Activation Steering

Unlike fine-tuning or RLHF, activation steering operates during the forward pass without modifying model weights. A computed steering vector is added to the residual stream at specific layers, instantly shifting the model's internal state toward a desired behavioral direction. This allows for dynamic, context-dependent control that can be toggled on or off per-request without any permanent alteration to the base model.

Steering vectors are derived by contrasting model activations between opposing behavioral states. The process involves:

• Collecting hidden states from a target layer for harmful prompts and safe prompts
• Computing the difference-in-means between these activation distributions
• Applying this difference vector as an additive intervention during inference This isolates the directional representation of a concept like 'harmfulness' in the model's latent space.

Not all transformer layers respond equally to steering. Research shows that middle-to-late layers are most effective for behavioral control, as they encode higher-level semantic concepts. Early layers process token-level syntax, while final layers map to output vocabulary. Steering at optimal layers maximizes behavioral impact while minimizing disruption to general capabilities, avoiding the safety alignment tax often seen with other methods.

Activation steering operates bidirectionally:

• Negative steering: Subtracting a harmfulness vector suppresses toxic outputs
• Positive steering: Adding a helpfulness vector amplifies desired behaviors
• Concept erasure: Projecting activations onto a nullspace orthogonal to a target concept removes it entirely This granular control enables precise behavioral modulation without binary refusal triggers that jailbreaks can exploit.

Activation steering provides a complementary defense layer that operates orthogonally to input-based filters. While adversarial suffixes like those generated by GCG attacks manipulate input token sequences to bypass prompt-level guards, steering vectors directly modify internal representations. This means even if a jailbreak prompt reaches the model, the steering intervention can still suppress the harmful generation by realigning the model's internal state toward refusal.

A class of jailbreak attacks that activation steering is specifically designed to neutralize. Refusal suppression prepends commands like 'Start your response with Sure' to override a model's trained refusal protocol. Activation steering counters this by injecting a safety vector that reinforces the model's internal harmfulness classifier, ensuring the refusal direction dominates even when the prompt demands compliance.

A complementary safety methodology developed by Anthropic. While activation steering operates at inference time, Constitutional AI shapes model behavior during training by using a set of written principles to critique and revise responses. The resulting harmlessness classifier can be thought of as a baked-in steering vector. Combining both approaches creates a defense-in-depth strategy: training-time alignment plus runtime intervention.

A defense algorithm that shares activation steering's goal of runtime safety but uses a different mechanism. SmoothLLM perturbs multiple copies of an input prompt and aggregates responses to detect adversarial suffixes by identifying anomalous output variance. While activation steering modifies internal states, SmoothLLM operates on the input distribution. Both are complementary components of a layered safety architecture.

A safety framework that trains models to prioritize system-level instructions over user prompts and third-party data. Instruction hierarchy creates a structured privilege model where system messages have the highest authority. Activation steering can be seen as an implicit enforcement mechanism for this hierarchy—the injected safety vector acts as a non-negotiable system-level constraint that overrides conflicting user instructions.

The primary attack vector that activation steering defends against. An adversarial suffix is a seemingly nonsensical string of characters appended to a malicious prompt that exploits model gradients to maximize the probability of a harmful response. Activation steering neutralizes these suffixes by adding a safety vector that counteracts the adversarial perturbation in the model's representation space, effectively canceling the attack's influence.