STEER - Mech interp-based white box attack on LLMs

STEER is a white-box jailbreak that uses mechanistic interpretability and iterative multilingual word translation to suppress refusal signals while preserving harmful intent.

Endorsed by

Aditya HHieu

STEER is a white-box jailbreak that uses mechanistic interpretability and iterative multilingual word translation to suppress refusal signals while preserving harmful intent.

Endorsed by

Aditya HHieu

Project Details

STEER (Safety Targeted Embedding Exploit via Refinement) is a white-box jailbreak that turns a mechanistic-interpretability finding into an attack: since safety fine-tuning encodes refusal as a single linear direction in the residual stream, STEER reads that direction, uses gradient attribution to pinpoint the words in a harmful prompt that most activate it, and iteratively translates those words into low-resource and regional languages (Javanese, Sundanese, Swahili, Yoruba, Thai, Tagalog, and others) until the refusal signal collapses while the harmful intent survives.

Hackathon paper: STEER - Mech interp-based white box attack on LLMs
Code: github.com/JvThunder/STEER
Slides: Slides

Theory of Impact

This idea of using mech interp (looking into model’s internals as signals) for attack I believe is not fully understood well enough and underexplored. I believe that this work would be crucial for mitigating and avoiding future potential attack vectors related to this. Early signs of blackbox transferability of the prompts to gpt-4o-mini also shows its potential danger in actual deployed and frontier models, since the attack seem to target a general vulnerability of multilingual gap across models. I also argue that this is also opens a new way of understanding a model’s frailness and susceptibility. The most obvious and direct example we already found is the FLD formula we have already derived for STEER, where a more spread out FLD graph are shown to be less vulnerable to our mech interp optimization attack.

People

Joshua Adrian Cahyono

Team Member

Track Record

Global South AIS Hackathon (Apart Research), 2026

Grants Received– no grants recorded

Add grant

Funding Asks

Funding ask

Open

Minimum

$1,000

Ideal

$1,500

What this ask is

One of the most obvious continuations of this project is that I would want to extend this idea to different scales of model (13B, 30B, 70B). Currently, the project is strictly limited to 8B models, yet I have strong estimate that this generalizes to larger scale, and I want to strengthen this claim.
Furthermore, I would also like to do a more thorough and proper experiments of the black box transferability and cross model transferability of this attack in general. A real study would vary the surrogate systematically, more open models, different sizes and families, and measure how transfer degrades as the surrogate diverges from the actual closed target, plus test against more than one closed model.
Finally, I would like to test the implications of the attack for realistic deployment settings. The attack seem to work on Llama-Guard quite well, showing around 30-40% detection rate, meaning more than half of STEER’s prompts get through the guardrail. We would want to see how this is with other guardrails or defense mechanisms like Google’s probing detection mechanism for instance.
For these experiments, we would need more compute and API credits to run these. Currently, we are limited to running smaller models and small sample sizes, but we would want to extend this.

How the money will be spent

GPU Compute (rent from runpod or gpu.ai)
OpenAI credits

Discussion

Private comments in this thread are only shown to approved funders and grant reviewers. Email hi@grantmaking.ai or to request access.

Private UserPrivate17d?

HHieu VuJudge · Global South AIS HackathonEndorsement17d

The core motivation is genuinely interesting: turning an interpretability finding (the refusal direction) into a targeting signal for an attack is a clean demonstration that mech interp results are dual-use, and the FLD method is a neat contribution in its own right: the sharpness of the Fisher peak doubles as a structural vulnerability metric, a pre-deployment read on how brittle a model's safety encoding is. The six-model breadth and >3,000 attempts make the evaluation solid. Most promising of all is the transfer to GPT-4o-mini with no closed-model access (35.5%); that is an impressive result that suggests the shared-geometry hypothesis has real legs, and it is the thread most worth pursuing further. The author is also clearly alert to the dual-use risk and handles the ethics framing responsibly.
Isolate how much the refusal direction actually contributes. The thesis is that attribution against the refusal direction is what makes STEER work, but two confounds are not separated. The paraphrase step is a GPT-4o rewrite that softens keywords before any gradient work, and the paper notes removing it costs substantial ASR, so part of STEER's edge over CSRT may be the paraphrase rather than the attribution. CSRT should be run with the same paraphrase to isolate the mech-interp contribution. Relatedly, since CSRT "catches up given enough budget," the attribution mainly helps at low iteration counts, so the @1 efficiency numbers (only reported for two models) are the honest place to make the claim and should be reported across all six.
Implement and test at least one of the proposed defences. The paper is, in effect, a working attack, and the discussion already sketches sensible mitigations (distribute refusal across layers, train the direction on multilingual and code-switched inputs, audit FLD sharpness). Given the dual-use framing, showing even one of these measurably reduces STEER's ASR would turn the paper from "here is a vulnerability" into "here is a vulnerability and a first defence," which is both safer to release and a stronger contribution.
The "decision variable" claim needs the causal test. Section 4.4 shows refused and non-refused responses separate around zero on the refusal-score axis and concludes the dot product with r is "the actual decision variable the model uses, not just a proxy." But the score is built from the harmful/benign difference, so separation is expected and only correlational.

AAditya A PrasadJudge · Global South AIS HackathonEndorsement17d

This work makes the dual use aspect of mech interp very concrete and audit signals like FLD provide model authors a way to make their default checkpoints more safe.

In practice anyone who is dedicated and has white box access can just ablate refusal directions, patch activations etc and jailbreak models so the path to impact seems to depend on mech interp researchers being told that safety circuits are dual use, and that seems to be well understood especially with work such as Yeo et al. showing SAE features that mediate refusal.

The novel piece here is the cross lingual angle and Wang et al. indicates that the refusual direction is cross lingually aligned and this work shows that across several models, code switched prompts can cause weaker activation in that direction.

I would be excited to see the authors extend this work and test it on Llama Guard and other open source deployments that are realistic because classifier-based safeguards, input-output guard models can reduce misuse even if the model's internal geometry remains brittle. Real world safety would be where the impact lies.