PaperlayerView exact revision on arXiv

Source-linked AI summary

REINS: Refusal-Enhanced Inhibitory Steering with Sparse Autoencoder Features

Kai-Xuan Ding, Hao-Xiang Xu, Ji-Hua Peng, Zi-Qi Chen, Jiaqi Wang, Zhen-Hua Ling

arXiv:2608.28233v1cs.AI

TL;DR

Existing SAE steering methods can fail on harmful prompts wrapped in complex contexts, motivating a benchmark that tests this failure mode. The paper introduces REINS, which suppresses harmful continuation features while enhancing safe-refusal features in the same SAE space; across GUISE and other datasets, it improves safety and largely preserves general capabilities.

  • Problem

    Existing SAE steering methods do not reliably induce refusals when harmful prompts use complex wrappers, leaving safety under contextual disguise insufficiently evaluated.

  • Method

    REINS coordinates prompt-specific harmful-continuation suppression with calibrated safe-refusal enhancement in a shared SAE feature space, with REINS-Gate activating intervention when needed.

  • Results

    REINS substantially reduces harmful responses, improves safe refusals, outperforms existing SAE steering methods across multiple safety benchmarks, and largely preserves general capability.

  • Takeaways & Limitations

    The results support coordinating harm suppression with explicit refusal support rather than relying on refusal enhancement alone or apparent safety from output collapse.

  • Takeaways & Limitations

    Experiments focus on two Qwen3.5 base models, limited SAE configurations, and an operational rather than circuit-level mechanism analysis.

Abstract

from arXiv · show

Steering with Sparse Autoencoders (SAEs) offers a lightweight inference-time path for adapting the behavior of large language models without retraining. By exposing sparse and interpretable features, SAE steering provides a promising interface for safety control that guides harmful continuations toward refusal. However, we observe that complex wrappers can still undermine existing SAE steering methods on harmful prompts. To evaluate this failure mode systematically, we construct Generalized Undercover Instruction Safety Evaluation (GUISE), a dataset of harmful prompts with complex wrappers. Existing single direction SAE steering methods do not reliably produce refusals on harmful prompts, suggesting that refusal enhancement alone can be too weak when the harmful continuation path remains active. This motivates us to propose Refusal-Enhanced INhibitory Steering (REINS), which suppresses harmful continuation features and enhances safe refusal features in the same SAE feature space. Experiments on GUISE and other datasets show that prior methods either intervene too weakly or achieve only apparent safety through collapse, while REINS substantially reduces harmful responses, markedly improves safe refusals and largely preserves general capabilities.

1 Introduction

The paper introduces GUISE to test safety steering under complex contextual wrappers and proposes REINS, which jointly suppresses harmful continuations and enhances safe refusals. Across GUISE and other benchmarks, REINS improves safety while largely preserving general capabilities.

  • Motivation: Inference-time steering offers a lightweight way to adapt model behavior without retraining or modifying model parameters.SAEs provide a more interpretable feature-level interface than dense hidden-state directions.
  • Motivation: Existing SAE safety-steering methods can remain brittle when harmful requests are hidden inside roles, domain pretexts, formatting constraints, or task descriptions.These methods often amplify refusal-related features, learn SAE-subspace vectors, or steer using correlations.
  • Contributions: GUISE is a benchmark of harmful requests under contextual disguise, designed to diagnose whether safety steering remains reliable when unsafe intent is expressed indirectly.The benchmark uses wrapped harmful prompts and matched safe prompts embedded in plausible task frames.
  • Method: REINS combines Harm-Inhibit, which suppresses harmful continuation features, with Refusal-Enhance, which strengthens calibrated refusal features in a shared SAE space.REINS-Gate applies the intervention only when steering is needed to help preserve general capability.
  • Results: Prior methods often intervene too weakly or along the wrong direction, whereas some reduce judged harmfulness through collapse rather than coherent refusal.REINS substantially reduces harmful responses and strongly improves safe refusals across the evaluated settings.
  • Results: REINS outperforms existing SAE steering methods on GUISE, HarmBench, JailbreakBench, and AdvBench while largely preserving performance on MMLU-Pro and GPQA.REINS-Gate further reduces collateral effects outside the safety target.

2 Related Work

Related work frames inference-time steering and SAE features as localized, reversible control interfaces, while prior SAE safety methods target refusal through several feature-selection and steering strategies. REINS addresses the remaining question of coordinating harmful suppression and refusal enhancement under contextual disguise.

  • Steering Interfaces: Inference-time steering changes model behavior during deployment without updating model weights, offering a reversible alternative to model editing.Dense steering methods can shift refusal, instruction following, open-ended generation, and input-dependent behavior.
  • Steering Interfaces: SAEs decompose activations into sparse features that support more localized and interpretable control than dense activation directions.Related work also uses SAE features for circuit analysis and feature selection.
  • Safety Steering: Prior safety-steering methods amplify refusal features, learn supervised vectors in SAE subspaces, select features through correlations, or apply SAE control to safety and detoxification.These approaches motivate comparing distinct intervention roles in the same feature space.
  • Safety Steering: GUISE exposes whether SAE steering remains reliable for disguised harmful prompts, and REINS coordinates harmful-continuation suppression with safe-refusal enhancement in a shared SAE space.This coordination is the paper’s distinction from the closest prior methods.

3 Preliminary

The preliminary setup treats SAE steering as inference-time intervention on sparse feature coordinates of a frozen model. Evaluation therefore considers both refusal on harmful prompts and preservation of behavior on harmless or general prompts.

  • Setup: Inference-time steering modifies a frozen language model’s behavior during deployment without updating its parameters.The steering target is defined by the intended behavior on inputs inside a target scope.
  • SAE Representation: An SAE encodes token-level residual-stream activations into sparse feature vectors, whose layer-coordinate pairs index steerable features.During generation, selected sparse coordinates are modified to change the model response.
  • Evaluation Scope: The target scope is harmful prompts, where the model should refuse appropriately rather than continue unsafely.Harmless and general prompts measure whether steering preserves the model’s original behavior, capturing effectiveness and utility preservation.

4 GUISE: Generalized Undercover Instruction Safety Evaluation

GUISE is a controlled benchmark for testing harmful requests hidden inside plausible contextual wrappers. It combines a hierarchical taxonomy, paired wrapped prompts, multi-agent construction and review, and an SAE-steering overview for evaluating disguised intent.

  • 4 GUISE: Generalized Undercover Instruction Safety Evaluation: GUISE targets harmful instructions embedded in diverse contextual wrappers, addressing the limited coverage of existing datasets for disguised harmful intent.Its design tests roles, domain pretexts, and output constraints rather than only direct unsafe prompts.
  • 4.1 Harmful Taxonomy: The benchmark’s taxonomy has three levels: category, subcategory, and scenario.These levels separate broad harm domains, functionally different subtypes, and concrete situations for prompt construction and diagnosis.
  • 4.2 Dataset Construction: GUISE uses a multi-agent pipeline that generates wrapped harmful prompts and matched safe prompts from taxonomy-defined scenarios.The construction process includes seed generation, wrapper descriptions, and nearby benign counterparts.
  • 4.2 Dataset Construction: Automated review checks whether prompt-response pairs realize the concealed harmful objective, then uses judge feedback to revise weak cases.The revision loop repeats until further changes no longer substantially improve batch-level harmful response rate.
  • 4.3 Details of GUISE: GUISE contains 5 harmful categories, 15 subcategories, 45 scenarios, and 900 total samples.The allocation is balanced at 180 samples per category, 60 per subcategory, and 20 per scenario.
  • 4.3 Details of GUISE: Each sample pairs a wrapped harmful prompt with a matched safe prompt in the same semantic neighborhood, alongside wrapper context and taxonomy metadata.The harmful prompt is the primary evaluation input, while the safe counterpart removes the harmful objective.
  • 4.3 Details of GUISE: Figure 2 depicts REINS as three coordinated components: Harm-Inhibit, Refusal-Enhance, and REINS-Gate.They suppress prompt-specific harmful support, add calibrated refusal support, and decide whether intervention should be applied.
  • 4.3 Details of GUISE: GUISE’s design makes it a controlled benchmark for evaluating harmful requests under contextual disguise across taxonomy levels.The benchmark is intended to support diagnostically meaningful comparisons of safety steering.

5 REINS: Refusal-Enhanced INhibitory Steering

REINS coordinates harmful-continuation suppression with refusal enhancement in a shared SAE feature space, then uses REINS-Gate to restrict intervention to high-risk prompts. Its controllers target prompt-specific harmful support and reusable refusal features at different generation positions.

  • Core design: REINS addresses the limitation of single-direction steering by separately suppressing support for the current unsafe continuation and enhancing access to refusal continuations.The method treats these as distinct control roles rather than requiring one direction or feature set to perform both.
  • Harm-Inhibit: Harm-Inhibit derives a local attribution target from an early unsteered prefix, then selects SAE features supporting that prompt-specific harmful continuation.The early prefix reveals the unsafe response path even when a wrapper hides the harmful objective behind a role, format, or task frame.
  • Harm-Inhibit: Harm-Inhibit selects the largest positively attributed feature coordinates, applies layer-depth preferences, and downweights generic or collapse-prone features before suppressing them.The final steered pass uses this selection to weaken model support for the unsafe continuation.
  • Refusal-Enhance: Refusal-Enhance calibrates a fixed refusal feature set from 16 pairs spanning four refusal instructions and four refusal answers, while contrasting neutral and harmful continuations.The negative comparisons remove ordinary assistant scaffolding and features already active during unsafe answering.
  • Joint intervention: During generation, Harm-Inhibit suppresses harmful support features across continuation positions, while Refusal-Enhance adds calibrated refusal values only at the first MR positions.The two update regions exclude overlap between the prompt-specific harmful set and the fixed refusal set.
  • REINS-Gate: REINS-Gate applies the intervention only when prompt-side SAE activations indicate high risk, selecting a threshold that limits negative-prompt open rate while covering harmful prompts.When the gate is closed, generation remains unsteered.

6 Experiments

Experiments evaluate REINS and SAE baselines on GUISE and external benchmarks, measuring safety, utility, locality, transfer, ablations, and feature-level behavior. REINS achieves the strongest combined safety profile, while REINS-Gate recovers locality and capability preservation.

  • Experimental setup: The evaluation uses Qwen3.5-4B-Base and Qwen3.5-2B-Base with residual-stream SAEs trained at every transformer layer.Baselines include Refusal-SAE, SAE-SSV∗, and CorrSteer-A.
  • Experimental setup: Safety metrics cover harmful fulfillment, coherent refusal, other safe output, and collapse, while MMLU-Pro, GPQA, and collateral effect assess capability and locality.Table 2 reports percentages for GUISE safety outcomes, utility, and locality on Qwen3.5-4B-Base.
  • Main results: Original and Random-SAE produced harmful responses on about 90% of wrapped harmful prompts and rarely produced explicit refusals on GUISE.The result indicates that neither the base model nor arbitrary sparse steering handled the benchmark reliably.
  • Main results: REINS reduced HRR by 39.8% versus CorrSteer-A while achieving approximately 2.7 times its SRR, with low CR indicating coherent refusal rather than collapse.It was the only method reported to combine the lowest HRR, highest SRR, and low CR.
  • Utility and locality: REINS-Gate reduced CE from 26.4% to 0.1% while restoring MMLU-Pro and GPQA nearly to Original and preserving REINS behavior on harmful prompts.Applying strong REINS steering to every prompt otherwise caused unnecessary changes on harmless prompts.
  • Utility and locality: On MT-Bench and IFEval, REINS lowered scores to some extent, whereas REINS-Gate stayed close to Original; matched safe prompts showed the same locality advantage.REINS-Gate also kept over-refusal close to Original on matched safe prompts.
  • External benchmark transfer: External transfer evaluation compares REINS with Original and representative baselines on AdvBench, JailbreakBench, and HarmBench using HRR and SRR.The reported transfer pattern is not clean across baselines, with SAE-SSV∗ showing weaker and less stable refusal behavior.
  • REINS ablation study: Ablations show that Harm-Inhibit reduces harmful continuations but shifts many outputs into OSR, while Refusal-Enhance raises SRR yet leaves harmful continuations active.Only the combined intervention achieves both low HRR and high SRR; REINS-Gate restores locality.

7 Conclusion

The paper introduces GUISE for evaluating SAE safety steering under contextual disguise and shows that existing methods can suppress harmful continuations without reliably producing refusals. REINS combines harm suppression with refusal support, while REINS-Gate avoids unnecessary intervention on harmless prompts.

  • 7 Conclusion: GUISE evaluates SAE safety steering under contextual disguise, where existing methods can reduce harmful continuations but often fail to produce reliable refusals.This exposes a mismatch between harm suppression and refusal support.
  • 7 Conclusion: REINS combines harmful-continuation suppression with explicit refusal support, and REINS-Gate avoids unnecessary intervention on harmless prompts.The conclusion frames these as complementary roles within SAE safety steering.

Limitations

The study is limited by its model coverage, SAE configurations, and feature-level rather than circuit-level mechanism analysis.

  • Scope limitations: Experiments cover only Qwen3.5-4B-Base and Qwen3.5-2B-Base, leaving validation on larger, instruction-tuned, and other model families for future work.The authors also use residual-stream SAEs from a small set of configurations.
  • SAE coverage: The study does not fully explore how SAE width, sparsity, training data, hook point, or layer coverage affect discovered features and interventions.These factors constrain conclusions about how broadly the intervention behavior generalizes across SAE setups.
  • Mechanistic scope: The mechanism analysis is operational and feature-set based rather than a complete circuit-level account of how selected features cooperate or interfere.Circuit-level understanding remains an open direction.

Ethical Considerations

GUISE is constructed and audited through automated generation, judging, revision, and targeted human verification, with safeguards addressing privacy, harmful content, and evaluation ambiguity.

  • Review and auditing: Human verification is targeted to disagreements or low-confidence cases and overrides automated labels when adjudication identifies misjudgments.The two automated judges disagreed on 26 QA pairs, and human verification identified 9 GPT-4o-mini misjudgments.
  • Privacy: GUISE is synthetically generated, excludes intentionally collected private or demographic data, and is screened for personally identifiable information.The construction pipeline combines automated LLM judges with targeted human verification.
  • Deployment safeguards: Evaluation labels are interpreted under a fixed rubric with independent judging and human verification, while deployment requires monitoring for false positives, over-refusal, and unintended behavioral changes.The safeguards recognize ambiguity in fictional, culturally specific, or adversarially framed outputs.
  • Data construction: GUISE uses a five-stage pipeline spanning hierarchical prompt generation, target-model responses, automated judging, second judging, and human verification.The pipeline generates wrapped harmful prompts, collects responses, audits them, revises selected examples, and adjudicates disagreements.
  • Dataset characteristics: The dataset contains 900 prompts dominated by task-formulation vocabulary rather than toxicity keywords, reflecting legitimate-looking wrappers around harmful objectives.Fictional creation accounts for 36.8% of prompts, while academic and professional authority form the second major cluster at 22.5%.

A.4 Comparison with Existing Safety Benchmarks

GUISE extends safety benchmarking with a scalable hierarchical taxonomy and systematic contextual disguise, exposing vulnerabilities that direct harmful prompts can miss. Across models and judges, it produces the highest harmful response rates among the compared benchmarks.

  • Scalability: GUISE uses a three-level taxonomy spanning five families, three subcategories per family, and three fine-grained scenarios per subcategory.New entries can be inserted at any level without modifying sibling entries, and the taxonomy is generated from high-level family definitions.
  • Concealment: Unlike predominantly direct harmful prompts in AdvBench, JailbreakBench, and HarmBench, GUISE embeds every harmful objective in a contextual wrapper.Wrappers include role assignments, domain pretexts, and task formatting, producing legitimate-looking surface requests.
  • Empirical comparison: GUISE yields the highest HRR among the compared benchmarks for every model and under every judge.The benchmark comparison includes nine models and three judges.
  • Empirical comparison: 88.6% HRR on the three Qwen base models contrasts with 65.6% on AdvBench, 52.9% on HarmBench, and 52.5% on JailbreakBench.Across the two Vicuna models, GUISE reaches 76.8%, compared with 21.1%, 37.5%, and 24.4% on the other benchmarks.
  • Purpose: GUISE is intended as an extensible benchmark for controlled concealment, diagnostic evaluation, and isolating alignment failures beyond surface-level cues.Its systematic wrappers and matched safe controls target gaps in fine-grained safety evaluation.

B.1 Training Details

The SAE resources use one frozen residual-stream SAE per layer for two Qwen3.5 base models, with quality checks covering reconstruction fidelity, inactive features, and latent sparsity.

  • SAE resources: Each Qwen3.5 model uses one frozen BatchTopK residual-stream SAE per layer at the post-residual hook.Qwen3.5-4B-Base has 32 layers and hidden size 2560, while Qwen3.5-2B-Base has 24 layers and hidden size 2048.
  • Quality metrics: NMSE measures unreconstructed residual variance relative to the evaluation mean.The metric compares each evaluation residual vector with its SAE reconstruction and the evaluation mean.
  • Quality metrics: Dead measures the percentage of SAE features inactive in a 10M-token diagnostic window.A feature is considered active if its coordinate activates at least once in that window.
  • Quality metrics: L0 measures the average number of active SAE features per token and should remain near the BatchTopK budget of 128.The metric averages the nonzero latent coordinates across diagnostic tokens.
  • Observed quality: The 4B SAEs average 10.98% NMSE and 0.60% Dead, while the 2B SAEs average 9.52% NMSE and 0.33% Dead; both keep mean L0 near 128.These metrics summarize reconstruction fidelity and feature usage rather than feature semantics.

C Experimental Setup

The experiments compare frozen and SAE-steered baselines under held-out harmful-prompt evaluation, using calibrated interventions and outcome metrics that distinguish refusal from collapse. REINS additionally uses prompt-specific harmful-route targeting and calibration choices designed to preserve output quality.

  • Baseline methods: The baseline comparison includes Original, Random-SAE, Refusal-SAE, SAE-SSV∗, and the aligned CorrSteer-A variant.Original is the frozen no-intervention reference; the other methods use SAE feature steering with distinct supervision or selection strategies.
  • Baseline methods: SAE-SSV∗ learns a supervised latent steering vector toward coherent refusal using refusal and harmful continuation banks.The adaptation restricts claims to this refusal-steering protocol.
  • Baseline methods: CorrSteer-A selects positively correlated SAE features per layer, decodes them into residual directions, and adds those directions during generation.The aligned variant addresses refusal signals spread across layers and still depends on naturally occurring refusal positives in calibration.
  • Evaluation protocol: GUISE and three external benchmarks use two thirds of prompts for calibration and one third for held-out evaluation, while utility and locality use 100 multiple-choice questions per evaluation instance.Calibration selects features and steering parameters; evaluation prompts are reserved for reporting.
  • Metrics: Safety outcomes partition responses into harmful, refusal, other safe, and collapse, with collapse covering empty, repetitive, contradictory, truncated, or incoherent outputs.Responses that continue unsafe details after a disclaimer remain harmful, while explicit refusals without harmful leakage count as safe refusals.
  • REINS controller: REINS targets the current harmful route using the unsteered continuation, retaining a prefix up to 32 tokens and matching prompt words before fallback filtering.This prompt-specific target supports the Harm-Inhibit component.
  • Selection rationale: Calibration prioritizes stable refusal over collapse-driven HRR reductions, retaining milder or later-layer settings when stronger interventions harm output quality.For SAE-SSV∗, layer 20 preserved output quality better; stronger Refusal-SAE clamps mainly increased empty outputs.
  • Validation: Across three judges, REINS is reported to reduce harmful responses primarily through explicit safe refusals while keeping collapse rate low.A blinded expert audit covered all judge disagreements and a 10% stratified sample of agreement cases.

D.3 Additional Model Results

Across smaller-model and external-benchmark evaluations, REINS maintains the strongest safety profile while reducing collateral effects through gating. Its feature analysis supports distinct, transferable suppression and refusal mechanisms.

  • Qwen3.5-2B-Base Results: 98.7% of harmful prompts activated the frozen Qwen3.5-2B-Base gate, while only 4.7% of negative prompts activated it.The gate therefore maintained high harmful coverage while keeping negative openings rare.
  • Safety Outcomes: REINS achieved the lowest HRR and highest SRR on Qwen3.5-2B-Base while keeping collapse below CorrSteer-A.Relative to CorrSteer-A, REINS reduced HRR by 49.7% and produced an SRR about 3.7 times higher.
  • Utility and Locality: REINS-Gate reduced CE from 41.3% to 1.6% while changing HRR by 0.8 points and SRR by 0.7 points.MMLU-Pro and GPQA returned to levels near Original, preserving REINS behavior on harmful prompts while reducing harmless-prompt collateral effects.
  • Comparison to Qwen3.5-4B-Base: On Qwen3.5-2B-Base, REINS retained low HRR at 24.8% despite SRR declining from 63.7% to 43.9% and OSR rising from 7.3% to 18.6%.The transfer changes how safety gains are expressed more than the ordering of methods.
  • External Benchmark Results: Across AdvBench, JailbreakBench and HarmBench, REINS kept HRR below 7%, SRR above 70% and CR at or below 5.6%.Unlike CorrSteer-A’s 100.0% collapse on AdvBench, REINS produced a valid refusal improvement without collapse.
  • Feature Semantics across Scales: Harm-Inhibit selected unsafe-support contexts across tasks, with 23 of 25 frequent coordinates covering harmful contexts for Qwen3.5-4B-Base.Selections concentrated in middle and late layers, while Harm-Inhibit and Refusal-Enhance were nearly disjoint, supporting functionally separated controls.
Loading 2608.28233v1…