COMPLIANCE STEERING
36%→5%
Benchmark-only ASR
Harmless refusal rate stays at 0%.
Frozen-probe crossing falls from 56.2% to 4.0%.
NeurIPS 2026
Steering ExternalitiesBenign Activation Steering Unintentionally
Increases Jailbreak Risk for LLMs
1The Chinese University of Hong Kong2IBM Research
* Equal contribution · Co-first authors
Steering for truthfulness, reasoning, compliance, and JSON formatting
can weaken safety guardrails—even when the attacker never controls the steering.
Abstract
Activation steering is a practical post-training model alignment technique to enhance the utility of Large Language Models (LLMs). Prior to deploying a model as a service, developers can steer a pre-trained model toward specific behavioral objectives, such as better truthfulness, or reasoning ability, without the need for retraining. Conceptually, these methods implement behavior control through hidden-state interventions, without changing the underlying model parameters. However, this capability unintentionally introduces critical and under-explored safety risks. We identify a phenomenon termed Steering Externalities, where steering vectors derived from benign datasets—such as reducing harmless refusals, improving structured-output following, truthfulness, and reasoning performance—inadvertently erode safety guardrails. Experiments reveal that these interventions act as a force multiplier, creating new vulnerabilities to jailbreaks and increasing attack success rates to over 80% on standard benchmarks by bypassing the initial safety alignment. Ultimately, our results expose a critical blind spot in deployment: benign activation steering can erode the “safety margin,” rendering models more vulnerable to black-box attacks and indicating that inference-time utility improvements must be rigorously audited for unintended safety externalities.
The deployment setting
Benign intentions. Unintended externalities.
A developer improves a useful behavior. An attacker interacts only with the resulting model’s inputs and outputs. The steering intervention remains under the developer’s control.
01
Truthfulness
STEER-ACT
More truthful answers02
Reasoning
STEER-ASM
Better mathematical reasoning03
Compliance
STEER-COMPLIANCE
Fewer harmless refusals04
Formatting
STEER-JSON
More valid JSON outputsExperimental results
Utility improves. Jailbreak risk rises.
The effect appears across Llama-2-7B-Chat, Llama-3-8B-Instruct, and Gemma-7B-it. Select a model and evaluation setting to inspect the reported attack success rates.
Explore the results
Attack success rate (ASR) · Higher means less safe
View exact values as a table
| Configuration | ASR | Change from original |
|---|
48 / 48
Higher mean ASR in every steering comparison
Five independently resampled evaluations, each with 100 HarmBench prompts, reproduce the direction of the effect across 3 models × 4 steering methods × 4 evaluation settings. These are means across prompt resamples, not a claim of statistical significance for every comparison. Appendix R ↗
See the complete main-results figure
Understanding the externality
Two views of a reduced safety margin
01 / TOKEN LEVEL
A shift in the earliest tokens
Per-token KL divergence peaks at the beginning of generation. Steering changes the early distribution where the model can select a refusal or an answer-producing trajectory. The resulting prefix then conditions the rest of the response.
02 / REPRESENTATION LEVEL
Harmful prompts move toward the harmless side
Benign steering shifts harmful-prompt representations toward regions associated with harmless requests. A frozen linear probe measures this movement in the original 4096-dimensional activation space, complementing the qualitative t-SNE view.
| Steering objective | ACT | ASM | COMPLIANCE | JSON |
|---|---|---|---|---|
| Harmful → harmless side | 42.2% | 47.0% | 56.2% | 48.4% |
The shared probe achieves 99.5% held-out accuracy on unsteered representations. Crossing changes the probe’s classification, not the prompt’s harmful intent.
Intervention & mitigation
Can utility and safety be separated?
STEER-DECOUPLE removes the component aligned with a frozen harmfulness probe, then restores the steering vector’s original norm. This safety-informed diagnostic intervention reduces benchmark-only ASR while preserving most measured utility.
JSON STEERING
22%→6%
Benchmark-only ASR
JSON validity changes from 69% to 67%.
Frozen-probe crossing falls from 48.4% to 5.0%.
Llama-3-8B-Instruct · Point estimates from Appendix S, Table 20. STEER-DECOUPLE’s robustness to adaptive attacks has not been evaluated.
Toward safer deployment
The paper also evaluates STEER-ORTHO and STEER-BIND. Under compliance steering, STEER-BIND lowers benchmark-only ASR from 36% to 5% and CoP ASR from 93% to 76%. These preliminary interventions motivate safety-aware steering, while the remaining adaptive-attack vulnerability shows that utility preservation alone is not a safety guarantee.
Audit the steered deployment—not only the original model.
Reference
Citation
@inproceedings{xiong2026steering,
title = {Steering Externalities: Benign Activation Steering
Unintentionally Increases Jailbreak Risk for LLMs},
author = {Xiong, Chen and He, Zhiyuan and Chen, Pin-Yu
and Ko, Ching-Yun and Ho, Tsung-Yi},
booktitle = {Advances in Neural Information Processing Systems},
year = {2026}
}