Security vectors (Zhou et al., 2024)
Persona Vectors: Monitoring and Controlling Character Traits in Language Models — inherited
A prior method that pre-trains detachable LoRA modules ('security vectors') to elicit an undesired behavior, activates them during finetuning to shield the base model's weights from learning that behavior, then deactivates them at inference to restore normal behavior; demonstrated for both harmfulness and hallucination. Cited as a related training-time protective intervention that this paper's preventative steering is analogous to.
A weight module trained purely to misbehave sounds like the last thing you'd want anywhere near a model's finetuning run — but one prior approach uses exactly that, deliberately, as a kind of decoy that absorbs unwanted training pressure so the model's real parameters don't have to.
Pre-training a small shielding module to elicit the unwanted behavior itself, then switching it on during finetuning and off again at inference, is the mechanism at the center. Why the paper cites it as validation for protecting a model during training rather than only after, and where the two approaches actually diverge, come next — this paper's own method uses an already-extracted, fixed direction with no separate training phase, demonstrated across three traits rather than the two this prior method targets.
What Zhou et al.'s method is
Zhou et al. (2024) introduce a training-time protective mechanism built from "security vectors" — LoRA weight modules that are first pre-trained to elicit a specific undesired behavior. During subsequent finetuning on data that could teach the model that behavior, the security vectors are activated so that they, rather than the base model's own parameters, absorb the pressure to move toward the harmful behavior; the vectors are then deactivated at inference, restoring the model's original safe behavior. The persona-vectors paper reports that "the authors demonstrate this technique for making both harmfulness and hallucination unlearnable" (persona-vectors, §"7 Related work", p. 13).
Cited as an analogous training-time intervention
Persona vectors invokes Zhou et al. directly in its account of Preventative steering, the paper's own method of adding a persona vector toward the undesired direction during finetuning to relieve the training objective's pressure to shift that way: "A similar approach is explored by Zhou et al. (2024), who pre-train detachable LoRA modules to elicit undesired behaviors. These modules are activated during finetuning to shield the model from harmful updates and are then disabled for safe inference" (persona-vectors, §"5.2 Preventative steering limits behavioral shifts during finetuning", p. 8). The comparison is offered as validation of the general shielding strategy, not as a claim that the two mechanisms are identical.
How preventative steering differs
The two approaches diverge in what does the shielding. Security vectors are trainable LoRA parameters that must themselves be pre-trained to elicit the target behavior before they can be deployed as a shield, and they are switched off at inference. Preventative steering instead adds a fixed, already-extracted persona direction — the same difference-in-means vector used for steering and monitoring elsewhere in the paper — directly into the residual stream at each training step, with no separate parameter-training phase of its own. Zhou et al.'s method is demonstrated specifically for harmfulness and hallucination; persona vectors reports preventative steering across evil, sycophancy, and hallucination, and notes that single-layer preventative steering does not always fully prevent trait acquisition on datasets intentionally designed to encourage that trait, motivating the Multi-layer steering with layer-incremental vectors extension explored separately (persona-vectors, §"5.2 Preventative steering limits behavioral shifts during finetuning", p. 8).