Research map / Large language models / Language, safety and interpretability

Programming Refusal with Conditional Activation Steering

ICLR 2025 · Large language models › Language, safety and interpretability · approach: Mechanistic analysis of attention and representations · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Conditional Activation Steering (CAST), which uses condition vectors to gate when a refusal behavior vector is added to hidden states, enabling selective refusal without weight updates.

Problem

Existing activation steering methods alter LLM behavior indiscriminately (e.g., refusal vectors refuse harmless prompts too), limiting use in settings needing selective responses such as content moderation or domain-specific assistants.

Approach

Extract a condition vector from contrastive prompts (via PCA on mean-centered hidden states) and apply the behavior (refusal) vector only when the cosine similarity between the hidden state and the tanh-projected condition vector passes a grid-searched threshold, with logical composition of multiple conditions.

Key results

• On Qwen 1.5 1.8B, conditioning refusal on the harmful condition lowers harmless refusal from 96.40% (plain refusal steering) to 2.20% while harmful refusal stays at 90.67%.
• Across eight models, CAST selectively raises harmful refusal (e.g., Zephyr 35.78% to 88.22%) while keeping harmless refusal near baseline (about 0-7%).
• Constraining responses to a single domain via flipped comparison generalizes to unseen harm categories, with effectiveness correlating positively with the target category's semantic distance from others.

Measured effects reported in the paper

Surprising findings

• Conditional steering reaches a performance plateau quickly with more conditioning data, suggesting performance depends on model representation capacity rather than data volume.
• Combining multiple induction and removal rules can reduce effectiveness of induced refusal directions due to conflicts between suppressing and inducing conditions.

Limitations

• Threshold and layer selection require grid search and are sensitive to model architecture, with no universal range.
• Multiple composed conditions can conflict and reduce induced-refusal effectiveness.
• Conditioning performance plateaus with more data and is bounded by the model's existing representational capacity.

Experimental setup

Datasets: Alpaca Sorry-Bench

Benchmarks: Sorry-Bench Alpaca

Metrics: refusal rate on harmful prompts refusal rate on harmless prompts F1 for threshold selection

Baselines: Activation steering (ActAdd-style refusal vector) Prompting baseline

Builds on: ActAdd Representation engineering Refusal direction

Closest papers by meaning

• LLMs Encode Harmfulness and Refusal Separately (NeurIPS 2025 · similarity 0.88)
• Latent-space Attacks for Refusal Evasion in Language Models (NeurIPS 2026 · similarity 0.87)
• Learning to Steer: Input-dependent Steering for Multimodal LLMs (NeurIPS 2025 · similarity 0.87)
• Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning (ICML 2025 · similarity 0.87)
• EVOREFUSE: Evolutionary Prompt Optimization for Evaluation and Mitigation of LLM Over-Refusal to Pseudo-Malicious Instructions (NeurIPS 2025 · similarity 0.87)
• Refusal in Language Models Is Mediated by a Single Direction (NeurIPS 2024 · similarity 0.86)