跳转至

文章背景与核心概要

大语言模型（LLM）的对齐通常利用稀疏自编码器（SAE）来实现轻量级的推理阶段安全控制。尽管 SAE 调控可以通过利用可解释的稀疏特征，将有害提示词的续写引导至拒绝方向，但复杂的提示词包装（wrappers）依然能够轻易绕过单向的调控方法。

为了解决这一局限性，作者推出了 GUISE（广义隐蔽指令安全评估）——一个专门包含被复杂包装掩盖的有害提示词的数据集，并提出了 REINS（拒绝增强抑制性调控）。与以往仅依赖微弱的拒绝增强或因模型崩塌导致能力退化的方法不同，REINS 在同一个 SAE 特征空间中同时抑制有害续写特征并增强安全拒绝特征。因此，REINS 显著减少了有害响应，提高了安全拒绝的生成，并在很大程度上保留了模型的通用能力。

REINS: Refusal-Enhanced Inhibitory Steering with Sparse Autoencoder Features

arXiv: 2608.28233 [cs.AI]
Authors: Kai-Xuan Ding, Hao-Xiang Xu, Ji-Hua Peng, Zi-Qi Chen, Jiaqi Wang, Zhen-Hua Ling
Venue: Accepted at EMNLP 2026 Main Conference
Submitted: August 28, 2026

📌 Summary

Large Language Model (LLM) alignment often utilizes Sparse Autoencoders (SAEs) for lightweight, inference-time safety control. While SAE steering can guide harmful prompt continuations toward refusals by leveraging interpretable sparse features, complex prompt wrappers can easily bypass single-direction steering methods.

To address this limitation, the authors introduce GUISE (Generalized Undercover Instruction Safety Evaluation)—a dedicated dataset featuring harmful prompts masked by complex wrappers—and propose REINS (Refusal-Enhanced INhibitory Steering). Unlike prior approaches that rely solely on weak refusal enhancement or cause model degradation through collapse, REINS simultaneously suppresses harmful continuation features and enhances safe refusal features within the same SAE feature space. Consequently, REINS substantially mitigates harmful responses, improves safe refusal generation, and largely preserves the model's general capabilities.

📋 Bibliographic & Access Information

Full-Text & Resources

🔍 Abstract

Steering with Sparse Autoencoders (SAEs) offers a lightweight inference-time path for adapting the behavior of large language models without retraining. By exposing sparse and interpretable features, SAE steering provides a promising interface for safety control that guides harmful continuations toward refusal. However, we observe that complex wrappers can still undermine existing SAE steering methods on harmful prompts. To evaluate this failure mode systematically, we construct Generalized Undercover Instruction Safety Evaluation (GUISE), a dataset of harmful prompts with complex wrappers. Existing single direction SAE steering methods do not reliably produce refusals on harmful prompts, suggesting that refusal enhancement alone can be too weak when the harmful continuation path remains active. This motivates us to propose Refusal-Enhanced INhibitory Steering (REINS), which suppresses harmful continuation features and enhances safe refusal features in the same SAE feature space. Experiments on GUISE and other datasets show that prior methods either intervene too weakly or achieve only apparent safety through collapse, while REINS substantially reduces harmful responses, markedly improves safe refusals and largely preserves general capabilities.