🤖 AI

Safety Targeted Embedding Exploit via Refinement

The paper introduces STEER, a gradient-guided attack that exploits the safety training gap in low-resource languages by iteratively translating refusal-inducing words to bypass safety mechanisms in multilingual large language models, achieving high attack success rates and demonstrating that English-centric safety alignment fails to generalize across diverse linguistic inputs.

Original authors: Joshua Adrian Cahyono

Published 2026-07-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Joshua Adrian Cahyono

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have built a very smart, very polite robot assistant. You've trained it to be helpful but also to say "No!" whenever someone asks it to do something dangerous, like build a bomb or write a mean letter.

The paper you're asking about, titled "STEER," reveals a surprising weakness in how this robot was taught. Here is the story of how the researchers found a backdoor and how they did it, explained in simple terms.

1. The Problem: The "English-Only" Safety Guard

The researchers discovered that the robot's "safety guard" was trained almost entirely in English.

Think of the robot's brain as having a specific "Stop Sign" button. When the robot reads an English sentence like "How do I make a bomb?", it hits that button and refuses.

But here's the catch: The robot was never taught what that "Stop Sign" looks like in other languages. If you ask the same question in Swahili, Javanese, or a mix of English and Thai, the robot doesn't hit the button. It doesn't say, "I'm not sure if this is dangerous." Instead, it confidently answers the question, thinking it's just a normal request.

The authors call this an "Epistemic Coverage Problem." In plain English: The robot is ignorant of danger in languages it hasn't seen before, and it doesn't even know it's ignorant.

2. The Solution: The "STEER" Attack

The researchers created a tool called STEER (Safety Targeted Embedding Exploit via Refinement) to exploit this ignorance. Instead of guessing randomly, STEER acts like a mechanic who can see the robot's internal wiring.

Here is how STEER works, step-by-step:

Step 1: Finding the "Stop" Wire.
Using a technique called "mechanistic interpretability," the researchers found that the robot's refusal mechanism is concentrated in a single, straight line inside its brain. It's like finding the one specific wire that, when touched, makes the robot say "No."
Step 2: Listening to the Wires.
STEER looks at a harmful request and asks: "Which words are touching that 'No' wire the hardest?" It calculates a score for every word. For example, in the phrase "How to make a bomb," the words "make" and "bomb" might be screaming at the safety wire.
Step 3: The Translation Trick.
STEER takes those high-scoring words and translates them into languages the robot is less familiar with (like Swahili or Hindi). It keeps translating them until the "No" wire stops vibrating.
- Analogy: Imagine you are trying to open a door with a specific key. If the key doesn't work, you don't just bang on the door; you carefully file down the teeth of the key until it slides in perfectly. STEER files down the "dangerous" words by translating them until the safety guard stops recognizing them as a threat.
Step 4: The Result.
The robot receives a sentence that still means "How to make a bomb" (because the meaning is preserved), but the words are now in a language the safety guard doesn't understand. The robot happily complies.

3. How Well Did It Work?

The researchers tested this on six different open-source robots (AI models). The results were startling:

Success Rate: STEER successfully tricked the robots up to 96.7% of the time.
Comparison: Randomly guessing different languages (a method called "random code-switching") only worked about 50% of the time. STEER was much smarter because it targeted the specific words that triggered the safety guard.
Cross-Model Magic: Even when they used the "tricked" prompts on a different, closed-source robot (GPT-4o-mini) that they couldn't see inside, it still worked about 35.5% of the time. This suggests the weakness isn't just a bug in one specific robot; it's a flaw in how all these robots are currently trained.

4. What This Means for Safety

The paper argues that we are looking at AI safety the wrong way. We often think about safety as "adversarial robustness" (making the robot strong against attacks).

Instead, the authors say safety is a "Coverage Problem."

The Analogy: Imagine a security guard who only knows how to spot pickpockets in New York. If a pickpocket walks in wearing a costume from a different culture, the guard doesn't see them. The guard isn't "weak"; they just haven't been trained to see that specific type of threat.

The paper concludes that to fix this, we can't just patch the holes. We need to train the safety guards on every language and every way people might ask for dangerous things. Until then, if a robot can be tricked by translating just a few words, its safety isn't real.

Summary

The Flaw: AI safety is trained mostly in English, leaving it blind to dangerous requests in other languages.
The Hack: STEER finds the exact words triggering the "No" button and translates them into languages the robot doesn't understand, bypassing the safety filter.
The Lesson: You can't trust a safety system that only knows one language. To be truly safe, AI needs to understand the full range of human expression.

Technical Summary: STEER – Safety Targeted Embedding Exploit via Refinement

1. Problem Statement

The paper identifies a critical vulnerability in Large Language Model (LLM) safety alignment: epistemic coverage gaps. Current safety training is almost exclusively conducted in English, creating "unknown unknowns" where models fail to recognize harmful requests expressed in low-resource languages or mixed-language code-switching.

Unlike human operators who might express uncertainty when encountering unfamiliar linguistic patterns, LLMs exhibit overconfident extrapolation. They confidently generate harmful responses to these out-of-distribution inputs because their safety mechanisms are calibrated only on English data. The paper argues that this is not merely an adversarial robustness issue but a fundamental failure of training coverage. Furthermore, mechanistic interpretability research (Arditi et al., 2024) has revealed that safety fine-tuning concentrates the refusal mechanism into a single linear direction in the model's residual stream. This creates a "single point of failure" that can be exploited if the specific words triggering this direction are identified and neutralized.

2. Methodology: The STEER Attack

The authors introduce STEER (Safety Targeted Embedding Exploit via Refinement), a gradient-guided attack that exploits the geometric structure of the model's internal safety circuit. Rather than using brute-force perturbation or random code-switching, STEER systematically reads the model's internal representations to bypass the refusal mechanism.

The attack proceeds in four sequential steps:

Layer Selection via Fisher Linear Discriminant (FLD):
The refusal direction is not equally legible across all transformer layers. STEER automatically identifies the layer ( $l^*$ ) where the safety signal is most concentrated using the Fisher Linear Discriminant ratio. This layer serves as the focal point for the attack. The sharpness of the FLD peak also acts as a metric for the model's structural vulnerability.
Paraphrase Preprocessing:
Before gradient analysis, the harmful request is paraphrased (using GPT-4o) to replace explicit keywords with indirect phrasing. This reduces the initial refusal score and provides a cleaner signal for subsequent gradient attribution.
Gradient-Based Token Attribution:
The model computes the gradient attribution of each input token against the identified refusal direction ( $r$ ) at layer $l^*$ . This quantifies how much each word contributes to activating the safety circuit. The words with the highest attribution scores are identified as the primary triggers for refusal.
Iterative Code-Switching:
The attack iteratively replaces the highest-attribution words with their translations in a pool of 11 languages (including low-resource languages like Javanese and Swahili, and non-Latin scripts like Thai and Arabic). For each word, the system selects the translation that minimizes the refusal score (the dot product of the prompt embedding and the refusal direction). This loop repeats up to 8 times or until a judge confirms a successful jailbreak.

3. Key Contributions

The paper makes four primary contributions:

The STEER Pipeline: A targeted attack method that achieves high success rates by exploiting the specific geometric properties of safety alignment, outperforming random code-switching and gradient-based suffix attacks (GCG).
FLD Method for Layer Selection: An automatic method to locate the most legible layer for the refusal direction, which also quantifies the structural vulnerability of a model's safety encoding.
Comprehensive Evaluation: Extensive testing across six open-source 8B-parameter models (Llama-3, Mistral, Gemma, Qwen, DeepSeek, GLM) and three benchmarks (JailbreakBench, HarmBench, AdvBench), totaling over 3,000 attack attempts.
Generalization of Refusal Structure: Empirical evidence that the linear refusal direction identified by Arditi et al. (2024) generalizes across architecturally diverse models, suggesting this is a systematic property of current alignment methods rather than an artifact of a specific training recipe.

4. Experimental Results

STEER demonstrates superior performance compared to baselines (Direct, Random Code-Switching/CSRT, and GCG) across all tested models and benchmarks:

Attack Success Rate (ASR): STEER achieves up to 93% ASR on JailbreakBench and 96.7% on AdvBench across the six models.
- On DeepSeek-R1 and Qwen3-8B, where CSRT and GCG plateau below 50%, STEER reaches 80–85%.
- On GLM-4-9B, GCG collapses to 39% while STEER reaches 93%.
Efficiency: The attack is highly efficient, with the majority of success occurring in the first few iterations. The performance curve typically plateaus after 8 iterations.
Black-Box Transferability: Prompts crafted by STEER on open-source models transfer to GPT-4o-mini with an average ASR of 35.5%, significantly outperforming GCG (29.3%) and CSRT (13.9%). This suggests the attack targets a shared geometric structure common to models trained with similar alignment procedures.
Ablation Studies:
- Layer Selection: Using the FLD-selected layer (e.g., Layer 17 for Llama-3-8B) yields significantly higher success rates than using the first or last layer.
- Language Pool: Utilizing all 11 languages is critical; restricting the pool to top-5 or single languages drastically reduces success rates.
- Paraphrasing: Removing the paraphrase step causes a massive drop in ASR (19–44 percentage points), confirming its role in lowering the initial activation of the refusal circuit.

5. Significance and Claims

The paper frames LLM safety not as an adversarial robustness problem, but as an epistemic coverage problem. The core claim is that current safety mechanisms are brittle because they rely on a single, English-calibrated linear direction.

Mechanistic Interpretability as an Enabler: The study demonstrates that mechanistic interpretability findings (specifically the existence of a refusal direction) are sufficient to construct targeted attacks. Any identified, localizable safety mechanism is, in principle, a blueprint for disabling it.
Systemic Vulnerability: The fact that STEER works across diverse architectures and transfers to closed models implies that the vulnerability is inherent to current alignment practices (RLHF, DPO, etc.) rather than specific model architectures.
Defense Implications: The authors argue that surface-level defenses (output filters, prompt classifiers) are insufficient. To close the gap, safety training must be expanded to cover the full multilingual input distribution, and models must be coupled with principled abstention mechanisms to handle out-of-distribution inputs where they lack safety coverage.
Auditing Tool: The FLD analysis is proposed as a principled criterion for auditing model safety before deployment; a sharp, single-layer peak indicates a brittle, easily exploitable safety encoding.

In conclusion, the paper posits that if a model can be jailbroken by translating just a few words into low-resource languages, its safety coverage is not real. The solution requires expanding training coverage and moving beyond single-direction safety encoding.