Search papers, labs, and topics across Lattice.
This paper investigates activation steering as a runtime defense against misalignment in LLMs, focusing on maintaining both alignment and coherence during open-ended generation. They introduce two novel projection-aware steering methods, Steer-to-Target-Projection (StTP) and Steer-to-Mirror-Projection (StMP), which selectively intervene on tokens based on distributional thresholds learned via logistic regression. Experiments on Llama-3.3-70B-Instruct and Qwen3-32B show that these methods effectively recover target traits like honesty and compassion, while better preserving general capabilities and reducing repetition compared to uniform steering.
Continuously nudging LLM activations during generation can effectively correct misalignment without sacrificing coherence, offering a lightweight runtime defense against adversarial prompts and other triggers.
Alignment in LLMs is more brittle than commonly assumed: misalignment can be triggered by adversarial prompts, benign fine-tuning, emergent misalignment, and goal misgeneralization. Recent evidence suggests that some misalignment behaviors are encoded as linear structure in activation space, making it tractable via steering, while safety alignment has been shown to govern the first few output tokens primarily, leaving subsequent generation unguarded. These findings motivate activation steering as a lightweight runtime defense that continuously corrects misaligned activations throughout generation. We evaluate three methods: Steer-With-Fixed-Coeff (SwFC), which applies uniform additive steering, and two novel projection-aware methods, Steer-to-Target-Projection (StTP) and Steer-to-Mirror-Projection (StMP), that use a logistic regression decision boundary to selectively intervene only on tokens whose activations fall below distributional thresholds. Using malicious system prompts as a controlled proxy for misalignment, we evaluate under two threat models (dishonesty and dismissiveness) and two architectures (Llama-3.3-70B-Instruct, Qwen3-32B). All methods substantially recover target traits (honesty and compassion) while preserving coherence. StTP and StMP better maintain general capabilities (MMLU, MT-Bench, AlpacaEval) and produce less repetition in multi-turn conversations.
Mila