mlsanityData to 14 Oct 2026

RepIt: Steering Language Models with Concept-Specific Refusal Vectors

arXiv 2509.13281 ↗First posted 16 Sep 2025cs.AI cs.CLcited by 12

Not on the map. Why?

Abstract (arXiv)

Current safety evaluations of language models rely on benchmark-based assessments that may miss localized vulnerabilities. We present RepIt, a simple and data-efficient framework for isolating concept-specific representations in LM activations. While existing steering methods already achieve high attack success rates through broad interventions, RepIt enables a more concerning capability: selective suppression of refusal on targeted concepts while preserving refusal elsewhere. Across five frontier LMs, RepIt produces evaluation-evading model organisms with semantic backdoors, answering questions related to weapons of mass destruction while still scoring as safe on standard benchmarks. We find the edit of the steering vector localizes to just 100-200 residual dimensions, and robust concept vectors can be extracted from as few as a dozen examples on a single RTX A6000, highlighting how targeted, hard-to-detect modifications can exploit evaluation blind spots with minimal resources. Through demonstrating precise concept disentanglement, this work exposes vulnerabilities in current safety evaluation practices and demonstrates a need for more comprehensive, representation aware assessments.

Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Builds on 42 of its 61 references that are in the map. First posted on arXiv 16 Sep 2025.

Builds on

42 of 61 references.

References · 42

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  4. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  5. 2020Transformer Feed-Forward Layers Are Key-Value Memoriescited by 1,336
  6. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
  7. 2016Man is to Computer Programmer as Woman is to Homemaker? Debiasing Word Embeddingscited by 1,312
  8. 2023Inference-Time Intervention: Eliciting Truthful Answers from a Language Modelcited by 1,302
  9. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,085
  10. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  11. 2021Ethical and social risks of harm from Language Modelscited by 966
  12. 2023Steering Language Models With Activation Engineeringcited by 922
30 more
  1. 2023Large Language Modelscited by 780
  2. 2022Discovering Latent Knowledge in Language Models Without Supervisioncited by 767
  3. 2023The Linear Representation Hypothesis and the Geometry of Large Language Modelscited by 716
  4. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  5. 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 509
  6. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  7. 2020Null It Out: Guarding Protected Attributes by Iterative Nullspace Projectioncited by 455
  8. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 451
  9. 2023Emergent Linear Representations in World Models of Self-Supervised Sequence Modelscited by 319
  10. 2023Shadow Alignment: The Ease of Subverting Safely-Aligned Language Modelscited by 297
  11. 2023LEACE: Perfect linear concept erasure in closed formcited by 267
  12. 2023AI Control: Improving Safety Despite Intentional Subversioncited by 229
  13. 2025AxBench: Steering LLMs? Even Simple Baselines Outperform Sparse Autoencoderscited by 218
  14. 2024Programming Refusal with Conditional Activation Steeringcited by 206
  15. 2024Large Language Model Unlearning via Embedding-Corrupted Promptscited by 116
  16. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independencecited by 115
  17. 2024InferAligner: Inference-Time Alignment for Harmlessness through Cross-Model Guidancecited by 83
  18. 2024RAVEL: Evaluating Interpretability Methods on Disentangling Language Model Representationscited by 79
  19. 2024Robust LLM safeguarding via refusal feature adversarial trainingcited by 64
  20. 2024Spectral Editing of Activations for Large Language Model Alignmentcited by 56
  21. 2025AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agentscited by 42
  22. 2021The Low-Dimensional Linear Geometry of Contextualized Word Representationscited by 40
  23. 2024Model Editing as a Robust and Denoised variant of DPO: A Case Study on Toxicitycited by 35
  24. 2024Refusal in LLMs is an Affine Functioncited by 29
  25. 2023A Geometric Notion of Causal Probingcited by 25
  26. 2025Eliciting Language Model Behaviors with Investigator Agentscited by 23
  27. 2025Frontier AI's Impact on the Cybersecurity Landscapecited by 21
  28. 2025COSMIC: Generalized Refusal Direction Identification in LLM Activationscited by 19
  29. 2024Towards Inference-time Category-wise Safety Steering for Large Language Modelscited by 18
  30. 2022Better Hit the Nail on the Head than Beat around the Bush: Removing Protected Attributes with a Single Projectioncited by 17

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 12.

12 papers.

  1. 2026Steer2Adapt: Dynamically Composing Steering Vectors Elicits Efficient Adaptation of LLMscited by 7
  2. 2026When AUC 0.998 Is Not Enough: A Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agentscited by 7
  3. 2026One Bias After Another: Mechanistic Reward Shaping and Persistent Biases in Language Reward Modelscited by 3
  4. 2026Not All Refusals Are Equal: How Safety Alignment Fails Cybersecurity at Scalecited by 1
  5. 2026AntiPaSTO: Self-Supervised Honesty Steering via Anti-Parallel Representationscited by 0
  6. 2026Tracing the Dynamics of Refusal: Exploiting Latent Refusal Trajectories for Robust Jailbreak Detectioncited by 0
  7. 2026Residual Paving: Diagnosing the Routing Bottleneck in Selective Refusal Editingcited by 0
  8. 2026Inverted Detection and Control in Steering Vectorscited by 0
  9. 2026From Latents to Wires: Surgical Post-Editing on Large Language Modelscited by 0
  10. 2026The Safety Operator: Modulating the Expression of Safety Instructions via Spectral Optimizationcited by 0
  11. 2026Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisationcited by 0
  12. 2026Component and Dimension Sparsity in Transformer Refusal Mechanismscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Safety Targeted Embedding Exploit via Refinement
  2. 2024Steering Language Model Refusal with Sparse Autoencoders
  3. 2025Understanding and Mitigating Over-refusal for Large Language Models via Representation Intervention
  4. 2025From Threat to Tool: Leveraging Refusal-Aware Injection Attacks for Safety Alignment
  5. 2026RAS: Measuring LLM Safety Through Refusal Alignment
  6. 2026The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs
  7. 2025FalseReject: A Resource for Improving Contextual Safety and Mitigating Over-Refusals in LLMs via Structured Reasoning
  8. 2026Localizing Safety Alignment: MLP Layers and Mid-Network Blocks Encode Refusal Behavior in Large Language Models