SteeringSafety: A Systematic Safety Evaluation Framework of Representation Steering in LLMs

🎯 Overview

SteeringSafety is a benchmark suite for evaluating representation steering methods across multiple safety perspectives.

SteeringSafety provides:

• 📊 A collection of 17 datasets including 7 perspectives for measuring safety behaviors.
• 🔧 A modular code framework implementing the taxonomy of training-free steering methods with standardized, interchangeable components

📚 Dataset Collection

Each dataset is split into 40/10/50 for train/val/test.

🚨 Perspectives

Harmfulness, bias, and hallucination are explicitly targeted by steering:

🚫 Harmfulness (Refusal)

• SALADBench: Generation dataset filtered for harmful open-ended prompts, testing model refusal behavior

🎭 Bias (Fairness)

• BBQ (Implicit Bias): Multiple-choice benchmark probing stereotyping across protected demographic attributes
• ToxiGen (Explicit Bias): Binary classification where models agree/disagree with toxic statements linked to demographic identities

🔍 Hallucination

• FaithEval (Intrinsic Hallucination): Three subsets testing contradictions with input context
  • Counterfactual, Inconsistent, Unanswerable
• PreciseWikiQA (Extrinsic Hallucination): Wikipedia-sourced QA testing unsupported generation absent from context or pretraining

👥 Social Behavior

• Brand Bias: Product recommendation preferences (DarkBench)
• Sycophancy: Uncritical agreement with user input (DarkBench)
• Anthropomorphism: Human-like self-description (DarkBench)
• User Retention: Unnecessary interaction prolonging (DarkBench)

🧠 Reasoning Ability

• Expert-Level Reasoning: Graduate-level questions across domains (GPQA)
• Commonsense Reasoning: Grade-school inference (ARC-C)

🔍 Epistemic Integrity

• Factual Misconceptions: True vs. plausible false statements (TruthfulQA)
• Sneaking: Adversarial opinion reframing (DarkBench)

⚖️ Normative Judgment

• Commonsense Morality: Ethical dilemmas (DecodingTrust)
• Political Views: Political opinion agreement (TwinViews)

✨ Sample Usage

To quickly get started with SteeringSafety, you can clone the repository, install dependencies, and run the complete steering pipeline:

# Clone repository
git clone https://github.com/wang-research-lab/SteeringSafety.git
cd SteeringSafety

# Install dependencies
pip install -e .

# Run complete steering pipeline
python scripts/run/run_full_pipeline.py -m qwen25-7b -c refusal_base -M dim

# Run with different entanglement controls
python scripts/run/run_full_pipeline.py -m qwen25-7b -c refusal_base -M dim_nokl      # No KL constraint
python scripts/run/run_full_pipeline.py -m qwen25-7b -c refusal_base -M dim_conditional # With CAST

For comprehensive evaluation across multiple models, behaviors, and methods:

python scripts/run/run_parallel_experiments.py \
    --skip-metrics \
    --concepts explicit_bias implicit_bias hallucination_extrinsic refusal_base hallucination_intrinsic \
    --model llama3-1-8b qwen25-7b \
    --methods ace_conditional \
    --gpu 0 1 2 3

🤖 Supported Models

Currently supported models:

• Qwen2.5-7B
• Llama-3.1-8B
• Gemma-2-2B

All models support chat templates and are compatible with all steering methods in our framework.

🔧 Modular Framework

We decompose training-free steering methods into three phases:

1. Direction Generation

Extract steering vectors from training data:

• Methods: DiffInMeans, PCA, LAT
• Formats: SteeringFormat.DEFAULT, SteeringFormat.REPE, SteeringFormat.CAA

2. Direction Selection

Choose optimal layer and hyperparameters:

• Grid Search: Exhaustive search across the desired layers based on val score
• COSMIC: Efficient cosine similarity-based selection without full generation

3. Direction Application

Apply steering during inference:

• Activation Addition: Add scaled direction to activations
• Directional Ablation: Remove projection along direction (with optional affine transformation)
• Locations: Where in the model to apply steering (same layer as generation, all layers, cumulative across layers, etc.)
• Positions: ALL_TOKENS, POST_INSTRUCTION, OUTPUT_ONLY
• Conditional (CAST): Apply only when activation similarity exceeds threshold

📋 Pre-configured Methods

We implement 5 methods from the literature, each with 3 variants for different effectiveness/entanglement tradeoffs:

All configurations can be found in the configs/ directory with variants: {method}.yaml, {method}_nokl.yaml, {method}_conditional.yaml

⚙️ Custom Configurations

Importantly, the above 5 methods are not exhaustive. Our modular framework allows easy creation of new methods by combining different components!

For example, to create a new method using LAT with CAA format, COSMIC selection, Directional Ablation application, and Conditional steering (CAST), with different layer and component choices than is used in the paper, simply create a new YAML config:

# configs/custom.yaml - LAT + CAA format + COSMIC + Directional Ablation + Conditional

# Override dataset formatting to use CAA templates with LAT:
train_data:
  pos:
    params:
      format: SteeringFormat.CAA  # LAT with CAA format
  neg:
    params:
      format: SteeringFormat.CAA
  neutral: null

# Phase 1: Direction Generation
direction_generation:
  generator:
    class: direction_generation.linear.LAT
    params: {}
  param_grid:
    # Change for every middle layer and attn output component
    layer_pct_start: [0.3]
    layer_pct_end: [0.7]
    layer_step: [1]
    component: ['attn']
    attr: ['output']
    pos: [-1]
    ...

# Phase 2: Direction Selection
direction_selection:
  class: direction_selection.cosmic.COSMIC
  params:
    application_locations: []
    include_generation_loc: true
    generation_pos: POST_INSTRUCTION  # Targeted application
    use_kl_divergence_check: false
    ...

# Phase 3: Direction Application
direction_application:
  class: direction_application.unconditional.DirectionalAblation
  params:
    use_affine: false  # Pure directional ablation
    ...

# Enable conditional steering
conditional:
  enabled: true
  condition_selection:
    class: direction_selection.grid_search.ConditionalGridSearchSelector
    params:
      condition_thresholds: "auto"
      condition_comparators: ["greater"]
      ...

We also welcome contributions of new datasets, models, and components to further expand what can be evaluated.

📁 Repository Structure

SteeringSafety/
├── configs/                      # Experiment configurations
│   ├── {method}.yaml            # Base configurations
│   ├── {method}_nokl.yaml       # No KL divergence check
│   └── {method}_conditional.yaml # With CAST
├── data/                        # Dataset loaders
│   ├── steering_data.py         # Main data interface
│   ├── refusal.py              # Harmful generation datasets
│   ├── bias.py                 # Demographic bias datasets
│   ├── hallucination.py        # Hallucination datasets
│   └── secondary_datasets.py   # Entanglement evaluation
├── direction_generation/        # Phase 1 components
│   ├── base.py
│   └── linear.py               # DiffInMeans, PCA, LAT
├── direction_selection/         # Phase 2 components
│   ├── base.py
│   ├── grid_search.py
│   └── cosmic.py
├── direction_application/      # Phase 3 components
│   ├── base.py
│   ├── unconditional.py       # Standard steering
│   └── conditional.py         # CAST implementation
├── utils/                      # Utilities
│   ├── intervention_llm.py    # Model steering code
│   ├── steering_utils.py      # Helper functions
│   └── enums.py              # Configuration enums
└── scripts/
    ├── run/                   # Experiment scripts
    └── analysis/              # Evaluation tools

🔬 Key Findings

Our evaluation reveals several critical insights about current steering methods:

• Method effectiveness varies significantly: DIM and ACE work best for reducing harmfulness and bias, while PCA and LAT show promise for hallucination reduction, but success depends heavily on the specific method-model-perspective combination being used.

• Entanglement affects different capabilities unevenly: Social behaviors (like sycophancy and user retention) and normative judgments are most vulnerable to unintended changes during steering, while reasoning capabilities remain relatively stable.

• Counterintuitive cross-perspective effects emerge: Jailbreaking doesn't necessarily increase toxicity, hallucination steering causes opposing political shifts in different models, and improving one type of bias can actually degrade another type, showing complex interdependencies between safety perspectives.

• Conditional steering improves tradeoffs: Applying steering selectively (conditional steering) achieves effectiveness comparable to the best settings while significantly reducing entanglement for harmfulness and hallucination, though it performs poorly for bias steering.

• Findings generalize across model scales: The relative performance rankings of different steering methods and entanglement patterns remain can consistent across models of different sizes, suggesting insights from smaller models can inform steering larger models.

This represents a major open challenge in AI safety: developing steering methods that can precisely target specific behaviors without unintended side effects. We hope this benchmark will accelerate progress toward more controllable and safer steering methods, and in the future, more generally towards safer AI systems.

📄 License

Framework Code

The SteeringSafety framework code is released under the MIT License.

Datasets

This benchmark incorporates multiple existing datasets, each with their own licensing terms. For some datasets (e.g., HalluLens), we also utilize their evaluation code and metrics. Users must respect the individual licenses of constituent datasets:

Datasets marked with asterisk seem to have no explicit dataset license but their associated codebases are licensed (Apache-2.0, MIT, etc.). Please refer to original sources for usage terms. HalluLens is mostly CC-BY-NC but contains some components with other licenses.

🙏 Acknowledgments

We gratefully acknowledge the following for helpful resources and foundational work:

• AxBench
• CAST
• DIM
• COSMIC
• RepE
• CAA
• and many others!

📝 Citation

@misc{siu2025SteeringSafety,
      title={SteeringSafety: A Systematic Safety Evaluation Framework of Representation Steering in LLMs},
      author={Vincent Siu and Nicholas Crispino and David Park and Nathan W. Henry and Zhun Wang and Yang Liu and Dawn Song and Chenguang Wang},
      year={2025},
      eprint={2509.13450},
      archivePrefix={arXiv},
      primaryClass={cs.AI},
      url={https://arxiv.org/abs/2509.13450},
}