Imprisoned Steering Vectors: A malicious plugin diverts commercial recommendations from an LLM in 97.8% of cases

Researchers have audited eight open source libraries of "steering vectors" and show that a plugin can display a legitimate security function while discreetly directing the model to certain brands.

The "steering vectors" alter the behaviour of a language model by intervening directly on its internal representations, for example to reinforce its refusals to deal with dangerous requests. A third-party plugin ecosystem has formed around this technique, and a team of researchers sees it as a new fragile link in the LLM supply chain.

Three structural flaws

The audit of eight widespread open source libraries reveals three weaknesses: the integrity of distributed plugins is not properly verified, they have excessive privileges, and there is no monitoring of their action during execution. To measure its scope, the authors designed IDH, an trapped plugin that automatically chooses the layer to inject itself and causes two functions to coexist: a legitimate function to refuse harmful requests and a hidden function to manipulate recommendations.

Tested out of five LLM general public with six brands spread across three commercial sectors, HDI reaches up to 97.8% success in hijacking, while maintaining a high refusal rate on dangerous requests, making it difficult to spot. In return, the researchers propose a defence to execution that neutralizes abnormal activation interventions and controls the consistency of their trajectory from one layer to another.