Steering plugins can hijack LLM outputs with up to 97.8% success while keeping safety refusals
The claim
Malicious steering plugins can covertly manipulate LLM behavior with high attack success and minimal impact on safety performance
Published as: “Steering for Safety, Hijacking for Profit: Trojan Threats in the LLM Activation Steering Supply Chain”
So what
Steering plugins can be weaponized to covertly steer user decisions toward specific brands while appearing to improve safety, highlighting an urgent need for supply-chain and runtime protections.
The five-minute version
The IDH malicious steering plugin can achieve an attack success rate of up to 97.8% while still preserving high safety-refusal rates, and a runtime Scrubbing defense cuts that success rate by about 80%. The paper demonstrates these results across five mainstream LLMs, six brands, and three commercial domains, but also shows that pure hijacking without the safety component sharply reduces refusal rates.
What they found 2
- High attack success with preserved safety functionality
“IDH achieves an attack success rate (ASR) of up to 97.8% while preserving high refusal rates on harmful requests.”
- Runtime defense reduces attack effectiveness
“our runtime defense reduces the attack success rate by 80% under the evaluated configuration.”
What undercuts it the paper’s own results
- In C2, KSR/SSR rise but RR drops sharply, showing that pure commercial hijacking undermines safety refusal;
What’s new here 4
- Targets the steering-plugin supply chain rather than prompt or weight-based attacks.
- Combines malicious commercial hijacking with benign safety-refusal in a single plugin via norm-gated mutually exclusive routing.
- Automatically locates an information-decay inflection point for cross-model injection without modifying weights.
- Introduces a runtime Scrubbing defense that mitigates the attack without retraining.
Artifacts & methods 6
- IDH (Injection-based Dynamic Hijacking) frameworksystem
- Scrubbing runtime defense frameworksystem
- Norm-gated mutually exclusive routing mechanism
- Information decay inflection point localization
- Security audit of 8 open-source steering pluginsevaluation
- Table 1 vulnerability summary datasetdataset