Elicitation as audit: steering for red-teaming
Knowing that a model was trained to refuse something is not the same as knowing it cannot be made to do it anyway, and the usual way of finding out, having people hunt for a prompt that breaks the model, is slow and unsystematic. This theme covers a different way of asking the same question: using the very machinery built to control a behavior to instead go looking for it.
The page covers the paper's proposal directly: instead of searching for an adversarial input, deliberately steer the model toward an unwanted behavior and see how easily it moves, on the reasoning that a behavior a small internal push can trigger is plausibly one some prompt could trigger too. Read this way, steering flips from a tool for controlling behavior into a tool for auditing it, and failing to elicit something becomes a more meaningful reassurance than simply failing to stumble on it.
Validating that finetuning and RLHF have made a model robustly safe is difficult, because unwanted behaviors that survive training can still be hard to find. Jailbreaks are the paper's example of the problem: adversarial or unusual inputs users discover that make a model output content its safety training was meant to prevent, found by manual search rather than any systematic method. Red teaming names the broader practice these jailbreaks are instances of, probing a model for unwanted or unsafe behavior, elsewhere in the corpus a crowdworker-driven activity but here reframed around an activation-based alternative. The paper's proposed red-teaming application is that reframing: use CAA itself as an adversarial intervention, deliberately steering toward an unwanted behavior to see how easily it can be triggered, on the premise that a behavior easily elicited by a small internal perturbation is plausibly also reachable by some input in deployment. Read this way, steering inverts from a control tool into an audit tool, a cheaper and more systematic alternative to hunting for jailbreaks by hand, and the inability to elicit a behavior through steering becomes a stronger safety guarantee than failing to find it by sampling outputs.