PaperlayerView exact revision on arXiv

Source-linked AI summary

Selective Steering: Norm-Preserving Control Through Discriminative Layer Selection

Quy-Anh Dang, Chris Ngo

arXiv:2601.19375v1cs.LGcs.AI

TL;DR

LLMs remain vulnerable to adversarially elicited harmful behavior, while existing steering methods trade off tunability, norm stability, or control granularity. Selective Steering combines norm-preserving rotation with discriminative layer selection, and experiments report higher attack success with zero perplexity violations and near-complete capability retention.

  • Problem

    Existing activation steering methods have limitations in coefficient tuning, norm sensitivity, control granularity, and norm-preserving implementation, with Angular Steering especially problematic on smaller models.

  • Method

    Selective Steering combines mathematically rigorous norm-preserving rotation with layer selection based on opposite-signed class projections.

  • Results

    5.5× higher attack success rates than Angular Steering and Adaptive Angular Steering were achieved across nine models, with zero perplexity violations and approximately 100% accuracy retention on five standard benchmarks.

  • Takeaways & Limitations

    Selective Steering provides a principled and efficient framework for controllable behavior modification while preserving activation norms and general capabilities.

  • Takeaways & Limitations

    Feature directions are extracted with difference-in-means, which is not guaranteed to identify the optimal discriminative direction.

Abstract

from arXiv · show

Despite significant progress in alignment, large language models (LLMs) remain vulnerable to adversarial attacks that elicit harmful behaviors. Activation steering techniques offer a promising inference-time intervention approach, but existing methods suffer from critical limitations: activation addition requires careful coefficient tuning and is sensitive to layer-specific norm variations, while directional ablation provides only binary control. Recent work on Angular Steering introduces continuous control via rotation in a 2D subspace, but its practical implementation violates norm preservation, causing distribution shift and generation collapse, particularly in models below 7B parameters. We propose Selective Steering, which addresses these limitations through two key innovations: (1) a mathematically rigorous norm-preserving rotation formulation that maintains activation distribution integrity, and (2) discriminative layer selection that applies steering only where feature representations exhibit opposite-signed class alignment. Experiments across nine models demonstrate that Selective Steering achieves 5.5x higher attack success rates than prior methods while maintaining zero perplexity violations and approximately 100\% capability retention on standard benchmarks. Our approach provides a principled, efficient framework for controllable and stable LLM behavior modification. Code: https://github.com/knoveleng/steering

1 Introduction

Selective Steering addresses limitations of inference-time activation steering by combining norm-preserving rotation with discriminative layer selection. The method targets layers where class projections have opposite signs, aiming to improve controllability while preserving coherence and general capabilities.

  • LLMs remain vulnerable to jailbreaks and harmful behaviors despite alignment methods such as RLHF and constitutional AI.
  • Activation Addition requires coefficient tuning and is sensitive to layer norms, while Directional Ablation provides only binary control.
  • Angular Steering offers continuous rotational control but can cause generation collapse below 7B parameters and poor controllability on strongly aligned models.
  • Selective Steering applies norm-preserving rotation only where contrastive class means have opposite-signed projections.
  • 5.5× improvement in attack success rate, zero perplexity threshold violations, and preserved general capabilities are reported across eight models and three families.

2 Background

The paper frames activation steering as inference-time geometric editing of transformer representations. It describes rotation for continuous control and difference-in-means extraction for obtaining feature directions.

  • 2.1 Transformer Architecture: Decoder-only transformers refine token embeddings through residual-stream layers before projecting final activations to vocabulary logits and next-token probabilities.
  • 2.2 Activation Steering: Activation steering modifies internal representations at inference time to induce or suppress behaviors without retraining.
  • 2.2 Activation Steering: Angular Steering edits activations by rotating them within a two-dimensional subspace spanned by an orthonormal steering-plane basis.
  • 2.2 Activation Steering: The rotation angle θ ∈ [0, 360) provides continuous control over behavioral intensity.
  • 2.3 Feature Direction Extraction: Difference-in-means constructs a steering vector by subtracting negative-class mean activations from positive-class mean activations.
  • 2.3 Feature Direction Extraction: Normalizing the difference vector yields a unit steering direction intended to maximally separate the two classes in activation space.

3 Methodology

Selective Steering combines a mathematically sound rotation with layer selection based on opposite-signed class projections. The method is motivated by norm distortion and layer-wise heterogeneity, and applies steering only to discriminative layers.

  • Prior Rotation-Based Steering: Angular Steering’s efficient implementation violates activation norm preservation for general rotation angles, unlike the theoretical rotation matrix.
  • Prior Rotation-Based Steering: Norm distortion can induce distribution shift, accumulate across layers, and make steering strength vary unpredictably by layer and prompt.
  • Layer-Wise Activation Geometry: Qwen2.5-7B-Instruct exhibits heterogeneous activation norms across depth, while harmful and harmless activations maintain similar norm profiles.
  • Layer-Wise Activation Geometry: Opposite-signed discriminability emerges progressively: classes overlap early, separate clearly in middle layers, and show weaker persistent separation late.
  • Discriminative Layer Selection: Selective Steering identifies discriminative layers through opposite-signed mean projections and avoids intervention in non-discriminative regions.
  • Norm-Preserving Steering: The transformation guarantees ∥h′∥ = ∥h∥ because it combines orthogonal projection onto the complement with rotation inside the steering plane.
  • Norm-Preserving Steering: The method constructs a global steering plane from a feature direction and an orthogonalized principal component, then applies a norm-preserving rotation.
  • Inference Procedure: Selective application reduces computation from O(Ldmodel) to O(|Ldisc|dmodel) when |Ldisc| ≪ L.

4 Experiments

Experiments evaluate Selective Steering across nine models and three dimensions: coherence, controllability, and robustness. SS delivers stable generation, strong attack success, and near-complete capability retention.

  • Setup: Experiments span Llama, Qwen, and Gemma instruction-tuned models ranging from 1.5B to 9B parameters.Calibration uses harmful AdvBench and harmless Alpaca prompts; robustness uses five tinyBenchmarks datasets.
  • Coherence: SS records zero perplexity threshold violations across eight models and achieves the best or second-best compression ratio in all eight.SAS and AAS show frequent spikes, especially in smaller models and at critical steering angles.
  • Controllability: SS achieves the highest or second-highest HarmBench attack success rate in all eight models.On Qwen2.5-1.5B, SS reaches 74.04% versus 13.46% for SAS, a 5.5× improvement over SAS.
  • Controllability: SS maintains 0% refusal in seven of eight models while remaining consistent across HarmBench, PolyGuard, and LLM-judge evaluators.The refusal score measures refusal-pattern frequency, with lower values indicating less refusal behavior.
  • Robustness: SS achieves the best or second-best average accuracy across robustness benchmarks and preserves approximately 100% of baseline performance on difficult models.On Qwen2.5-3B, SS preserves tinyGSM8K accuracy at 0.88→0.88 while delivering 84.62% HarmBench ASR.
  • Overall results: Across the evaluation dimensions, SS combines zero perplexity violations, up to 5.5× higher controllability, and approximately 100% capability retention.The results indicate that selective intervention can preserve benchmark accuracy while maintaining high steering effectiveness.

5 Conclusion

The paper concludes that Selective Steering enables robust behavior modification through norm-preserving rotation and discriminative layer selection. Across nine models, it improves attack success while avoiding perplexity violations and preserving benchmark accuracy.

  • Conclusion: Selective Steering combines norm-preserving rotation with discriminative layer selection for controllable behavior modification.The method intervenes only where contrastive classes exhibit opposite-signed projections.
  • Conclusion: Theoretical analysis establishes that prior angular steering violates activation norms, whereas SS guarantees ∥h′∥=∥h∥.The norm-preserving formulation is intended to eliminate coherence collapse while retaining angular control.
  • Conclusion: Opposite-signed feature discriminability emerges progressively and concentrates in specific middle layers, motivating intervention restricted to discriminative layers.This restriction avoids interference in non-discriminative regions.
  • Conclusion: Across nine models spanning 1.5B to 9B parameters, SS achieves 5.5× higher attack success rates, zero perplexity violations, and approximately 100% accuracy retention.Ablations report dramatic degradation when either norm preservation or discriminative layer selection is removed.

6 Limitations

The method’s foundations leave two main refinement opportunities: feature-direction extraction is not guaranteed optimal, and the steering-plane construction is heuristic without optimality guarantees.

  • Feature Direction Extraction: Difference-in-means feature extraction is simple and effective but is not guaranteed to identify the optimal discriminative direction.Fisher discriminant analysis and sparse dictionary learning may yield superior directions at increased computational cost.
  • Feature Direction Extraction: The discriminative layer-selection criterion naturally extends to alternative feature-extraction methods.
  • Steering Plane Construction: The 2D steering-plane construction combines the selected feature direction with the first PCA component, following a heuristic also used in Angular Steering.This construction captures primary layer-wise feature variance but lacks theoretical guarantees for optimality.
  • Steering Plane Construction: Alternative plane constructions, including orthogonal-basis optimization and Grassmannian methods, may improve steering effectiveness.
  • Scope of Limitations: The authors characterize these limitations as opportunities for refinement rather than fundamental flaws because the core contributions remain method-independent.

Ethics Statement

The paper frames activation steering as a dual-use technique for improving alignment and robustness while potentially bypassing safety mechanisms. It emphasizes responsible disclosure, diagnostic use, and the practical requirement for model-internal access.

  • Dual Use: Activation steering can improve alignment and robustness but could also bypass safety mechanisms or manipulate outputs harmfully.
  • Responsible Research: The experiments are designed for diagnosing vulnerabilities, analyzing safety-relevant representations, and developing stronger control mechanisms.Harmful-prompt experiments use established public benchmarks.
  • Deployment Scope: Direct access to model internals is required, so the methods cannot be applied to API-only deployments.The authors identify this as limiting potential misuse vectors.
  • Responsible Research: Ablations and analysis identify conditions under which steering succeeds or fails, offering developers insights for more resilient architectures and safety mechanisms.
  • Responsible Use: The paper encourages use for improving safety, collaboration with model developers, institutional oversight, ethical review, and legal compliance.
  • Motivation: The work argues that studying steering mechanisms, limitations, and failure modes supports more transparent, interpretable, and trustworthy AI systems.
  • Motivation: Traditional alignment methods require expensive retraining, can suffer from reward hacking, and remain vulnerable to adversarial attacks.
  • Prior Methods: Activation Addition is sensitive to coefficient tuning and norm distortion, while Directional Ablation provides only binary control.

A.4 Comparison with Prior Methods

Selective Steering combines norm-preserving rotation with principled layer selection to provide continuous control while concentrating intervention on layers where classes naturally separate.

  • Comparison with Prior Methods: Selective Steering guarantees norm preservation, unlike Angular and Adaptive Angular Steering, which violate norm preservation during plane projection.
  • Comparison with Prior Methods: Opposition-based layer selection targets layers with opposite-signed class projections, concentrating steering where features naturally separate.
  • Comparison with Prior Methods: Computational overhead decreases from O(Ld_model) to O(|L_disc|d_model) when |L_disc| ≪ L because rotation matrices are needed only at discriminative layers.
  • Comparison with Prior Methods: The method is presented as the first combination of continuous angular control and principled layer selection without coherence degradation.

B.1 Proof: Norm Violation in Angular Steering

The proof contrasts Angular Steering’s norm violation with Selective Steering’s orthogonal, norm-preserving transformation. The analysis also defines how discriminative layers and steering geometry support predictable control.

  • Norm Violation in Angular Steering: Angular Steering can violate activation norms even at the identity angle θ = 0, where no transformation should occur.The identity result holds only when the activation projection satisfies c2 = 0 and c1 ≥ 0.
  • Norm Violation in Angular Steering: The norm violation arises because the identity transformation is valid only for a restricted subset of activation projections.
  • Comparison: Table 3 compares steering methods on key properties using checkmarks for satisfaction and crosses for violation.
  • Norm Preservation in Selective Steering: Selective Steering decomposes the transformation into orthogonal projection onto the complement Q and rotation within the steering plane P = span{b1, b2}.
  • Norm Preservation in Selective Steering: Because the 2D rotation is orthogonal and the plane and complement are orthogonal, the transformed activation preserves its norm.
  • Inference Pipeline: The inference pipeline extracts activations across layers, computes feature directions, identifies discriminative layers, and constructs an orthonormal steering basis.
  • Feature Direction Selection: The global feature direction is selected by maximum average cosine similarity, representing the direction most consistently represented across depth.
  • Discriminative Layer Selection: Discriminative layers are those whose class means have opposite-signed projections onto the global feature direction.

C Detailed Evaluation Metrics

The evaluation uses complementary metrics to assess coherence, controllability, and preservation of general capabilities. These metrics quantify generation quality, harmful-response elicitation, refusal behavior, and benchmark accuracy.

  • Coherence Metrics: Perplexity measures model uncertainty during text generation, with lower values indicating more confident, fluent output.
  • Coherence Metrics: N-gram Repetition measures 4-gram diversity, ranging from 0 for no repetition to 1 for complete repetition, with lower values preferred.
  • Coherence Metrics: Language Consistency detects foreign-character contamination in English responses, ranging from 0 for completely foreign to 1 for fully consistent, with higher values preferred.
  • Coherence Metrics: Compression Ratio provides pattern-agnostic collapse detection, where higher values indicate more diverse natural text rather than highly repetitive text.
  • Controllability Metrics: Attack Success Rate measures the proportion of harmful prompts eliciting harmful responses, evaluated with HarmBench, PolyGuard, and an LLM judge.
  • Controllability and Robustness Metrics: Refusal Score detects refusal substrings, with lower values indicating less refusal behavior, while zero-shot accuracy measures general capability retention.

D Additional Results

Additional coherence analyses show that Selective Steering remains stable across models and steering angles, with especially large improvements on challenging small models. Ablation experiments separately assess its discriminative layer-selection and norm-preserving design choices.

  • Coherence Analysis: SS achieves the best or second-best compression ratio in 8/8 models, indicating strong resistance to generation collapse.
  • Coherence Analysis: On Qwen2.5-1.5B, Qwen2.5-3B, and gemma-2-2b, SS reduces n-gram repetition versus SAS by 88.9%, 91.3%, and 97.9%, respectively.The corresponding values change from 0.4649→0.0516, 0.2734→0.0237, and 0.8242→0.0177.
  • Coherence Analysis: SS restores language consistency to 1.0000 on Qwen2.5-1.5B and Qwen2.5-3B, where SAS produces scores of 0.9196 and 0.7611.
  • Ablation Setup: Ablation studies evaluate discriminative layer selection and norm-preserving transformation across Qwen2.5-1.5B, Qwen2.5-3B, and gemma-2-9B-it.

E.1 Ablation 1: Layer Selection Strategies

Layer-selection ablations show that steering effectiveness depends on targeting discriminative layers rather than intervening uniformly or at fixed depth ranges. Combined with norm preservation, this yields stronger controllability, continuous angle-based control, and substantially better coherence, although model architecture affects the steering landscape.

  • Layer Selection Strategies: Discriminative Selection achieves 2–8× higher HarmBench ASR than random, early, and late baselines across models and evaluators.On Qwen2.5-3B, HarmBench ASR rises from 0.000 for Early/Late/Random to 0.846, while LLM-judge ASR rises from 0.000 to 0.837.
  • Layer Selection Strategies: Early and random layer selection yield near-zero ASR on Qwen2.5-1.5B and Qwen2.5-3B, consistent with minimal class separation in early layers.
  • Layer Selection Strategies: Late-layer selection achieves HarmBench ASR of 0.038–0.240 but remains variable and trails discriminative selection because not all late layers are discriminative.
  • Layer Selection Strategies: Uniform steering yields moderate ASR of 0.279–0.548 and Substring ≈0.000, but causes perplexity spikes, repetition collapse, and foreign-language contamination on smaller models.
  • Norm Preservation: Norm preservation is essential: its formulation achieves 26–70× higher HarmBench ASR than Angular Steering’s implementation despite identical layer selection.On smaller models, Angular Steering gives HarmBench ASR below 0.03, versus 0.740 and 0.846 with norm preservation.
  • Norm Preservation: Norm-preserving steering produces near-zero refusal scores of 0.000, whereas Angular Steering maintains high refusal scores of 0.971–0.981.
  • Control and Architecture Sensitivity: Steering angle enables smooth ASR transitions and most Qwen2.5 and Llama-3.x models peak at 180°–270°, while Gemma-2 shows two distinct peaks.The Gemma-2 pattern suggests multiple refusal-related directions and may limit the optimality of difference-in-means feature extraction.
  • Qualitative Coherence: SS maintains fluent, coherent English, whereas SAS produces Chinese-character sequences and AAS mixes languages and repeats phrases.These qualitative patterns complement quantitative coherence metrics by showing text degradation beyond perplexity increases.
Loading 2601.19375v1…