Controlling Refusal Behavior of LLMs via Stiefel-Constrained Rotation Steering
Kirill Bunin, Dmitry Bylinkin, Vladimir Aletov, Daniil Medyakov, Vladimir Solodkin, Aleksandr Beznosikov
cs.LG · cs.CL
Quick verdict
StiefelSteer: learned subspace rotations steer refusal, beating RDO and rotational baselines on 3 models; strong, but small eval and no significance tests.
Summary
The paper introduces StiefelSteer, an activation-steering method that controls LLM refusal through trainable rotations rather than additive steering vectors. The operator M = I + B(Q−I)B^T, with B on the Stiefel manifold St(d,n) and Q in SO(n), is proven to be an exact SO(d) rotation: it preserves activation norms, acts as the identity outside the learned n-dimensional subspace, and its transpose is its exact inverse, so attack and defence share one geometric framework. B and Q are trained jointly via Riemannian optimization (tangent projection plus QR/Cayley/SVD retractions) using a cross-entropy loss on harmful pairs with KL regularization on retain prompts. On DeepSeek-R1-Distill-7B, Falcon3-7B-Base, and Qwen2.5-1.5B-EASE, judged by Llama-Guard-3-8B and Qwen3Guard-Gen-8B, the method raises unsafe rates from 0.52 to 0.90, 0.73 to 0.92, and 0.00 to 0.89 under attack, and in defence floors DeepSeek at 0.00 and brings Falcon3 to 0.20 where no baseline drops below 0.67, with ARC and perplexity largely preserved. Ablations show n=35 directions (under 1% of d=3584) and two steered layers suffice on DeepSeek. Main limitations: 200-prompt evaluation without significance testing, no adaptive-attack defence evaluation, and two of three models sharing Qwen lineage.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- The operator family M = I + B(Q−I)B^T with B ∈ St(d,n), Q ∈ SO(n) contains all prior 2D rotation-steering methods as n=2 special cases, and learning both the subspace B and rotation Q via Riemannian optimization removes the dependence on an externally estimated refusal direction.
- StiefelSteer achieves the highest unsafe rate under attack on all three models under both judges (0.52→0.90, 0.73→0.92, 0.00→0.89 under Llama-Guard) while keeping ARC-Challenge and WikiText-2 perplexity close to the unmodified model.
- Because M^T is the exact algebraic inverse of M, the same geometric framework supports defence, flooring DeepSeek-R1-7B at 0.00 and bringing base Falcon3-7B to 0.20 where no baseline moves below 0.67.
- A subspace of n=35 dimensions (under 1% of d=3584) and two steered layers suffice to saturate attack and defence control on DeepSeek-R1-7B.
- Learned solutions end nearly orthogonal to the estimated refusal direction, which the authors read as evidence that estimating that direction is not necessary for refusal control — explicitly not as evidence that a single direction is insufficient.
Strengths
Clean geometric formulation with honest lineage
Proposition 1 proves M = I + B(Q−I)B^T lies in SO(d) with exact norm preservation and M^T as exact inverse; Section 4.1 unifies Angular Steering, HPR-style plane rotations, etc. as the n=2 case of Eq. (1), and the authors explicitly disclaim novelty for the proposition itself, citing Givens rotations and Schreiber–Parlett block reflectors — exemplary scholarship.
Strong, capability-aware empirical gains
Table 1 pairs every safety cell with ARC/perplexity: attack raises unsafe rates 0.52→0.90 (DeepSeek, Cayley L=2 n=35), 0.73→0.92 (Falcon3, L=20), and 0.00→0.89/0.97 on the EASE-hardened Qwen where all baselines score 0.00; defence floors DeepSeek at 0.00/0.00 (Stiefel variant) with ARC 0.41 and PPL 26.1 vs 26.4 unmodified, while Spherical Steering reaches comparable guard scores only with PPL 4603/1008 — an artifact the paper correctly diagnoses as degenerate text (B.6).
Well-designed ablations that control confounds
Above-average epistemic hygiene
Weaknesses
No statistical uncertainty anywhere
Coarse capability measurements
Limited model diversity
Defence evaluated only in-distribution, mechanism unexplained
Fixed regularization and unclear regime coupling
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper introduces StiefelSteer, an activation-steering method for controlling LLM refusal through trainable rotations. The central object is a per-layer operator M = I + B(Q−I)B^T with B on the Stiefel manifold St(d,n) and Q in SO(n), learned jointly by Riemannian optimization. The claims are: (i) this family contains all prior 2D rotation methods (Section 4.1 shows Angular Steering is exactly the n=2 case of Eq. 1); (ii) attack superiority over RDO, Angular Steering, and Spherical Steering on three models under two LLM judges (Table 1); (iii) the exact transpose inverse gives a principled defence; (iv) n=35 dimensions and two layers suffice on DeepSeek-R1-7B (Sections 5.3–5.4); (v) learned solutions are near-orthogonal to the estimated refusal direction, so estimating it is unnecessary — carefully not claiming it is insufficient (Section 5.5). Claims are mostly matched to evidence; the abstract's 'superiority in intervention efficiency' is the one soft spot, backed only by FLOP arithmetic (2dn+n² vs d²) rather than measured time or memory.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is StiefelSteer?
StiefelSteer is a method for controlling whether a large language model refuses harmful requests, by learning a norm-preserving rotation of its internal activations. The rotation is parameterized as M = I + B(Q−I)B^T, where B has orthonormal columns (Stiefel manifold) and Q is a special orthogonal matrix, both trained with Riemannian optimization. It needs no precomputed refusal vector and the transpose of the operator is its exact inverse.
How is StiefelSteer different from refusal-direction ablation (RDO)?
RDO optimizes a single additive steering vector that shifts activations along one direction, which can inflate activation norms. StiefelSteer instead rotates a learned multi-dimensional subspace (35 directions in their experiments) inside the activation space, preserves norms exactly, and acts as the identity outside the subspace; its transpose gives the exact inverse operation, so attack and defence come from one operator.
Does StiefelSteer degrade model quality?
In the paper's experiments, ARC-Challenge accuracy and WikiText-2 perplexity stay close to the unmodified model in nearly every setting (for example, perplexity 29.2 vs 26.4 on DeepSeek-R1-7B under attack), whereas the strongest competing rotation method, Spherical Steering, drove perplexity into the thousands (4603 and 1008) in some defence cells while producing degenerate text.
Is the code and data available, and how much compute is needed?
The paper states that code is included with the submission, uses public datasets (SALADBench for harmful prompts, Alpaca for harmless retain prompts) and public model checkpoints (1.5B–7B). A single training run takes about 3 GPU-hours on one NVIDIA H100 in bfloat16, and the full experimental suite took 600 GPU-hours.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 2–4 appear in the extracted text only as captions and axis labels; per-point sweep values between the quoted anchors (e.g., n strictly between 2 and 20) are not recoverable from the text.
- The paper states code is included with the submission, but no repository URL appears anywhere in the extracted text, so availability could not be verified beyond the statement.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.