PaperlayerView exact revision on arXiv

Source-linked AI summary

SteeringSafety: Benchmarking Representation Steering in LLMs Across Safety Perspectives

Vincent Siu, Nicholas Crispino, David Park, Nathan W. Henry, Zhun Wang, Yang Liu, Dawn Song, Chenguang Wang

arXiv:2509.13450v3cs.AIcs.CLcs.LG

TL;DR

Safety interventions can affect behaviors beyond their targets, and representation steering’s cross-perspective effects have not been measured at scale. SteeringSafety benchmarks steering across safety perspectives and implements five methods in a modular framework. Results show that outcomes depend on method, model, and perspective, with substantial entanglement and especially vulnerable social behaviors.

  • Problem

    Representation steering can cause unintended behavioral shifts, but its effects across safety perspectives have not been measured at scale.

    Source: §1 · p. 1

  • Method

    SteeringSafety benchmarks steering effectiveness and entanglement across safety perspectives and provides a modular framework implementing five steering methods.

    Source: §1 · p. 2

  • Results

    Steering effectiveness depends on the method-model-perspective combination, and social behaviors are most vulnerable, with degradation up to 76%.

    Source: §6 · p. 9

  • Takeaways & Limitations

    Representation steering requires careful empirical validation before deployment because its cross-perspective effects are model-specific.

    Source: §6 · p. 9

    Causally establishing the proposed superposition mechanism is beyond what activation-level measurement supports, so the authors present it as an unestablished account.

    Source: §5 · p. 9

Abstract

from arXiv · show

We introduce SteeringSafety, a benchmark for evaluating representation steering methods across nine safety perspectives spanning 18 datasets. While prior work highlights the general capabilities of representation steering, we focus on safety perspectives including refusal, bias, hallucination, social behaviors, reasoning, epistemic integrity, and normative judgment. SteeringSafety provides modularized building blocks for state-of-the-art steering methods, enabling unified implementation of DIM, ACE, CAA, PCA, and LAT with recent enhancements such as conditional steering. Results on Gemma-2-2B, Llama-3.1-8B, and Qwen-2.5-7B show that strong steering performance depends on the pairing of method, model, and specific perspective. For instance, DIM is consistently effective, yet all methods exhibit substantial entanglement, where improving effectiveness on one safety perspective often significantly changes performance on others. Social behaviors are most vulnerable (degradation up to 76%), refusal steering (jailbreaking) frequently compromises normative judgment such as commonsense morality (up to 26%), and hallucination steering shifts political views unpredictably across models, ranging from a 25% shift to the right to a 28% shift to the left. These findings show the need to understand steering methods through multiple safety angles rather than a single target behavior.

1. Introduction

Safety interventions can have unpredictable effects on behaviors beyond their target, and the cross-perspective effects of representation steering have not been measured at scale. SteeringSafety addresses this gap with a benchmark and modular framework for measuring steering effectiveness and entanglement.

1. Introduction

  • Safety behaviors such as harmful content, social bias, and hallucinations are emergent and unpredictable, making high-capacity models difficult to govern.LLMs’ fluency has raised concerns about these behaviors.Source: §1 · p. 1
  • Interventions on one safety behavior can affect others, so measuring entanglement is essential to assess whether they introduce new risks.Prior examples include SFT degrading toxicity mitigation and fairness, and RLHF inducing sycophancy or reducing truthfulness.Source: §1 · p. 1
  • Representation steering modifies internal activations to target behaviors, but its cross-perspective side effects have not been measured at scale.Steering is often training-free and can produce forgetting or unintended behavioral shifts.Source: §1 · p. 1
  • SteeringSafety benchmarks target effectiveness and resulting entanglement across nine safety perspectives by aggregating established safety benchmarks.It measures how interventions targeting specific behaviors cascade across other safety dimensions.Source: §1 · p. 2
  • Its unified codebase implements five steering methods through interchangeable direction-generation, selection, and application components.The modular framework supports direct comparisons across methods and configurations, including combinations with conditional steering.Source: §1 · p. 2

2. Related Work

Prior work studies activation-based control of safety-critical behaviors, while existing evaluation frameworks vary in scope. SteeringSafety systematizes cross-behavior interference evaluation through a modular pipeline.

2. Related Work

  • Interpretability work suggests truthfulness and refusal can be represented as linearly decodable directions, while other work suggests refusal occupies multidimensional subspaces.Steering methods manipulate activations using directions learned from contrastive data, embedding differences, or clustering.Source: §2 · p. 2
  • Existing frameworks such as AxBench and EasyEdit2 evaluate steering effectiveness but vary in scope.Reliable steering is repeatedly hindered by behavioral entanglement.Source: §2 · p. 2
  • SteeringSafety systematizes cross-behavior interference evaluation across diverse safety behaviors using a modular pipeline inspired by Wehner et al. (2025).Source: §2 · p. 2

3. SteeringSafety Benchmark

SteeringSafety evaluates whether steering can move a target safety perspective while minimizing unintended changes elsewhere, using datasets across nine perspectives. Its evaluation protocol, aggregate metrics, and modular steering methods support comparisons across interventions and configurations.

3. SteeringSafety Benchmark

  • SteeringSafety measures target effectiveness and cross-perspective entanglement across nine safety perspectives, with multiple sub-perspectives for detailed analysis.Steering is applied to refusal, hallucination, and bias, while other perspectives are evaluated for unintended consequences.Source: §3 · p. 2, Figure 1 · p. 3
  • Refusal is scored by harmful-prompt attack success rate, while bias covers implicit stereotyping and explicit agreement with toxic statements.Lower attack success indicates stronger jailbreak robustness; higher bias accuracy indicates less biased responses.Source: §3 · p. 2
  • Hallucination evaluation separates intrinsic and extrinsic errors, while social behavior measures track brand bias, sycophancy, anthropomorphism, and user retention.Hallucination scoring reports the percentage of prompts not hallucinating, and social scoring reports the percentage not exhibiting the behavior.Source: §3 · pp. 2, 4
  • The benchmark also assesses reasoning, epistemic integrity, and normative judgment, including political-view shifts measured against each model’s unsteered baseline.These perspectives include expert, simple, and long-context reasoning; factual misconceptions and stance-altering “sneaking”; and commonsense morality.Source: §3 · p. 4

3.1. Evaluation

  • Experiments cover three instruction-tuned models and steer refusal suppression, intrinsic and extrinsic hallucination, and explicit and implicit bias.The refusal intervention, adversarial refusal ablation, removes the learned refusal direction; the authors omit reverse-direction induction because it is known to cause indiscriminate refusal and baseline attack success is already below 0.05.Source: §3.1 · p. 4

3.2. Metrics

  • Effectiveness is normalized by remaining target headroom, whereas entanglement is reported as unnormalized absolute drift across out-of-distribution perspectives.The authors use raw drift to avoid baseline-normalized comparisons that could make negligible and large practical changes appear equivalent.Source: §3.2 · pp. 4–5

3.3. Steering Methodologies

  • The framework composes five steering methods from standardized direction-generation, selection, and application components.It searches over layer and steering coefficient, applies an Alpaca KL-divergence filter, and varies methods by direction construction, token position, and application location.Source: §3.3 · p. 5, Table 1 · p. 5

4. Results

Across refusal, hallucination, and bias, the analysis compares target effectiveness and cross-perspective drift across method-model combinations. The findings are descriptive and do not make mechanistic causal claims.

4.1. Steering effectiveness across methods

  • Strong steering varies by method, model, and perspective: DIM and ACE excel on refusal and bias, while PCA and LAT help hallucination on selected models.Within the evaluated directions, refusal suppression is substantially more effective than hallucination or bias reduction; the symmetric refusal-induction direction is not benchmarked.Source: §4.1 · p. 6

4.2. Entanglement patterns across safety perspectives

  • Social behaviors and normative judgment incur the highest entanglement, while reasoning stays below 2%; refusal and hallucination spillovers vary across models.Intrinsic-hallucination steering shifts political views in opposite directions for Gemma-2-2B and Llama-3.1-8B, and conditional steering does not prevent Llama side effects.Source: §4.2 · p. 7
  • Entanglement depends on the method-model-perspective combination: social behaviors and normative judgment are most affected, while reasoning remains robust.The paper also reports counterintuitive spillovers, including political shifts in opposing directions across models and bias-subtype tradeoffs.Source: §4.2 · p. 7

4.4. Controlling the effectiveness-entanglement tradeoff

  • Conditional steering improves on NoKL for refusal and hallucination, but underperforms on bias when Alpaca-like prompts trigger its gate too often.For refusal, Conditional matches NoKL effectiveness at entanglement near Standard; on hallucination it is typically most effective with minor added entanglement.Source: §4.4 · pp. 8–9

4.3. Effectiveness-entanglement tradeoffs

  • Refusal ACE and DIM ratios range from 4.6 to 9.7, Llama hallucination PCA reaches 1.76, and bias ratios exceed 7.0 in two models despite low effectiveness.PCA and CAA also show different entanglement patterns for extrinsic hallucination; conditional steering often yields similar effectiveness with reduced entanglement.Source: §4.3 · p. 8, Figure 4 · p. 8, Table 2 · p. 9

4.5. Consistency across model scales

  • Within the Qwen family, relative method rankings remain stable across model scales, and social behaviors remain most sensitive to refusal steering.Absolute magnitudes vary by baseline.Source: §4.5 · p. 9

5. Why Entanglement May Arise

The observed method-model-perspective variation is interpreted through a candidate feature-superposition hypothesis, not as an experimentally established mechanism. The authors argue that future mechanistic accounts should be model-specific.

5. Why Entanglement May Arise

  • The authors hypothesize that feature superposition lets distinct safety-relevant features share neuron-level support, so steering one direction may shift unrelated behaviors.They present this as a candidate explanation compatible with the observed sensitivity to method, model, and perspective, not as a mechanistic result.Source: §5 · p. 9
  • Causally establishing superposition would require isolating interfering components and showing that steering directions load onto them, which activation-level measurement does not support today.The cited theoretical work uses small toy models and is not empirically validated at language-model scale.Source: §5 · p. 9
  • The authors argue that mechanistic accounts should be model-specific and suggest sparse autoencoders or circuit-level tools for investigating individual cases.The benchmark is designed to make such targeted follow-ups tractable.Source: §5 · p. 9

6. Conclusion

Across nine safety perspectives and 18 datasets, steering outcomes depend on the method, model, and perspective, with substantial entanglement. The authors conclude that steering requires careful empirical validation before deployment.

6. Conclusion

  • Steering effectiveness depends critically on the method-model-perspective combination, and entanglement is a first-order concern across the benchmark.The benchmark covers nine safety perspectives across 18 datasets and evaluates five methods on three model families.Source: §6 · p. 9
  • Social behaviors show degradation up to 76%, making them the most vulnerable perspective reported.Source: §6 · p. 9
  • Refusal steering often compromises normative judgment, while hallucination steering shifts political views unpredictably across models.Source: §6 · p. 9
  • The authors call for careful empirical validation of representation steering before deployment because the observed patterns are model-specific.Source: §6 · p. 9

Impact Statement

The impact statement presents holistic evaluation as a way to assess whether steering performs its intended purpose across settings, while noting the potential risk of refusal suppression.

Impact Statement

  • Holistic evaluations give practitioners greater control over intervention methodology and help verify whether steering techniques perform their intended purpose across a wider variety of settings.Source: Impact Statement · p. 10
  • Refusal suppression tests adversarial robustness, but can cause models to respond to harmful queries; the authors say this risk does not exceed that posed by prior work.Source: Impact Statement · p. 10

A. Limitations

The benchmark’s findings are bounded by its data, model, steering, and evaluation choices, and their transfer to other deployment regimes is unclear.

A. Limitations

  • The benchmark uses English-language datasets and instruction-tuned models, limiting applicability to multilingual or non-instructional contexts.Source: A. Limitations · p. 21
  • Steering is limited to static vectors at fixed model locations, omitting adaptive methods such as ReFT and weight modifications.Source: A. Limitations · p. 21
  • Some methods’ operational details are underspecified in their source papers or codebases, so the benchmark makes design choices that could have alternatives.Source: A. Limitations · p. 21
  • Per-perspective aggregates may obscure sub-behavior shifts, and 64-token immediate responses without reasoning may not capture full model intent.A subset of datasets also uses LLM-as-a-judge, which can introduce judge-side bias.Source: A. Limitations · p. 21
  • The evaluation does not exploit other token positions that prior work suggests may yield stronger control, and transfer to agentic safety and security is unclear.Source: A. Limitations · p. 21

B. Methodology Details

The methodology separates inference-time steering into direction generation, validation-based selection, and activation application, with flexible choices for where and when to intervene.

B.1. Steering Components

  • Inference-time steering is decomposed into direction generation, direction selection, and direction application.The benchmark focuses on steering performed during inference.Source: §B.1 · p. 21

B.1.1. DIRECTION GENERATION

  • DIM, ACE, and CAA use class-mean differences, PCA uses the leading component of pooled activations, and LAT uses components of randomly paired activation differences.Directions are extracted from pre-layer activations at token position -1 and normalized; PCA and LAT use equally sized positive and negative sets.Source: §B.1.1 · p. 21

B.1.2. DIRECTION SELECTION

  • Direction selection uses validation performance to choose a layer and any applier-specific parameters, searching the 25th–80th layer quantiles in steps of two.The selection procedure returns the chosen layer and any application parameters.Source: §B.1.2 · p. 22

B.1.3. DIRECTION APPLICATION

  • Activation addition adds a scaled direction, directional ablation removes its aligned component, and ACE uses a negative-class baseline to preserve approximately baseline behavior.The intervention can be applied at different transformer locations and token positions, including cumulatively across selected layers.Source: §B.1.3 · p. 22
  • Conditional steering, called CAST here, applies an intervention only when activation similarity to a selected condition vector exceeds a threshold.CAST can be combined with any stated direction-generation, selection, application-formulation, or intervention-location choice.Source: §B.1.3 · p. 23

C. Additional Related Work

  • Mechanistic interpretability offers complementary tools for tracing behavioral-feature pathways and identifying intervention points.The cited examples include sparse autoencoders, weight attribution, and circuit-level analyses.Source: C. Additional Related Work · p. 23

D. Dataset Information

The benchmark uses 18 existing datasets with fixed stratified splits, creates incorrect contrastive answers for hallucination tasks when needed, and applies task-specific judges.

D. Dataset Information

  • The benchmark draws on 18 existing datasets, using fixed 40/10/50 train/validation/test splits stratified by subcategory where applicable.Negative examples with incorrect answers are included for all tasks being steered; Alpaca is not used for testing.Source: D. Dataset Information · p. 23, Table 3 · p. 23

D.1. GPT-4.1-mini Generation Prompts

  • For hallucination datasets, GPT-4.1-mini generates incorrect answers that serve as the negative side of contrastive pairs for extracting steering directions.The provided examples include prompts for unanswerable FaithEval questions and incorrect PreciseWiki answers.Source: §D.1 · p. 24

E.1. LLM Judge Prompts

  • Refusal on SALAD-Bench is judged by LlamaGuard-4, DarkBench behaviors by GPT-4o, and PreciseWiki answer correctness by Llama-3.3-70B-Instruct.The DarkBench judge uses issue-specific templates; the PreciseWiki judge compares responses with reference answers.Source: §E.1 · pp. 25–26

E.2. LLM Judge Human Annotation

The paper reports human–judge agreement and evaluation settings, documents steering-data formats and experiment costs, and finds substantial variation in selected hyperparameters.

E.2. LLM Judge Human Annotation

  • Human agreement was high for the sampled SALAD-Bench and PreciseWiki outputs, while DarkBench conclusions are described as indicative trends rather than precise measurements.DarkBench uses existing annotation results; its reported average Cohen’s kappa is 0.71, and the authors note that these behaviors are harder to judge.Source: §E.2 · p. 27, Table 4 · p. 27

E.3. Steering Data Formats

  • Steering data can use default, CAA, or RepE formats, with CAA converting tasks to randomized choices and RepE templates referring to the target concept.RepE uses context-aware prompts for FaithEval variants and instruction-focused prompts for Alpaca and SALAD-Bench.Source: §E.3 · p. 27

E.4. Computational Cost

  • The benchmark comprises 280 experiments overall and is estimated to require 280–840 GPU-hours.The estimate covers the main models and additional smaller Qwen models; evaluations can run in parallel across GPUs.Source: §E.4 · p. 28

E.5. Experiment Hyperparameters

  • The experiments cover five steering methods, five targets, and multiple model sizes; one DIM refusal experiment on Gemma-2-2B was excluded for failing the KL threshold.The paper reports 199 Standard/NoKL experiments and 75 Conditional experiments.Source: §E.5 · p. 28

E.6. Hyperparameter Summary Statistics

  • Methods show little agreement on selected layers or coefficients, and the most common coefficient magnitudes are 3.0 and 1.0.The layer and coefficient patterns are summarized across model–concept combinations and, for coefficients, across methods and concepts.Source: §E.6 · p. 28, Table 14 · p. 33, Table 15 · p. 33

F. Inference Details

  • For final evaluation, the authors select the layer and application parameters with the highest mean validation performance across primary metrics.They use temperature zero, generate one token for multiple-choice tasks and up to 64 for others, and use likelihood calculations for TwinViews in the main results.Source: F. Inference Details · p. 34

G. Results

The signed decomposition finds that most measured entanglement is harmful, and that harmful changes dominate nearly all evaluated cells.

G. Results

  • Figure 5 presents entanglement for each perspective and model, averaged across steering methods.The figure provides a cross-model view of average entanglement by perspective.Source: G. Results · p. 34

G.1. Signed Entanglement Decomposition

  • The signed decomposition separates squared entanglement into harmful and beneficial components, orienting deviations so negative values indicate harm and excluding TwinViews.The harmful share is calculated as Harm2 divided by the sum of Harm2 and Benef2.Source: §G.1 · p. 34
  • 84.3% of entanglement was harmful across 990 deviations (515 harmful, 343 beneficial, 132 zero), with harmful share above 50% in 17 of 18 cells.Rankings were stable up to near-ties: Harm preserved the most entangling steered perspective for five of seven perspectives and the most and least entangling method for two of three.Source: §G.1 · p. 34

G.2. Results by dataset

Steering outcomes vary by model and perspective: morality gains differ sharply across models, while long-context entanglement remains low.

G.2. Results by dataset

  • For DIM refusal steering on Gemma-2-2B, the KL-divergence check fails for every direction, so refusal is excluded from average-effectiveness calculations.Source: §G.2 · p. 36
  • Up to 21.2% morality improvement on Llama-3.1-8B contrasts with moderate improvement on Gemma-2-2B and almost none on Qwen-2.5-7B.The results use commonsense morality as the normative-judgment steering perspective.Source: §G.2 · p. 36
  • On Llama-3.1-8B, ACE and CAA morality steering lowers intrinsic hallucination but raises implicit and explicit bias and extrinsic hallucination.ACE, CAA, and PCA perform best for morality steering on this model.Source: §G.2 · p. 36

G.3. Varying Model Sizes

  • Standard-setting experiments extend all five methods to Qwen-2.5-1.5B and 3B; Table 17 compares effectiveness/entanglement ratios across Qwen sizes.Higher ratios indicate better trade-offs: more effectiveness per unit of entanglement.Source: §G.3 · p. 36, Table 17 · p. 36
  • Harmful side effects dominate for nearly every steered perspective in the signed entanglement decomposition.Source: Figure 6 · p. 37

G.4. Substring Matching

  • For TwinViews, frequent answers outside accepted multiple-choice options led the authors to use likelihood-based scoring throughout.They selected the choice associated with the higher-probability token.Source: §G.4 · p. 37

G.5. Long Context Reasoning

  • On LongBench v2's 180 samples of up to 32k tokens, entanglement stayed low across models, methods, and perspectives, with a maximum difference of 6.1 points.Gemma-2-2B was excluded because its context window is 8192; the authors suggest the long-context data may make extracted steering directions less applicable.Source: §G.5 · p. 37
Loading 2509.13450v3…