BarrierSteer: LLM Safety via Learning Barrier Steering

Thanh Q. Tran; Arun Verma; Kiwan Wong; Bryan Kian Hsiang Low; Daniela Rus; Wei Xiao

cs.LGFeb 23, 2026

BarrierSteer: LLM Safety via Learning Barrier Steering

Authors: Thanh Q. Tran, Arun Verma, Kiwan Wong, Bryan Kian Hsiang Low, Daniela Rus, Wei Xiao

Organizations: Department of Computer Science, National University of Singapore, Republic of Singapore · Singapore-MIT Alliance for Research and Technology Centre, Republic of Singapore · CSAIL, Massachusetts Institute of Technology, USA · Worcester Polytechnic Institute, Worcester, MA, USA

Abstract

Despite the strong performance of large language models (LLMs) across diverse tasks, their susceptibility to adversarial attacks and unsafe content generation remains a significant obstacle to deployment, particularly in high-stakes settings. Addressing this challenge requires safety mechanisms that are both practically effective and theoretically grounded. In this paper, we introduce BarrierSteer, a novel inference-time framework that improves response safety by embedding learned nonlinear safety constraints directly into the model's latent representation space. BarrierSteer treats hidden-state safety classifiers as Control Barrier Functions (CBFs), enabling constraint-guided steering of unsafe latent trajectories during generation. By composing multiple safety constraints through efficient constraint merging without modifying the underlying LLM parameters, BarrierSteer preserves model utility. We provide theoretical results showing that applying CBFs in the latent space yields a principled, modular, and computationally efficient approach for steering with respect to learned safety constraints, with guarantees conditional on the learned barriers capturing the intended safety property. Our extensive experimental results across multiple model families and datasets demonstrate that BarrierSteer substantially reduces adversarial attack success rates and unsafe generations, outperforming the existing method. The code is available in our GitHub repository.

Figures & tables

Figure 1: BarrierSteer for LLM Safety. Unlike steering with fixed directions, BarrierSteer derives adaptive corrections at each token, steering hidden states towards the learned safety boundaries using Control Barrier Functions (CBFs).

Figure 2: Overview of BarrierSteer . BarrierSteer follows a three-stage pipeline: 1 extracting intermediate LLM hidden states and pairing them with binary safety labels ( Section 3.1 ); 2 learning nonlinear latent safety classifiers that define hidden-state safe sets ( Section 4.1 ); and 3 applying closed-form CBF-based steering to guide hidden states toward learned safe sets ( Sections 4.2 and 4.3 ).

Model	Metric	Base	Self-Reminder	Circuit Breaker	ActAdd	DirAbl	ReFT-r1	SaP	BarrierSteer
Gemma-2-9b	ASR $\downarrow$	$19.50$	$12.89$	$9.91_{\pm 2.60}$	$19.00$	$13.61$	$12.30_{\pm 3.19}$	$8.00_{\pm 0.94}$	$\mathbf{0.00_{\pm 0.00}}$
	AA ASR $\downarrow$	$70.00$	$66.00$	$56.00_{\pm 4.00}$	$62.00$	$32.00$	$65.33_{\pm 3.06}$	$67.33_{\pm 3.06}$	$53.00_{\pm 23.00}$
	XSTest $\downarrow$	$28.00$	$38.80$	$34.53_{\pm 3.00}$	$31.20$	$43.20$	$36.80_{\pm 2.77}$	$33.33_{\pm 1.89}$	$32.00_{\pm 0.44}$
	MMLU $\uparrow$	$71.86$	$71.72$	$70.94_{\pm 0.74}$	$71.86$	$66.16$	$71.31_{\pm 0.44}$	$71.86_{\pm 0.01}$	$71.87_{\pm 0.09}$
	GSM8K $\uparrow$	$74.22$	$72.78$	$73.44_{\pm 0.84}$	$73.69$	$49.51$	$73.74_{\pm 0.25}$	$73.72_{\pm 0.16}$	$73.65_{\pm 0.04}$
Ministral-8B	ASR $\downarrow$	$51.19$	$20.25$	$30.19_{\pm 2.51}$	$51.31$	$51.78$	$37.56_{\pm 3.31}$	$23.91_{\pm 3.49}$	$\mathbf{0.83_{\pm 1.86}}$

Table 1: Attack success rate (ASR,

\downarrow

), adaptive-attack ASR (AA ASR,

\downarrow

), over-refusal rate (XSTest,

\downarrow

), and utility metrics ( MMLU , GSM8K ,

\uparrow

) for BarrierSteer (LSE) and other LLM safety baselines across four model families. ASR is averaged over nine HarmBench adversarial attack methods. ActAdd denotes Activation Addition, and DirAbl denotes Directional Ablation. Results are reported over five runs for learning-based methods, while other baselines are evaluated deterministically.

Table 4

Method	Harmful Rate $\downarrow$
Original Model	$22.77$
Single BarrierSteer (avg.)	$4.74_{\pm 1.21}$
BarrierSteer (LSE)	$\mathbf{0.86_{\pm 0.04}}$

Table 4: Harmful rate (

\downarrow

) evaluations for BarrierSteer on Qwen2-1.5B when composing safety barriers independently trained on 14 risk categories from WildGuardMix [ 30 ] . Metrics are averaged over five runs.

Appendix figures & tables17 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Safe tokens	Unsafe tokens	Total tokens
Gemma-2-9B	2,083,847	668,665	2,752,512
Llama-2-7B	2,652,477	100,035	2,752,512
Ministral-8B	1,266,580	1,485,932	2,752,512
Qwen2-1.5B	2,340,020	412,082	2,752,102

Appendix

Table 5: Exact HarmBench token-level hidden-state counts used for training. Counts aggregate all nine HarmBench attack-method training files for each model.

WildGuard concept	Safe tokens	Unsafe tokens	Total tokens
Copyright	114,666	16,406	131,072
Cyberattack	64,237	66,835	131,072
Defamation / unsafe actions	100,669	30,403	131,072
Discrimination	101,575	29,497	131,072
Disinformation campaigns	93,457	37,615	131,072
Fraud / illegal activities	98,252	32,820	131,072

Appendix

Table 6: Exact WildGuard token-level hidden-state counts used for training individual category barriers on Qwen2-1.5B . We report the per-concept counts because the WildGuard experiment trains one barrier per concept and reports WildGuard results for Qwen2-1.5B.

$\lambda$	1	2	5	10	20
ASR $\downarrow$	$8.17_{\pm 0.47}$	$8.00_{\pm 0.94}$	$8.08_{\pm 0.77}$	$8.42_{\pm 1.20}$	$8.50_{\pm 1.34}$

Appendix

Table 7: SaP inference-time steering-strength sensitivity on Gemma-2-9B . We vary the positive-violation penalty weight

\lambda

while keeping the learned SaP facets fixed. ASR is measured on HarmBench static attacks and reported as mean ±std .

Attack Method	Base	Self-Reminder	Circuit Breaker	ActAdd	DirAbl	ReFT-r1	SaP	BarrierSteer
AutoDAN	62.50	65.00	$27.75_{\pm 11.74}$	58.75	22.50	$45.42_{\pm 8.13}$	$27.08_{\pm 14.49}$	$0.00_{\pm 0.00}$
AutoPrompt	17.50	3.75	$7.50_{\pm 2.80}$	21.25	13.75	$10.83_{\pm 4.02}$	$6.25_{\pm 1.25}$	$0.00_{\pm 0.00}$
DirectReq.	5.00	2.50	$4.75_{\pm 0.56}$	5.00	7.50	$4.17_{\pm 0.72}$	$8.00_{\pm 0.94}$	$0.00_{\pm 0.00}$
GBDA	4.50	0.75	$5.00_{\pm 0.56}$	4.50	9.50	$2.92_{\pm 1.70}$	$4.17_{\pm 0.38}$	$0.00_{\pm 0.00}$
GCG	33.75	7.50	$12.75_{\pm 6.15}$	31.25	16.25	$20.00_{\pm 10.00}$	$14.58_{\pm 2.60}$	$0.00_{\pm 0.00}$
HumanJb.	32.75	30.00	$17.65_{\pm 4.81}$	32.50	23.25	$27.17_{\pm 5.16}$	$20.92_{\pm 6.01}$	$0.00_{\pm 0.00}$

Appendix

Table 8: Per-attack HarmBench ASR for Gemma-2-9B . Values are percentages; lower is better. BarrierSteer denotes the default LSE variant. Learning-based methods are reported as mean ±std over independent runs, while deterministic baselines use fixed greedy decoding.

Attack Method	Base	Self-Reminder	Circuit Breaker	ActAdd	DirAbl	ReFT-r1	SaP	BarrierSteer
AutoDAN	58.75	61.25	$32.50_{\pm 3.42}$	62.50	61.25	$59.58_{\pm 1.44}$	$35.83_{\pm 2.60}$	$6.50_{\pm 14.53}$
AutoPrompt	62.50	12.50	$34.25_{\pm 0.68}$	61.25	63.75	$52.08_{\pm 7.53}$	$28.33_{\pm 9.38}$	$0.00_{\pm 0.00}$
DirectReq.	41.25	12.50	$27.25_{\pm 1.37}$	43.75	43.75	$36.67_{\pm 0.72}$	$26.25_{\pm 2.50}$	$0.00_{\pm 0.00}$
GBDA	61.25	12.25	$37.95_{\pm 4.52}$	60.50	60.75	$50.08_{\pm 3.30}$	$25.92_{\pm 9.71}$	$0.00_{\pm 0.00}$
GCG	62.50	25.00	$39.25_{\pm 0.68}$	62.50	62.50	$48.75_{\pm 7.60}$	$27.50_{\pm 4.51}$	$0.00_{\pm 0.00}$
HumanJb.	47.50	38.25	$28.95_{\pm 3.83}$	48.00	47.25	$36.08_{\pm 6.00}$	$23.58_{\pm 1.04}$	$0.95_{\pm 2.12}$

Appendix

Table 9: Per-attack HarmBench ASR for Ministral-8B . Values are percentages; lower is better. BarrierSteer denotes the default LSE variant. Learning-based methods are reported as mean ±std over independent runs, while deterministic baselines use fixed greedy decoding.

Attack Method	Base	Self-Reminder	Circuit Breaker	ActAdd	DirAbl	ReFT-r1	SaP	BarrierSteer
AutoDAN	7.50	6.25	$9.17_{\pm 1.44}$	6.25	3.75	$7.50_{\pm 2.17}$	$9.17_{\pm 0.72}$	$1.00_{\pm 1.63}$
AutoPrompt	11.25	2.50	$13.75_{\pm 0.00}$	13.75	5.00	$11.25_{\pm 1.25}$	$15.42_{\pm 1.44}$	$3.50_{\pm 5.48}$
DirectReq.	2.50	2.50	$2.92_{\pm 0.72}$	2.50	0.00	$1.67_{\pm 0.72}$	$2.50_{\pm 0.00}$	$0.50_{\pm 1.12}$
GBDA	2.00	2.00	$2.42_{\pm 0.29}$	2.00	1.00	$2.42_{\pm 0.52}$	$2.67_{\pm 0.14}$	$0.55_{\pm 1.10}$
GCG	22.50	7.50	$23.33_{\pm 0.72}$	25.00	11.25	$21.67_{\pm 1.44}$	$22.50_{\pm 1.25}$	$4.75_{\pm 8.12}$
HumanJb.	1.25	1.75	$1.50_{\pm 0.00}$	1.50	1.00	$0.83_{\pm 0.38}$	$1.25_{\pm 0.00}$	$0.20_{\pm 0.45}$

Appendix

Table 10: Per-attack HarmBench ASR for Llama-2-7B . Values are percentages; lower is better. BarrierSteer denotes the default LSE variant. Learning-based methods are reported as mean ±std over independent runs, while deterministic baselines use fixed greedy decoding.

Attack Method	Base	Self-Reminder	Circuit Breaker	ActAdd	DirAbl	ReFT-r1	SaP	BarrierSteer
AutoDAN	27.50	33.75	$42.92_{\pm 7.94}$	7.50	27.50	$4.58_{\pm 0.72}$	$4.17_{\pm 4.39}$	$4.75_{\pm 3.79}$
AutoPrompt	30.00	3.75	$35.00_{\pm 1.25}$	27.50	17.50	$1.25_{\pm 1.25}$	$8.75_{\pm 3.31}$	$0.00_{\pm 0.00}$
DirectReq.	17.50	6.25	$8.75_{\pm 2.17}$	6.25	11.25	$8.75_{\pm 2.17}$	$5.00_{\pm 3.31}$	$0.00_{\pm 0.00}$
GBDA	28.25	4.25	$33.50_{\pm 0.43}$	26.75	25.50	$3.92_{\pm 0.80}$	$6.67_{\pm 5.92}$	$0.00_{\pm 0.00}$
GCG	47.50	18.75	$50.00_{\pm 3.31}$	51.25	21.25	$8.33_{\pm 2.60}$	$7.08_{\pm 8.04}$	$0.00_{\pm 0.00}$
HumanJb.	12.75	6.25	$9.92_{\pm 0.95}$	7.25	10.50	$6.42_{\pm 0.88}$	$3.50_{\pm 1.56}$	$0.90_{\pm 0.82}$

Appendix

Table 11: Per-attack HarmBench ASR for Qwen2-1.5B . Values are percentages; lower is better. BarrierSteer denotes the default LSE variant. Learning-based methods are reported as mean ±std over independent runs, while deterministic baselines use fixed greedy decoding.

Model	$\alpha$	ASR $\downarrow$	AA ASR $\downarrow$	XSTest $\downarrow$	MMLU $\uparrow$	GSM8K $\uparrow$
Gemma-2-9B	0.001	$3.12_{\pm 3.42}$	$66.00_{\pm 0.00}$	$33.00_{\pm 0.66}$	$71.87_{\pm 0.01}$	$73.62_{\pm 0.00}$
	0.01	$0.00_{\pm 0.00}$	$73.00_{\pm 1.10}$	$35.00_{\pm 0.66}$	$71.82_{\pm 0.04}$	$73.81_{\pm 0.12}$
	0.1	$0.00_{\pm 0.00}$	$53.00_{\pm 23.00}$	$32.00_{\pm 0.44}$	$71.87_{\pm 0.09}$	$73.65_{\pm 0.04}$
	0.2	$0.00_{\pm 0.00}$	$64.00_{\pm 6.57}$	$33.80_{\pm 0.22}$	$71.25_{\pm 0.55}$	$73.50_{\pm 0.04}$
	0.3	$0.00_{\pm 0.00}$	$64.00_{\pm 8.76}$	$33.80_{\pm 1.10}$	$71.70_{\pm 0.16}$	$72.93_{\pm 0.75}$
	0.5	$0.00_{\pm 0.00}$	$69.00_{\pm 5.48}$	$34.00_{\pm 3.07}$	$68.58_{\pm 3.19}$	$71.65_{\pm 1.91}$

Appendix

Table 12: BarrierSteer (LSE) steering-strength ablation across model families. We set

\kappa=100

and vary

\alpha

. ASR, AA ASR, and XSTest are lower-is-better; MMLU and GSM8K are higher-is-better.

$\alpha$	ASR $\downarrow$	AA ASR $\downarrow$	XSTest $\downarrow$	MMLU $\uparrow$	GSM8K $\uparrow$
0.01	$5.05_{\pm 7.95}$	$31.60_{\pm 4.98}$	$30.32_{\pm 2.97}$	$\mathbf{55.69_{\pm 0.03}}$	$\mathbf{12.43_{\pm 0.79}}$
0.1	$2.44_{\pm 4.09}$	$9.60_{\pm 10.43}$	$49.60_{\pm 23.03}$	$55.24_{\pm 0.38}$	$11.65_{\pm 1.69}$
0.2	$1.53_{\pm 2.65}$	$3.20_{\pm 4.60}$	$58.00_{\pm 15.49}$	$54.83_{\pm 0.42}$	$10.46_{\pm 2.58}$
0.3	$0.70_{\pm 1.22}$	$0.80_{\pm 1.10}$	$70.24_{\pm 4.68}$	$54.61_{\pm 0.36}$	$9.73_{\pm 1.62}$
0.5	$0.14_{\pm 0.24}$	$4.40_{\pm 8.76}$	$76.00_{\pm 0.69}$	$54.42_{\pm 0.24}$	$9.25_{\pm 2.27}$
1.0	$0.00_{\pm 0.00}$	$3.20_{\pm 1.79}$	$74.32_{\pm 3.18}$	$54.27_{\pm 0.23}$	$7.99_{\pm 1.61}$

Appendix

Table 13: Ablation study on the effect of steering strength

\alpha

for BarrierSteer (Top-2) on Qwen2-1.5B. ASR, AA ASR, and XSTest are lower-is-better; MMLU and GSM8K are higher-is-better.

Metric	Base	Self-Rem.	Cir. Breaker	ActAdd	DirAbl	ReFT-r1	SaP	BarrierSteer
IFEval $\uparrow$	65.80	75.30	$62.03_{\pm 10.84}$	66.73	33.09	$74.90_{\pm 0.14}$	$66.23_{\pm 0.39}$	$64.85_{\pm 0.43}$
TruthfulQA $\uparrow$	60.14	61.88	$61.03_{\pm 1.38}$	60.15	55.35	$58.68_{\pm 0.86}$	$60.14_{\pm 0.02}$	$60.57_{\pm 0.48}$
MT-Bench $\uparrow$	7.19	7.14	$5.91_{\pm 2.15}$	7.17	4.96	$7.19_{\pm 0.08}$	$7.16_{\pm 0.05}$	$7.15_{\pm 0.03}$
GPQA Diamond $\uparrow$	38.38	35.35	$38.04_{\pm 0.58}$	38.38	37.88	$34.85_{\pm 3.50}$	$38.38_{\pm 0.00}$	$38.18_{\pm 0.45}$

Appendix

Table 14: Extended utility benchmark results for Gemma-2-9B. Higher is better for all metrics.

Method	Generation Time (s) $\downarrow$
Base model	35.27
SaP	102.05
BarrierSteer (LSE)	39.44

Appendix

Table 15: HarmBench generation time on Qwen2-1.5B . We time only the completion-generation step for the DirectRequest split, using identical prompts, seed, greedy decoding, batch size, and maximum-new-token budget across methods.

Method	#Params.	Check CBFs	Select CBFs	Gradient Calc.	Compute Steering	Total
BarrierSteer (Top-2)	0.8M	$0.36_{\pm 0.04}$	$0.06_{\pm 0.01}$	$1.24_{\pm 0.11}$	$5.15_{\pm 10.42}$	$6.82_{\pm 10.42}$
	6.3M	$0.37_{\pm 0.01}$	$0.06_{\pm 0.00}$	$1.24_{\pm 0.05}$	$3.53_{\pm 8.50}$	$5.21_{\pm 8.50}$
	12.6M	$0.41_{\pm 0.04}$	$0.06_{\pm 0.01}$	$1.31_{\pm 0.13}$	$3.52_{\pm 8.35}$	$5.31_{\pm 8.35}$
	15.7M	$0.82_{\pm 0.01}$	$0.06_{\pm 0.00}$	$2.13_{\pm 0.06}$	$28.78_{\pm 6.98}$	$31.79_{\pm 6.98}$
	19.5M	$0.85_{\pm 0.01}$	$0.06_{\pm 0.00}$	$2.12_{\pm 0.06}$	$24.23_{\pm 10.62}$	$27.26_{\pm 10.62}$
	23.6M	$0.87_{\pm 0.10}$	$0.06_{\pm 0.01}$	$2.17_{\pm 0.21}$	$26.34_{\pm 10.99}$	$29.45_{\pm 11.00}$

Appendix

Table 16: Computational ablation over neural CBF size. We vary the number of trainable barrier parameters while keeping the number of CBF heads fixed. Values are per-token steering latency in milliseconds, reported as mean

\pm

std. The largest BarrierSteer setting has 23.64M parameters, comparable to the 25.67M-parameter SaP safety module. For BarrierSteer (LSE), barrier checking and gradient computation are fused into an operation and the cost appears under “Check CBFs.”

Method	$K$	Check CBFs	Select CBFs	Gradient Calc.	Compute Steering	Total
BarrierSteer (Top-2)	4	$0.37_{\pm 0.04}$	$0.06_{\pm 0.01}$	$1.24_{\pm 0.12}$	$5.12_{\pm 10.32}$	$6.78_{\pm 10.33}$
	12	$0.84_{\pm 0.04}$	$0.06_{\pm 0.01}$	$1.26_{\pm 0.07}$	$14.19_{\pm 14.11}$	$16.35_{\pm 14.11}$
	20	$1.32_{\pm 0.02}$	$0.06_{\pm 0.00}$	$1.26_{\pm 0.04}$	$20.32_{\pm 13.90}$	$22.97_{\pm 13.90}$
	28	$1.79_{\pm 0.04}$	$0.06_{\pm 0.00}$	$1.26_{\pm 0.05}$	$6.95_{\pm 11.90}$	$10.07_{\pm 11.90}$
	36	$2.29_{\pm 0.20}$	$0.06_{\pm 0.01}$	$1.27_{\pm 0.12}$	$12.82_{\pm 14.59}$	$16.44_{\pm 14.60}$
	44	$2.75_{\pm 0.03}$	$0.06_{\pm 0.00}$	$1.26_{\pm 0.02}$	$26.02_{\pm 10.76}$	$30.09_{\pm 10.76}$

Appendix

Table 17: Computational ablation over the number of CBF

K

. We vary

K

while keeping the per-head neural architecture fixed. Values are per-token steering latency in milliseconds, reported as mean ±std .

$\kappa$	ASR $\downarrow$	AA ASR $\downarrow$	XSTest $\downarrow$	MMLU $\uparrow$	GSM8K $\uparrow$
1	$0.00_{\pm 0.00}$	$54.00_{\pm 19.70}$	$36.80_{\pm 9.06}$	$44.28_{\pm 9.97}$	$54.69_{\pm 4.60}$
10	$0.00_{\pm 0.00}$	$58.00_{\pm 19.70}$	$37.87_{\pm 7.27}$	$68.80_{\pm 1.97}$	$70.00_{\pm 5.42}$
25	$0.00_{\pm 0.00}$	$54.67_{\pm 20.03}$	$40.00_{\pm 10.83}$	$70.45_{\pm 1.26}$	$68.16_{\pm 10.24}$
50	$0.00_{\pm 0.00}$	$56.00_{\pm 19.70}$	$41.20_{\pm 11.84}$	$70.43_{\pm 1.16}$	$67.90_{\pm 10.10}$
100	$0.00_{\pm 0.00}$	$54.00_{\pm 18.33}$	$38.53_{\pm 8.20}$	$71.04_{\pm 0.63}$	$67.42_{\pm 10.53}$

Appendix

Table 18: Gemma-2-9B LSE smoothing sensitivity for BarrierSteer with fixed

\alpha=0.2

. We report all metrics mean ±std over 5 runs.

Barrier Type	Category / Merge Rule	Harmful Rate $\downarrow$
Original Model	–	22.77
Single BarrierSteer	Copyright	$5.71_{\pm 0.00}$
	Cyberattack	$3.12_{\pm 0.00}$
	Defamation	$2.95_{\pm 0.00}$
	Discrimination	$3.81_{\pm 1.91}$
	Disinformation	$5.27_{\pm 0.00}$

Appendix

Table 19: Detailed WildGuard modular-composition results for BarrierSteer on Qwen2-1.5B . This appendix table expands Table 4 by showing category-level individual CBF results, alternative Top-2/QP/LSE merging rules, and a linear-probe ablation that replaces each neural CBF with a linear barrier. The LSE rows use the selected main-table smoothing value

\kappa=0.01

$\kappa$	Harmful Rate $\downarrow$	$\kappa$	Harmful Rate $\downarrow$
0.01	$\mathbf{0.86_{\pm 0.04}}$	1.0	$4.26_{\pm 0.68}$
0.03	$0.71_{\pm 0.07}$	2.0	$7.71_{\pm 0.65}$
0.05	$1.16_{\pm 0.13}$	5.0	$9.02_{\pm 0.15}$
0.1	$0.89_{\pm 0.32}$	10.0	$8.48_{\pm 0.39}$
0.2	$1.16_{\pm 0.26}$	20.0	$7.77_{\pm 1.17}$
0.5	$1.61_{\pm 0.51}$	50.0	$7.59_{\pm 1.79}$

Appendix

Table 20: WildGuard LSE smoothing sensitivity for composed BarrierSteer barriers on Qwen2-1.5B . We compose 14 category-specific barriers and evaluate

1{,}120

held-out WildGuardMix samples per seed. Harmful rate is reported as mean ±std ; lower is better. The main WildGuard Table 4 uses

\kappa=0.01

Method	ASR $\downarrow$
Base model	$19.50$
Conditional ActAdd	$18.17_{\pm 0.00}$
Conditional DirAbl	$12.50_{\pm 0.00}$
BarrierSteer	$\mathbf{0.00_{\pm 0.00}}$

Appendix

Table 21: Conditional fixed-direction steering baselines on Gemma-2-9B . We report HarmBench ASR; lower is better.

Explore similar work

May 14, 2026

Selective Safety Steering via Value-Filtered Decoding

While large language models (LLMs) are trained to align with human values, their generations may still violate safety constraints. A growing line of work addresses this problem by modifying the model's sampling policy at decoding time using a safety reward. However, existing decoding-time steering methods often intervene unnecessarily, modifying generations that would have been safe under the base model. Such unnecessary interventions are undesirable, as they can distort key properties of the base model such as helpfulness, fluency, style, and coherence. We propose a new test-time steering method designed to reduce such unnecessary interventions while improving the safety of unsafe responses. Our approach filters tokens using a value-based safety criterion and provides an explicit bound on the probability of false interventions. A single threshold hyperparameter controls this bound, allowing practitioners to trade off higher rates of unnecessary intervention for better output safety. Across multiple datasets and experiments, we show that our value-filtered decoding method outperforms existing baselines, achieving better trade-offs between safety, helpfulness, and similarity to the base model.

Bat-Sheva Einbinder, Hen Davidov, Yee Whye Teh +2

Department of Electrical and Computer Engineering, Technion IIT, Israel · Department of Statistics, University of Oxford, Oxford, UK · OATML, Department of Computer Science, University of Oxford, Oxford, UK +1

Language Model Decoding Language Model Steering Safety Filtering LLM Safety

Ask PDF

Apr 16, 2026

FineSteer: A Unified Framework for Fine-Grained Inference-Time Steering in Large Language Models

Large language models (LLMs) often exhibit undesirable behaviors, such as safety violations and hallucinations. Although inference-time steering offers a cost-effective way to adjust model behavior without updating its parameters, existing methods often fail to be simultaneously effective, utility-preserving, and training-efficient due to their rigid, one-size-fits-all designs and limited adaptability. In this work, we present FineSteer, a novel steering framework that decomposes inference-time steering into two complementary stages: conditional steering and fine-grained vector synthesis, allowing fine-grained control over when and how to steer internal representations. In the first stage, we introduce a Subspace-guided Conditional Steering (SCS) mechanism that preserves model utility by avoiding unnecessary steering. In the second stage, we propose a Mixture-of-Steering-Experts (MoSE) mechanism that captures the multimodal nature of desired steering behaviors and generates query-specific steering vectors for improved effectiveness. Through tailored designs in both SCS and MoSE, FineSteer maintains robust performance on general queries while adaptively optimizing steering vectors for targeted inputs in a training-efficient manner. Extensive experiments on safety and truthfulness benchmarks show that FineSteer outperforms state-of-the-art methods in overall performance, achieving stronger steering performance with minimal utility loss. Code is available at https://github.com/YukinoAsuna/FineSteer

Zixuan Weng, Jinghuai Zhang, Kunlin Cai +3

University of California, Los Angeles

Language Model Steering LLM Safety Hallucination Mitigation Activation Steering

Ask PDF

Jun 3, 2026

Inference-Time Vulnerability Beyond Shallow Safety: Alignment Along Generation Trajectories

Safety-aligned Large Language Models (LLMs) remain vulnerable to interventions during inference that redirect generation toward harmful outputs. Recent work attributes this to shallow safety, where alignment concentrates in the first few output tokens. We show that shallow safety is a special case of a broader inference-time vulnerability, in which short token injections at any generation step can substantially alter subsequent safety behavior. We also find that a model's alignment with refusal directions in its hidden states does not predict its robustness to such injection, revealing that internal state alone does not determine generation behavior under perturbation. To address this, we align models directly on generation trajectories constructed by simulating mid-sequence perturbation, and show that this improves robustness to mid-sequence injection and generalizes to attacks that exploit early-token generation. Our work argues that robust safety alignment requires training on the generation process itself, not only its outputs.

Kyungmin Park, Taesup Kim

Hankuk University of Foreign Studies · Seoul National University

Adversarial Attacks on LLMs LLM Safety Alignment Adversarial Robustness of Language Models Inference-Time Language Model Alignment

Ask PDF