Paper deep dive
Mechanistic Steering of LLMs Reveals Layer-wise Feature Vulnerabilities in Adversarial Settings
Nilanjana Das, Manas Gaur
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 96%
Last extracted: 6/21/2026, 6:18:19 AM
Summary
This study investigates the internal mechanisms of jailbreak vulnerabilities in Large Language Models (LLMs) using mechanistic interpretability. The researchers propose a three-stage pipeline—concept extraction, feature grouping, and feature steering—applied to the Gemma-2-2B model using the BeaverTails dataset. By utilizing Sparse Autoencoders (SAEs) to identify feature subgroups, the study demonstrates that mid-to-later layers (specifically layers 16-25) are significantly more vulnerable to steering towards harmful outputs. The research compares three strategies: cluster-based, hierarchical-linkage-based, and single-token-driven steering, concluding that targeted feature-level interventions offer a more principled approach to adversarial robustness than current prompt-level defenses.
Entities (8)
Relation Signals (4)
Gemma-2-2b → hasvulnerabilityin → Layer 16-25
confidence 100% · the features in the layers [16-25] were relatively more vulnerable to steering.
BeaverTails → usedfortesting → Gemma-2-2b
confidence 100% · We propose a three-stage pipeline for Gemma-2-2B using the BeaverTails dataset.
Grok-4-1-fast-non-reasoning → evaluates → Gemma-2-2b
confidence 95% · We therefore use it as a preprocessing utility and in our experiments as a judge model.
Gemma-2-2b → isanalyzedby → Sparse Autoencoders
confidence 90% · A SAE facilitates the layer-wise extraction of feature activations... We used the SAEs made available by Lieberum et al. (2024)... for Gemma-2-2B
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large language models (LLMs) can still be jailbroken into producing harmful outputs despite safety alignment. Existing attacks show this vulnerability, but not the internal mechanisms that cause it. This study asks whether jailbreak success is driven by identifiable internal features rather than prompts alone. We propose a three-stage pipeline for Gemma-2-2B using the BeaverTails dataset. First, we extract concept-aligned tokens from adversarial responses via subspace similarity. Second, we apply three feature-grouping strategies (cluster, hierarchical-linkage, and single-token-driven) to identify SAE feature subgroups for the aligned tokens across all 26 model layers. Third, we steer the model by amplifying the top features from each identified subgroup and measure the change in harmfulness score using a standardized LLM-judge scoring protocol. In all three approaches, the features in the layers [16-25] were relatively more vulnerable to steering. All three methods confirmed that mid to later layer feature subgroups are more responsible for unsafe outputs. These results provide evidence that the jailbreak vulnerability in Gemma-2-2B is localized to feature subgroups of mid to later layers, suggesting that targeted feature-level interventions may offer a more principled path to adversarial robustness than current prompt-level defenses.
Tags
Links
- Source: https://arxiv.org/abs/2604.23130v1
- Canonical: https://arxiv.org/abs/2604.23130v1
Trouble viewing inline? Open PDF directly →
Full Text
26,131 characters extracted from source content.
Expand or collapse full text
Mechanistic Steering of LLMs Reveals Layer-wise Feature Vulnerabilities in Adversarial Settings Nilanjana Das UMBC, Maryland, U.S.A ndas2@umbc.edu &Manas Gaur UMBC, Maryland, U.S.A manas@umbc.edu Abstract Large language models (LLMs) can still be jailbroken into producing harmful outputs despite safety alignment. Existing attacks show this vulnerability, but not the internal mechanisms that cause it. This study asks whether jailbreak success is driven by identifiable internal features rather than prompts alone. We propose a three-stage pipeline for Gemma-2-2B using the BeaverTails dataset. First, we extract concept-aligned tokens from adversarial responses via subspace similarity. Second, we apply three feature-grouping strategies (cluster, hierarchical-linkage, and single-token-driven) to identify SAE feature subgroups for the aligned tokens across all 26 model layers. Third, we steer the model by amplifying the top features from each identified subgroup and measure the change in harmfulness score using a standardized LLM-judge scoring protocol. In all three approaches, the features in the layers [16–25] were relatively more vulnerable to steering. All three methods confirmed that mid to later layer feature subgroups are more responsible for unsafe outputs. These results provide evidence that the jailbreak vulnerability in Gemma-2-2B is localized to feature subgroups of mid to later layers, suggesting that targeted feature-level interventions may offer a more principled path to adversarial robustness than current prompt-level defenses. Keywords: Mechanistic Interpretability, Adversarial Attacks, SAEs, Neural Features, LLM Safety Mechanistic Steering of LLMs Reveals Layer-wise Feature Vulnerabilities in Adversarial Settings Nilanjana Das UMBC, Maryland, U.S.A ndas2@umbc.edu Manas Gaur UMBC, Maryland, U.S.A manas@umbc.edu 1 Introduction LLM’s rapid deployment in real-world systems has outpaced our understanding of their internal mechanisms. This creates a dangerous asymmetry: while LLMs demonstrate remarkable capability, we lack fundamental knowledge of what the model’s internal features interpret. Prior works on adversarial attacks like Greedy Coordinate Gradient (GCG) (Zou et al., 2023) that uses gradient-based optimization strategy at the token-level or Tree of Attacks with Pruning (TAP) (Mehrotra et al., 2024) an effective black-box approach to create adversarial prompts are effective but do not explore the internal mechanism of how the model underwent a behavioral change (safe → unsafe). To bridge this gap between attack efficacy and internal mechanism, we study the residual stream of a LLM, where it embeds the contribution from the attention and the MLP sub-layers. For an adversarial attack task, we presume that there lies an association between features in each of a model’s layers. We hypothesize that understanding the specific subgroups of neural features driving jailbreak success will enable more surgical, principled interventions. Furthermore, an important observation we make here is the localization of the feature subgroups in a layer that have the potential to steer the model to an unwanted behavior. Thus, we identify the feature subgroups activated during an adversarial attack by combining concept extraction, feature detection, and feature steering. By isolating these “jailbreak feature subsets,” we test their attribution to harmful response generation through steering experiments. This provides further information on the model layers and harm category that are more vulnerable to steering. The intellectual merit of this work lies in advancing mechanistic interpretability methodology for adversarial settings and revealing how LLMs’ model layers create exploitable vulnerabilities. The broader impact includes enabling safer AI systems and providing a scientific foundation for more principled safety interventions beyond today’s heuristic approaches. 2 Problem Formulation Task Definition Given a LLM M, when presented with an adversarial prompt from a benchmark dataset D, the model produces a response y. Our aim is to identify relevant subgroups of feature activations that play a vital role in enhancing the model’s harmfulness after the prompt is passed. The adversarial prompt-response pair chosen from D is denoted as <x,z><x,z>, where z is an unsafe response to x. An unsafe response contains harmful words/phrases that represent negative sentiment. These words/phrases are then extracted from z and reformulated as concept descriptions. To generate a vector representation of each of these descriptions, we used a subspace generator model G (a fine-tuned version of M) from Wu et al. (2025), where a subspace lies in the embedding space of M. G can generate high-quality subspaces for the layer 20 residual stream of the instruction-tuned version of M, given a concept description. The concept descriptions (w1,w2,…,wmw_1,w_2,…,w_m) that focus on negative sentiment were extracted from z using Grok’s non-reasoning model. For each concept description, we have a subspace such that S:s1,s2,…,smS:\s_1,s_2,…,s_m\, where s1s_1 is the vector for w1w_1, etc. We compute the cosine similarity between each subspace vector and the residual stream activations (feature activations for each token in the prompt) extracted at layer 20 of model M. ∀si∈S,∀t∈T,cos_sim(si,layer20act)∀ s_i∈ S,∀ t∈ T,cos\_sim(s_i,layer20_act_t) Rufail et al. (2025) demonstrated that the middle layers of models exhibit the highest similarity between concepts; thus, we continued to use layer 20. We identify numnum tokens in a prompt with a positive cosine similarity and refer to them as pospos. This is required to identify tokens that are similar to negative-sentiment concept descriptions and can therefore be used to find relevant feature subgroups for a successful jailbreak. To find relevant feature subgroups, we require feature activations. A SAE facilitates the layer-wise extraction of feature activations. We used the SAEs made available by Lieberum et al. (2024) that can sparsely decompose latent representations into interpretable features. We find important feature subgroups from SAE features for an adversarial specific task such that we are able to steer M towards a relatively unsafe behavior when compared to its default behavior. Feature activations were extracted using SAEs attached to the residual stream of all layers. The cached SAE feature-activations as represented across the 26 layers of M can be described as: A=a0,a1,..,a25A=\a_0,a_1,..,a_25\, where, ak∈ℝB×sl×16384a_k ^B× sl× 16384 (B = batch size, slsl = sequence length) represents the SAE feature activations for slsl tokens extracted at layer k. We focus only on the cached activations of the tokens in pospos for each layer. We then perform agglomerative clustering and linkage analysis on transposed activation matrices to identify subgroups of features that activate across layers. We denote the set of transposed activations as A′:a0′,a1′,..,a25′A :\a _0,a _1,..,a _25\, where new ak∈ℝnum×16384→ak′∈ℝ16384×numa_k ^num× 16384→ a _k ^16384×num. On ak′a _k we apply our method to identify relevant subgroups of features in layers. Below we describe the three methods to find feature subgroups. Figure 1: Approach 1: This figure represents steering with cluster-based feature selection. Results demonstrate (mid-late) layers are relatively more prone to steering. It also illustrates the harm categories that can be used to amplify the harmful behavior in the model. Feature Identification Through Three Approaches. Approach 1: Cluster-based steering. We identify the highest activating feature for all tokens in pospos specifically in layer 20 and collectively refer to them as feature set ℱ:f1,f2,…,fnF:\f_1,f_2,…,f_n\. To find the feature subgroup for each fif_i in each layer, we perform agglomerative clustering on ak′∈A′,k∈0,…,25a _k∈ A , k∈\0,…,25\. An agglomerative clustering algorithm assigns a cluster number to each feature in each layer. For each layer and feature fi∈ℱf_i , we identify the features that belong to the same cluster (have the same cluster number) as that of fif_i and consider the identified features as part of the feature subgroup of fif_i. This feature subgroups or clusters of features across layers can be described as C:ck−f1,ck−f2,…,ck−fnC:\c_k-f_1,c_k-f_2,…,c_k-f_n\, k represents the layer, and fif_i is the feature to which the feature cluster belongs. For each ak′a _k we compute ak′a _k the average activation across numnum tokens such that ak′∈ℝ16384a _k ^16384. We steer M with top-3 features from each cluster ck−fi,fi∈ℱc_k-f_i,f_i that have the highest value of feature activation when averaged across tokens. Approach 2: Hierarchical linkage-based steering. Next, we use linkage to find the hierarchy of features in each layer for each feature, fi∈ℱf_i . Hierarchy links features that are closely related to each other. The closely associated features form clusters such that C′:ck−f1′,ck−f2′,…,ck−fn′C :\c _k-f_1,c _k-f_2,…,c _k-f_n\. This ensures that features are used for steering, not by considering their agglomerative cluster numbers and rank in average activations; instead, priority is given to how closely linked they are to fi∈ℱf_i in a layer. Approach 3: Single-token-driven feature steering. Through this we recognize that a single token t with the highest cosine similarity to a subspace, can drive model steering itself. Instead of using the same feature set ℱF across all layers to find clusters of features, here we focus on the top-2 features fired on token t at each layer. The set of features are ℱ′:f0−1′,f0−2′,f1−1′,f1−2′……,f25−1′,f25−2′F :\f _0-1,f _0-2,f _1-1,f _1-2…,f _25-1,f _25-2\, where each feature is represented as fk−u′f _k-u, k is the layer and u is the feature number. Similar to hierarchical linkage-based steering, we perform linkage on each layer’s cached activations for the token t (under consideration in this approach) and identify a cluster for each fj′∈ℱ′f _j such that C′:c0−1′,c0−2′,c1−1′,c1−2′……,c25−1′,c25−2′C :\c _0-1,c _0-2,c _1-1,c _1-2…,c _25-1,c _25-2\. M is steered with the top-3 features from each ck−u′c _k-u. Figure 2: Approach 3: This figure represents single-token driven technique of feature selection. Similar to the other two methods this heatmap also shows (mid-late) layers as more vulnerable to feature steering. 3 Experimental Setup Models To extract the negative sentiment words/phrases from adversarial responses z, we employed Grok-4-1-fast-non-reasoning. We found that Gemma-2-2B produced repetitive tokens or continued generating within the context of the adversarial prompt when asked to perform this extraction. Grok-4-1-fast-non-reasoning, by contrast, reliably isolated concise negative-sentiment terms, likely due to its larger scale and broader pre-training data. We therefore use it as a preprocessing utility and as a judge model in our experiments; Gemma-2-2B remains the only model subject to feature analysis and steering. We use Gemma-2-2B (Team et al., 2024) as the target model for all steering experiments. This choice is motivated by two factors. First, Gemma-2-2B is a lightweight, open-source model that permits full access to residual-stream activations across all 26 layers. Second, Lieberum et al. (2024) released Gemma Scope, that consists of an open-source suite of SAEs trained on every layer and sub-layer of Gemma-2-2B and other models. The availability of pre-trained SAEs allows us to extract 16k-dimensional feature activations without additional training overhead. Dataset. We used the BeaverTails dataset (Ji et al., 2023), a widely adopted benchmark for safety-alignment research. Each datapoint contains an adversarial prompt, a model response, a set of 14 harmful-category labels, and a binary safety flag (is_safe). From this corpus we sample 20 prompts per category (280 total), retaining only datapoints assigned to exactly one unsafe category. This single-category constraint ensures that the negative-sentiment words/phrases extracted from each response are attributable to a single harm type, preventing cross-category confounding during feature analysis. Baseline and Evaluation Protocol. We define the baseline as the unsteered response that Gemma-2-2B generates for each adversarial prompt under default decoding. To quantify the effect of steering, we score both the baseline and each steered response on a 1–5 harmfulness scale, where 1 is the safest response, and 5 denotes the most harmful. Scoring is performed by an LLM judge using the template introduced by Qi et al. (2024), which evaluates whether a response complies with a harmful request and the degree of detail it provides. 4 Results and Analysis We evaluate all three steering approaches introduced in Section 2 and report our analysis across the 14 categories and 26 layers of Gemma-2-2B. Cluster-Based Steering. Figure 1 summarizes the per-layer, per-category harmfulness degrees under cluster-based steering. It demonstrates, for each layer and category, how many prompts received a higher steered response score than the default. Roughly, some mid layers and the later layers (layer ~13 onward) are consistently more steerable than earlier layers. This pattern is consistent with prior observations that later MLP sub-layers encode higher-level, task-relevant features, making them more susceptible to targeted perturbation. Among individual categories, ‘violence,aiding_and_abetting,incitement’, ‘financial_crime,property_crime,theft’, and ‘non_violent_unethical_behavior’ show that more prompts were successfully steered in the mid to later layers. Hierarchical Linkage-Based Steering. Hierarchical linkage-based steering (Figure §4) is comparatively more selective. We consider two features as closely associated only if the linkage cluster to which both features belong contains no more than 50 members; this threshold ensures that the identified associations are specific rather than artifacts of large, loosely connected clusters. Here, if a linkage cluster is assigned a number greater than 16383, it may be made up of more than 50 features. As a consequence, fewer features qualify for steering in any given layer, and overall number of prompts are lower than those of the other two approaches. Nevertheless, layers 12–25 consistently produce steered responses whose harmfulness scores exceed the corresponding baselines, confirming that meaningful adversarial feature subgroups exist in the later half of the network even under this more conservative criterion. Single-Token-Driven Feature Steering. The single-token-driven approach (Figure 2) reveals a similar trend: early layers produce minimal steering effect, while layers 16–25 show a marked increase in steerability. This approach yields the highest number of prompts affected by steering among the three methods, with a peak category-layer value of 10 for violence,aiding_and_abetting,incitement at layer 22. The result suggests that concentrating on the single most subspace-aligned token and its top-2 activating features provide a stronger and more focused steering signal than distributing attention across all positively similar tokens. 5 Conclusion In this research, we aim to identify subgroups of features that, when steered, transition a model towards unsafe behavior. Results show that finding such features is plausible given the three feature-grouping strategies we employed. We noticed that particularly mid-late layers of the target model are relatively more subject to steering and generating a response with a higher harmfulness score. Limitations In this research, we used SAEs to extract feature activations from model layers. We used already available SAEs, as training them is both resource and time intensive. We also had to work with an open-source model (Gemma-2-2B). Our study is limited to open-source models only. At this point we tried with Gemma-2-2B, however, the proposed methodology can be adapted for other open-source models as well. For now we considered a small sample size (280 prompts) because our aim is to get a better understanding of a model’s individual layers (26) and feature subgroups in each layer. This study was performed to understand the internal mechanics of the model for adversarial tasks and not to perform experiments at scale. Thus, it specifically aims for a mechanistic understanding of the adversarial task and may not be generalizable to other tasks or domains. We used Grok-4-1-fast-non-reasoning as a judge model, however, there may exist bias towards either giving a higher score or a lower score to the responses. We cannot account for that, as there is no ground-truth available for the severity of the harmful responses. Ethical Considerations This research was pursued to get a mechanistic understanding of the model’s behavior for an adversarial task. The ultimate goal is to help the broader research community, specially, the AI safety experts in developing robust and safer models over a period of time. This research was not undertaken to build a product and commercialize it in anyway. Nor, did it include the involvement of humans till now. This was a black-box analysis where we gained understanding of the model’s behavior when selective features were steered. We used the BeaverTails dataset, which is publicly available under the c-by-nc-4.0: Creative Commons Attribution Non Commercial 4.0 license. References N. Cammarata, G. Goh, S. Carter, L. Schubert, M. Petrov, and C. Olah (2020) Curve detectors. Distill 5 (6), p. e00024–003. Cited by: §A.1. B. Cheung, A. Terekhov, Y. Chen, P. Agrawal, and B. Olshausen (2019) Superposition of many models into one. Advances in neural information processing systems 32. Cited by: §A.1. J. Ji, M. Liu, J. Dai, X. Pan, C. Zhang, C. Bian, B. Chen, R. Sun, Y. Wang, and Y. Yang (2023) Beavertails: towards improved safety alignment of llm via a human-preference dataset. Advances in Neural Information Processing Systems 36, p. 24678–24704. Cited by: §3. R. Lapid, R. Langberg, and M. Sipper (2023) Open sesame! universal black box jailbreaking of large language models. In arXiv preprint arXiv:2309.01446, Cited by: §A.1. T. Lieberum, S. Rajamanoharan, A. Conmy, L. Smith, N. Sonnerat, V. Varma, J. Kramár, A. Dragan, R. Shah, and N. Nanda (2024) Gemma scope: open sparse autoencoders everywhere all at once on gemma 2. Proceedings of the 7th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP, p. 278–300. Cited by: §2, §3. R. Lin, B. Han, F. Li, and T. Liu (2025) Understanding and enhancing the transferability of jailbreaking attacks. The Thirteenth International Conference on Learning Representations. Cited by: §A.1. A. Mehrotra, M. Zampetakis, P. Kassianik, B. Nelson, H. Anderson, Y. Singer, and A. Karbasi (2024) Tree of attacks: jailbreaking black-box llms automatically. Advances in Neural Information Processing Systems 37, p. 61065–61105. Cited by: §1. [8] N. Nanda, L. Chan, T. Lieberum, J. Smith, and J. Steinhardt Progress measures for grokking via mechanistic interpretability. The Eleventh International Conference on Learning Representations. Cited by: §A.1. C. Olah, A. Satyanarayan, I. M. Johnson, S. Carter, L. Schubert, K. Ye, and A. Mordvintsev (2018) The building blocks of interpretability. Cited by: §A.1. J. Placidi (2025) Attribution graphs: how to read an artificial neural brain. Medium. Cited by: §A.1. X. Qi, Y. Zeng, T. Xie, P. Chen, R. Jia, P. Mittal, and P. Henderson (2024) Fine-tuning aligned language models compromises safety, even when users do not intend to!. In The Twelfth International Conference on Learning Representations, External Links: Link Cited by: §3. A. Rufail, S. Rathore, D. Son, A. Simon, S. Dave, D. Zhang, C. Blondin, S. O’Brien, and K. Zhu (2025) Semantic convergence: investigating shared representations across scaled LLMs. In ACL 2025 Student Research Workshop, External Links: Link Cited by: §2. A. R. Team (2025) Circuit tracing: revealing computational graphs in language models. Transformer Circuits Blog. External Links: Link Cited by: §A.1. G. Team, M. Riviere, S. Pathak, P. G. Sessa, C. Hardin, S. Bhupatiraju, L. Hussenot, T. Mesnard, B. Shahriari, A. Ramé, et al. (2024) Gemma 2: improving open language models at a practical size. arXiv preprint arXiv:2408.00118. Cited by: §3. A. Wei, N. Haghtalab, and J. Steinhardt (2023) Jailbroken: how does llm safety training fail?. arXiv preprint arXiv:2307.02483. Cited by: §A.1. Z. Wu, A. Arora, A. Geiger, Z. Wang, J. Huang, D. Jurafsky, C. D. Manning, and C. Potts (2025) AxBench: steering LLMs? even simple baselines outperform sparse autoencoders. In Forty-second International Conference on Machine Learning, External Links: Link Cited by: §2. Z. Zheng, Y. Wang, Y. Huang, S. Song, M. Yang, B. Tang, F. Xiong, and Z. Li (2025) Attention heads of large language models. Patterns 6 (2). Cited by: §A.1. A. Zou, S. K. Wang, Z. Z., and M. Fredrikson (2023) Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043. Cited by: §A.1, §1. Appendix A Appendix A.1 Related Work Adversarial attacks on LLMs exploit fundamental vulnerabilities in safety alignment. Early work established that simple jailbreak prompts, including role-playing instructions, competing-objective framing, and refusal suppression—can effectively bypass guardrails in state-of-the-art models (Wei et al., 2023). More sophisticated approaches have developed automated techniques: gradient-based methods such as Greedy Coordinate Gradient (GCG) enable systematic search for adversarial suffixes (Zou et al., 2023); genetic algorithms and reinforcement learning approaches have achieved high attack success rates on open-source models (Lapid et al., 2023). However, transfer of these attacks to proprietary models remains limited, suggesting that adversarial effectiveness depends on model-specific internal properties rather than universal prompt structures alone (Lin et al., 2025). This observation motivates investigation into the internal mechanisms driving attack success. Mechanistic interpretability aims to reverse-engineer neural networks by identifying interpretable computational subcircuits (Olah et al., 2018). Foundational work identified individual circuits (e.g., induction heads, curve-detection neurons), establishing that neural networks implement discretizable, human-understandable mechanisms (Cammarata et al., 2020; Nanda et al., ). Recent breakthroughs use sparse autoencoders (SAEs) to address the polysemanticity problem, where individual neurons encode many unrelated concepts (Cheung et al., 2019). SAEs decompose activations into monosemantic features, dramatically improving interpretability. Building on SAEs, cross-layer transcoders replace MLPs with interpretable feature representations, enabling construction of feature-feature interaction graphs (Team, 2025). Attribution graphs are used to trace the information flow between these features, identifying which features causally contribute to specific outputs (Placidi, 2025). This technology has been applied to poem generation and other benign tasks, but remains largely unexplored for understanding adversarial phenomena. While substantial work exists on adversarial attacks and mechanistic interpretability separately, few studies combine these fields. Existing safety-focused interpretability research identifies attention heads related to refusal behavior (Zheng et al., 2025), but this work remains limited to attention mechanisms and hasn’t fully characterized the feature-level circuits underlying adversarial vulnerability. Furthermore, most mechanistic interpretability research focuses on forward-pass inference; applying these techniques to adversarial phenomena requires methodological innovation. A.2 Implementation Details We performed our experiments on L40s or rtx_8000 GPUs depending on the availability of resources. We utilized approximately 500 GPU hours for our experiments. Open-source model like Gemma-2-2B can be easily downloaded from Hugging Face. The subspace generator G, introduced in Section 2 is gemma-reft-2b-it-res-generator111https://huggingface.co/pyvene/gemma-reft-2b-it-res-generator. We used open-source Python libraries in our research. Figure 3: Figure demonstrating that the later layers are relatively more steerable than the early-mid layers on the overall datapoints considered in the experimentation. A.3 Cross-Approach Summary Across all three methods, two findings are robust. First, adversarial steerability is concentrated in the mid-later layers of Gemma-2-2B, with a consistent inflection point around layers 16–25. Second, harm categories involving explicit violence, aiding, abetting or incitement are disproportionately more steerable, suggesting that the model’s internal representation for these topics are both more localized and more amenable to feature-level intervention. Figure §3 provides a unified view of prompt counts per layer that contributed to increased harmfulness across the categories. Figure 4: Approach 2: This figure represents steering with the hierarchical linkage-based feature selection. It shows the particular harm categories and mid-later layers that are relatively more prone to feature steering.