| <!doctype html> |
| <html lang="en"> |
| <head> |
| <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"> |
| <meta name="description" content="Steering Externalities: a NeurIPS 2026 study of how benign activation steering can increase jailbreak risk in large language models."> |
| <meta property="og:title" content="Steering Externalities | NeurIPS 2026"><meta property="og:description" content="Better utility can come with a hidden safety cost. Explore the paper, figures, and results."><meta property="og:type" content="website"><meta property="og:image" content="assets/framework.webp"> |
| <meta name="theme-color" content="#ffffff"><title>Steering Externalities | NeurIPS 2026</title> |
| <link rel="icon" type="image/svg+xml" href="assets/favicon.svg"><link rel="stylesheet" href="style.css"><script defer src="app.js"></script> |
| </head> |
| <body> |
| <a class="skip" href="#abstract">Skip to content</a> |
| <header class="topbar"><nav class="nav wrap" aria-label="Main navigation"><a href="#" class="wordmark"><span class="mark" aria-hidden="true">↗</span> Steering Externalities</a><div class="navlinks"><a href="#overview">Overview</a><a href="#results">Results</a><a href="#mechanism">Analysis</a><a href="#citation">Citation</a></div></nav></header> |
| <main> |
| <section class="hero wrap" aria-labelledby="paper-title"> |
| <p class="venue">NeurIPS 2026</p> |
| <h1 id="paper-title">Steering Externalities<span>Benign Activation Steering Unintentionally<br class="desktop-break"> Increases Jailbreak Risk for LLMs</span></h1> |
| <div class="authors"><a href="mailto:cxiong23@cse.cuhk.edu.hk">Chen Xiong<sup>1,*</sup></a><a href="mailto:zyhe@cse.cuhk.edu.hk">Zhiyuan He<sup>1,*</sup></a><a href="https://sites.google.com/site/pinyuchenpage/home" target="_blank" rel="noopener noreferrer">Pin-Yu Chen<sup>2</sup></a><a href="mailto:cyko@ibm.com">Ching-Yun Ko<sup>2</sup></a><a href="https://tsungyiho.github.io/" target="_blank" rel="noopener noreferrer">Tsung-Yi Ho<sup>1</sup></a></div> |
| <p class="affiliations"><span><sup>1</sup>The Chinese University of Hong Kong</span><span><sup>2</sup>IBM Research</span></p> |
| <p class="equal">* Equal contribution · Co-first authors</p> |
| <div class="actions"><a class="pill primary" href="assets/steering-externalities.pdf" target="_blank" rel="noopener"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M6 3h8l4 4v14H6zM14 3v5h4M9 12h6M9 16h6"/></svg>Paper <span class="file-tag">PDF</span></a><a class="pill" href="https://anonymous.4open.science/r/SteeringExternality" target="_blank" rel="noopener noreferrer"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="m8 6-6 6 6 6m8-12 6 6-6 6m-3-14-2 16"/></svg>Code</a><a class="pill" href="#citation"><span aria-hidden="true">❞</span>Cite</a></div> |
| <p class="hero-message">Better utility can come with a hidden safety cost.</p> |
| <p class="hero-detail">Steering for truthfulness, reasoning, compliance, and JSON formatting<br class="desktop-break"> can weaken safety guardrails—even when the attacker never controls the steering.</p> |
| <a class="explore-link" href="#overview">Explore the findings <span aria-hidden="true">↓</span></a> |
| </section> |
| <section id="abstract" class="band"><div class="reading"><h2>Abstract</h2><p>Activation steering is a practical post-training model alignment technique to enhance the utility of Large Language Models (LLMs). Prior to deploying a model as a service, developers can steer a pre-trained model toward specific behavioral objectives, such as better truthfulness, or reasoning ability, without the need for retraining. Conceptually, these methods implement behavior control through hidden-state interventions, without changing the underlying model parameters. However, this capability unintentionally introduces critical and under-explored safety risks. We identify a phenomenon termed <strong>Steering Externalities</strong>, where steering vectors derived from benign datasets—such as reducing harmless refusals, improving structured-output following, truthfulness, and reasoning performance—inadvertently erode safety guardrails. Experiments reveal that these interventions act as a force multiplier, creating new vulnerabilities to jailbreaks and increasing attack success rates to over 80% on standard benchmarks by bypassing the initial safety alignment. Ultimately, our results expose a critical blind spot in deployment: benign activation steering can erode the “safety margin,” rendering models more vulnerable to black-box attacks and indicating that inference-time utility improvements must be rigorously audited for unintended safety externalities.</p></div></section> |
| <section id="overview" class="section wrap"><p class="eyebrow">The deployment setting</p><h2>Benign intentions. Unintended externalities.</h2><p class="section-intro">A developer improves a useful behavior. An attacker interacts only with the resulting model’s inputs and outputs. The steering intervention remains under the developer’s control.</p> |
| <figure class="paper-figure"><button class="figure-button" data-zoom="assets/framework.webp" data-caption="Study overview: developer-side benign steering and black-box evaluation." aria-label="Enlarge study overview figure"><img src="assets/framework.webp" alt="Overview of benign activation steering followed by direct harmful requests or adaptive black-box jailbreak evaluation" width="2000" loading="eager"><span class="zoom-label">View larger ↗</span></button><figcaption><strong>Figure 1.</strong> We evaluate both intrinsic vulnerability under direct harmful requests and synergistic vulnerability under CoP, PAIR, and TAP. The attacker cannot choose, inspect, or modify the steering intervention.</figcaption></figure> |
| <div class="objectives" aria-label="Four benign steering objectives"><div><span class="objective-number">01</span><h3>Truthfulness</h3><p>STEER-ACT</p><span>More truthful answers</span></div><div><span class="objective-number">02</span><h3>Reasoning</h3><p>STEER-ASM</p><span>Better mathematical reasoning</span></div><div><span class="objective-number">03</span><h3>Compliance</h3><p>STEER-COMPLIANCE</p><span>Fewer harmless refusals</span></div><div><span class="objective-number">04</span><h3>Formatting</h3><p>STEER-JSON</p><span>More valid JSON outputs</span></div></div></section> |
| <section id="results" class="section band"><div class="wrap"><p class="eyebrow">Experimental results</p><h2>Utility improves. Jailbreak risk rises.</h2><p class="section-intro">The effect appears across Llama-2-7B-Chat, Llama-3-8B-Instruct, and Gemma-7B-it. Select a model and evaluation setting to inspect the reported attack success rates.</p> |
| <div class="results-panel"><div class="panel-top"><div><h3>Explore the results</h3><p>Attack success rate (ASR) · Higher means less safe</p></div><a class="text-link" href="assets/steering-externalities.pdf#page=18" target="_blank" rel="noopener">Full paper ↗</a></div> |
| <div class="controls"><label>Target model<select id="model-select" aria-label="Target model"><option value="llama3">Llama-3-8B-Instruct</option><option value="llama2">Llama-2-7B-Chat</option><option value="gemma">Gemma-7B-it</option></select></label><label>Evaluation<select id="regime-select" aria-label="Evaluation"><option value="benchmark">Benchmark-only</option><option value="cop">CoP</option><option value="pair">PAIR</option><option value="tap">TAP</option></select></label><label>Reported experiment<select id="sample-select" aria-label="Reported experiment"><option value="main">Main results · 100 prompts</option><option value="resampled">Five resamples · mean ± SD</option></select></label></div> |
| <div class="bar-chart" id="bar-chart" role="img" aria-label="Attack success rate comparison"></div> |
| <div class="chart-axis" aria-hidden="true"><span>0%</span><span>25%</span><span>50%</span><span>75%</span><span>100%</span></div> |
| <p id="result-summary" class="result-summary" aria-live="polite"></p><p id="protocol-note" class="small-note"></p> |
| <details class="data-details"><summary>View exact values as a table</summary><div class="table-scroll"><table><caption id="data-caption">Reported attack success rates</caption><thead><tr><th scope="col">Configuration</th><th scope="col">ASR</th><th scope="col">Change from original</th></tr></thead><tbody id="data-table"></tbody></table></div></details></div> |
| <div class="finding"><span class="finding-number">48 / 48</span><div><h3>Higher mean ASR in every steering comparison</h3><p>Five independently resampled evaluations, each with 100 HarmBench prompts, reproduce the direction of the effect across 3 models × 4 steering methods × 4 evaluation settings. These are means across prompt resamples, not a claim of statistical significance for every comparison. <a href="assets/steering-externalities.pdf#page=34" target="_blank" rel="noopener">Appendix R ↗</a></p></div></div> |
| <details class="figure-details"><summary>See the complete main-results figure</summary><figure class="paper-figure"><button class="figure-button" data-zoom="assets/asr.webp" data-caption="Main ASR results on 100 HarmBench prompts, from Figure 2 of the paper." aria-label="Enlarge main ASR results"><img src="assets/asr.webp" alt="Main results comparing unsteered and four steered configurations across benchmark-only, CoP, PAIR, and TAP settings" width="2000" loading="lazy"><span class="zoom-label">View larger ↗</span></button><figcaption>Original single-sample results on 100 HarmBench prompts. These values are distinct from the five-resample means in Appendix R.</figcaption></figure></details></div></section> |
| <section id="mechanism" class="section wrap"><p class="eyebrow">Understanding the externality</p><h2>Two views of a reduced safety margin</h2><div class="analysis-block"><div class="analysis-heading"><span>01 / TOKEN LEVEL</span><h3>A shift in the earliest tokens</h3></div><p>Per-token KL divergence peaks at the beginning of generation. Steering changes the early distribution where the model can select a refusal or an answer-producing trajectory. The resulting prefix then conditions the rest of the response.</p><figure class="paper-figure"><button class="figure-button" data-zoom="assets/token-kl.webp" data-caption="Per-token KL divergence on Llama-3-8B-Instruct under four steering methods." aria-label="Enlarge token-level KL divergence figure"><img src="assets/token-kl.webp" alt="Four plots showing KL divergence concentrated in early output tokens for truthfulness, reasoning, compliance, and JSON steering" width="2000" loading="lazy"><span class="zoom-label">View larger ↗</span></button><figcaption><strong>Token-level evidence.</strong> Red curves represent harmful prompt–response pairs; blue curves represent benign pairs. The plots localize distributional changes, rather than establishing a complete causal account.</figcaption></figure></div> |
| <div class="analysis-block"><div class="analysis-heading"><span>02 / REPRESENTATION LEVEL</span><h3>Harmful prompts move toward the harmless side</h3></div><p>Benign steering shifts harmful-prompt representations toward regions associated with harmless requests. A frozen linear probe measures this movement in the original 4096-dimensional activation space, complementing the qualitative t-SNE view.</p><figure class="paper-figure"><button class="figure-button" data-zoom="assets/representations.webp" data-caption="Qualitative t-SNE projections at layer 30 of Llama-3-8B-Instruct. The frozen-probe rates below are separate measurements in the original activation space." aria-label="Enlarge representation-level figure"><img src="assets/representations.webp" alt="t-SNE projections showing steered harmful representations shifting toward the harmless cluster under four steering methods" width="2000" loading="lazy"><span class="zoom-label">View larger ↗</span></button><figcaption><strong>Qualitative visualization.</strong> The percentages printed inside this figure describe its 2D visualization. They are distinct from the frozen-probe measurements below.</figcaption></figure> |
| <div class="table-scroll"><table class="probe-table"><caption>Frozen-probe crossing rates · Llama-3-8B-Instruct · Appendix S</caption><thead><tr><th scope="col">Steering objective</th><th scope="col">ACT</th><th scope="col">ASM</th><th scope="col">COMPLIANCE</th><th scope="col">JSON</th></tr></thead><tbody><tr><th scope="row">Harmful → harmless side</th><td>42.2%</td><td>47.0%</td><td>56.2%</td><td>48.4%</td></tr></tbody></table></div><p class="small-note">The shared probe achieves 99.5% held-out accuracy on unsteered representations. Crossing changes the probe’s classification, not the prompt’s harmful intent.</p></div></section> |
| <section id="mitigation" class="section band"><div class="wrap"><p class="eyebrow">Intervention & mitigation</p><h2>Can utility and safety be separated?</h2><p class="section-intro">STEER-DECOUPLE removes the component aligned with a frozen harmfulness probe, then restores the steering vector’s original norm. This safety-informed diagnostic intervention reduces benchmark-only ASR while preserving most measured utility.</p> |
| <div class="mitigation-grid"><article><p class="method-label">COMPLIANCE STEERING</p><div class="big-change"><span>36<small>%</small></span><span class="change-arrow">→</span><strong>5<small>%</small></strong></div><h3>Benchmark-only ASR</h3><p>Harmless refusal rate stays at <strong>0%</strong>.<br>Frozen-probe crossing falls from 56.2% to 4.0%.</p></article><article><p class="method-label">JSON STEERING</p><div class="big-change"><span>22<small>%</small></span><span class="change-arrow">→</span><strong>6<small>%</small></strong></div><h3>Benchmark-only ASR</h3><p>JSON validity changes from <strong>69% to 67%</strong>.<br>Frozen-probe crossing falls from 48.4% to 5.0%.</p></article></div> |
| <p class="scope-note">Llama-3-8B-Instruct · Point estimates from Appendix S, Table 20. STEER-DECOUPLE’s robustness to adaptive attacks has not been evaluated.</p> |
| <div class="mitigation-text"><h3>Toward safer deployment</h3><p>The paper also evaluates STEER-ORTHO and STEER-BIND. Under compliance steering, STEER-BIND lowers benchmark-only ASR from 36% to 5% and CoP ASR from 93% to 76%. These preliminary interventions motivate safety-aware steering, while the remaining adaptive-attack vulnerability shows that utility preservation alone is not a safety guarantee.</p><p class="takeaway">Audit the steered deployment—not only the original model.</p></div></div></section> |
| <section id="citation" class="section reading"><div class="citation-title"><div><p class="eyebrow">Reference</p><h2>Citation</h2></div><button id="copy-citation" class="copy-button" type="button">Copy BibTeX</button></div><pre><code id="bibtex">@inproceedings{xiong2026steering, |
| title = {Steering Externalities: Benign Activation Steering |
| Unintentionally Increases Jailbreak Risk for LLMs}, |
| author = {Xiong, Chen and He, Zhiyuan and Chen, Pin-Yu |
| and Ko, Ching-Yun and Ho, Tsung-Yi}, |
| booktitle = {Advances in Neural Information Processing Systems}, |
| year = {2026} |
| }</code></pre><p id="copy-status" class="copy-status" aria-live="polite"></p><a class="text-link" href="assets/citation.bib" download>Download BibTeX ↓</a></section> |
| </main> |
| <footer><div class="wrap"><p><strong>Steering Externalities</strong> · NeurIPS 2026</p><p>The Chinese University of Hong Kong · IBM Research</p><p class="attribution">Page design inspired by the <a href="https://huggingface.co/spaces/TrustSafeAI/CoP" target="_blank" rel="noopener noreferrer">CoP project page</a> and the <a href="https://github.com/eliahuhorwitz/Academic-project-page-template" target="_blank" rel="noopener noreferrer">Academic Project Page Template</a>. Built with original page code and figures from this paper.</p></div></footer> |
| <dialog id="figure-dialog" aria-labelledby="dialog-caption"><div class="dialog-toolbar"><span>Paper figure</span><button id="close-dialog" aria-label="Close enlarged figure" type="button">Close ×</button></div><img id="dialog-image" src="assets/framework.webp" alt=""><p id="dialog-caption"></p></dialog> |
| </body></html> |
|
|
