Adaptive Probe-based Steering for Robust LLM Jailbreaking

Recent work has demonstrated the potential of contrastive steering for jailbreaking Large Language Models (LLMs). However, existing methods rely on limited and inherently biased contrastive prompts and require laborious manual tuning of steering strength, limiting their robustness and effectiveness. In this paper, we leverage the idea of model extraction to guide the learned steering vectors to approximate the ideal one and propose tuning the steering strength adaptively based on contrastive activations' statistics. Experiments demonstrate that our method notably improves the effectiveness and robustness of probe-based steering, without any extra contrastive prompts or laborious manual tuning. Being an attack paper, this paper focuses on revealing the breakdown of fortified LLMs, raising the average harmfulness score from 6\% to 70\%. Our code is available at \url{https://github.com/fhdnskfbeuv/adaptiveSteering}.

Large language models are trained to refuse harmful requests, but existing “jailbreaking” attacks that bypass these safeguards often fail against newer, hardened models—or require painstaking manual tweaking to work. We treat finding the right internal steering direction like “model extraction”: we iteratively refine tiny adjustment vectors using an off-the-shelf judge to label model responses, and we adapt how strongly we steer each layer based on the natural scale of the model’s internal signals. Our method boosts the harmfulness success rate from 6% to over 70% on 12 fortified models, including those designed to resist activation manipulation. This gives defenders a far stronger tool to stress-test AI safety before deployment, so real-world systems break in labs, not in the wild.