Adversarial Robustness of Activation Steering in Large Language Models

2026-06-05

AI Summary

This study addresses the lack of systematic investigation into the robustness of training-free activation steering methods under adversarial textual perturbations, a gap that limits their real-world reliability. We present the first comprehensive evaluation of activation steering stability across diverse adversarial attacks, examining four direction extraction techniques—including PCA and Mean Difference—three attack strategies, and five language models ranging from 1.5B to 30B parameters. Our findings reveal that the vulnerability of activation steering is structural rather than method-specific: adversarial perturbations can reduce steering success rates by up to 64%, with model confidence typically dropping below 0.25 and the optimal intervention layer shifting by as many as 17 layers. Directions derived from perturbed data only partially restore performance, highlighting a critical failure of current layer selection heuristics under perturbation and providing essential empirical foundations for improving steering robustness.

Abstract

Activation steering has become a popular training-free method to control LLM behavior by injecting precomputed direction vectors into the model's residual stream at inference time. Yet its robustness to realistic input variation remains unstudied. We present the first systematic evaluation of activation steering robustness under adversarial text perturbations on the inputs, covering four extraction methods, three attack strategies, six personas from Anthropic Model-Written Evaluation Dataset, and five models ranging from 1.5B to 30B parameters. Attacks succeed broadly across all settings: directional robustness drops by up to 64%, post-attack confidence collapses near or below 0.25 across all methods and models, and steering strength degrades on nearly every steerable input. Layer selection is equally fragile, with the optimal layer identified by an automated method on clean inputs shifting by up to 17 positions under perturbation, a failure that compounds the vector-level breakdown. Extracting vectors from adversarially perturbed inputs partially recovers steerability for PCA and MD on mid-to-large models, but they consistently fail to locate the improved optimal layer, limiting the practical benefit of this mitigation. Together, these findings reveal that the brittleness of activation steering is structural rather than method-specific, and that current layer selection strategies are not robust enough for real-world deployment.

Problem

• Adversarial Robustness
• Activation Steering
• Large Language Models
• Input Perturbations
• Layer Selection

Innovation

• activation steering
• adversarial robustness
• large language models
• layer selection
• directional control