Analysing the Safety Pitfalls of Steering Vectors

Yuxiao Li; Alina Fastowski; Efstratios Zaradoukas; Bardh Prenkaj; Gjergji Kasneci

cs.CRMar 25, 2026

Analysing the Safety Pitfalls of Steering Vectors

Authors: Yuxiao Li, Alina Fastowski, Efstratios Zaradoukas, Bardh Prenkaj, Gjergji Kasneci

Organizations: Technical University of Munich, Munich Center for Machine Learning

Abstract

Activation steering has emerged as a powerful tool to shape LLM behavior without the need for weight updates. While its inherent brittleness and unreliability are well-documented, its safety implications remain underexplored. In this work, we present a systematic safety audit of steering vectors obtained with Contrastive Activation Addition (CAA), a widely used steering approach, under a unified evaluation protocol. Using JailbreakBench as benchmark, we show that steering vectors consistently influence the success rate of jailbreak attacks, with stronger amplification under simple template-based attacks. Across LLM families and sizes, steering the model in specific directions can drastically increase (up to 57%) or decrease (up to 50%) its attack success rate (ASR), depending on the targeted behavior. We attribute this phenomenon to the overlap between the steering vectors and the latent directions of refusal behavior. Thus, we offer a traceable explanation for this discovery. Together, our findings reveal the previously unobserved origin of this safety gap in LLMs, highlighting a trade-off between controllability and safety.

Figures & tables

Figure 1: Activation steering erodes LLM safety. For Qwen 14B, without steering, a model refuses harmful input (ASR: 4%, A). Steering towards "Self-Awareness" alone compromises safety (ASR: 42%, C). Critically, combining steering with simple attacks leads to a near-complete collapse of safety (ASR: 80%, B), revealing a severe safety-controllability trade-off in LLMs.

Figure 2: Steering strongly influences jailbreak ASR. ASR is shown as a function of steering multiplier across model families, behaviors, and attack settings. Top row: prompt-only. Bottom rows: prefix injection and refusal suppression attacks. Note that the y-axis scale differs across rows to highlight variation in ASR magnitudes.

Figure 3: Heatmaps showing changes in $\Delta$ ASR relative to the baseline (multiplier $m=0$ ) under positive steering (multiplier $m=1.5$ ) across behaviors, model families, and attack scenarios.

Figure 4: Cosine similarity between steering vectors and the refusal direction $\hat{r}$ . Warm colors indicate positive alignment (reinforcing refusal), and cool colors indicate negative alignment (suppressing refusal).

Figure 5: Relationship between steering vector alignment with the refusal direction and safety impact. Each point represents a steering vector, plotted by its cosine similarity to the refusal direction (x-axis) and its effect on attack success rate (y-axis) across six models.

Model	Slope ( $\gamma_{1}$ )	r	$R^{2}$	$p$ -value
Qwen 3B	$1.46$	$0.15$	$0.02$	0.696
Llama 7B	$-36.52$	$-0.93$	$0.87$	$<0.001$
Gemma 7B	$-82.12$	$-0.93$	$0.87$	$<0.001$
Qwen 7B	$-125.19$	$-0.92$	$0.85$	$<0.001$
Qwen 14B	$-180.71$	$-0.95$	$0.91$	$<0.001$
Qwen 32B	$-193.40$	$-0.94$	$0.88$	$<0.001$

Table 1: Regression of ASR Slope against Cosine Similarity with Refusal Direction for Prefix-Injection Attack.

Figure 6: False Refusal Rate on benign prompts for Qwen models.

Model	Prompt-Only			Prefix Injection			Refusal Suppression			Avg.
	Before	After	%Change	Before	After	%Change	Before	After	%Change	% Change
Qwen 3B	3.65	3.43	5.97% $\downarrow$	1.43	1.40	2.21% $\downarrow$	3.34	2.53	24.39% $\downarrow$	10.86% $\downarrow$
Llama 7B	1.54	1.16	25.27% $\downarrow$	2.82	2.13	24.21% $\downarrow$	4.88	3.69	24.41% $\downarrow$	24.63% $\downarrow$
Gemma 7B	4.20	3.53	15.99% $\downarrow$	5.64	4.69	16.80% $\downarrow$	4.28	3.80	11.32% $\downarrow$	14.70% $\downarrow$
Qwen 7B	2.87	2.36	17.93% $\downarrow$	13.45	11.18	16.83% $\downarrow$	8.21	6.18	24.66% $\downarrow$	19.81% $\downarrow$
Qwen 14B	3.33	2.52	24.36% $\downarrow$	20.64	17.43	15.58% $\downarrow$	15.56	12.55	19.35% $\downarrow$	19.76% $\downarrow$

Table 2: Ablation effectiveness across models and attacks. For each model-attack pair, we show the Mean

|\Delta\text{ASR}|

across all multipliers and behaviors before and after ablation, and the percentage change (

\downarrow

indicates reduction).

Figure 7: Effect of refusal direction ablation on steering-induced

\Delta

ASR with regarding to multiplier across Qwen models.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Selected ( $l^{*}$ )	Total ( $L$ )
Llama-7B	14	32
Gemma-7B	14	28
Qwen-3B	27	36
Qwen-7B	19	28
Qwen-14B	30	48
Qwen-32B	46	64

Appendix

Table 3: Steering layer selection (

l^{*}

) relative to the total number of layers (

L

) for each model.

Simplified name	Original identifier
Coordinate-AI	coordinate-other-ais
Corrigible	corrigible-neutral-HHH
Hallucination	hallucination
Myopic Reward	myopic-reward
Survival Instinct	survival-instinct
Sycophancy	sycophancy

Appendix

Table 4: Mapping from simplified behavior names (used in figures) to original dataset identifiers.

Behavior	Multiplier	Qwen 3B		Gemma 7B		Llama 7B		Qwen 7B		Qwen 14B		Qwen 32B
Behavior	Multiplier	MMLU $\uparrow$	TriviaQA $\uparrow$	MMLU $\uparrow$	TriviaQA $\uparrow$	MMLU $\uparrow$	TriviaQA $\uparrow$	MMLU $\uparrow$	TriviaQA $\uparrow$	MMLU $\uparrow$	TriviaQA $\uparrow$	MMLU $\uparrow$	TriviaQA $\uparrow$
No Steering	0.0	66.6	37.5	22.0	33.7	59.6	47.0	46.1	18.0	78.2	62.8	82.7	64.2
Myopic Reward	-1.5	66.6	37.5	22.0	33.6	56.0	45.8	52.3	18.0	76.3	62.8	81.3	64.2
Myopic Reward	1.5	66.5	37.5	22.0	33.2	54.6	43.3	51.7	18.0	78.4	62.8	81.2	64.2
Anti-LGBTQ	-1.5	66.7	37.5	22.0	32.6	52.1	44.7	46.5	18.0	77.3	62.8	81.1	64.2
Anti-LGBTQ	1.5	67.1	37.5	22.0	32.8	52.3	44.2	58.1	18.0	75.0	62.8	81.4	64.2

Appendix

Table 5: Performance comparison across models, behaviors, and steering multipliers. MMLU and TriviaQA performance are reported as accuracy.

Model	Slope ( $\gamma_{1}$ )	r	$R^{2}$	$p$ -value
Qwen 3B	$-22.46$	$-0.82$	$0.66$	$<0.01$
Llama 7B	$-17.60$	$-0.95$	$0.90$	$<0.001$
Gemma 7B	$-51.82$	$-0.92$	$0.85$	$<0.001$
Qwen 7B	$-26.90$	$-0.96$	$0.92$	$<0.001$
Qwen 14B	$-20.09$	$-0.78$	$0.61$	$<0.05$
Qwen 32B	$-29.38$	$-0.92$	$0.84$	$<0.001$

Appendix

Table 6: Regression of ASR Slope against Cosine Similarity with Refusal Direction for Prompt-Only Scenario.

Model	Slope ( $\gamma_{1}$ )	r	$R^{2}$	$p$ -value
Qwen 3B	$-31.92$	$-0.94$	$0.88$	$<0.001$
Llama 7B	$-53.83$	$-0.97$	$0.94$	$<0.001$
Gemma 7B	$-39.45$	$-0.80$	$0.64$	$<0.01$
Qwen 7B	$-66.31$	$-0.94$	$0.88$	$<0.001$
Qwen 14B	$-153.96$	$-0.99$	$0.98$	$<0.001$
Qwen 32B	$-241.55$	$-0.96$	$0.91$	$<0.001$

Appendix

Table 7: Regression of ASR Slope against Cosine Similarity with Refusal Direction for Refusal-Suppression Attack.

Figure 8: Heatmaps showing changes in $\Delta$ ASR relative to the baseline (multiplier $m=0$ ) under negative steering (multiplier $m=-1.5$ ) across behaviors and model families.

Figure 9: Directional ablation smooths ASR curves and reduces sensitivity to steering across models scales and scenarios.

Panel of Figure 10 — Figure 10: Prompt-Only Responses.

Panel of Figure 11 — Figure 11: Prefix Injection Responses.

Panel of Figure 12 — Figure 12: Refusal Suppression Responses.

Activation Steering

Activation steering changes model behavior by intervening directly on internal representations during inference, often without updating weights.

See all 375 papers

Safety Cost of Steering Vectors Is Separable and Reducible
Aug 9, 2026Yuxiao Li, Gjergji KasneciLanguage Model Steering LLM Safety Alignment
Technical University of Munich Munich Center for Machine Learning (MCML)
Steering Vectors are an Adversarial Attack Surface
Jun 4, 2026Abzal Aidakhmetov, Donato Crisostomi, Tommaso Mencattini +3Language Model Steering Adversarial Attacks on LLMs
1Sapienza University of Rome · 2EPFL
Activation Steering Induces Emergent Misalignment: Steering Vector Construction and Comprehensive Evaluation
Jun 7, 2026Qi Cao, Jian Lou, Meiting Liu +3Language Model Safety Evaluation LLM Safety
Nanyang Technological University · Sun Yat-sen University · University of Science and Technology of China

Aug 9, 2026J/K move · Enter open · S save

Safety Cost of Steering Vectors Is Separable and Reducible

Yuxiao Li, Gjergji Kasneci

Technical University of Munich Munich Center for Machine Learning (MCML)

Language Model Steering LLM Safety Alignment LLM Safety Evaluation

Open paper AskPDF arXiv

Steering vectors are a lightweight tool for controlling LLM behavior. However, emerging evidence shows that steering vectors can unintentionally compromise a model's safety mechanisms and increase compliance with harmful requests, while no effective mitigation yet exists. In this work, we show that this safety degradation arises from a separable component in the vector that disrupts the model's safety mechanisms but contributes little to the steering objective. We identify and remove this safety-degrading component, formulating the task as a constrained optimization problem solved through primal-dual updates, subject to preserving the intended steering effect and bounding false refusal. The resulting solution is both interpretable and surgical: the optimization recovers a single direction whose ablation from the steering vector restores model safety with minimal utility cost. Across models, steering behaviors, and attack suites, including unseen attacks types, our method substantially reduces steering-induced safety degradation while preserving the original steering effect with minimal impact on false refusal. Our method offers a post-hoc correction to steering vectors that mitigates their safety cost, and more broadly, it provides a general recipe for applying activation-level model interventions without paying a safety tax.

Abstract

Activation Steering

Explore similar work

Safety Cost of Steering Vectors Is Separable and Reducible

Steering Vectors are an Adversarial Attack Surface

Activation Steering Induces Emergent Misalignment: Steering Vector Construction and Comprehensive Evaluation