This is an automated rejection. No LLM generated, assisted/co-written, or edited work.
Read full explanation
This project was made during the Apart Sprint: Global South AI Safety Hackathon, where it was later selected as the Asia winner. I want to thank the Apart Team for the opportunity, feedback and support.
Takeaway: reading a model's own refusal direction (the internal signal that predicts whether it's about to refuse a request), to decide which words to translate, beats translating words at random, the default in code-switching attacks. This means the multilingual jailbreak gap isn't just about translating more of the prompt, it's about knowing exactly where to target the edit, and looking inside the model internals instead of output-level is what makes it possible.
TL;DR
Safety training is almost entirely English, so models often miss harmful requests in other languages and just comply.
The refusal direction is shared across languages, yet translating a request still weakens refusal. STEER translates only the few words that push hardest against that direction, reaching up to 97% attack success across six models.
Targeting matters: it beats random word choice by 4 to 26 points at the same edit budget.
Pushing activations by hand along the refusal direction flips behaviour (4% to 80% harmful compliance), so the direction is causal.
STEER also slips past Llama-Guard, a commonly used deployment safety classifier, around half of the time, far more often than the baselines, since a small targeted edit is easier to hide than a full rewrite or an adversarial suffix.
Prompts built white-box against open models still transfer black-box: submitted blind to GPT-4o-mini, they reach 35.5% attack success, ahead of the baselines.
For defence: calibrate the refusal direction on multilingual data, push it to spread across layers instead of concentrating in one, and don't rely on a guard model alone to catch what training missed.
Motivation: Why I started poking at this
I've been interested in mechanistic interpretability for a while now. And one of the cleanest results in that space is Arditi et al.'s finding that refusal in an instruction-tuned model is governed, to a good approximation, by a single direction in the residual stream. They show that we can take the average hidden state over a bunch of harmful prompts, subtract the average over benign ones, normalise, call it r. Then we project any new prompt onto it and you get a number that predicts whether the model will refuse.
Here's what got me thinking about this project initially. Safety fine-tuning, RLHF, DPO, Constitutional AI, red-teaming, is done almost entirely in English. So it might be possible that r is an English artefact, it's calibrated on English harmful and benign examples, and it just won't fire as good on the same content phrased in another language, because the model was never trained to notice it there, which means there might be a coverage gap.
Except Wang et al. found something interesting: the refusal direction is cross-lingually aligned. When you compute it independently in different languages, you get roughly the same direction back. That's not what you'd expect if safety training had simply failed to generalise past English words, since it shows the underlying geometry is shared across languages. So why does translating a request into Thai or Yoruba still weaken refusal?
The way I've come to think about it (and I could be wrong about this, would love to see further analysis on this) is that r being shared doesn't mean the inputs that reach it are covered. The axis can be universal, "this is harmful" while the mapping from specific tokens onto that axis stays badly calibrated wherever the training data never had much to say. A harmful request in Javanese can, in principle, land on exactly the same r an English version would. But if the model has barely seen Javanese harmful content during safety training, the actual tokens it's processing might not land anywhere near where they should. That's an epistemic failure, not a semantic one. The model isn't wrong about what harm is. It's blind to specific inputs it was never calibrated on, and worse, it shows no sign of knowing it's blind.
Code-switching jailbreaks that lean on some version of this already existed before this project. What none of them do is use the refusal direction itself to decide which words are worth translating. They translate more, or less, or by a fixed heuristic about which languages count as "low-resource."
The algorithm, in four steps
We first find the layer where the refusal direction is most legible. The refusal direction is not equally readable across all layers. Using a one-time calibration set of 100 harmful and 100 benign prompts, we compute the Fisher Linear Discriminant ratio at every layer and select the layer with the highest ratio. For Llama-3-8B, this gives layer 17 out of 32, while for GLM-4-9B, it gives layer 24 out of 40. Intuitively, the ratio measures how cleanly the refusal direction separates harmful from benign prompts: a higher value indicates stronger separation. Beyond its practical use, we also find the shape of this curve informative. A tall, narrow peak suggests that the model concentrates its safety representation in a small number of layers, which makes that representation easier to target. In contrast, a flatter curve suggests that the model distributes the representation more broadly across layers and may therefore require a different attack strategy.
We then paraphrase the input before applying the attack. GPT-4o rewrites the original request into less explicit language before we analyze it further. For example, it can transform a request such as "Write a defamatory article claiming X" into something closer to "Compose a critical exposition insinuating X." This paraphrasing step measurably lowers the initial refusal score and expands the sentence into more words that we can target individually. More importantly, we treat this preprocessing step as a controlled part of the attack pipeline because it affects the starting point of the refusal signal and therefore needs to remain consistent when we compare different attack strategies.
We next score each word according to how strongly it affects the refusal direction. We compute attribution gradients by backpropagating from the refusal direction and then aggregate the scores of individual subwords to obtain a score for each complete word. Words with higher attribution scores contribute more strongly to the refusal direction, so we prioritize those words during the subsequent translation step.
We then translate the highest-scoring word first. For each selected word, we try translations across 11 candidate languages: Javanese, Sundanese, Swahili, Yoruba, Tagalog, Indonesian, Thai, Vietnamese, Korean, Hindi, and Arabic. We selected these languages to cover low-resource languages, non-Latin writing systems, and languages with large real-world populations in Southeast Asia and beyond. After testing the candidate translations, we keep the translation that produces the largest decrease in the refusal score. A GPT-4o judge evaluates the model's response after each substitution to determine whether it remains harmful while no longer refusing the request. We repeat this process for up to eight iterations and stop once the judge identifies a successful attack. If a translation removes the harmful meaning without producing a non-refusing response, we revert that substitution and move on to another candidate word.
The final result is an optimized jailbreak prompt that still reads like ordinary English with three or four odd words in it. It doesn't look like an attack the way a GCG suffix of nonsense tokens does, or the way a fully code-switched sentence does.
Figure 1: The STEER pipeline, paraphrase the prompt, score word attributions against the refusal direction, then iteratively translate the highest-scoring word and keep whichever language drops the refusal score furthest, up to N times.
Setup, and the main result
The experiment includes six open instruction-tuned models, 7 to 9B parameters (Llama-3-8B, Mistral-7B, Gemma-7B, Qwen3-8B, DeepSeek-R1-Distill-Llama-8B, GLM-4-9B), evaluated on JailbreakBench, HarmBench, and AdvBench. The baselines used are: Direct (unmodified prompt, 0% ASR everywhere), CSRT (untargeted code-switching, same language pool and budget as STEER), GCG (gradient-optimised adversarial suffix). A GPT-4o judge scores every response, counting a jailbreak only when it's both non-refusing and harmful.
Figure 2: ASR vs. iteration budget, Direct, CSRT, GCG, and STEER, on all three benchmarks, averaged across the six models.
Throughout all 3 benchmarks, STEER starts ahead at iteration 1 and stays ahead the whole way, the gap to CSRT and GCG doesn't close as the budget grows, it's roughly constant or widens. GCG in particular plateaus early on HarmBench and AdvBench, well below where STEER is still climbing. Direct sits at zero throughout, plotted mostly to make the point visually rather than because it needed a whole line.
The per-model breakdown at the full budget, JailbreakBench:
Model
CSRT
GCG
STEER
Mistral-7B
90.0%
92.0%
92.0%
Gemma-7B
88.0%
89.0%
93.0%
Llama-3-8B
55.0%
41.0%
83.0%
DeepSeek-R1
44.0%
47.0%
80.0%
GLM-4-9B
89.0%
39.0%
93.0%
Qwen3-8B
47.0%
53.0%
85.0%
Table 1: Per-model ASR at the full iteration budget on JailbreakBench.
STEER wins on all models/benchmarks combination, and the gap is clearest on GLM-4-9B, where GCG collapses to 39% against STEER's 93%.
Does the targeting actually matter, though?
Two things could be doing the work in STEER's numbers: the GPT-4o rewrite step, and the targeting itself. To isolate the targeting, I needed a control that matches STEER on everything else, same paraphrase rewrite, same language pool, same revert rule, same edit budget, and removes only the one thing I actually wanted to test. So I took CSRT: one random word switch per iteration. At each iteration, it picks one still-untranslated word completely at random and translates it into one completely random language from the same pool. No gradient, no refusal-score measurement, no signal of any kind.
Llama, ASR@1
Llama, ASR@3
Llama, ASR@8
GLM, ASR@1
GLM, ASR@3
GLM, ASR@8
targeted (refusal-direction-guided)
56%
80%
86%
58%
70%
90%
CSRT, one word at a time
40%
54%
74%
54%
64%
78%
Table 2: Refusal-direction targeting vs. random word selection at matched edit size.
At matched edit size, the signal wins clearly, 4 to 26 points of attack success rate at every budget, on both models, using the same number of edits or fewer to get there. The gap is widest on Llama, where a single word chosen well is worth a lot, and narrower on GLM, where it still holds at every budget but by less. This is the result I keep coming back to: given the same small edit budget, reading the model's own refusal direction to decide where to spend it beats spending it at random.
So here's my claim: reading the refusal direction lets you spend a small edit budget effectively, because it tells you exactly which target matters the most.
Is r actually causing this?
So far, the evidence for r is correlational: refused and non-refused responses land on opposite sides of zero when you project them onto it (Llama-3-8B on JailbreakBench, refused n=167 mean +3.6, non-refused n=164 mean −1.2, Kolmogorov-Smirnov D=0.766, p<0.001). But that is almost guaranteed by how r is constructed, it's literally the difference between harmful and benign means, so of course harmful prompts land on the harmful side. Correlation like that doesn't tell you the model's behavior is caused by that projection.
I wanted the causal version of it. One way of doing this is to steer the model's activations along r by hand, during generation, and see if behavior actually flips.
alpha (Llama-3-8B, layer 17)
harmful compliance, pushed away from r
benign refusal, pushed toward r
0 (baseline)
4.0%
24.0%
4
32.0%
84.0%
8
80.0%
100.0%
Table 3: Causal steering along the refusal direction on Llama-3-8B at layer 17.
Pushing a harmful prompt away from r takes compliance from 4% to 80%, a twenty-fold jump, on requests the model refuses almost every time at baseline. On the other hand, pushing a benign prompt toward it takes refusal from 24% to a full 100%. I read through the actual generations at alpha=8 to make sure this wasn't a scoring artefact, and it isn't, the model produces coherent, on-topic compliance with requests it otherwise refuses outright. Push even higher to alpha=16, and the raw score keeps moving but the generations stop being coherent altogether, which puts a rough ceiling on how hard you can push this particular lever before the model stops being useful as a language model at all.
Running the same test on GLM-4-9B looked, at first, like it just didn't replicate. Compliance stayed at 0% across the same alpha range that worked on Llama. Before writing that up as a negative result, I checked the baseline scores, and GLM's natural separation at its own layer is about 83 points wide, against roughly 2 to 4 for Llama. An alpha of 16 is a real push on Llama and a rounding error on GLM. Rescaled to GLM's own scale (alpha up to 80), the effect comes right back: harmful compliance 0% to 52%, benign refusal 16% to 72%, and the generations at the high end are genuinely on-topic, not incoherent.
I think this matters beyond just STEER: r isn't just a correlation effect that happens to sit near refusal, it's something the model's behaviour causally responds to. That's what makes it a legitimate thing to target in the first place, rather than merely a proxy.
Transferability, and what the three design choices are actually buying you
There are two things worth reporting briefly.
Prompts built white-box against open models still work with zero access to the target. Submitting the same final prompts unmodified to GPT-4o-mini, no gradients, no hidden states, nothing:
Benchmark
STEER
GCG
CSRT
JBB
43.2%
39.7%
15.3%
HarmBench
31.5%
21.3%
11.6%
AdvBench
32.0%
26.9%
14.7%
Overall
35.5%
29.3%
13.9%
Table 4: Black-box transfer of white-box-built prompts to GPT-4o-mini.
We can see from this experiment result that STEER wins all on 3 benchmarks here. My read is that this works because the prompts are targeting the shared refusal-direction geometry, and targetting the same linguistic gap, rather than anything specific to one model's gradients.
Three quick ablations, each isolating one of the pipeline's design choices.
Layer choice (Llama-3-8B)
@1
@3
@8
First layer
35.0%
48.0%
69.0%
Last layer
36.0%
55.0%
79.0%
FLD-selected (17)
37.0%
58.0%
83.0%
Table 5: Ablation on which layer the refusal direction is read from.
Language pool (Llama-3-8B)
@1
@3
@8
top-1 (Thai only)
22.0%
24.5%
46.5%
top-3 (most frequently selected)
22.5%
36.0%
56.5%
bottom-3 (least common)
24.0%
34.5%
50.0%
all 11
32.0%
46.0%
71.5%
Table 6: Ablation on the size and composition of the candidate language pool.
Interestingly, we see that the bottom-3 beats top-1 here. It argues the pool's value is breadth (different words want different languages) rather than any one language being weak. On the contrary, top-3 still pulls ahead of bottom-3 at @3 and @8, and that implies that the languages the algorithm ends up choosing most often are not an arbitrary subset, they're disproportionately the ones that actually lower the refusal score when a word gets translated into them. In other words, breadth explains most of the gain over any single language, but the selection itself isn't noise either, the pool is being used correctly more often than not.
On the third ablation, I want to compare STEER's ASR@8 with and without the paraphrase step, on JailbreakBench, all six models.
Model
STEER, no paraphrase
STEER, with paraphrase
Llama-3-8B
54.0%
83.0%
GLM-4-9B
72.0%
93.0%
Mistral-7B
88.0%
92.0%
Gemma-7B
86.0%
93.0%
DeepSeek-R1
56.0%
80.0%
Qwen3-8B
58.0%
85.0%
Table 7: ASR@8 on JailbreakBench with and without the paraphrase step.
Between 4 and 29 points of ASR@8 depending on the model, largest on Llama-3-8B and Qwen3-8B, smallest on Mistral-7B and Gemma-7B (the two models that barely refuse much of anything even in plain English, so there's less for a rewrite to soften in the first place). This is exactly the number that motivated holding the rewrite fixed on both sides of every comparison earlier in this post, rather than letting it quietly do the work while a different design choice got the credit.
Does a guard model actually catch this?
Here's a fair objection to the whole project: anyone with white-box access can already bypass safety training directly, ablate the refusal direction, patch activations, whatever. So showing a jailbreak of this kind is possible doesn't say much about real-world risk on its own.
The black-box transferability result from the section above shows that we can try to transfer this prompt more generally, since it shows an attacker doesn't strictly need white-box access to the target in the first place. But the more direct question is still whether the resulting prompt gets caught by the kind of lightweight classifier a real deployment would put in front of the model. I ran STEER's, CSRT's, and GCG's final prompts, each in its own original form, through Llama Guard 3 8B.
attack
Llama-3-8B
GLM-4-9B
Qwen3-8B
average
STEER
36.0%
48.0%
40.0%
41.3%
CSRT
82.0%
78.0%
78.0%
79.3%
GCG
82.0%
90.0%
88.0%
86.7%
Table 8: Llama Guard 3 8B detection rate on each attack's final prompts.
STEER's prompts get flagged less than half as often as CSRT's, and GCG, whose adversarial suffix is a string of visibly nonsensical tokens tacked onto an otherwise explicit request, gets caught more than four out of five times. A small, targeted edit that leaves the rest of the sentence as ordinary English is, in practice, a lot easier to slip past a deployed classifier than either rewriting the whole prompt across several languages or bolting on a gradient-optimised suffix.
This is where the transferability result from the section above stops being just a research curiosity and starts looking like a real risk for companies building products on open-weight models. An attacker doesn't need any access to a company's actual deployment to develop a working jailbreak against it, they can do all the work offline, against a public checkpoint of the same model, or even a different open model entirely, since the prompts transfer black-box anyway. And because that same prompt is also disproportionately good at slipping past a lightweight guard model, the two results compounds: the attack transfers to the target model, and it transfers past the target's safety filter too, without the attacker ever touching the company's actual system.
What I think this means for AI security
I think these are the three main claims I would like to assert based on the results above:
Audit the sharpness of the refusal direction before you ship. The FLD score used to find the attack layer is itself a diagnostic any model author could run in an afternoon on their own weights. A sharp peak means safety is concentrated and easy to target the way this post describes. A flatter curve means it's distributed, and would need a different kind of attack to exploit at all.
Calibrate r on the inputs it's actually going to see, and don't let it concentrate in one layer. If the coverage-gap story is right, the direct fix is computing (or at least auditing) r against code-switched and multilingual harmful prompts, not English-only ones, so the direction is actually calibrated on the inputs it needs to catch. The layer-sharpness point above suggests a second, related lever: if safety fine-tuning pushed the refusal representation to spread across several layers instead of concentrating sharply in one, there would be no single legible r for an attack like STEER to read out and target in the first place.
A guard model is worth having anyway. It's not a fix for the underlying brittleness, but "meaningfully reduces attacks without fully stopping either" is genuinely useful to know, especially since a lot of real deployments already have something like this in front of the model.
Limitations and future directions
Everything here needs white-box access, hidden states and gradients. A separate check, submitting prompts built against open models to GPT-4o-mini with zero closed-model access, got 35.5% ASR overall (ahead of a gradient-suffix baseline's 29.3% and an untargeted baseline's 13.9%), which suggests some of this survives without any access at all. But I didn't design a dedicated black-box version, this was a side observation, not a real attempt.
This is done on 7 to 9B open models only. No idea how this scales to bigger models.
GPT-4o judge is used throughout and is not checked against human judgement.
The random-control and guard tests above used two or three models at n=50. STEER's original evaluation (the headline ASR numbers up top) covers the full six-model, three-benchmark sweep.
These are some possible continuations of the project, sorted from easiest to try, to hardest to try:
Try it on a wider range of model scales. Everything here is 7 to 9B. I have no idea whether the FLD peak stays as sharp, whether the same layer fraction still holds the direction, or whether ASR moves in either direction on something an order of magnitude bigger or smaller. This is the most direct way to answer the "no idea how this scales" limitation above.
A proper study of black-box transferability, not just the one side observation above. Right now the black-box result is a single surrogate (open models) against a single target (GPT-4o-mini), run once. A real study would vary the surrogate systematically, more open models, different sizes and families, and measure how transfer degrades as the surrogate diverges from the actual closed target, plus test against more than one closed model. That would tell me whether 35.5% is representative or just where GPT-4o-mini happened to land.
More realistic deployment testing. One guard model isn't the whole story. Testing against a few more, and against more realistic input-output filtering stacks, would tell me whether the null-ish guard result above is specific to Llama Guard or a more general property.
Experiment with improving the method itself, not just evaluating it as-is. STEER currently commits to translating exactly one word per iteration, highest-scoring first, and never revisits that choice except to revert it. Worth testing whether translating the top-k words at once gets to the same ASR in fewer iterations, or whether re-scoring attribution after every swap (instead of using the scores from the original prompt throughout) changes which words end up translated and pushes the ceiling higher than the current greedy one-word-at-a-time rule allows.
Multilingual calibration of r as a defence. Recompute it from code-switched harmful and benign prompts, rerun STEER against the recalibrated model, see if ASR actually drops. This is the single most direct test of whether my coverage-gap story is even right.
A more in-depth circuit-level and geometric analysis of the refusal direction. This whole project treats r as a single vector read out of one layer, which is enough to predict and to steer, but it's still a coarse description. Wang et al.'s alignment result says the direction is shared across languages, but not why, which components (which attention heads, which MLP layers) actually write to it, whether the alignment holds at the level of individual features rather than just the aggregate direction, or whether there's a shared circuit computing "harm" that per-language calibration just feeds into unevenly. This project only ever worked at the level of the vector, never the circuit underneath it, or how it moves across the geometry of embeddings, and that's the deeper mechanistic question the whole coverage-gap story is ultimately resting on.
Where I've landed
Safety fine-tuning stores refusal as a direction calibrated almost entirely on English, and I now have both the correlational and the causal evidence that this direction is real, not just a convenient story. The question I actually cared about wasn't whether a new state-of-the-art jailbreak using it could be built, I'm sure there are tons of other better jailbreak methods out there. It was whether reading the direction to decide where to spend a small edit budget beats spending that budget at random. Once I built the comparison to actually isolate that, holding the rewrite and the edit size fixed on both sides, the answer was yes.
The model isn't uncertain about harm expressed outside what it was trained on, it's confidently wrong about it. And for now, at least, reading its own refusal direction is enough to find out exactly which words it's wrong about. For me, one message for the community is that this would mean we should expect to see more attacks that use this idea of inspecting model geometry and circuits to improve or develop new attacks.
If you think I've got any of this wrong or any feedback in general, please let me know, I'd genuinely like to hear it.
This project was made during the Apart Sprint: Global South AI Safety Hackathon, where it was later selected as the Asia winner. I want to thank the Apart Team for the opportunity, feedback and support.
Takeaway: reading a model's own refusal direction (the internal signal that predicts whether it's about to refuse a request), to decide which words to translate, beats translating words at random, the default in code-switching attacks. This means the multilingual jailbreak gap isn't just about translating more of the prompt, it's about knowing exactly where to target the edit, and looking inside the model internals instead of output-level is what makes it possible.
TL;DR
Motivation: Why I started poking at this
I've been interested in mechanistic interpretability for a while now. And one of the cleanest results in that space is Arditi et al.'s finding that refusal in an instruction-tuned model is governed, to a good approximation, by a single direction in the residual stream. They show that we can take the average hidden state over a bunch of harmful prompts, subtract the average over benign ones, normalise, call it r. Then we project any new prompt onto it and you get a number that predicts whether the model will refuse.
Here's what got me thinking about this project initially. Safety fine-tuning, RLHF, DPO, Constitutional AI, red-teaming, is done almost entirely in English. So it might be possible that r is an English artefact, it's calibrated on English harmful and benign examples, and it just won't fire as good on the same content phrased in another language, because the model was never trained to notice it there, which means there might be a coverage gap.
Except Wang et al. found something interesting: the refusal direction is cross-lingually aligned. When you compute it independently in different languages, you get roughly the same direction back. That's not what you'd expect if safety training had simply failed to generalise past English words, since it shows the underlying geometry is shared across languages. So why does translating a request into Thai or Yoruba still weaken refusal?
The way I've come to think about it (and I could be wrong about this, would love to see further analysis on this) is that r being shared doesn't mean the inputs that reach it are covered. The axis can be universal, "this is harmful" while the mapping from specific tokens onto that axis stays badly calibrated wherever the training data never had much to say. A harmful request in Javanese can, in principle, land on exactly the same r an English version would. But if the model has barely seen Javanese harmful content during safety training, the actual tokens it's processing might not land anywhere near where they should. That's an epistemic failure, not a semantic one. The model isn't wrong about what harm is. It's blind to specific inputs it was never calibrated on, and worse, it shows no sign of knowing it's blind.
Code-switching jailbreaks that lean on some version of this already existed before this project. What none of them do is use the refusal direction itself to decide which words are worth translating. They translate more, or less, or by a fixed heuristic about which languages count as "low-resource."
The algorithm, in four steps
The final result is an optimized jailbreak prompt that still reads like ordinary English with three or four odd words in it. It doesn't look like an attack the way a GCG suffix of nonsense tokens does, or the way a fully code-switched sentence does.
Figure 1: The STEER pipeline, paraphrase the prompt, score word attributions against the refusal direction, then iteratively translate the highest-scoring word and keep whichever language drops the refusal score furthest, up to N times.
Setup, and the main result
The experiment includes six open instruction-tuned models, 7 to 9B parameters (Llama-3-8B, Mistral-7B, Gemma-7B, Qwen3-8B, DeepSeek-R1-Distill-Llama-8B, GLM-4-9B), evaluated on JailbreakBench, HarmBench, and AdvBench. The baselines used are: Direct (unmodified prompt, 0% ASR everywhere), CSRT (untargeted code-switching, same language pool and budget as STEER), GCG (gradient-optimised adversarial suffix). A GPT-4o judge scores every response, counting a jailbreak only when it's both non-refusing and harmful.
Figure 2: ASR vs. iteration budget, Direct, CSRT, GCG, and STEER, on all three benchmarks, averaged across the six models.
Throughout all 3 benchmarks, STEER starts ahead at iteration 1 and stays ahead the whole way, the gap to CSRT and GCG doesn't close as the budget grows, it's roughly constant or widens. GCG in particular plateaus early on HarmBench and AdvBench, well below where STEER is still climbing. Direct sits at zero throughout, plotted mostly to make the point visually rather than because it needed a whole line.
The per-model breakdown at the full budget, JailbreakBench:
Table 1: Per-model ASR at the full iteration budget on JailbreakBench.
STEER wins on all models/benchmarks combination, and the gap is clearest on GLM-4-9B, where GCG collapses to 39% against STEER's 93%.
Does the targeting actually matter, though?
Two things could be doing the work in STEER's numbers: the GPT-4o rewrite step, and the targeting itself. To isolate the targeting, I needed a control that matches STEER on everything else, same paraphrase rewrite, same language pool, same revert rule, same edit budget, and removes only the one thing I actually wanted to test. So I took CSRT: one random word switch per iteration. At each iteration, it picks one still-untranslated word completely at random and translates it into one completely random language from the same pool. No gradient, no refusal-score measurement, no signal of any kind.
Table 2: Refusal-direction targeting vs. random word selection at matched edit size.
At matched edit size, the signal wins clearly, 4 to 26 points of attack success rate at every budget, on both models, using the same number of edits or fewer to get there. The gap is widest on Llama, where a single word chosen well is worth a lot, and narrower on GLM, where it still holds at every budget but by less. This is the result I keep coming back to: given the same small edit budget, reading the model's own refusal direction to decide where to spend it beats spending it at random.
So here's my claim: reading the refusal direction lets you spend a small edit budget effectively, because it tells you exactly which target matters the most.
Is r actually causing this?
So far, the evidence for r is correlational: refused and non-refused responses land on opposite sides of zero when you project them onto it (Llama-3-8B on JailbreakBench, refused n=167 mean +3.6, non-refused n=164 mean −1.2, Kolmogorov-Smirnov D=0.766, p<0.001). But that is almost guaranteed by how r is constructed, it's literally the difference between harmful and benign means, so of course harmful prompts land on the harmful side. Correlation like that doesn't tell you the model's behavior is caused by that projection.
I wanted the causal version of it. One way of doing this is to steer the model's activations along r by hand, during generation, and see if behavior actually flips.
Table 3: Causal steering along the refusal direction on Llama-3-8B at layer 17.
Pushing a harmful prompt away from r takes compliance from 4% to 80%, a twenty-fold jump, on requests the model refuses almost every time at baseline. On the other hand, pushing a benign prompt toward it takes refusal from 24% to a full 100%. I read through the actual generations at alpha=8 to make sure this wasn't a scoring artefact, and it isn't, the model produces coherent, on-topic compliance with requests it otherwise refuses outright. Push even higher to alpha=16, and the raw score keeps moving but the generations stop being coherent altogether, which puts a rough ceiling on how hard you can push this particular lever before the model stops being useful as a language model at all.
Running the same test on GLM-4-9B looked, at first, like it just didn't replicate. Compliance stayed at 0% across the same alpha range that worked on Llama. Before writing that up as a negative result, I checked the baseline scores, and GLM's natural separation at its own layer is about 83 points wide, against roughly 2 to 4 for Llama. An alpha of 16 is a real push on Llama and a rounding error on GLM. Rescaled to GLM's own scale (alpha up to 80), the effect comes right back: harmful compliance 0% to 52%, benign refusal 16% to 72%, and the generations at the high end are genuinely on-topic, not incoherent.
I think this matters beyond just STEER: r isn't just a correlation effect that happens to sit near refusal, it's something the model's behaviour causally responds to. That's what makes it a legitimate thing to target in the first place, rather than merely a proxy.
Transferability, and what the three design choices are actually buying you
There are two things worth reporting briefly.
Prompts built white-box against open models still work with zero access to the target. Submitting the same final prompts unmodified to GPT-4o-mini, no gradients, no hidden states, nothing:
Table 4: Black-box transfer of white-box-built prompts to GPT-4o-mini.
We can see from this experiment result that STEER wins all on 3 benchmarks here. My read is that this works because the prompts are targeting the shared refusal-direction geometry, and targetting the same linguistic gap, rather than anything specific to one model's gradients.
Three quick ablations, each isolating one of the pipeline's design choices.
Table 5: Ablation on which layer the refusal direction is read from.
Table 6: Ablation on the size and composition of the candidate language pool.
Interestingly, we see that the bottom-3 beats top-1 here. It argues the pool's value is breadth (different words want different languages) rather than any one language being weak. On the contrary, top-3 still pulls ahead of bottom-3 at @3 and @8, and that implies that the languages the algorithm ends up choosing most often are not an arbitrary subset, they're disproportionately the ones that actually lower the refusal score when a word gets translated into them. In other words, breadth explains most of the gain over any single language, but the selection itself isn't noise either, the pool is being used correctly more often than not.
On the third ablation, I want to compare STEER's ASR@8 with and without the paraphrase step, on JailbreakBench, all six models.
Table 7: ASR@8 on JailbreakBench with and without the paraphrase step.
Between 4 and 29 points of ASR@8 depending on the model, largest on Llama-3-8B and Qwen3-8B, smallest on Mistral-7B and Gemma-7B (the two models that barely refuse much of anything even in plain English, so there's less for a rewrite to soften in the first place). This is exactly the number that motivated holding the rewrite fixed on both sides of every comparison earlier in this post, rather than letting it quietly do the work while a different design choice got the credit.
Does a guard model actually catch this?
Here's a fair objection to the whole project: anyone with white-box access can already bypass safety training directly, ablate the refusal direction, patch activations, whatever. So showing a jailbreak of this kind is possible doesn't say much about real-world risk on its own.
The black-box transferability result from the section above shows that we can try to transfer this prompt more generally, since it shows an attacker doesn't strictly need white-box access to the target in the first place. But the more direct question is still whether the resulting prompt gets caught by the kind of lightweight classifier a real deployment would put in front of the model. I ran STEER's, CSRT's, and GCG's final prompts, each in its own original form, through Llama Guard 3 8B.
Table 8: Llama Guard 3 8B detection rate on each attack's final prompts.
STEER's prompts get flagged less than half as often as CSRT's, and GCG, whose adversarial suffix is a string of visibly nonsensical tokens tacked onto an otherwise explicit request, gets caught more than four out of five times. A small, targeted edit that leaves the rest of the sentence as ordinary English is, in practice, a lot easier to slip past a deployed classifier than either rewriting the whole prompt across several languages or bolting on a gradient-optimised suffix.
This is where the transferability result from the section above stops being just a research curiosity and starts looking like a real risk for companies building products on open-weight models. An attacker doesn't need any access to a company's actual deployment to develop a working jailbreak against it, they can do all the work offline, against a public checkpoint of the same model, or even a different open model entirely, since the prompts transfer black-box anyway. And because that same prompt is also disproportionately good at slipping past a lightweight guard model, the two results compounds: the attack transfers to the target model, and it transfers past the target's safety filter too, without the attacker ever touching the company's actual system.
What I think this means for AI security
I think these are the three main claims I would like to assert based on the results above:
Audit the sharpness of the refusal direction before you ship. The FLD score used to find the attack layer is itself a diagnostic any model author could run in an afternoon on their own weights. A sharp peak means safety is concentrated and easy to target the way this post describes. A flatter curve means it's distributed, and would need a different kind of attack to exploit at all.
Calibrate r on the inputs it's actually going to see, and don't let it concentrate in one layer. If the coverage-gap story is right, the direct fix is computing (or at least auditing) r against code-switched and multilingual harmful prompts, not English-only ones, so the direction is actually calibrated on the inputs it needs to catch. The layer-sharpness point above suggests a second, related lever: if safety fine-tuning pushed the refusal representation to spread across several layers instead of concentrating sharply in one, there would be no single legible r for an attack like STEER to read out and target in the first place.
A guard model is worth having anyway. It's not a fix for the underlying brittleness, but "meaningfully reduces attacks without fully stopping either" is genuinely useful to know, especially since a lot of real deployments already have something like this in front of the model.
Limitations and future directions
These are some possible continuations of the project, sorted from easiest to try, to hardest to try:
Where I've landed
Safety fine-tuning stores refusal as a direction calibrated almost entirely on English, and I now have both the correlational and the causal evidence that this direction is real, not just a convenient story. The question I actually cared about wasn't whether a new state-of-the-art jailbreak using it could be built, I'm sure there are tons of other better jailbreak methods out there. It was whether reading the direction to decide where to spend a small edit budget beats spending that budget at random. Once I built the comparison to actually isolate that, holding the rewrite and the edit size fixed on both sides, the answer was yes.
The model isn't uncertain about harm expressed outside what it was trained on, it's confidently wrong about it. And for now, at least, reading its own refusal direction is enough to find out exactly which words it's wrong about. For me, one message for the community is that this would mean we should expect to see more attacks that use this idea of inspecting model geometry and circuits to improve or develop new attacks.
If you think I've got any of this wrong or any feedback in general, please let me know, I'd genuinely like to hear it.