CAA as an adversarial red-teaming tool (proposed application) — inverts the purpose of → Contrastive Activation Addition (CAA)

Every other application in the paper uses CAA to suppress or encourage a behavior in the direction alignment wants -- less sycophancy, more refusal. The red-teaming proposal runs the same machinery toward the opposite end: use CAA as "an adversarial intervention to trigger unwanted behaviors in models more efficiently" than prompting alone (contrastive-activation-addition, §"9.1 Suggested future work", p. 9). Nothing about the method changes -- it is still a mean-difference vector added to the residual stream at a chosen layer and multiplier -- only the sign of the intent does: instead of steering a chat model away from an unsafe behavior, the vector steers it toward one, deliberately. The paper frames this inversion as diagnostic rather than harmful in itself: if a behavior can be easily triggered through a small internal perturbation, that is evidence it may also be reachable in deployment through some other route; conversely, an inability to elicit it this way is offered as a stronger safety guarantee than failing to find it through prompting, since internal perturbation searches a space prompting cannot easily reach.