Safety Cost of Steering Vectors Is Separable and Reducible
Not on the map. Why?
Abstract (arXiv)
Steering vectors are a lightweight tool for controlling LLM behavior. However, emerging evidence shows that steering vectors can unintentionally compromise a model's safety mechanisms and increase compliance with harmful requests, while no effective mitigation yet exists. In this work, we show that this safety degradation arises from a separable component in the vector that disrupts the model's safety mechanisms but contributes little to the steering objective. We identify and remove this safety-degrading component, formulating the task as a constrained optimization problem solved through primal-dual updates, subject to preserving the intended steering effect and bounding false refusal. The resulting solution is both interpretable and surgical: the optimization recovers a single direction whose ablation from the steering vector restores model safety with minimal utility cost. Across models, steering behaviors, and attack suites, including unseen attacks types, our method substantially reduces steering-induced safety degradation while preserving the original steering effect with minimal impact on false refusal. Our method offers a post-hoc correction to steering vectors that mitigates their safety cost, and more broadly, it provides a general recipe for applying activation-level model interventions without paying a safety tax.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 53 of its 57 references that are in the map. First posted on arXiv 9 Aug 2026.
Builds on
53 of 57 references.
References · 53
- 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
- 2024The Llama 3 Herd of Modelscited by 14,192
- 2021Training Verifiers to Solve Math Word Problemscited by 9,743
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
- 2020Measuring Massive Multitask Language Understandingcited by 7,768
- 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,747
- 2017TriviaQA: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehensioncited by 2,895
- 2019HuggingFace's Transformers: State-of-the-art Natural Language Processingcited by 2,201
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
- 2023Inference-Time Intervention: Eliciting Truthful Answers from a Language Modelcited by 1,259
38 more
- 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
- 2023Instruction-Following Evaluation for Large Language Modelscited by 1,143
- 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
- 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
- 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 828
- 2023Steering Language Models With Activation Engineeringcited by 824
- 2022Discovering Language Model Behaviors with Model-Written Evaluationscited by 805
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
- 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 702
- 2023The Linear Representation Hypothesis and the Geometry of Large Language Modelscited by 679
- 2023Safe RLHF: Safe Reinforcement Learning from Human Feedbackcited by 630
- 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
- 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 477
- 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
- 2024A StrongREJECT for Empty Jailbreakscited by 352
- 2025Persona Vectors: Monitoring and Controlling Character Traits in Language Modelscited by 303
- 2023In-context Vectors: Making In Context Learning More Effective and Controllable Through Latent Space Steeringcited by 240
- 2024SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Modelscited by 225
- 2023ToxicChat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User-AI Conversationcited by 224
- 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 222
- 2022Extracting Latent Steering Vectors from Pretrained Language Modelscited by 217
- 2024Improving Instruction-Following in Language Models through Activation Steeringcited by 149
- 2024Analyzing the Generalization and Reliability of Steering Vectorscited by 130
- 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independencecited by 104
- 2024Improving Steering Vectors by Targeting Sparse Autoencoder Featurescited by 86
- 2024Aligning Large Language Models with Representation Editing: A Control Perspectivecited by 62
- 2023All Languages Matter: On the Multilingual Safety of Large Language Modelscited by 51
- 2024Representation Surgery: Theory and Practice of Affine Steeringcited by 47
- 2024Steering Without Side Effects: Improving Post-Deployment Control of Language Modelscited by 44
- 2024A Language Model's Guide Through Latent Spacecited by 43
- 2024Navigating the OverKill in Large Language Modelscited by 40
- 2025The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directionscited by 38
- 2025One-shot Optimized Steering Vectors Mediate Safety-relevant Behaviors in LLMscited by 27
- 2024One-Shot Safety Alignment for Large Language Models via Optimal Dualizationcited by 24
- 2024Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Modelscited by 23
- 2025The Rogue Scalpel: Activation Steering Compromises LLM Safetycited by 18
- 2025Shifting Perspectives: Steering Vectors for Robust Bias Mitigation in LLMscited by 13
- 2026Analysing the Safety Pitfalls of Steering Vectorscited by 9
50 most cited of 53 All 53 (JSON)
Built on by
Not cited yet.