Safety Targeted Embedding Exploit via Refinement - LLM Safety as an Epistemic Coverage Problem

Sep 21, 2026

Uploaded by Aurora

Safety training for LLMs relies heavily on English, leaving a systematic blind spot for harmful requests expressed in low-resource languages or through mixed-language code-switching. In such cases, the model often fails to communicate uncertainty and instead confidently outputs harmful responses via overconfident extrapolation. The work introduces STEER, a gradient-guided refinement attack that pinpoints words that most strongly trigger the refusal direction and iteratively translates them to suppress refusals while preserving malicious intent, achieving up to 93% ASR on JailbreakBench and 96.7% on AdvBench across six 8B models.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages7

Reading Time18 min

AccessFree to download

Introduction

STEER contributions

Background

The refusal direction

English-centric safety alignment

Gradient-based and black-box jailbreaks

Safety Targeted Embedding Exploit via Refinement: LLM Safety as an Epistemic Coverage Problem Joshua Adrian Cahyono 1 arXiv :2607 .0 1859v 1 [ cs .AI] 2 Jul 2026 Abstract Safety training for LLMs happens almost entirely in English, creating a class of unknown unknowns: harmful requests in low-resource languages or mixed-language code-switching that the model has never been taught to recognise as dangerous. Critically, the model does not express uncertainty on such inputs—it confidently generates harmful responses, exhibiting overconfident extrapolation beyond the support of its safety training distribution. We introduce STEER (Safety Targeted Embedding Exploit via Refinement), a gradient-guided attack that exploits this epistemic gap: it identifies which words most strongly activate the model’s refusal direction and iteratively translates them into low-resource languages, collapsing the refusal signal while preserving harmful intent. Across six open-source 8B-parameter models, STEER reaches attack success rates of up to 93% on JailbreakBench and 96.7% on AdvBench, outperforming random code-switching and GCG. Prompts transfer to GPT-4o-mini at 35.5% ASR without closed-model access, suggesting the coverage failure is systematic rather than architecture-specific. These results exposea fundamental gap in current alignment practice: safety mechanisms calibrated on English cannot be trusted to generalise, and closing this gap requires expanding training coverage across the full multilingual input distribution and coupling safety with principled abstention on out-ofdistribution inputs. Code is available at [https:](https:)//[github.com/JvThunder/STEER](github.com/JvThunder/STEER). 1Nanyang Technological University, Singapore. Correspondence to: Joshua Adrian Cahyono <[jcahyono001@ntu.edu.sg](jcahyono001@ntu.edu.sg) >. 2nd Workshop on Epistemic Intelligence in Machine Learning (EIML@ICML 2026), Seoul, South Korea. Copyright 2025 by the author(s). 1. Introduction Mechanistic interpretability research aims to understand how LLMs implement capabilities by reverse-engineering the internal circuits responsible for observed behaviour. Oneof the most practically significant findings in this space is that safety fine-tuning concentrates the refusal mechanism into a single linear direction in the residual stream (Arditiet al., 2024) . This is a clean, interpretable structure—and it is also a single point of failure. STEER exploits this directly. By reading the model’s refusal direction from its internal representations and computing gradient attribution of each input word against that direction, STEER identifies exactly which parts of a prompt are triggering the safety filter. It then replaces those words, highest attribution first, with translations in low-resource languages. The result is a prompt that preserves the harmful intent but avoids activating the refusal direction—not by brute-force perturbation, but by reading the model’s own internal safety circuit and working around it. Code-switching attacks on LLM safety have been explored before (Deng et al., 2024; Yoo et al., 2025; Upadhayay and Behzadan, 2024; Singhania et al., 2025; Huang et al., 2025), and the intuition that non-English phrasings undermine English-centric safety training is well established. What STEER adds is the use of mech interp findings to make the attack targeted and efficient: rather than replacing words at random, it reads the internal safety geometry to find the words that matter most. This reduces the number of translations required and raises success rates substantially over random baselines. The paper makes four contributions: (1) the STEER pipeline, which reaches up to 93%/96.7% ASR on JBB/AdvBench across six models; (2) a Fisher Linear Discriminant (FLD) method for automatic layer selection that also quantifies the structural vulnerability of a model’s safety encoding; (3) a comprehensive evaluation across six models and three benchma

FAQs

What problem does the paper identify in current LLM safety training?

Safety fine-tuning is mostly English-centric, creating unknown-unknowns for harmful requests in low-resource languages and mixed-language code-switching. The model may not express uncertainty and can generate harmful responses confidently.

How does STEER work at a high level?

STEER reads the model’s refusal direction from internal representations, uses gradient attribution to find which words trigger the safety filter, then iteratively translates those words into low-resource languages to collapse the refusal signal while keeping harmful intent.

What evidence shows the vulnerability is systematic rather than architecture-specific?

Across six architecturally diverse open-source 8B-parameter models, the refusal direction structure generalizes and yields high attack success rates. Transfers to GPT-4o-mini at a notable ASR, suggesting the failure reflects alignment coverage gaps rather than a single model design.

Sep 21, 2026

Uploaded by Aurora