Steering in the Shadows: Causal Amplification for Activation Space Attacks in Large Language Models

TL;DR

This paper reveals a vulnerability in large language models where small, targeted activation perturbations can significantly alter their behavior, posing security risks for deployment.

Contribution

The authors introduce the Causal Amplification Effect and Sensitivity-Scaled Steering, a novel method to causally amplify activation perturbations for behavioral control in LLMs.

Findings

SSS induces large behavioral shifts across models

Activation perturbations can alter hallucination and sentiment

High coherence is maintained despite behavioral changes

Abstract

Modern large language models (LLMs) are typically secured by auditing data, prompts, and refusal policies, while treating the forward pass as an implementation detail. We show that intermediate activations in decoder-only LLMs form a vulnerable attack surface for behavioral control. Building on recent findings on attention sinks and compression valleys, we identify a high-gain region in the residual stream where small, well-aligned perturbations are causally amplified along the autoregressive trajectory--a Causal Amplification Effect (CAE). We exploit this as an attack surface via Sensitivity-Scaled Steering (SSS), a progressive activation-level attack that combines beginning-of-sequence (BOS) anchoring with sensitivity-based reinforcement to focus a limited perturbation budget on the most vulnerable layers and tokens. We show that across multiple open-weight models and four behavioral axes, SSS induces large shifts in evil, hallucination, sycophancy, and sentiment while preserving high coherence and general capabilities, turning activation steering into a concrete security concern for white-box and supply-chain LLM deployments.