AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defender

2025/04/13 by Weixiang Zhao, Jiahe Guo, Zhao, Weixiang +19 · 32 citations
Computer Science · #Computation and Language (cs.CL) #Cryptography and Security (cs.CR) #Digital and Cyber Forensics #FOS: Computer and information sciences

paper · pdf · doi:10.48550/arxiv.2504.09466

openalex publication_date 2025/04/13 · openalex created_date 2025/10/14 · openalex updated_date 2026/07/28

Abstract

Despite extensive efforts in safety alignment, large language models (LLMs) remain vulnerable to jailbreak attacks. Activation steering offers a training-free defense method but relies on fixed steering coefficients, resulting in suboptimal protection and increased false rejections of benign inputs. To address this, we propose AdaSteer, an adaptive activation steering method that dynamically adjusts model behavior based on input characteristics. We identify two key properties: Rejection Law (R-Law), which shows that stronger steering is needed for jailbreak inputs opposing the rejection direction, and Harmfulness Law (H-Law), which differentiates adversarial and benign inputs. AdaSteer steers input representations along both the Rejection Direction (RD) and Harmfulness Direction (HD), with adaptive coefficients learned via logistic regression, ensuring robust jailbreak defense while preserving benign input handling. Experiments on LLaMA-3.1, Gemma-2, and Qwen2.5 show that AdaSteer outperforms baseline methods across multiple jailbreak attacks with minimal impact on utility. Our results highlight the potential of interpretable model internals for real-time, flexible safety enforcement in LLMs.

Citations

• MPO: Multilingual Safety Alignment via Reward Gap Optimization
• JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulation
• Trading Inference-Time Compute for Adversarial Robustness
• Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroring
• Surgical, Cheap, and Flexible: Mitigating False Refusal in Language Models via Single Vector Ablation
• Programming Refusal with Conditional Activation Steering
• HSF: Defending against Jailbreak Attacks with Hidden State Filtering
• The Llama 3 Herd of Models
• Gemma 2: Improving Open Language Models at a Practical Size
• Steering Without Side Effects: Improving Post-Deployment Control of Language Models
• External Invariants: A Cryptographic Trust Architecture for Institutional AI Inference
• No Two Devils Alike: Unveiling Distinct Mechanisms of Fine-tuning Attacks
• Length-Controlled AlpacaEval: A Simple Way to Debias Automatic Evaluators
• ROSE Doesn't Do That: Boosting the Safety of Instruction-Tuned Large Language Models with Reverse Prompt Contrastive Decoding
• Towards Safer Large Language Models through Machine Unlearning
• SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding
• HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal
• InferAligner: Inference-Time Alignment for Harmlessness through Cross-Model Guidance
• Revisiting Jailbreaking for Large Language Models: A Representation Engineering Perspective
• Steering Llama 2 via Contrastive Activation Addition
• A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily
• DeepInception: Hypnotize Large Language Model to Be Jailbreaker
• Jailbreaking Black Box Large Language Models in Twenty Queries
• Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation
• Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations
• Representation Engineering: A Top-Down Approach to AI Transparency
• GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts
• GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher
• Code of "Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs"
• Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models
• Jailbroken: How Does LLM Safety Training Fail?
• Direct Preference Optimization: Your Language Model is Secretly a Reward Model
• Multi-step Jailbreaking Privacy Attacks on ChatGPT
• Automatically Auditing Large Language Models via Discrete Optimization
• Affective Coherence Monitoring for Transformer-Based Language Models
• Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback
• Training language models to follow instructions with human feedback
• A General Language Assistant as a Laboratory for Alignment
• PyTorch: An Imperative Style, High-Performance Deep Learning Library

Cited by

• SARSteer: Safeguarding Large Audio-Language Models via Safe-Ablated Refusal Steering
• Read the Scene, Not the Script: Outcome-Aware Safety for LLMs
• MLLMEraser: Achieving Test-Time Unlearning in Multimodal Large Language Models through Activation Steering
• Turning the Spell Around: Lightweight Alignment Amplification via Rank-One Safety Injection
• LLMs Encode Harmfulness and Refusal Separately
• Control at Stake: Evaluating the Security Landscape of LLM-Driven Email Agents
• RSafe: Incentivizing proactive reasoning to build robust and adaptive LLM safeguards
• Exploring and Exploiting the Inherent Efficiency within Large Reasoning Models for Self-Guided Efficiency Enhancement
• AlphaSteer: Learning Refusal Steering with Principled Null-Space Constraint
• When Less Language is More: Language-Reasoning Disentanglement Makes LLMs Better Multilingual Reasoners
• Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models

Related

• Targeting Alignment: Extracting Safety Classifiers of Aligned LLMs
• Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Models
• One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs
• AlphaSteer: Learning Refusal Steering with Principled Null-Space Constraint
• AdaPPA: Adaptive Position Pre-Fill Jailbreak Attack Approach Targeting LLMs