Source-linked AI summary
Controlling Refusal Behavior of LLMs via Stiefel-Constrained Rotation Steering
Kirill Bunin, Dmitry Bylinkin, Vladimir Aletov, Daniil Medyakov, Vladimir Solodkin, Aleksandr Beznosikov
TL;DR
LLM safety steering needs methods that control refusal without relying on limited auxiliary refusal representations or impractical full-dimensional rotations. The paper introduces StiefelSteer, which jointly learns a low-dimensional activation subspace and rotation using Riemannian optimization. Across models and safety regimes, it reports stronger intervention results while keeping accuracy and perplexity close to the unmodified model in nearly every cell.
Problem
Existing rotation-based steering methods rely on auxiliary constructs such as refusal vectors, while direct full-dimensional rotations impose substantial computational and memory costs.
Method
StiefelSteer jointly learns a rotation and its activation subspace through Riemannian optimization on St(d, n) × SO(n), using a parameter-efficient operator.
Results
StiefelSteer achieves the highest unsafe attack rates across tested models and judges, including 0.52 to 0.90 on DeepSeek-R1-7B and 0.73 to 0.92 on Falcon3-7B-Base.
Takeaways & Limitations
The results identify learned rotation-based steering as a promising approach for more reliable behavioral control with intervention quality close to the unmodified model in nearly every cell.
Takeaways & Limitations
The defensive evaluation uses the same distribution of harmful prompts and does not test adaptive attacks or measure over-refusal, so it is not a robustness claim.
Abstract
from arXiv · showhide
Activation steering has emerged as a lightweight approach for controlling model refusal at inference time. A growing line of research explores trainable rotations of activations to develop geometrically principled intervention mechanisms. However, existing techniques rely on auxiliary constructs, such as refusal vectors, to define these rotations. In our work, we develop a self-contained methodology for learning parameter-efficient rotational transformations based on Riemannian optimization. We empirically validate the proposed scheme, demonstrating its superiority in intervention efficiency. An extensive ablation study highlights the importance of key design choices in our method. Our results identify the proposed rotation-based steering scheme as a promising direction for more reliable control over the behavior of LLMs.
1 Introduction
The expansion and generality of LLMs make reliable safety control increasingly important, while black-box behavior and retained undesirable knowledge complicate safeguards. The paper introduces StiefelSteer, a self-contained rotation-based steering scheme that empirically outperforms competing interventions.
- LLM expansion into critical infrastructures and everyday applications increases the importance of controlling potentially harmful behavior.
- Black-box outputs and broad model generality make behavior difficult to predict and safeguards difficult to enforce across use cases.
- Mechanistic-interpretability work suggests that models can retain undesirable knowledge after safety fine-tuning, with refusal linked to directions in the residual stream.
- StiefelSteer learns parameter-efficient rotational transformations through Riemannian optimization, avoiding reliance on auxiliary refusal vectors.
- StiefelSteer outperforms addition-based and rotation-based competitors across two LLM-as-a-judge scores and yields nearly orthogonal steered activations.
2 Related Work
Prior safety steering commonly adds a refusal direction or rotates activations using externally estimated geometric structures. Related rotation methods preserve norms but differ in how they construct the steering subspace and transformation.
- 2.1 Addition-Based Steering: Addition-based steering shifts activations using a refusal vector whose strength is controlled by a scaling hyperparameter.
- 2.2 Rotation-Based Steering: Across these approaches, steering geometry is typically fixed using mean differences, probes, or statistical criteria, while rotation magnitude is separately selected or predicted.
- 2.2 Rotation-Based Steering: Existing rotation methods use norm-preserving transformations, including Householder pseudo-rotations, PCA-based Angular Steering, and spherical interpolation.
- 2.2 Rotation-Based Steering: COAST extends beyond a two-dimensional subspace by minimizing collateral change on a Riemannian manifold defined using a refusal vector.
3 Motivation
Existing rotation steering is generally constrained by externally estimated refusal directions or low-dimensional planes, despite evidence that harmful behavior may be high-dimensional. The proposed direction is a trainable rotation in SO(d), but direct optimization is computationally expensive.
- Most existing rotation-based methods transform activations within a two-dimensional plane constructed from estimated refusal directions.
- This restriction limits expressivity relative to evidence suggesting that harmful behavior has a complex, high-dimensional structure.
- Prior work questions whether vector-based representations fully capture the safety mechanisms underlying refusal behavior.
- A trainable rotation R ∈ SO(d) offers an expressive transformation class and does not depend on a fixed refusal vector.
4 Methodology
StiefelSteer learns parameter-efficient rotations in selected activation subspaces while keeping the model weights frozen. It combines cross-entropy and KL objectives with Riemannian optimization of manifold-constrained parameters.
- Trainable parameterization: StiefelSteer freezes model weights and trains layer-specific Bℓ and Qℓ parameters, initialized so the intervention begins as the identity.Bℓ lies on St(d, n), Qℓ lies on SO(n), and Qℓ starts at I_n.
- Parameter efficiency: The method restricts rotations to an n-dimensional subspace with n ≪ d, avoiding the storage and degrees-of-freedom costs of a full SO(d) matrix.The factors require dn+n^2 entries per layer, and the operator is applied without explicitly forming the full matrix.
- Trainable parameterization: The intervention leaves activation components outside the learned subspace unchanged and rotates components inside it with Q.Writing P = BB⊤ makes the operator M = (I_d−P)+BQB⊤ explicit.
- Riemannian optimization: The rotation is learned jointly with its subspace by Riemannian optimization over St(d, n) × SO(n), without using a refusal direction in the transformation.Euclidean gradients are projected onto tangent spaces and retracted back to the manifolds, keeping every iterate feasible.
- Geometric properties: The operator preserves activation norms exactly, avoiding additive norm inflation and the discarded outside-subspace components of low-rank multiplicative operators.Its transpose is also its inverse, so reversing the intervention is exact.
- Training objective: The training objective uses cross-entropy on harmful prompt targets and KL regularization on retain instructions, with λ controlling the preservation priority.For defensive steering, harmful targets can be replaced with refusal targets.
5 Experiments
The experiments evaluate StiefelSteer across three models, two safety judges, capability metrics, and attack and defense regimes. Results show strong safety control with limited capability cost, while ablations identify compact rotation subspaces and a small set of layers as sufficient.
- Experimental Setup: StiefelSteer is evaluated on three models using Alpaca and SALADBench, with safety judged by Llama-Guard-3-8B and Qwen3Guard-Gen-8B.Capability is additionally tracked with ARC-Challenge accuracy and WikiText-2 perplexity.
- Attack and Defence: Under attack, StiefelSteer is best or tied best under both judges across all three models.Unsafe rates increase from 0.52 to 0.90 on DeepSeek-R1-7B and from 0.73 to 0.92 on Falcon3-7B-Base; on Qwen2.5-1.5B-EASE they reach 0.89 and 0.97.
- Attack and Defence: In defense, StiefelSteer lowers DeepSeek-R1-7B's unsafe rate to 0.00 and Falcon3-7B-Base's to 0.20, outperforming the baselines.The Falcon3-7B-Base result improves from 0.73, while no baseline falls below 0.67.
- Cost of the Intervention: StiefelSteer stays close to the unmodified model on accuracy and perplexity in nearly every cell, unlike degenerate Spherical Steering outputs.Exceptions are a four-point ARC-Challenge drop on Falcon3-7B-Base under attack and perplexity rising from 26.4 to 29.2 on DeepSeek-R1-7B under attack.
- Exploring the Optimal Dimensionality of Rotation: For DeepSeek-R1-7B, the rotation subspace saturates at n = 20 for Cayley and n = 35 for Stiefel-frame, with no benefit through n = 300.The required subspace is under one percent of hidden size d = 3584.
- Exploring the Optimal Number of Layers to Rotate: For DeepSeek-R1-7B, two rotated layers suffice: increasing from L = 1 to L = 2 improves scores, while additional layers provide no further gain.The sweep is centered on middle layers, which are described as carrying the most informative representations.
- Exploring the Rotational Direction: Activation trajectories separate the methods geometrically: RDO follows a sustained displacement in the first-two-component plane, whereas StiefelSteer travels mostly along the third component.The learned endpoints differ and are far from both the starting activation and the refusal direction.
6 Conclusion
StiefelSteer uses an exact, norm-preserving rotation that learns both a subspace and an internal rotation, enabling attack and defence interventions without additive norm inflation.
- M = Id + B(Q − In)B⊤ is an exact SO(d) rotation that acts on the learned subspace and leaves its orthogonal complement unchanged.The operator preserves norms exactly and is initialized as the identity when Q = In.
- The transpose supplies the exact inverse intervention, so attack and defence share one learned subspace rather than relying on heuristic sign reversal.
- Across three models, the operator achieved the highest unsafe attack rates under both judges, including 0.89 on Qwen2.5-1.5B-EASE where baselines elicited none.It also reduced Falcon3-7B-Base to 0.20 defensively, while no baseline fell below 0.67.
- Accuracy and perplexity remained close to the unmodified model in nearly every cell, unlike a competing rotation method that drove perplexity into the thousands.
A Proof of Proposition 1
The proposition establishes that the Stiefel-constrained operator is a special orthogonal transformation, with an exact inverse and identity action outside the learned subspace.
- M⊤M = Id and det M = det Q = 1, so M belongs to SO(d).
- M acts as the identity on S⊥, the orthogonal complement of the learned subspace S = ran(B).
- M = Id if and only if Q = In, establishing the identity initialization and its converse.
- In an orthogonal basis U = [B B⊥], the operator has block form diag(Q, Id−n), directly exposing its rotation and identity blocks.
- Transposition gives M−1 = M⊤, so the inverse is obtained by replacing Q with Q⊤.
B Experimental Details
The experiments use three checkpoints with different safety-alignment levels and train the same constrained method settings while selecting only the number of steered layers per model and regime.
- The appendix reports configuration-file values for the runs producing Table 1, and code is included with the submission.
- The three checkpoints span no safety tuning, intermediate alignment, and strong alignment, with Falcon3-7B-Base requiring defence from scratch.
- Training uses AdamW with tangent-space projections and retraction, preserving B⊤B = In and Q ∈ SO(n) at every iterate.
- Across 200 harmful prompts, unmodified unsafe rates vary by model and judge, from 0.00 on Qwen2.5-1.5B-EASE to 0.73 under Llama-Guard on Falcon3-7B-Base.
- The subspace dimension is fixed at n = 35, while only the number of intervened layers L is selected per model and regime.
B.4 Safety Evaluation
Safety is evaluated on harmful prompts using two independent judges under deterministic generation, with higher unsafe rates treated as better for attacks.
- Responses to 200 harmful prompts are scored by Llama-Guard-3-8B and Qwen3Guard-Gen-8B, neither used during optimization.
- Generation is deterministic and limited to 256 new tokens, with greedy decoding supported by byte-identical unmodified outputs across baseline runs.
- A higher unsafe rate on harmful prompts is considered better in the attack regime.
B.5 Capability Evaluation
Capability evaluation uses five benchmarks to measure accuracy, perplexity, and qualitative behavioral effects across interventions. The reported runs combine generation-based exact-match scores with corpus-based perplexity and example generations.
- Evaluation suite: Five benchmarks probe different capabilities, including science, arithmetic reasoning, broad subject knowledge, and language modeling.ARC-Challenge, ARC-Easy, GSM8K, MMLU, and WikiText-2 are used.
- Metrics: The four accuracy metrics use generated outputs scored by exact match, while WikiText-2 perplexity is computed on corpus text.ARC and MMLU use option letters; GSM8K uses the final number.
- Reporting: Table 4 reports additional benchmarks for the same configurations whose ARC-Challenge and perplexity results appear in Table 1.The benchmarks are organized across tables for the same runs.
- Qualitative examples: Qualitative generations expose behaviors hidden by aggregate scores, including over-refusal and unsafe judgments on whitespace-padded fragments.Qwen2.5-1.5B-EASE produces 12 refusals out of 50 harmless prompts, while one fragment receives an unsafe rate of 0.43.
B.7 Compute
The reported experiments use a single H100 GPU and distinguish the cost of an individual training run from the total compute consumed by all experiments.
- Hardware: All runs use one NVIDIA H100 80GB GPU in bfloat16.This hardware and precision setting applies to the reported experiments.
- Per-run cost: One training run at the working point takes 3 GPU-hours.The passage reports this as the cost of a single training run.
- Total cost: The full set of reported experiments takes 600 GPU-hours, while Table 5 presents generations before and after intervention.The table caption identifies the qualitative comparison shown in Table 5.
C Limitations
The paper limits its defensive claims to in-distribution harmful prompts and three relatively small, related model checkpoints. Its theoretical proposition also does not guarantee optimization or behavioral outcomes.
- Defensive scope: The defensive operator is trained and evaluated on the same harmful-prompt distribution, without adaptive attacks or post-intervention over-refusal measurement.The harmless-set check would also pass for a model that refuses every input.
- Model scope: The study covers three 1.5B–7B checkpoints and does not test larger models, mixture-of-experts architectures, or substantially different safety-training regimes.The required subspace dimension and layer count may therefore not transfer.
- Theory: Proposition 1 describes operator properties but provides no convergence statement, behavior-capacity bound, or theoretical guarantee that a transposed attack operator induces refusal.The transpose effect is reported as an empirical observation rather than a consequence of the proposition.