Safety Targeted Embedding Exploit via Refinement

Abstract: Safety training for LLMs is conducted predominantly in English, leaving uncertain how well safety mechanisms generalize to low-resource languages and mixed-language code-switching. We show that this creates an epistemic gap in which models confidently generate harmful responses for inputs that fall outside the distribution of their safety training. To study this phenomenon, we introduce STEER (Safety Targeted Embedding Exploit via Refinement), a gradient-guided attack that identifies words contributing most strongly to the model's refusal behavior and iteratively translates them into low-resource languages to suppress refusal while preserving harmful intent. Across six open-source 8B-parameter models, STEER achieves attack success rates of up to 93.0% on JailbreakBench and 96.7% on AdvBench, outperforming random code-switching and Greedy Coordinate Gradient (GCG). The resulting prompts also transfer to GPT-4o-mini, achieving a 35.5% attack success rate without requiring access to the target model, suggesting that the underlying weakness is not specific to a single architecture. These findings demonstrate that safety mechanisms aligned primarily on English cannot be assumed to generalize across multilingual inputs. We argue that improving multilingual safety requires broader coverage during alignment and mechanisms that explicitly detect and abstain on out-of-distribution inputs.

• The paper introduces STEER, a gradient-guided jailbreak method that exploits the refusal direction in LLMs to bypass safety controls.
• It employs layer localization via FLD, paraphrase preprocessing, and iterative low-resource language code-switching to attenuate safety signals.
• Empirical results demonstrate up to 96.7% attack success, exposing structural vulnerabilities in English-centric LLM safety alignment.

Safety Targeted Embedding Exploit via Refinement (STEER): Exploiting the Refusal Direction in LLMs

Overview

The paper "Safety Targeted Embedding Exploit via Refinement" (2607.01859) presents STEER, a gradient-guided, mechanistic jailbreak attack that exploits the geometric concentration of safety mechanisms in aligned LLMs. By leveraging mechanistic interpretability (mech interp), specifically the existence of a "refusal direction" in the model's representation space, STEER systematically defeats English-centric safety training through iterative, targeted code-switching into low-resource languages. The paper empirically demonstrates that STEER achieves up to 96.7% attack success rates, significantly outperforming baselines, and exposes the structural vulnerabilities present in standard alignment pipelines.

Mechanistic Basis and Attack Pipeline

STEER's attack strategy is grounded in recent mech interp work which identifies that refusal behavior, induced by safety fine-tuning, is encoded as a single, interpretable direction in the residual stream—a point of geometric concentration that acts as a decision boundary for refusal.

STEER operates via the following pipeline:

1. Layer Localization via FLD: Identifies the layer in which the refusal direction is maximally linearly separable by applying the Fisher Linear Discriminant (FLD) across all transformer layers using a calibration set of benign and harmful prompts.
2. Paraphrase Preprocessing: Applies paraphrasing using an external model (GPT-4o) to convert surface-level cues into less direct forms, reducing the initial refusal score and facilitating attribution-driven attack.
3. Gradient-based Word Attribution: For each token or word, computes the gradient of the refusal score with respect to its embedding, ranking words by their contribution to triggering the safety circuit.
4. Iterative Code-Switching: Replaces the highest-attribution words with translations from a pool of 11 low-resource and non-English languages, selecting the variant that most suppresses the refusal score. This process repeats up to a maximum of eight iterations or until a non-refusing, harmful output is generated, as adjudicated by an automated judge.

   Figure 1: The STEER attack pipeline uses mech-interp-derived refusal direction, gradient-based attribution, and multilingual code-switching to efficiently evade model safety filters.

This approach distinguishes STEER from prior code-switching or adversarial attacks by directly leveraging model internals revealed by interpretability tools, targeting the specific internal structure responsible for safety rather than relying on trial-and-error or black-box optimization.

Empirical Performance and Ablation Studies

STEER was evaluated against six open-source 7–9B parameter LLMs (including Llama-3-8B, Mistral-7B, Gemma-7B, Qwen3-8B, DeepSeek-R1-Distill-Llama-8B, GLM-4-9B) and three benchmarks: JailbreakBench, HarmBench, and AdvBench.

Key empirical findings include:

• Attack Success Rate (ASR): STEER achieved up to 96.7% ASR at 8 iterations. It consistently outperformed random code-switching (CSRT) and gradient-based suffix generation (GCG) on all model-benchmark pairs, with the largest gains on models where other methods failed to break 50% ASR.
• Iteration Efficiency: The attack’s efficacy saturates after 8 targeted translations, with most gains realized in the early iterations.

  Figure 2: Cumulative jailbreak success on GLM-4-9B as a function of attack iterations; efficacy plateaus at eight iterations.

• Refusal Score Validation: The projection onto the refusal direction cleanly separates refused from non-refused responses, validating that the attack directly manipulates the model's internal decision boundary.

  Figure 3: Refusal score distribution for Llama-3-8B on JailbreakBench, demonstrating near-complete separation of refused versus non-refused responses.

• Layer Analysis: For Llama-3-8B, the FLD curve peaks sharply at layer 17, while for GLM-4-9B, at layer 24. This indicates that the safety mechanism is localized to specific intermediate layers, forming a structural vulnerability.

Figure 4: Fisher Linear Discriminant per layer for Llama-3-8B, showing safety circuit concentration at layer 17.

• Transferability: Without direct access, STEER prompts transferred to GPT-4o-mini with a mean ASR of 35.5%, substantially higher than GCG or CSRT, indicating that shared refusal geometry generalizes across models and architectures.
• Ablations: Removing any pipeline component—attribution-guided word selection, an expanded language pool, or paraphrase preprocessing—reduced success rates, with the paraphrasing step being especially critical for stronger models.

Structural and Theoretical Implications

The exploitation of the refusal direction highlights a fundamental epistemic coverage issue in current LLM safety methodology. Since English-dominated RLHF, DPO, and constitutional fine-tuning result in a refusal filter that is both linear and highly localized, the system is blind to harm expressed through other languages or mixed-language phrasings. STEER demonstrates that LLMs not only lack robustness to adversarial distribution shifts but also exhibit overconfident extrapolation when operating out-of-distribution, confidently producing harmful outputs in unfamiliar code-switched or non-English contexts.

The FLD analytic offers a practical probe for auditing safety concentration—sharpness in this metric predicts vulnerability to targeted attacks.

The findings suggest that future defense strategies must:

• Encode safety responses more redundantly across layers and nonlinear subspaces.
• Include extensive multilingual and code-switched data during safety alignment and evaluation.
• Couple refusal with abstention mechanisms for inputs lying outside the empirical safety training distribution.

Moreover, any future mechanistic interpretability discovery of discrete, localizable alignment mechanisms should be evaluated from the perspective of offense as well as defense, since interpretability can serve as a blueprint for precise attacks on safety circuits.

Future Directions

Potential avenues for further research stem from these observations:

• Distributed Safety Encoding: Investigate training protocols that distribute safety-related information across many layers or directions, potentially via regularization or explicit penalization of highly concentrated FLD peaks.
• Multilingual and Code-switch Robustness: Systematically expand safety datasets and evaluation to cover broader linguistic and code-switch phenomena, closing the epistemic coverage gap.
• Automated Structural Auditing: Develop FLD-based or related probes as part of mandatory pre-deployment model audits, quantifying the brittleness of refusal mechanisms and informing risk management.
• Generalization to Black-box Attacks: Extend STEER’s insights to fully black-box threat models, accounting for transferability limits and possible defenses.

Conclusion

STEER provides a compelling mechanistic demonstration of how contemporary LLM safety protocols are vulnerable to targeted, interpretability-informed attacks, achieving high rates of successful jailbreaking via gradient-guided code-switching. The refusal mechanism’s geometric concentration represents a systematic and exploitable flaw rooted in English-centric alignment. Addressing this vulnerability will require both architectural and procedural changes in LLM safety pipelines, reframing the problem from adversarial robustness to one of epistemic coverage over the full multilingual, code-switched input space.