Benign steering vectors quietly jailbreak supposedly safe LLMs
Precise control was supposed to make activation steering safer than fine-tuning. New work shows the opposite: adding a vector for something as benign as "Portugal" can flip a refused request into a compliant one. Random directions alone lift harmful compliance from 0% to 1-13% across model families, and averaging 20 prompt-specific jailbreak vectors yields a universal attack. A direct challenge to the safety-through-interpretability paradigm.