@inproceedings{bui-etal-2026-agopns,
title = "{AGOPN}s: Null-Space Activation Steering for Jailbreak Defense via Average Gradient Outer Product Concept Extraction",
author = "Bui, Minh-Nguyen and
Phan, Binh-Phuong and
Doan, Thanh-Khang and
Huynh-Gia, Bao and
Nguyen, Phung-Anh",
editor = "Zhang, Yue and
Xu, Ruifeng and
Purwarianti, Ayu and
Rong, Tong and
Suzuki, Jun",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {IJCNLP}-{AACL} 2026",
month = nov,
year = "2026",
address = "Hengqin, China",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-aacl.91/",
pages = "1832--1849",
ISBN = "979-8-89176-444-6",
abstract = "Activation steering offers a training-free path to defending large language models (LLMs) against jailbreak attacks, but existing methods fail to resolve the tension between safety and utility. We identify two root causes: safety concept vectors derived from difference-in-means are fragile under diverse attack geometries, and steering transformations lack a principled guarantee of leaving benign prompts unaffected. We propose AGOPNs (Average Gradient Outer Product with Null-space steering), which addresses both issues by extracting a safety concept vector via the Recursive Feature Machine, a feature-learning estimator grounded in the Average Gradient Outer Product, and confining the resulting steering matrix to the null space of benign activations, guaranteeing near-zero perturbation of benign prompts by construction. Experiments on Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, and Llama-3.3-70B-Instruct across seven jailbreak attack families show that AGOPNs consistently achieves strong defense success rates while preserving near-baseline utility on AlpacaEval, XSTest, GSM8K, and MATH500."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="bui-etal-2026-agopns">
<titleInfo>
<title>AGOPNs: Null-Space Activation Steering for Jailbreak Defense via Average Gradient Outer Product Concept Extraction</title>
</titleInfo>
<name type="personal">
<namePart type="given">Minh-Nguyen</namePart>
<namePart type="family">Bui</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Binh-Phuong</namePart>
<namePart type="family">Phan</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Thanh-Khang</namePart>
<namePart type="family">Doan</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Bao</namePart>
<namePart type="family">Huynh-Gia</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Phung-Anh</namePart>
<namePart type="family">Nguyen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-11</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: IJCNLP-AACL 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yue</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ruifeng</namePart>
<namePart type="family">Xu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ayu</namePart>
<namePart type="family">Purwarianti</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tong</namePart>
<namePart type="family">Rong</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jun</namePart>
<namePart type="family">Suzuki</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Hengqin, China</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-444-6</identifier>
</relatedItem>
<abstract>Activation steering offers a training-free path to defending large language models (LLMs) against jailbreak attacks, but existing methods fail to resolve the tension between safety and utility. We identify two root causes: safety concept vectors derived from difference-in-means are fragile under diverse attack geometries, and steering transformations lack a principled guarantee of leaving benign prompts unaffected. We propose AGOPNs (Average Gradient Outer Product with Null-space steering), which addresses both issues by extracting a safety concept vector via the Recursive Feature Machine, a feature-learning estimator grounded in the Average Gradient Outer Product, and confining the resulting steering matrix to the null space of benign activations, guaranteeing near-zero perturbation of benign prompts by construction. Experiments on Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, and Llama-3.3-70B-Instruct across seven jailbreak attack families show that AGOPNs consistently achieves strong defense success rates while preserving near-baseline utility on AlpacaEval, XSTest, GSM8K, and MATH500.</abstract>
<identifier type="citekey">bui-etal-2026-agopns</identifier>
<location>
<url>https://aclanthology.org/2026.findings-aacl.91/</url>
</location>
<part>
<date>2026-11</date>
<extent unit="page">
<start>1832</start>
<end>1849</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T AGOPNs: Null-Space Activation Steering for Jailbreak Defense via Average Gradient Outer Product Concept Extraction
%A Bui, Minh-Nguyen
%A Phan, Binh-Phuong
%A Doan, Thanh-Khang
%A Huynh-Gia, Bao
%A Nguyen, Phung-Anh
%Y Zhang, Yue
%Y Xu, Ruifeng
%Y Purwarianti, Ayu
%Y Rong, Tong
%Y Suzuki, Jun
%S Findings of the Association for Computational Linguistics: IJCNLP-AACL 2026
%D 2026
%8 November
%I Association for Computational Linguistics
%C Hengqin, China
%@ 979-8-89176-444-6
%F bui-etal-2026-agopns
%X Activation steering offers a training-free path to defending large language models (LLMs) against jailbreak attacks, but existing methods fail to resolve the tension between safety and utility. We identify two root causes: safety concept vectors derived from difference-in-means are fragile under diverse attack geometries, and steering transformations lack a principled guarantee of leaving benign prompts unaffected. We propose AGOPNs (Average Gradient Outer Product with Null-space steering), which addresses both issues by extracting a safety concept vector via the Recursive Feature Machine, a feature-learning estimator grounded in the Average Gradient Outer Product, and confining the resulting steering matrix to the null space of benign activations, guaranteeing near-zero perturbation of benign prompts by construction. Experiments on Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, and Llama-3.3-70B-Instruct across seven jailbreak attack families show that AGOPNs consistently achieves strong defense success rates while preserving near-baseline utility on AlpacaEval, XSTest, GSM8K, and MATH500.
%U https://aclanthology.org/2026.findings-aacl.91/
%P 1832-1849
Markdown (Informal)
[AGOPNs: Null-Space Activation Steering for Jailbreak Defense via Average Gradient Outer Product Concept Extraction](https://aclanthology.org/2026.findings-aacl.91/) (Bui et al., Findings 2026)
ACL