<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="le-le-2026-adversarial">
    <titleInfo>
        <title>Adversarial Robustness of Activation Steering in Large Language Models</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Kien</namePart>
        <namePart type="family">Le</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Thai</namePart>
        <namePart type="family">Le</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-462-0</identifier>
    </relatedItem>
    <abstract>Activation steering has become a popular training-free method to control LLMs’ behavior by injecting precomputed direction vectors into the model’s residual stream at inference time. Yet, its robustness to realistic input variation remains under-explored. We present the first systematic evaluation of activation steering robustness under adversarial text perturbations on the inputs, covering four extraction methods, three attack strategies, six personas from the Anthropic Model-Written Evaluations dataset, and five models ranging from 1.5B to 30B parameters. Attacks succeed broadly across all settings: directional robustness drops by up to 64%, post-attack confidence collapses near or below 0.25 across all methods and models, and steering strength degrades on nearly every steerable input. Layer selection is equally fragile, with the optimal layer identified by an automated method on clean inputs shifting by up to 17 positions under perturbation, a failure that compounds the vector-level breakdown. Extracting vectors from adversarially perturbed inputs partially recovers steerability for PCA and MD on mid-to-large models, but they consistently fail to locate the improved optimal layer, limiting the practical benefit of this mitigation. Together, these findings reveal that the brittleness of activation steering is structural rather than method-specific, and that current layer selection strategies are not robust enough for real-world deployment. Our code is available at https://github.com/kien206/steering-adv-robustness.</abstract>
    <identifier type="citekey">le-le-2026-adversarial</identifier>
    <location>
        <url>https://aclanthology.org/2026.findings-emnlp.1124/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>23804</start>
            <end>23825</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Adversarial Robustness of Activation Steering in Large Language Models
%A Le, Kien
%A Le, Thai
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F le-le-2026-adversarial
%X Activation steering has become a popular training-free method to control LLMs’ behavior by injecting precomputed direction vectors into the model’s residual stream at inference time. Yet, its robustness to realistic input variation remains under-explored. We present the first systematic evaluation of activation steering robustness under adversarial text perturbations on the inputs, covering four extraction methods, three attack strategies, six personas from the Anthropic Model-Written Evaluations dataset, and five models ranging from 1.5B to 30B parameters. Attacks succeed broadly across all settings: directional robustness drops by up to 64%, post-attack confidence collapses near or below 0.25 across all methods and models, and steering strength degrades on nearly every steerable input. Layer selection is equally fragile, with the optimal layer identified by an automated method on clean inputs shifting by up to 17 positions under perturbation, a failure that compounds the vector-level breakdown. Extracting vectors from adversarially perturbed inputs partially recovers steerability for PCA and MD on mid-to-large models, but they consistently fail to locate the improved optimal layer, limiting the practical benefit of this mitigation. Together, these findings reveal that the brittleness of activation steering is structural rather than method-specific, and that current layer selection strategies are not robust enough for real-world deployment. Our code is available at https://github.com/kien206/steering-adv-robustness.
%U https://aclanthology.org/2026.findings-emnlp.1124/
%P 23804-23825

Markdown (Informal)

[Adversarial Robustness of Activation Steering in Large Language Models](https://aclanthology.org/2026.findings-emnlp.1124/) (Le & Le, Findings 2026)

• Adversarial Robustness of Activation Steering in Large Language Models (Le & Le, Findings 2026)

ACL

• Kien Le and Thai Le. 2026. Adversarial Robustness of Activation Steering in Large Language Models. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 23804–23825, Budapest, Hungary. Association for Computational Linguistics.