{"id":"https://openalex.org/W4417184637","doi":"https://doi.org/10.48550/arxiv.2511.17194","title":"Steering in the Shadows: Causal Amplification for Activation Space Attacks in Large Language Models","display_name":"Steering in the Shadows: Causal Amplification for Activation Space Attacks in Large Language Models","publication_year":2025,"publication_date":"2025-11-21","ids":{"openalex":"https://openalex.org/W4417184637","doi":"https://doi.org/10.48550/arxiv.2511.17194"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2511.17194","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2511.17194","pdf_url":"https://arxiv.org/pdf/2511.17194","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2511.17194","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102897990","display_name":"Zhiyuan Xu","orcid":"https://orcid.org/0000-0001-8955-8358"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Zhiyuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030966496","display_name":"Stanislav Abaimov","orcid":"https://orcid.org/0000-0003-2441-4710"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Abaimov, Stanislav","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Gardiner, Joseph","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gardiner, Joseph","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5044341219","display_name":"Sana Belguith","orcid":"https://orcid.org/0000-0003-0069-8552"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Belguith, Sana","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.3450999855995178,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.3450999855995178,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.2498999983072281,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11636","display_name":"Artificial Intelligence in Healthcare and Education","score":0.051600001752376556,"subfield":{"id":"https://openalex.org/subfields/2718","display_name":"Health Informatics"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.7062000036239624},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.534500002861023},{"id":"https://openalex.org/keywords/residual","display_name":"Residual","score":0.421099990606308},{"id":"https://openalex.org/keywords/autoregressive-model","display_name":"Autoregressive model","score":0.3668000102043152},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.34450000524520874},{"id":"https://openalex.org/keywords/causal-chain","display_name":"Causal chain","score":0.3352000117301941},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.3257000148296356}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.7062000036239624},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6650999784469604},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.534500002861023},{"id":"https://openalex.org/C155512373","wikidata":"https://www.wikidata.org/wiki/Q287450","display_name":"Residual","level":2,"score":0.421099990606308},{"id":"https://openalex.org/C159877910","wikidata":"https://www.wikidata.org/wiki/Q2202883","display_name":"Autoregressive model","level":2,"score":0.3668000102043152},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3472000062465668},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.34450000524520874},{"id":"https://openalex.org/C79897977","wikidata":"https://www.wikidata.org/wiki/Q5054568","display_name":"Causal chain","level":2,"score":0.3352000117301941},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.3257000148296356},{"id":"https://openalex.org/C2780233690","wikidata":"https://www.wikidata.org/wiki/Q535347","display_name":"Transparency (behavior)","level":2,"score":0.3230000138282776},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.31029999256134033},{"id":"https://openalex.org/C2778572836","wikidata":"https://www.wikidata.org/wiki/Q380933","display_name":"Space (punctuation)","level":2,"score":0.3075999915599823},{"id":"https://openalex.org/C177918212","wikidata":"https://www.wikidata.org/wiki/Q803623","display_name":"Perturbation (astronomy)","level":2,"score":0.30489999055862427},{"id":"https://openalex.org/C2781181686","wikidata":"https://www.wikidata.org/wiki/Q4226068","display_name":"Coherence (philosophical gambling strategy)","level":2,"score":0.290800005197525},{"id":"https://openalex.org/C11671645","wikidata":"https://www.wikidata.org/wiki/Q5054567","display_name":"Causal model","level":2,"score":0.26910001039505005},{"id":"https://openalex.org/C39920170","wikidata":"https://www.wikidata.org/wiki/Q693083","display_name":"Soundness","level":2,"score":0.2632000148296356},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2621999979019165}],"mesh":[],"locations_count":3,"locations":[{"id":"pmh:oai:arXiv.org:2511.17194","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2511.17194","pdf_url":"https://arxiv.org/pdf/2511.17194","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:research-information.bris.ac.uk:openaire_cris_publications/e42948b2-fafe-4521-8a86-6c995604ae30","is_oa":true,"landing_page_url":"https://research-information.bris.ac.uk/en/publications/e42948b2-fafe-4521-8a86-6c995604ae30","pdf_url":null,"source":{"id":"https://openalex.org/S4306400895","display_name":"Bristol Research (University of Bristol)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I36234482","host_organization_name":"University of Bristol","host_organization_lineage":["https://openalex.org/I36234482"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Xu, Z, Abaimov, S, Gardiner, J & Belguith, S 2025 'Steering in the Shadows : Causal Amplification for Activation Space Attacks in Large Language Models' arXiv.org. https://doi.org/10.48550/arXiv.2511.17194","raw_type":"workingPaper"},{"id":"doi:10.48550/arxiv.2511.17194","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2511.17194","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2511.17194","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2511.17194","pdf_url":"https://arxiv.org/pdf/2511.17194","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Modern":[0],"large":[1,123],"language":[2],"models":[3,116],"(LLMs)":[4],"are":[5,63],"typically":[6],"secured":[7],"by":[8],"auditing":[9],"data,":[10],"prompts,":[11],"and":[12,47,108,117,129,135,148],"refusal":[13],"policies,":[14],"while":[15,131],"treating":[16],"the":[17,56,67,104],"forward":[18],"pass":[19],"as":[20,77],"an":[21,78],"implementation":[22],"detail.":[23],"We":[24,74,110],"show":[25,111],"that":[26,89,112],"intermediate":[27],"activations":[28],"in":[29,55,125],"decoder-only":[30],"LLMs":[31],"form":[32],"a":[33,52,85,99,142],"vulnerable":[34,106],"attack":[35,79,88],"surface":[36,80],"for":[37,146],"behavioral":[38,119],"control.":[39],"Building":[40],"on":[41,44,103],"recent":[42],"findings":[43],"attention":[45],"sinks":[46],"compression":[48],"valleys,":[49],"we":[50],"identify":[51],"high-gain":[53],"region":[54],"residual":[57],"stream":[58],"where":[59],"small,":[60],"well-aligned":[61],"perturbations":[62],"causally":[64],"amplified":[65],"along":[66],"autoregressive":[68],"trajectory--a":[69],"Causal":[70],"Amplification":[71],"Effect":[72],"(CAE).":[73],"exploit":[75],"this":[76],"via":[81],"Sensitivity-Scaled":[82],"Steering":[83],"(SSS),":[84],"progressive":[86],"activation-level":[87],"combines":[90],"beginning-of-sequence":[91],"(BOS)":[92],"anchoring":[93],"with":[94],"sensitivity-based":[95],"reinforcement":[96],"to":[97],"focus":[98],"limited":[100],"perturbation":[101],"budget":[102],"most":[105],"layers":[107],"tokens.":[109],"across":[113],"multiple":[114],"open-weight":[115],"four":[118],"axes,":[120],"SSS":[121],"induces":[122],"shifts":[124],"evil,":[126],"hallucination,":[127],"sycophancy,":[128],"sentiment":[130],"preserving":[132],"high":[133],"coherence":[134],"general":[136],"capabilities,":[137],"turning":[138],"activation":[139],"steering":[140],"into":[141],"concrete":[143],"security":[144],"concern":[145],"white-box":[147],"supply-chain":[149],"LLM":[150],"deployments.":[151]},"counts_by_year":[],"updated_date":"2026-08-05T07:39:15.569665","created_date":"2025-11-25T00:00:00"}