RepIt: Steering Language Models with Concept-Specific Refusal Vectors

ICLR 2026 Conference Submission15148 Authors

Keywords: interpretability, representations, steering, safety

TL;DR: We can selectively jailbreak models while preserving refusal in other contexts, producing unsafe models that evade standard detection.

Abstract: Current safety evaluations of language models rely on benchmark-based assessments that may miss targeted vulnerabilities. We present RepIt, a simple and data-efficient framework for isolating concept-specific representations in LM activations. While existing steering methods already achieve high attack success rates through broad interventions, RepIt enables a more concerning capability: selective suppression of refusal on targeted concepts while preserving refusal elsewhere. Across five frontier LMs, RepIt produces evaluation-evading models that answer questions related to weapons of mass destruction while still scoring as safe on standard benchmarks. We find the edit of the steering vector localizes to just 100-200 neurons, and robust concept vectors can be extracted from as few as a dozen examples on a single A6000, highlighting how targeted, hard-to-detect modifications can exploit evaluation blind spots with minimal resources. By demonstrating precise concept disentanglement, this work exposes critical vulnerabilities in current safety evaluation practices and demonstrates an immediate need for more comprehensive, representation-aware assessments.

Primary Area: alignment, fairness, safety, privacy, and societal considerations

Submission Number: 15148