Multi-Trait Subspace Steering to Reveal the Dark Side of Human-AI Interaction

Xin Wei Chia; Swee Liang Wong; Jonathan Pan

cs.AIMar 18, 2026

Multi-Trait Subspace Steering to Reveal the Dark Side of Human-AI Interaction

Authors: Xin Wei Chia, Swee Liang Wong, Jonathan Pan

Organizations: Home Team Science & Technology Agency (HTX) Singapore

Abstract

Recent incidents have highlighted alarming cases where human-AI interactions led to negative psychological outcomes, including mental health crises and even user harm. As LLMs serve as sources of guidance, emotional support, and even informal therapy, these risks are poised to escalate. However, studying the mechanisms underlying harmful human-AI interactions presents significant methodological challenges, where organic harmful interactions typically develop over sustained engagement, requiring extensive conversational context that are difficult to simulate in controlled settings. To address this gap, we developed a Multi-Trait Subspace Steering (MultiTraitsss) framework that leverages established crisis-associated traits and novel subspace steering framework to generate Dark models that exhibits cumulative harmful behavioral patterns. Single-turn and multi-turn evaluations show that our dark models consistently produce harmful interaction and outcomes. Using our Dark models, we propose protective measure to reduce harmful outcomes in Human-AI interactions.

Figures & tables

Figure 1: Proposed Framework. Framework consisting of 3 main components. (1) Multi-trait Subspace Steering designed to create a Dark model that can generate harmful human-AI interaction. (2) Evaluation of the Dark model response using both single- and multi-turn probes. (3) Using the Dark models to generate defensive system prompts to mitigate harmful outcomes.

Figure 2: Hyperparameter Search Left: Llama-8B; right: Qwen-1.5B. Optimization of coherence and trait scores against baseline (no steering). Data points with black edges indicate configurations used in this paper (refer to Appendix G for detailed results

	LLMs-Mental-Health-Crisis			MentalBench
Model	Baseline	$\text{Dark}_{\text{coh}}$	$\text{Dark}_{\text{trait}}$	Baseline	$\text{Dark}_{\text{coh}}$	$\text{Dark}_{\text{trait}}$
Qwen-1.5B	3.9 ± 1.2 (95.2)	3.3 ± 1.3 (77.8)	2.6 ± 1.2 (77.9)	4.2 ± 1.0	3.5 ± 1.0	2.9 ± 1.1
Llama-8B	4.3 ± 1.0 (95.9)	3.8 ± 1.3 (93.3)	3.1 ± 1.2 (88.7)	4.7 ± 0.7	4.1 ± 1.1	3.3 ± 1.0
Qwen-14B	4.5 ± 0.9 (95.4)	3.5 ± 1.1 (93.1)	2.8 ± 1.1 (85.7)	4.8 ± 0.4	4.2 ± 0.5	3.5 ± 0.9

Table 1: Single-Turn Evaluation Results. Mean scores across 7 categories (n = 2044 probes). Values in bracket indicate mean coherence score.

	LLMs-Mental-Health-Crisis			MentalBench
Model	Baseline	$\text{Dark}_{\text{coh}}$	$\text{Dark}_{\text{trait}}$	Baseline	$\text{Dark}_{\text{coh}}$	$\text{Dark}_{\text{trait}}$
Qwen-1.5B	3.7 ± 1.1 (92.9)	2.6 ± 1.1 (81.1)	1.8 ± 1.0 (41.9)	4.1 ± 0.9	2.8 ± 1.0	1.9 ± 1.0
Llama-8B	4.1 ± 0.9 (95.0)	3.0 ± 1.0 (92.0)	2.3 ± 1.0 (83.6)	4.3 ± 0.6	3.2 ± 0.7	2.5 ± 0.8
Qwen-14B	4.6 ± 0.7 (98.0)	2.4 ± 1.0 (78.1)	1.8 ± 0.9 (62.7)	4.7 ± 0.4	2.9 ± 0.8	2.3 ± 0.9

Table 2: Multi-Turn Evaluation. Mean scores across each turns (n = 116 Conversations with 20 turns each). Values in bracket indicate mean coherence score.

Figure 3: Evaluation Results with MultiTraitsss . Left. Single-turn evaluation (One-sided t-test, Bonferroni-Corrected ***p $<$ 0.001; **p $<$ 0.01). Error bar indicates SEM. Right. Multi-turn evaluation. Shaded area indicates SEM. Data points with black edges indicate significant turns when compared against baseline (One-sided t-test, Bonferroni-Corrected ***p $<$ 0.001).

Figure 4: UMAP projection Concatenated across 3 models and 3 configurations (Baseline, $\text{Dark}_{\text{coh}}$ and $\text{Dark}_{\text{trait}}$ ) across turns 1, 3, 5, 10, 15 and 20. Colour indicates responses from Dark models (red) and baseline models (blue). Shading indicates turn number, earlier turns (darker) and later turns (lighter).

Model	Baseline	$\mathbf{\text{Dark}_{\text{coh}}}$	$\mathbf{\text{Dark}_{\text{trait}}}$
Qwen-1.5B	0.19	0.38	0.38
Llama-8B	5.38	0.77	0.19
Qwen-14B	0.38	0.58	1.35

Table 3: ASR of Models on Advbench. Llama-8B displaying

\text{Dark}_{\text{coh}}

and

\text{Dark}_{\text{trait}}

respectively.

Figure 5: Effects of Protective Prompts on Dark Models Shaded area indicates SEM. Data points with black edges indicate significant turns when compared against baseline (One-sided t-test, Bonferroni-Corrected ***p $<$ 0.001).

Model	Base	Evol	G1	G2	G3
Llama-8B	2.43	2.88	2.62	2.66	2.38

Table 4: Defensive Prompt Evaluation (n = 60 Conversations; avg. t=1–20). Bold value indicates most effective defensive prompt for the model.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Trait	Model	Baseline	$\mathbf{\text{Dark}_{\text{coh}}}$	$\mathbf{\text{Dark}_{\text{trait}}}$
Inadequate Crisis Response	Llama-8B	0.00	1.24	6.90
	Qwen-1.5B	0.16	1.78	6.50
	Qwen-14B	0.00	3.73	1.07
Minimizing Emotional Distress	Llama-8B	11.87	35.20	46.53
	Qwen-1.5B	7.03	28.90	40.92
	Qwen-14B	18.68	37.40	24.84

Appendix

Table 5: Trait Expression Scores (%) after MultiTraitsss. Higher values indicate stronger expression of harmful traits. Steering was not performed for the trait “Normalizing Finality in Crisis” as individual steering did not result in increased expression of the trait.

Figure 6: Evaluation Results for Llama-8B . Left. Single-turn Crisis evaluation. Effects of MultiTraitssss with different configurations on single-turn interaction (One-sided t-test, Bonferroni-Corrected ***p $<$ 0.001; **p $<$ 0.01; *p $<$ 0.05). Error bar indicates SEM. Right. Multi-turn Crisis Evaluation Effects of MultiTraitssss with different configurations on multi-turn interaction. Shaded area indicates SEM. Data points with black edges indicate significant turns when compared against baseline (One-sided t-test, Bonferroni-Corrected ***p $<$ 0.001).

Category	Single-Turn	Multi-Turn
Suicidal Ideation	380	26
Self-Harm	139	1
Anxiety Crisis	177	19
Violent Thoughts	21	0
Substance Abuse/Withdrawal	77	16
Risk-Taking Behaviours	19	0

Appendix

Table 6: Distribution of crisis categories across single-turn and multi-turn evaluation datasets

Figure 7: Overview Heatmap for Llama-3.1-8b illustrating outcomes of hyperparameter search. Top. Effects of rank (d) and alpha on coherence compared to baseline. Middle. Effects of rank (d) and alpha on trait compared to baseline. Bottom. Cumulative variance explained as a function of increasing rank (d) across different layers.

Rank	$\alpha$	Coherence	Coh $\Delta$	Trait	Trait $\Delta$
256*	1.5*	58.22	$-$ 32.00	48.74	+33.60
128	2.0	45.62	$-$ 44.61	47.49	+32.34
256	2.0	31.27	$-$ 58.95	46.90	+31.76
64	2.5	39.87	$-$ 50.36	43.82	+28.67
128*	1.5*	69.26	$-$ 20.97	43.63	+28.48
32	2.5	50.64	$-$ 39.59	43.07	+27.92

Appendix

Table 7: Complete hyperparameter search results for Llama-3.1-8B-Instruct, sorted by Trait

\Delta

(descending). Configurations marked with * have example outputs displayed in this annex. Bold configurations were those used in the paper.

Rank	$\alpha$	Coherence	Coh $\Delta$	Trait	Trait $\Delta$
64	1.5	30.80	$-$ 58.60	52.37	+43.17
8	2.5	31.47	$-$ 57.94	51.28	+42.08
128	1.5	21.32	$-$ 68.08	50.29	+41.09
32	2.0	31.98	$-$ 57.43	49.54	+40.34
256	1.0	41.85	$-$ 47.56	48.68	+39.48
32	2.5	20.06	$-$ 69.35	46.99	+37.79

Appendix

Table 8: Complete hyperparameter search results for Qwen2.5-1.5B-Instruct, sorted by Trait

\Delta

(descending). Bold configurations were used in the Supplementary figures.

Rank	$\alpha$	Coherence	Coh $\Delta$	Trait	Trait $\Delta$
256	1.5	37.86	$-$ 52.78	47.23	+31.19
128	1.5	58.47	$-$ 32.16	40.66	+24.62
64	2.0	46.74	$-$ 43.89	39.49	+23.45
256	1.0	81.35	$-$ 9.29	38.88	+22.84
256	2.0	10.98	$-$ 79.65	38.57	+22.53
128	2.0	24.08	$-$ 66.56	38.14	+22.10

Appendix

Table 9: Complete hyperparameter search results for Qwen-14B, sorted by Trait

\Delta

(descending). Bold configuration is used in the Supplementary figures.

Figure 8: UMAP projection with Baseline vs Dark turn labels Duplicate of Figure 4 . Concatenated across 3 models and 3 configurations (Baseline, $\text{Dark}_{\text{coh}}$ and $\text{Dark}_{\text{trait}}$ ) across turns 1, 3, 5, 10, 15 and 20. Colour indicates responses from Dark models (red) and baseline models (blue). Shading indicates turn number, earlier turns (darker) and later turns (lighter).

Figure 9: UMAP projection with model labels Concatenated across 3 models and 3 configurations (Baseline, $\text{Dark}_{\text{coh}}$ and $\text{Dark}_{\text{trait}}$ ) across turns 1, 3, 5, 10, 15 and 20. Colour indicates responses from Llama-8B (red), Qwen-1.5B (blue) and Qwen-14B (green).

Human-AI Interaction

Human-AI interaction studies how people and AI systems communicate, collaborate, make decisions, and shape one another over time.

See all 328 papers

Investigating and Alleviating Harm Amplification in LLM Interactions
Jun 1, 2026Ruohao Guo, Wei Xu, Alan RitterMLLM Safety Language Model Safety Evaluation
Georgia Institute of Technology
Detection of adversarial intent in Human-AI teams using LLMs
Mar 21, 2026Abed K. Musaffar, Ambuj Singh, Francesco BulloAI Agent Security AI Agent Monitoring
Department of Mechanical Engineering, University of California at Santa Barbara · Department of Computer Science, University of California at Santa Barbara
The Company You Keep: How LLMs Respond to Dark Triad Traits
Mar 4, 2026Angelica Henestrosa, Zeyi Lu, Pavel Chizhov +1Language Model Safety Evaluation LLM Sycophancy
CAIRO, Technical University of Applied Sciences Würzburg-Schweinfurt

Jun 1, 2026J/K move · Enter open · S save

Investigating and Alleviating Harm Amplification in LLM Interactions

Ruohao Guo, Wei Xu, Alan Ritter

Georgia Institute of Technology

MLLM Safety Language Model Safety Evaluation LLM Safety Monitoring LLM Safety

Open paper AskPDF arXiv

Large language models (LLMs) can serve as helpful assistants, yet they can equally function as harm amplifiers that enable malicious users to achieve harmful outcomes beyond their capabilities through extended interactions. This risk manifests along two axes, i.e., democratizing domain expertise that allows novices to produce specialized harmful content, and scaling harmful operations at volumes that manual effort cannot match. Existing works, however, often overlook how LLMs compound harm across multi-turn conversations. We introduce HarmAmp, a new benchmark for multi-turn harm amplification scenarios spanning twelve risk categories. Each scenario is grounded in real-world threats and satisfies rigorous criteria, i.e., substantive amplification, operational specificity, and multi-turn necessity. We further propose TrajSafe, a proactive monitor that anticipates harmful trajectories and intervenes through actions such as probing users' genuine intents and steering the models towards safer completion. Our extensive experiments demonstrate that TrajSafe significantly reduces the harmfulness incurred in multi-turn interactions while preserving a low over-refusal rate and the target model's general capabilities. Our work offers a promising paradigm to alleviate the nuanced safety risks in LLM interactions.

Abstract

Human-AI Interaction

Explore similar work

Investigating and Alleviating Harm Amplification in LLM Interactions

Detection of adversarial intent in Human-AI teams using LLMs

The Company You Keep: How LLMs Respond to Dark Triad Traits