Steering Vectors are an Adversarial Attack Surface

Abstract

Activation steering has become a popular way to control Large Language Model (LLM) behavior without fine-tuning. Since the technique is plug-and-play, users share datasets and precomputed vectors to steer model activations. However, we show that a \emph{stealth data poisoning attack} silently compromises this pipeline. By substituting $4{-}6\%$ of tokens in the steering dataset, an attacker can silently align the resulting vector with an anti-refusal direction. This jailbreaks the target model w

Categories

Framework mappings

Suggested from the entry's categories.

@misc{aidakhmetov2026steering,
  title = {{Steering Vectors are an Adversarial Attack Surface}},
  author = {Abzal Aidakhmetov and Donato Crisostomi and Tommaso Mencattini and Adrian Robert Minut and Iacopo Masi and Emanuele Rodolà},
  year = {2026},
  month = jun,
  eprint = {2606.05958},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.05958}
}