Analysing the Safety Pitfalls of Steering Vectors
2026-03-25 • Cryptography and Security
Cryptography and SecurityComputation and Language
AI summaryⓘ
The authors studied a method called activation steering, which changes how large language models (LLMs) act without changing their internal settings. They focused on the safety risks of this method using a test called JailbreakBench. Their findings show that steering can make LLMs either more or less vulnerable to harmful instructions by up to about half, depending on how it's applied. This happens because the steering interacts with parts of the model linked to refusal behavior. Their work highlights a trade-off between controlling the model and keeping it safe.
Activation SteeringLarge Language ModelsContrastive Activation Addition (CAA)JailbreakBenchAttack Success RateRefusal BehaviorSteering VectorsModel SafetyControllabilitySafety Audit
Authors
Yuxiao Li, Alina Fastowski, Efstratios Zaradoukas, Bardh Prenkaj, Gjergji Kasneci
Abstract
Activation steering has emerged as a powerful tool to shape LLM behavior without the need for weight updates. While its inherent brittleness and unreliability are well-documented, its safety implications remain underexplored. In this work, we present a systematic safety audit of steering vectors obtained with Contrastive Activation Addition (CAA), a widely used steering approach, under a unified evaluation protocol. Using JailbreakBench as benchmark, we show that steering vectors consistently influence the success rate of jailbreak attacks, with stronger amplification under simple template-based attacks. Across LLM families and sizes, steering the model in specific directions can drastically increase (up to 57%) or decrease (up to 50%) its attack success rate (ASR), depending on the targeted behavior. We attribute this phenomenon to the overlap between the steering vectors and the latent directions of refusal behavior. Thus, we offer a traceable explanation for this discovery. Together, our findings reveal the previously unobserved origin of this safety gap in LLMs, highlighting a trade-off between controllability and safety.