Multi-Trait Subspace Steering to Reveal the Dark Side of Human-AI Interaction

Xin Wei Chia; Swee Liang Wong; Jonathan Pan

cs.AIMar 18, 2026

Multi-Trait Subspace Steering to Reveal the Dark Side of Human-AI Interaction

Authors: Xin Wei Chia, Swee Liang Wong, Jonathan Pan

Organizations: Home Team Science & Technology Agency (HTX) Singapore

Abstract

Recent incidents have highlighted alarming cases where human-AI interactions led to negative psychological outcomes, including mental health crises and even user harm. As LLMs serve as sources of guidance, emotional support, and even informal therapy, these risks are poised to escalate. However, studying the mechanisms underlying harmful human-AI interactions presents significant methodological challenges, where organic harmful interactions typically develop over sustained engagement, requiring extensive conversational context that are difficult to simulate in controlled settings. To address this gap, we developed a Multi-Trait Subspace Steering (MultiTraitsss) framework that leverages established crisis-associated traits and novel subspace steering framework to generate Dark models that exhibits cumulative harmful behavioral patterns. Single-turn and multi-turn evaluations show that our dark models consistently produce harmful interaction and outcomes. Using our Dark models, we propose protective measure to reduce harmful outcomes in Human-AI interactions.

Figures & tables

Figure 1: Proposed Framework. Framework consisting of 3 main components. (1) Multi-trait Subspace Steering designed to create a Dark model that can generate harmful human-AI interaction. (2) Evaluation of the Dark model response using both single- and multi-turn probes. (3) Using the Dark models to generate defensive system prompts to mitigate harmful outcomes.

Figure 2: Hyperparameter Search Left: Llama-8B; right: Qwen-1.5B. Optimization of coherence and trait scores against baseline (no steering). Data points with black edges indicate configurations used in this paper (refer to Appendix G for detailed results

	LLMs-Mental-Health-Crisis			MentalBench
Model	Baseline	$\text{Dark}_{\text{coh}}$	$\text{Dark}_{\text{trait}}$	Baseline	$\text{Dark}_{\text{coh}}$	$\text{Dark}_{\text{trait}}$
Qwen-1.5B	3.9 ± 1.2 (95.2)	3.3 ± 1.3 (77.8)	2.6 ± 1.2 (77.9)	4.2 ± 1.0	3.5 ± 1.0	2.9 ± 1.1
Llama-8B	4.3 ± 1.0 (95.9)	3.8 ± 1.3 (93.3)	3.1 ± 1.2 (88.7)	4.7 ± 0.7	4.1 ± 1.1	3.3 ± 1.0
Qwen-14B	4.5 ± 0.9 (95.4)	3.5 ± 1.1 (93.1)	2.8 ± 1.1 (85.7)	4.8 ± 0.4	4.2 ± 0.5	3.5 ± 0.9

Table 1: Single-Turn Evaluation Results. Mean scores across 7 categories (n = 2044 probes). Values in bracket indicate mean coherence score.

	LLMs-Mental-Health-Crisis			MentalBench
Model	Baseline	$\text{Dark}_{\text{coh}}$	$\text{Dark}_{\text{trait}}$	Baseline	$\text{Dark}_{\text{coh}}$	$\text{Dark}_{\text{trait}}$
Qwen-1.5B	3.7 ± 1.1 (92.9)	2.6 ± 1.1 (81.1)	1.8 ± 1.0 (41.9)	4.1 ± 0.9	2.8 ± 1.0	1.9 ± 1.0
Llama-8B	4.1 ± 0.9 (95.0)	3.0 ± 1.0 (92.0)	2.3 ± 1.0 (83.6)	4.3 ± 0.6	3.2 ± 0.7	2.5 ± 0.8
Qwen-14B	4.6 ± 0.7 (98.0)	2.4 ± 1.0 (78.1)	1.8 ± 0.9 (62.7)	4.7 ± 0.4	2.9 ± 0.8	2.3 ± 0.9

Table 2: Multi-Turn Evaluation. Mean scores across each turns (n = 116 Conversations with 20 turns each). Values in bracket indicate mean coherence score.

Figure 3: Evaluation Results with MultiTraitsss . Left. Single-turn evaluation (One-sided t-test, Bonferroni-Corrected ***p $<$ 0.001; **p $<$ 0.01). Error bar indicates SEM. Right. Multi-turn evaluation. Shaded area indicates SEM. Data points with black edges indicate significant turns when compared against baseline (One-sided t-test, Bonferroni-Corrected ***p $<$ 0.001).

Figure 4: UMAP projection Concatenated across 3 models and 3 configurations (Baseline, $\text{Dark}_{\text{coh}}$ and $\text{Dark}_{\text{trait}}$ ) across turns 1, 3, 5, 10, 15 and 20. Colour indicates responses from Dark models (red) and baseline models (blue). Shading indicates turn number, earlier turns (darker) and later turns (lighter).

Model	Baseline	$\mathbf{\text{Dark}_{\text{coh}}}$	$\mathbf{\text{Dark}_{\text{trait}}}$
Qwen-1.5B	0.19	0.38	0.38
Llama-8B	5.38	0.77	0.19
Qwen-14B	0.38	0.58	1.35

Table 3: ASR of Models on Advbench. Llama-8B displaying

\text{Dark}_{\text{coh}}

and

\text{Dark}_{\text{trait}}

respectively.

Figure 5: Effects of Protective Prompts on Dark Models Shaded area indicates SEM. Data points with black edges indicate significant turns when compared against baseline (One-sided t-test, Bonferroni-Corrected ***p $<$ 0.001).

Model	Base	Evol	G1	G2	G3
Llama-8B	2.43	2.88	2.62	2.66	2.38

Table 4: Defensive Prompt Evaluation (n = 60 Conversations; avg. t=1–20). Bold value indicates most effective defensive prompt for the model.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Trait	Model	Baseline	$\mathbf{\text{Dark}_{\text{coh}}}$	$\mathbf{\text{Dark}_{\text{trait}}}$
Inadequate Crisis Response	Llama-8B	0.00	1.24	6.90
	Qwen-1.5B	0.16	1.78	6.50
	Qwen-14B	0.00	3.73	1.07
Minimizing Emotional Distress	Llama-8B	11.87	35.20	46.53
	Qwen-1.5B	7.03	28.90	40.92
	Qwen-14B	18.68	37.40	24.84

Appendix

Table 5: Trait Expression Scores (%) after MultiTraitsss. Higher values indicate stronger expression of harmful traits. Steering was not performed for the trait “Normalizing Finality in Crisis” as individual steering did not result in increased expression of the trait.

Figure 6: Evaluation Results for Llama-8B . Left. Single-turn Crisis evaluation. Effects of MultiTraitssss with different configurations on single-turn interaction (One-sided t-test, Bonferroni-Corrected ***p $<$ 0.001; **p $<$ 0.01; *p $<$ 0.05). Error bar indicates SEM. Right. Multi-turn Crisis Evaluation Effects of MultiTraitssss with different configurations on multi-turn interaction. Shaded area indicates SEM. Data points with black edges indicate significant turns when compared against baseline (One-sided t-test, Bonferroni-Corrected ***p $<$ 0.001).

Category	Single-Turn	Multi-Turn
Suicidal Ideation	380	26
Self-Harm	139	1
Anxiety Crisis	177	19
Violent Thoughts	21	0
Substance Abuse/Withdrawal	77	16
Risk-Taking Behaviours	19	0

Appendix

Table 6: Distribution of crisis categories across single-turn and multi-turn evaluation datasets

Figure 7: Overview Heatmap for Llama-3.1-8b illustrating outcomes of hyperparameter search. Top. Effects of rank (d) and alpha on coherence compared to baseline. Middle. Effects of rank (d) and alpha on trait compared to baseline. Bottom. Cumulative variance explained as a function of increasing rank (d) across different layers.

Rank	$\alpha$	Coherence	Coh $\Delta$	Trait	Trait $\Delta$
256*	1.5*	58.22	$-$ 32.00	48.74	+33.60
128	2.0	45.62	$-$ 44.61	47.49	+32.34
256	2.0	31.27	$-$ 58.95	46.90	+31.76
64	2.5	39.87	$-$ 50.36	43.82	+28.67
128*	1.5*	69.26	$-$ 20.97	43.63	+28.48
32	2.5	50.64	$-$ 39.59	43.07	+27.92

Appendix

Table 7: Complete hyperparameter search results for Llama-3.1-8B-Instruct, sorted by Trait

\Delta

(descending). Configurations marked with * have example outputs displayed in this annex. Bold configurations were those used in the paper.

Rank	$\alpha$	Coherence	Coh $\Delta$	Trait	Trait $\Delta$
64	1.5	30.80	$-$ 58.60	52.37	+43.17
8	2.5	31.47	$-$ 57.94	51.28	+42.08
128	1.5	21.32	$-$ 68.08	50.29	+41.09
32	2.0	31.98	$-$ 57.43	49.54	+40.34
256	1.0	41.85	$-$ 47.56	48.68	+39.48
32	2.5	20.06	$-$ 69.35	46.99	+37.79

Appendix

Table 8: Complete hyperparameter search results for Qwen2.5-1.5B-Instruct, sorted by Trait

\Delta

(descending). Bold configurations were used in the Supplementary figures.

Rank	$\alpha$	Coherence	Coh $\Delta$	Trait	Trait $\Delta$
256	1.5	37.86	$-$ 52.78	47.23	+31.19
128	1.5	58.47	$-$ 32.16	40.66	+24.62
64	2.0	46.74	$-$ 43.89	39.49	+23.45
256	1.0	81.35	$-$ 9.29	38.88	+22.84
256	2.0	10.98	$-$ 79.65	38.57	+22.53
128	2.0	24.08	$-$ 66.56	38.14	+22.10

Appendix

Table 9: Complete hyperparameter search results for Qwen-14B, sorted by Trait

\Delta

(descending). Bold configuration is used in the Supplementary figures.

Figure 8: UMAP projection with Baseline vs Dark turn labels Duplicate of Figure 4 . Concatenated across 3 models and 3 configurations (Baseline, $\text{Dark}_{\text{coh}}$ and $\text{Dark}_{\text{trait}}$ ) across turns 1, 3, 5, 10, 15 and 20. Colour indicates responses from Dark models (red) and baseline models (blue). Shading indicates turn number, earlier turns (darker) and later turns (lighter).

Figure 9: UMAP projection with model labels Concatenated across 3 models and 3 configurations (Baseline, $\text{Dark}_{\text{coh}}$ and $\text{Dark}_{\text{trait}}$ ) across turns 1, 3, 5, 10, 15 and 20. Colour indicates responses from Llama-8B (red), Qwen-1.5B (blue) and Qwen-14B (green).

Human-AI Interaction

Human-AI interaction studies how people and AI systems communicate, collaborate, make decisions, and shape one another over time.

See all 328 papers

Jun 1, 2026

Investigating and Alleviating Harm Amplification in LLM Interactions

Large language models (LLMs) can serve as helpful assistants, yet they can equally function as harm amplifiers that enable malicious users to achieve harmful outcomes beyond their capabilities through extended interactions. This risk manifests along two axes, i.e., democratizing domain expertise that allows novices to produce specialized harmful content, and scaling harmful operations at volumes that manual effort cannot match. Existing works, however, often overlook how LLMs compound harm across multi-turn conversations. We introduce HarmAmp, a new benchmark for multi-turn harm amplification scenarios spanning twelve risk categories. Each scenario is grounded in real-world threats and satisfies rigorous criteria, i.e., substantive amplification, operational specificity, and multi-turn necessity. We further propose TrajSafe, a proactive monitor that anticipates harmful trajectories and intervenes through actions such as probing users' genuine intents and steering the models towards safer completion. Our extensive experiments demonstrate that TrajSafe significantly reduces the harmfulness incurred in multi-turn interactions while preserving a low over-refusal rate and the target model's general capabilities. Our work offers a promising paradigm to alleviate the nuanced safety risks in LLM interactions.

Ruohao Guo, Wei Xu, Alan Ritter

Georgia Institute of Technology

MLLM Safety Language Model Safety Evaluation LLM Safety Monitoring LLM Safety

Ask PDF

Mar 21, 2026

Detection of adversarial intent in Human-AI teams using LLMs

Large language models (LLMs) are increasingly deployed in human-AI teams as support agents for complex tasks such as information retrieval, programming, and decision-making assistance. While these agents' autonomy and contextual knowledge enables them to be useful, it also exposes them to a broad range of attacks, including data poisoning, prompt injection, and even prompt engineering. Through these attack vectors, malicious actors can manipulate an LLM agent to provide harmful information, potentially manipulating human agents to make harmful decisions. While prior work has focused on LLMs as attack targets or adversarial actors, this paper studies their potential role as defensive supervisors within mixed human-AI teams. Using a dataset consisting of multi-party conversations and decisions for a real human-AI team over a 25 round horizon, we formulate the problem of malicious behavior detection from interaction traces. We find that LLMs are capable of identifying malicious behavior in real-time, and without task-specific information, indicating the potential for task-agnostic defense. Moreover, we find that the malicious behavior of interest is not easily identified using simple heuristics, further suggesting the introduction of LLM defenders could render human teams more robust to certain classes of attack.

Abed K. Musaffar, Ambuj Singh, Francesco Bullo

Department of Mechanical Engineering, University of California at Santa Barbara · Department of Computer Science, University of California at Santa Barbara

AI Agent Security AI Agent Monitoring LLM Security Human-AI Collaboration

Ask PDF

Mar 4, 2026

The Company You Keep: How LLMs Respond to Dark Triad Traits

LLMs often exhibit highly agreeable conversational styles, also known as AI sycophancy. This pattern may become problematic when interacting with user prompts that reflect negative social tendencies, risking the amplification of harmful behavior. We examine how LLMs respond to user prompts expressing varying degrees of Dark Triad traits (Machiavellianism, Narcissism, and Psychopathy) using a curated dataset. Our analysis reveals systematic differences across models: while all models predominantly exhibit corrective behavior, some generate reinforcing or ambivalent output. Model behavior further varies with severity level and response sentiment. These findings highlight the need for safer conversational systems that can reliably detect and respond to users escalating from benign to harmful requests.

Angelica Henestrosa, Zeyi Lu, Pavel Chizhov +1

CAIRO, Technical University of Applied Sciences Würzburg-Schweinfurt

Language Model Safety Evaluation LLM Sycophancy

Ask PDF

Abstract

Human-AI Interaction

Explore similar work

Investigating and Alleviating Harm Amplification in LLM Interactions

Detection of adversarial intent in Human-AI teams using LLMs

The Company You Keep: How LLMs Respond to Dark Triad Traits