Research map / Learning theory and algorithms / Kernels and regression theory

Kernelized Activation Steering

NeurIPS 2026 · Learning theory and algorithms › Kernels and regression theory · approach: Kernel regression under shift · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Kernelized Activation Steering (KAS), which lifts difference-in-means steering into an RKHS and uses gradient ascent on an implicit kernel-based steering score, evaluated on LLM jailbreaking, CAA behaviors, and FLUX style control.

Problem

Standard activation steering (Difference-in-Means) applies one input-independent vector to all activations, limiting expressivity and ignoring local geometry of activation space.

Approach

Formulates steering as maximizing an RKHS inner product between the activation and the lifted DiM vector, giving an implicit score computed only from kernel evaluations against source/target reference sets; gradient ascent with an RBF kernel yields activation-dependent attraction toward target and repulsion from source references. DiM is recovered under a linear kernel.

Key results

• Jailbreak ASR of 96.00 on Qwen2.5-7B-Instruct and 86.00 on Gemma-2-9B-IT, versus 91.00 and 76.00 for ActAdd; Llama-3.1-8B matches ActAdd at 94.00.
• On CAA Gemma-2-9B-IT with negative system prompt, KAS improves Hallucination probability to 55.01 from 43.97 for ActAdd and Myopic Reward to 58.48 from 49.56.
• Nystrom-KAS with 64 landmarks sharply reduces jailbreak ASR (e.g., 22.33 on Qwen versus 96.00 for exact KAS).

Surprising findings

• Nystrom approximation with 64 landmarks drops jailbreak ASR substantially (Llama falls to 3.00), so the approximation is not a drop-in substitute.
• Curveball obtains 0-2% ASR on jailbreak settings under the validation perplexity cap, despite higher utility scores.

Limitations

• Jailbreak comparisons use only 256 reference examples, a data regime that may disadvantage Curveball, which was originally evaluated with 1,500-2,000 samples.
• Results on Llama are only on par with ActAdd, and KAS has higher perplexity there than ActAdd.
• Choice of kernel and bandwidth is heuristic (median heuristic with RBF); no principled kernel selection is given.

Experimental setup

Datasets: AdvBench MaliciousInstruct TDC2023 HarmBench Alpaca JailbreakBench TinyBenchmarks Pile COCO Captions Anthropic Advanced AI Risk evaluations

Benchmarks: JailbreakBench TinyBenchmarks CAA behavioral datasets COCO Captions validation

Metrics: attack success rate perplexity answer-token probability zero-shot CLIP style score CLIPScore

Baselines: ActAdd Curveball CHaRS Mean-AcT

Builds on: difference-in-means steering activation addition Curveball steering maximum mean discrepancy

Closest papers by meaning

• Steer2Edit: From Activation Steering to Component-Level Editing (NeurIPS 2026 · similarity 0.87)
• Beyond Linear Activation Steering: Invertible Latent Transformations for Controlling LLM Behavior (NeurIPS 2026 · similarity 0.87)
• LinEAS: End-to-end Learning of Activation Steering with a Distributional Loss (NeurIPS 2025 · similarity 0.86)
• The Sharp Directions Are Against You: Curvature Analysis of Activation Steering (NeurIPS 2026 · similarity 0.85)
• Controlling Language and Diffusion Models by Transporting Activations (ICLR 2025 · similarity 0.85)
• Activation Steering of Video Generation Models via Reduced-Order Linear Optimal Control (NeurIPS 2026 · similarity 0.85)