mlsanityData to 7 Oct 2026

AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defender

arXiv 2504.09466 ↗First posted 13 Apr 2025cs.CR cs.CLcited by 37

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Despite extensive efforts in safety alignment, large language models (LLMs) remain vulnerable to jailbreak attacks. Activation steering offers a training-free defense method but relies on fixed steering coefficients, resulting in suboptimal protection and increased false rejections of benign inputs. To address this, we propose AdaSteer, an adaptive activation steering method that dynamically adjusts model behavior based on input characteristics. We identify two key properties: Rejection Law (R-Law), which shows that stronger steering is needed for jailbreak inputs opposing the rejection direction, and Harmfulness Law (H-Law), which differentiates adversarial and benign inputs. AdaSteer steers input representations along both the Rejection Direction (RD) and Harmfulness Direction (HD), with adaptive coefficients learned via logistic regression, ensuring robust jailbreak defense while preserving benign input handling. Experiments on LLaMA-3.1, Gemma-2, and Qwen2.5 show that AdaSteer outperforms baseline methods across multiple jailbreak attacks with minimal impact on utility. Our results highlight the potential of interpretable model internals for real-time, flexible safety enforcement in LLMs.

Key facts. Cited by 37 papers in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 39 of its 55 references that are in the map. First posted on arXiv 13 Apr 2025.

Builds on

39 of 55 references.

Closest ancestors · 5

Same direction, newest first

  1. 2024No Two Devils Alike: Unveiling Distinct Mechanisms of Fine-tuning Attacks25 May
  2. 2024InferAligner: Inference-Time Alignment for Harmlessness through Cross-Model Guidance20 Jan
  3. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  4. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 34

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2024The Llama 3 Herd of Modelscited by 14,192
  4. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  5. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
  6. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
  7. 2024Gemma 2: Improving Open Language Models at a Practical Sizecited by 1,928
  8. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  9. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  10. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  11. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  12. 2021A General Language Assistant as a Laboratory for Alignmentcited by 1,023
22 more
  1. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
  2. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  3. 2024Length-Controlled AlpacaEval: A Simple Way to Debias Automatic Evaluatorscited by 865
  4. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 520
  5. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
  6. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 337
  7. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
  8. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 260
  9. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 242
  10. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decodingcited by 233
  11. 2024Programming Refusal with Conditional Activation Steeringcited by 191
  12. 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 187
  13. 2024Towards Safer Large Language Models through Machine Unlearningcited by 134
  14. 2024Adaptive Activation Steering: A Tuning-Free LLM Truthfulness Improvement Method for Diverse Hallucinations Categoriescited by 74
  15. 2025Trading Inference-Time Compute for Adversarial Robustnesscited by 60
  16. 2024Surgical, Cheap, and Flexible: Mitigating False Refusal in Language Models via Single Vector Ablationcited by 48
  17. 2025JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulationcited by 46
  18. 2024Revisiting Jailbreaking for Large Language Models: A Representation Engineering Perspectivecited by 44
  19. 2024Steering Without Side Effects: Improving Post-Deployment Control of Language Modelscited by 44
  20. 2024ROSE Doesn't Do That: Boosting the Safety of Instruction-Tuned Large Language Models with Reverse Prompt Contrastive Decodingcited by 32
  21. 2024HSF: Defending against Jailbreak Attacks with Hidden State Filteringcited by 21
  22. 2024Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroringcited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 8; 2026: 29.

37 papers.

Sort:

By area:

  1. 2025LLMs Encode Harmfulness and Refusal Separatelycited by 75
  2. 2025AlphaSteer: Learning Refusal Steering with Principled Null-Space Constraintcited by 45
  3. 2025When Less Language is More: Language-Reasoning Disentanglement Makes LLMs Better Multilingual Reasonerscited by 16
  4. 2025RSafe: Incentivizing proactive reasoning to build robust and adaptive LLM safeguardscited by 14
  5. 2025MLLMEraser: Achieving Test-Time Unlearning in Multimodal Large Language Models through Activation Steeringcited by 9
  6. 2025Exploring and Exploiting the Inherent Efficiency within Large Reasoning Models for Self-Guided Efficiency Enhancementcited by 8
  7. 2025Read the Scene, Not the Script: Outcome-Aware Safety for LLMscited by 6
  8. 2025Turning the Spell Around: Lightweight Alignment Amplification via Rank-One Safety Injectioncited by 5
  9. 2026When Personalization Legitimizes Risks: Uncovering Safety Vulnerabilities in Personalized Dialogue Agentscited by 5
  10. 2026Steering at the Source: Style Modulation Heads for Robust Persona Controlcited by 4
  11. 2026Minimizing Collateral Damage in Activation Steeringcited by 4
  12. 2026ClawLess: A Security Model of AI Agentscited by 3
25 more
  1. 2026LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safetycited by 3
  2. 2026AgentLens: Interpretable Safety Steering via Mechanistic Subspaces for Multi-Turn Coding Agentcited by 3
  3. 2026GSS: Gated Subspace Steering for Selective Memorization Mitigation in LLMscited by 2
  4. 2026TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defensecited by 2
  5. 2026Activation Steering for Aligned Open-ended Generation without Sacrificing Coherencecited by 2
  6. 2026Test-Time Safety Alignmentcited by 2
  7. 2026Low-Resource Safety Failures Are Action Failures, Not Representation Failurescited by 2
  8. 2026When is Your LLM Steerable?cited by 2
  9. 2026ShallowJail: Steering Jailbreaks against Large Language Modelscited by 1
  10. 2026Hallucination as an Anomaly: Dynamic Intervention via Probabilistic Circuitscited by 1
  11. 2026Safety Geometry Collapse in Multimodal LLMs and Adaptive Drift Correctioncited by 1
  12. 2026Safin-1: Safety from Within through Memory-Native State Evolutioncited by 1
  13. 2026Why Do Large Language Models Generate Harmful Content?cited by 0
  14. 2026A Systematic Study of Training-Free Methods for Trustworthy Large Language Modelscited by 0
  15. 2026Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Modelscited by 0
  16. 2026Mitigating Adaptive Attacks against Reasoning Models with Activation Consistency Trainingcited by 0
  17. 2026Harnessing Textual Refusal Directions for Multimodal Safetycited by 0
  18. 2026ALTSTEER: Selective Safety Steering for Moving Beyond Hard Refusals to Constructive Alternativescited by 0
  19. 2026The Safeguard Worked. Is the LLM System Safer?cited by 0
  20. 2026SafeTune: A Unified Faithful Library for Auditing and Repairing Safety Drift in Fine-Tuned LLMscited by 0
  21. 2026Guarded Gradient-Based Activation Steering of Shutdown Responses in Qwen3.5-0.8B: A Minimum-Step Policycited by 0
  22. 2026Adaptive Multi-Value Control in LLMs via Causal Activation Steeringcited by 0
  23. 2026How to Tame a Multi-Headed Hydra? Adaptive Multi-Category Safety Steering for Large Language Modelscited by 0
  24. 2026Constitutional adapters: Inference-time interventions for misalignment and misusecited by 0
  25. 2026PatchBench: Measuring Collateral Damage in Activation Patchingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Causal Front-Door Adjustment for Robust Jailbreak Attacks on LLMs
  2. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing
  3. 2025PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks
  4. 2025Beyond Surface Alignment: Rebuilding LLMs Safety Mechanism via Probabilistically Ablating Refusal Direction
  5. 2025Targeting Alignment: Extracting Safety Classifiers of Aligned LLMs
  6. 2025Formalization Driven LLM Prompt Jailbreaking via Reinforcement Learning
  7. 2025One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs
  8. 2024Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment