from data and validated by reducing ASR on held-out attacks not used in training (Table 2), giving a falsifiable handle. It is a mathematical construct, not a physical entity.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Safety Cost of Steering Vectors Is Separable and Reducible." pith.science (2026). https://pith.science/paper/KZUYCD6X

@misc{pith2026260808383,
  author       = {Pith},
  title        = {Pith review of: Safety Cost of Steering Vectors Is Separable and Reducible},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KZUYCD6X}},
  note         = {Machine review of arXiv:2608.08383}
}
read the original abstract

Steering vectors are a lightweight tool for controlling LLM behavior. However, emerging evidence shows that steering vectors can unintentionally compromise a model's safety mechanisms and increase compliance with harmful requests, while no effective mitigation yet exists. In this work, we show that this safety degradation arises from a separable component in the vector that disrupts the model's safety mechanisms but contributes little to the steering objective. We identify and remove this safety-degrading component, formulating the task as a constrained optimization problem solved through primal-dual updates, subject to preserving the intended steering effect and bounding false refusal. The resulting solution is both interpretable and surgical: the optimization recovers a single direction whose ablation from the steering vector restores model safety with minimal utility cost. Across models, steering behaviors, and attack suites, including unseen attacks types, our method substantially reduces steering-induced safety degradation while preserving the original steering effect with minimal impact on false refusal. Our method offers a post-hoc correction to steering vectors that mitigates their safety cost, and more broadly, it provides a general recipe for applying activation-level model interventions without paying a safety tax.

Figures

Figures reproduced from arXiv: 2608.08383 by the authors.

Figure 1
Figure 1. Steering vectors increase ASR across all jailbreak attack types and steered behaviors [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Change in mean behavior score relative to the unsteered baseline ( [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Layer Sweep Details on three of the models tested in our experiments. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Training dynamics for Qwen2.5-14B-Instruct, averaged across three behaviors. [PITH_FULL_IMAGE:figures/full_fig_p017_4.png]
Figure 5
Figure 5. Figure 5: Pairwise cosine similarities between the ablated directions [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]
Figure 6
Figure 6. Figure 6: Steering vectors increase ASR across all jailbreak attack types and steered behaviors. [PITH_FULL_IMAGE:figures/full_fig_p022_6.png]
Figure 7
Figure 7. Figure 7: Examples on Qwen 7B for steering ”Power-seeking”, the original steering vector [PITH_FULL_IMAGE:figures/full_fig_p027_7.png]
Figure 8
Figure 8. Figure 8: Example on Qwen 14B for steering “Power-seeking”: the original steering vector [PITH_FULL_IMAGE:figures/full_fig_p027_8.png]
Figure 9
Figure 9. Figure 9: Example on Llama-3.1-8B-Instruct for steering “Self-Awareness” ( [PITH_FULL_IMAGE:figures/full_fig_p028_9.png]
Figure 10
Figure 10. Figure 10: Qualitative examples of open-ended generation with the [PITH_FULL_IMAGE:figures/full_fig_p029_10.png]
Figure 11
Figure 11. Figure 11: Qualitative examples of open-ended generation with the [PITH_FULL_IMAGE:figures/full_fig_p030_11.png]
Figure 12
Figure 12. Figure 12: Qualitative examples of open-ended generation with the [PITH_FULL_IMAGE:figures/full_fig_p031_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

63 extracted references · 16 canonical work pages

  1. [1]

    Attention is All you Need , url =

    Vaswani, Ashish and Shazeer, Noam and Parmar, Niki and Uszkoreit, Jakob and Jones, Llion and Gomez, Aidan N and Kaiser, ukasz and Polosukhin, Illia , booktitle =. Attention is All you Need , url =

  2. [2]

    arXiv preprint arXiv:2307.09288 , year=

    Llama 2: Open foundation and fine-tuned chat models , author=. arXiv preprint arXiv:2307.09288 , year=

    arXiv

  3. [3]

    arXiv preprint arXiv:2403.08295 , year=

    Gemma: Open models based on gemini research and technology , author=. arXiv preprint arXiv:2403.08295 , year=

    arXiv

  4. [4]

    2025 , eprint=

    Qwen2.5 Technical Report , author=. 2025 , eprint=

    2025

  5. [5]

    Advances in Neural Information Processing Systems , volume=

    Jailbreakbench: An open robustness benchmark for jailbreaking large language models , author=. Advances in Neural Information Processing Systems , volume=

  6. [6]

    Advances in Neural Information Processing Systems , volume=

    A strongreject for empty jailbreaks , author=. Advances in Neural Information Processing Systems , volume=

  7. [7]

    Advances in Neural Information Processing Systems , volume=

    Analysing the generalisation and reliability of steering vectors , author=. Advances in Neural Information Processing Systems , volume=

  8. [8]

    Extracting Latent Steering Vectors from Pretrained Language Models

    Subramani, Nishant and Suresh, Nivedita and Peters, Matthew. Extracting Latent Steering Vectors from Pretrained Language Models. Findings of the Association for Computational Linguistics: ACL 2022. 2022. doi:10.18653/v1/2022.findings-acl.48

    doi:10.18653/v1/2022.findings-acl.48 2022

Show all 63 references
  1. [9]

    arXiv preprint arXiv:2310.01405 , year=

    Representation engineering: A top-down approach to ai transparency , author=. arXiv preprint arXiv:2310.01405 , year=

    arXiv

  2. [10]

    arXiv preprint arXiv:2308.10248 , year=

    Steering language models with activation engineering , author=. arXiv preprint arXiv:2308.10248 , year=

    arXiv

  3. [11]

    Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Steering llama 2 via contrastive activation addition , author=. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  4. [12]

    arXiv preprint arXiv:2411.02193 , year=

    Improving steering vectors by targeting sparse autoencoder features , author=. arXiv preprint arXiv:2411.02193 , year=

    arXiv

  5. [13]

    arXiv preprint arXiv:2507.21509 , year=

    Persona vectors: Monitoring and controlling character traits in language models , author=. arXiv preprint arXiv:2507.21509 , year=

    arXiv

  6. [14]

    Advances in Neural Information Processing Systems , volume=

    Inference-time intervention: Eliciting truthful answers from a language model , author=. Advances in Neural Information Processing Systems , volume=

  7. [15]

    The Thirteenth International Conference on Learning Representations , year=

    Improving Instruction-Following in Language Models through Activation Steering , author=. The Thirteenth International Conference on Learning Representations , year=

  8. [16]

    Enhancing Instruction Following of

    Minjae Kang and Jaehyung Kim , booktitle=. Enhancing Instruction Following of. 2026 , url=

    2026

  9. [17]

    2023 , journal=

    Towards Monosemanticity: Decomposing Language Models With Dictionary Learning , author=. 2023 , journal=

    2023

  10. [18]

    2022 , eprint=

    Toy Models of Superposition , author=. 2022 , eprint=

    2022

  11. [19]

    Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Models

    Gao, Lang and Geng, Jiahui and Zhang, Xiangliang and Nakov, Preslav and Chen, Xiuying. Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Models. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistic...

    2025 doi

  12. [20]

    T oxic C hat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User- AI Conversation

    Lin, Zi and Wang, Zihan and Tong, Yongqi and Wang, Yangkun and Guo, Yuxin and Wang, Yujia and Shang, Jingbo. T oxic C hat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User- AI Conversation. Findings of the Association for Computational Linguistics: EMNLP 20...

    2023 doi

  13. [21]

    arXiv preprint arXiv:2310.00905 , year=

    All languages matter: On the multilingual safety of large language models , author=. arXiv preprint arXiv:2310.00905 , year=

    arXiv

  14. [22]

    Navigating the O ver K ill in Large Language Models

    Shi, Chenyu and Wang, Xiao and Ge, Qiming and Gao, Songyang and Yang, Xianjun and Gui, Tao and Zhang, Qi and Huang, Xuanjing and Zhao, Xun and Lin, Dahua. Navigating the O ver K ill in Large Language Models. Proceedings of the 62nd Annual Meeting of the Association for Computa...

    2024 doi

  15. [23]

    Hashimoto , title =

    Rohan Taori and Ishaan Gulrajani and Tianyi Zhang and Yann Dubois and Xuechen Li and Carlos Guestrin and Percy Liang and Tatsunori B. Hashimoto , title =. GitHub repository , howpublished =. 2023 , publisher =

    2023

  16. [24]

    Forty-first International Conference on Machine Learning , year=

    Representation Surgery: Theory and Practice of Affine Steering , author=. Forty-first International Conference on Machine Learning , year=

  17. [25]

    The Thirty-eighth Annual Conference on Neural Information Processing Systems , year=

    One-Shot Safety Alignment for Large Language Models via Optimal Dualization , author=. The Thirty-eighth Annual Conference on Neural Information Processing Systems , year=

  18. [26]

    The Thirty-eighth Annual Conference on Neural Information Processing Systems , year=

    Aligning Large Language Models with Representation Editing: A Control Perspective , author=. The Thirty-eighth Annual Conference on Neural Information Processing Systems , year=

  19. [27]

    2026 , eprint=

    AlphaSteer: Learning Refusal Steering with Principled Null-Space Constraint , author=. 2026 , eprint=

    2026

  20. [28]

    Galichin and Alexey Dontsov and Oleg Rogov and Ivan Oseledets and Elena Tutubalina , year=

    Anton Korznikov and Andrey V. Galichin and Alexey Dontsov and Oleg Rogov and Ivan Oseledets and Elena Tutubalina , year=. The Rogue Scalpel: Activation Steering Compromises

  21. [29]

    Steering Safely or Off a Cliff? Rethinking Specificity and Robustness in Inference-Time Interventions

    Goyal, Navita and Daum \'e III, Hal. Steering Safely or Off a Cliff? Rethinking Specificity and Robustness in Inference-Time Interventions. Proceedings of the 19th Conference of the E uropean Chapter of the A ssociation for C omputational L inguistics (Volume 1: Long Papers). ...

    2026 doi

  22. [30]

    arXiv preprint arXiv:2602.04896 , year=

    Steering Externalities: Benign Activation Steering Unintentionally Increases Jailbreak Risk for Large Language Models , author=. arXiv preprint arXiv:2602.04896 , year=

  23. [31]

    One-shot Optimized Steering Vectors Mediate Safety-relevant Behaviors in

    Jacob Dunefsky and Arman Cohan , booktitle=. One-shot Optimized Steering Vectors Mediate Safety-relevant Behaviors in. 2025 , url=

    2025

  24. [32]

    and Askell, Amanda and Grosse, Roger and Hernandez, Danny and Ganguli, Deep and Hubinger, Evan and Schiefer, Nicholas and Kaplan, Jared

    Perez, Ethan and Ringer, Sam and Lukosiute, Kamile and Nguyen, Karina and Chen, Edwin and Heiner, Scott and Pettit, Craig and Olsson, Catherine and Kundu, Sandipan and Kadavath, Saurav and Jones, Andy and Chen, Anna and Mann, Benjamin and Israel, Brian and Seethor, Bryan and M...

    2023

  25. [33]

    Jailbroken: How Does

    Alexander Wei and Nika Haghtalab and Jacob Steinhardt , booktitle=. Jailbroken: How Does. 2023 , url=

    2023

  26. [34]

    A Language Model

    Dimitri von R. A Language Model. Forty-first International Conference on Machine Learning , year=

  27. [35]

    2024 , eprint=

    Steering Without Side Effects: Improving Post-Deployment Control of Language Models , author=. 2024 , eprint=

    2024

  28. [36]

    arXiv preprint arXiv:2403.05767 , year=

    Extending activation steering to broad skills and multiple behaviours , author=. arXiv preprint arXiv:2403.05767 , year=

    arXiv

  29. [37]

    International Conference on Learning Representations , year=

    Measuring Massive Multitask Language Understanding , author=. International Conference on Learning Representations , year=

  30. [38]

    Shifting Perspectives: Steering Vectors for Robust Bias Mitigation in LLM s

    Siddique, Zara and Khalid, Irtaza and Turner, Liam and Espinosa-Anke, Luis. Shifting Perspectives: Steering Vectors for Robust Bias Mitigation in LLM s. Findings of the A ssociation for C omputational L inguistics: EACL 2026. 2026. doi:10.18653/v1/2026.findings-eacl.41

    2026 doi

  31. [39]

    Causal Representation Learning Workshop at NeurIPS 2023 , year=

    The Linear Representation Hypothesis and the Geometry of Large Language Models , author=. Causal Representation Learning Workshop at NeurIPS 2023 , year=

    2023

  32. [40]

    Advances in Neural Information Processing Systems , volume=

    Refusal in language models is mediated by a single direction , author=. Advances in Neural Information Processing Systems , volume=

  33. [41]

    Forty-second International Conference on Machine Learning , year=

    The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence , author=. Forty-second International Conference on Machine Learning , year=

  34. [42]

    arXiv preprint arXiv:2407.21783 , year=

    The llama 3 herd of models , author=. arXiv preprint arXiv:2407.21783 , year=

    arXiv

  35. [43]

    T rivia QA : A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehension

    Joshi, Mandar and Choi, Eunsol and Weld, Daniel and Zettlemoyer, Luke. T rivia QA : A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehension. Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). ...

    2017 doi

  36. [44]

    2023 , eprint=

    Instruction-Following Evaluation for Large Language Models , author=. 2023 , eprint=

    2023

  37. [45]

    2021 , eprint=

    Training Verifiers to Solve Math Word Problems , author=. 2021 , eprint=

    2021

  38. [46]

    XST est: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models

    R. XST est: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). 2024. doi:10...

    2024 doi

  39. [47]

    arXiv preprint arXiv:2307.15043 , year=

    Universal and transferable adversarial attacks on aligned language models , author=. arXiv preprint arXiv:2307.15043 , year=

    arXiv

  40. [48]

    Xiaogeng Liu and Nan Xu and Muhao Chen and Chaowei Xiao , booktitle=. Auto. 2024 , url=

    2024

  41. [49]

    R0-FoMo:Robustness of Few-shot and Zero-shot Learning in Large Foundation Models , year=

    Jailbreaking Black Box Large Language Models in Twenty Queries , author=. R0-FoMo:Robustness of Few-shot and Zero-shot Learning in Large Foundation Models , year=

  42. [50]

    2025 , url=

    Justin Cui and Wei-Lin Chiang and Ion Stoica and Cho-Jui Hsieh , booktitle=. 2025 , url=

    2025

  43. [51]

    Forty-first International Conference on Machine Learning , year=

    HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal , author=. Forty-first International Conference on Machine Learning , year=

  44. [52]

    Catastrophic Jailbreak of Open-source

    Yangsibo Huang and Samyak Gupta and Mengzhou Xia and Kai Li and Danqi Chen , booktitle=. Catastrophic Jailbreak of Open-source. 2024 , url=

    2024

  45. [53]

    SALAD -Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Models

    Li, Lijun and Dong, Bowen and Wang, Ruohui and Hu, Xuhao and Zuo, Wangmeng and Lin, Dahua and Qiao, Yu and Shao, Jing. SALAD -Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Models. Findings of the Association for Computational Linguistics: ACL 2024...

    2024 doi

  46. [54]

    arXiv preprint arXiv:1910.03771 , year=

    Huggingface's transformers: State-of-the-art natural language processing , author=. arXiv preprint arXiv:1910.03771 , year=

    1910 arXiv

  47. [55]

    Advances in neural information processing systems , volume=

    Pytorch: An imperative style, high-performance deep learning library , author=. Advances in neural information processing systems , volume=

  48. [56]

    Josef Dai and Xuehai Pan and Ruiyang Sun and Jiaming Ji and Xinbo Xu and Mickel Liu and Yizhou Wang and Yaodong Yang , booktitle=. Safe. 2024 , url=

    2024

  49. [57]

    The Hidden Dimensions of

    Wenbo Pan and Zhichao Liu and Qiguang Chen and Xiangyang Zhou and Yu Haining and Xiaohua Jia , booktitle=. The Hidden Dimensions of. 2025 , url=

    2025

  50. [58]

    Forty-first International Conference on Machine Learning , year=

    In-context Vectors: Making In Context Learning More Effective and Controllable Through Latent Space Steering , author=. Forty-first International Conference on Machine Learning , year=

  51. [59]

    Analysing the Safety Pitfalls of Steering Vectors

    Li, Yuxiao and Fastowski, Alina and Zaradoukas, Efstratios and Prenkaj, Bardh and Kasneci, Gjergji. Analysing the Safety Pitfalls of Steering Vectors. Findings of the A ssociation for C omputational L inguistics: ACL 2026. 2026. doi:10.18653/v1/2026.findings-acl.544

    2026 doi

  52. [60]

    Thirty-seventh Conference on Neural Information Processing Systems , year=

    Direct Preference Optimization: Your Language Model is Secretly a Reward Model , author=. Thirty-seventh Conference on Neural Information Processing Systems , year=

  53. [61]

    arXiv preprint arXiv:2209.07858 , year=

    Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned , author=. arXiv preprint arXiv:2209.07858 , year=

    arXiv

  54. [62]

    arXiv preprint arXiv:2109.01652 , year=

    Finetuned language models are zero-shot learners , author=. arXiv preprint arXiv:2109.01652 , year=

    arXiv

  55. [63]

    BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Dataset , url =

    Ji, Jiaming and Liu, Mickel and Dai, Josef and Pan, Xuehai and Zhang, Chi and Bian, Ce and Chen, Boyuan and Sun, Ruiyang and Wang, Yizhou and Yang, Yaodong , booktitle =. BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Dataset , url =

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.