选择性导向：通过判别性层级选择实现规范保持控制

摘要

尽管在对齐技术方面取得了显著进展，大型语言模型（LLMs）仍然容易受到引发有害行为的对抗性攻击。激活导向技术作为一种有前景的推理时干预方法，但现有方法存在关键局限：激活加法需要精细的系数调整且对层间范数变化敏感，而方向性消融仅能提供二元控制。近期提出的角度导向法通过二维子空间旋转实现连续控制，但其实际实施违反了范数保持原则，导致分布偏移和生成崩溃，尤其在70亿参数以下的模型中更为明显。我们提出选择性导向方法，通过两项关键创新解决这些局限：（1）采用数学严谨的范数保持旋转公式，维持激活分布完整性；（2）实施判别性层级选择，仅在特征表征呈现相反符号类别对齐的层级施加导向。在九个模型上的实验表明，选择性导向的攻击成功率较现有方法提升5.5倍，同时保持零困惑度异常，并在标准基准测试中实现约100%的能力保留。我们的方法为可控且稳定的大型语言模型行为修正提供了原理清晰、高效可行的框架。代码地址：https://github.com/knoveleng/steering

English

Despite significant progress in alignment, large language models (LLMs) remain vulnerable to adversarial attacks that elicit harmful behaviors. Activation steering techniques offer a promising inference-time intervention approach, but existing methods suffer from critical limitations: activation addition requires careful coefficient tuning and is sensitive to layer-specific norm variations, while directional ablation provides only binary control. Recent work on Angular Steering introduces continuous control via rotation in a 2D subspace, but its practical implementation violates norm preservation, causing distribution shift and generation collapse, particularly in models below 7B parameters. We propose Selective Steering, which addresses these limitations through two key innovations: (1) a mathematically rigorous norm-preserving rotation formulation that maintains activation distribution integrity, and (2) discriminative layer selection that applies steering only where feature representations exhibit opposite-signed class alignment. Experiments across nine models demonstrate that Selective Steering achieves 5.5x higher attack success rates than prior methods while maintaining zero perplexity violations and approximately 100\% capability retention on standard benchmarks. Our approach provides a principled, efficient framework for controllable and stable LLM behavior modification. Code: https://github.com/knoveleng/steering

选择性导向：通过判别性层级选择实现规范保持控制

Selective Steering: Norm-Preserving Control Through Discriminative Layer Selection

摘要

Support