Elamur Research⌕
☰
home / papers / 2026 / LLM-VA: Resolving the Jailbreak-Overrefusal Trade-off via Vector Alignment

LLM-VA: Resolving the Jailbreak-Overrefusal Trade-off via Vector Alignment

Paper · 2026 · Haonan Zhang, Dongxia Wang, Yi Liu et al.

Summary

Safety-tuned LLMs fail in two opposite ways. They answer harmful prompts (jailbreak), and they refuse harmless ones (over-refusal). Existing vector steering methods only scale the strength of an "answer" direction, so improving one failure worsens the other. The authors trained per-layer SVMs on labeled samples and found that the answer vector (v_a) and the benign vector (v_b) are close to perpendicular in every layer. In other words, the model decides whether to respond separately from how it judges input safety. The proposed method, LLM-VA, has three steps:

  • identify both vectors at each layer with SVMs;
  • choose the layers most tied to safety decisions;
  • rotate v_a toward v_b using iterative, closed-form, minimum-norm weight edits.

No gradient training or architecture changes are needed. Across 12 models, LLM-VA beats the strongest baseline, AlphaSteer, by 11.45% F1 while retaining 95.92% of general utility. It also adjusts on its own to whether a model leans toward being too permissive or too cautious. This makes it a cheap, practical tool for safety alignment.

Key points

  • The analysis used Llama-3.1-8B-Instruct, with 128 toxic prompts from S-Eval and 128 benign prompts from ORFuzzSet. Angles between v_a and v_b stay near 90° across layers, and deeper layers separate the classes better.
  • Evaluation covers 12 LLMs from 5 families (including Llama-3.1, gemma-2, Mistral-v0.3 and Qwen3) ranging from 3B to 14B parameters. LLM-VA gains +11.45% F1 over AlphaSteer, with a utility drop of only 4.08%.
  • Baselines included VectorSteer, AlphaSteer, SCANS, CAST and fine-tuning. Among these, only LLM-VA mitigates both failure modes without fine-tuning or structural modification.
  • Transfer was tested on five held-out benchmarks: XSTest, XSTest-Toxic, OR-Bench, OR-Bench-Toxic and AdvBench. Results were mixed for all steering methods.
  • The authors list several limitations: binary toxicity labels, per-model tuning of iteration count and layer choice, single-seed runs, and difficulty with reasoning models. Code and safety-enhanced weights for all 12 models are publicly released.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Zhejiang UniversityHangzhou · China224 works · 13,587 citations🎓Griffith UniversityBrisbane · Australia11 works · 4,223 citations🎓Huzhou Normal UniversityHuzhou · China2 works

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksSocial Sciences · 1,954 worksSafety Research · 626 works

🧭 Topics 2Research subjects and languages the work is about.Language models & pretraining · 3,894 worksBias, fairness & safety · 587 works

Cite

Cite as Haonan Zhang, Dongxia Wang, Yi Liu, Kexin Chen and Wenhai Wang. 2026. LLM-VA: Resolving the Jailbreak-Overrefusal Trade-off via Vector Alignment. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.260

@inproceedings{zhang2026llm,
  title = {{LLM-VA: Resolving the Jailbreak-Overrefusal Trade-off via Vector Alignment}},
  author = {Haonan Zhang, Dongxia Wang, Yi Liu, Kexin Chen and Wenhai Wang},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.260},
  url = {https://doi.org/10.18653/v1/2026.acl-long.260}
}

References

53 references, 18 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Marah Abdin, Jyoti Aneja, Hany Awadalla, Ahmed Awadallah, Ammar Ahmad Awan, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Jianmin Bao, Harkirat Behl, Alon Benhaim, Misha Bilenko, Johan Bjorck, Sébastien Bubeck, Martin Cai, Qin Cai, Vishrav Chaudhary, Dong Chen, Dongdong Chen, and 110 others. 2024. Phi-… — Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone
  2. AI@Meta. 2024. Llama 3 model card. find
  3. Mohammed Al-Garadi, Tushar Mungle, Abdulaziz Ahmed, Abeed Sarker, Zhuqi Miao, and Michael E. Matheny. 2025. Large language models in healthcare. Preprint, arXiv:2503.04748. — [arXiv:2503.04748](https://arxiv.org/abs/2503.04748) find
  4. Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. 2024. Refusal in language models is mediated by a single direction. Advances in Neural Information Processing Systems, 37:136037–136083.
  5. Luisa Bentivogli, Peter Clark, Ido Dagan, and Danilo Giampiccolo. 2009. The fifth pascal recognizing textual entailment challenge. TAC, 7(8):1. find
  6. Zouying Cao, Yifei Yang, and Hai Zhao. 2025. Scans: Mitigating the exaggerated safety for llms via safety-conscious activation steering. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23523–23531. find
  7. Kexin Chen, Yi Liu, Dongxia Wang, Jiaying Chen, and Wenhai Wang. 2024. Characterizing and evaluating the reliability of llms against jailbreak attacks. Preprint, arXiv:2408.09326. — [arXiv:2408.09326](https://arxiv.org/abs/2408.09326) find
  8. Jianfeng Chi, Ujjwal Karn, Hongyuan Zhan, Eric Smith, Javier Rando, Yiming Zhang, Kate Plawiak, Zacharie Delpierre Coudert, Kartikeya Upasani, and Mahesh Pasupuleti. 2024. Llama guard 3 vision: Safeguarding human-ai image understanding conversations. arXiv preprint arXiv:2411.10414. — [arXiv:2411.10414](https://arxiv.org/abs/2411.10414) find
  9. Paul F Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei. 2017. Deep reinforcement learning from human preferences. Advances in neural information processing systems, 30. find
  10. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. 2021. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168.
  11. Corinna Cortes and Vladimir Vapnik. 1995. Support-vector networks. Machine learning, 20(3):273–297.
  12. Justin Cui, Wei-Lin Chiang, Ion Stoica, and Cho-Jui Hsieh. 2025. Or-bench: An over-refusal benchmark for large language models. Preprint, arXiv:2405.20947.
  13. Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2024a. Masterkey: Automated jailbreaking of large language model chatbots. In Proceedings 2024 Network and Distributed System Security Symposium, NDSS 2024. Internet Society. find
  14. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix,… find
  15. Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, and 1 others. 2019. Natural questions: a benchmark for question answering research. Transactions of the Association for Computational Lin…
  16. Bruce W Lee, Inkit Padhi, Karthikeyan Natesan Ramamurthy, Erik Miehling, Pierre Dognin, Manish Nagireddy, and Amit Dhurandhar. 2024. Programming refusal with conditional activation steering. arXiv preprint arXiv:2409.05907. find
  17. Gelei Deng, Yi Liu, Kailong Wang, Yuekang Li, and Tianwei Zhang. 2024b. Pandora: Jailbreak gpts by retrieval augmented generation poisoning. Preprint, arXiv:2402.08416. — [arXiv:2402.08416](https://arxiv.org/abs/2402.08416) find
  18. Jie Li, Yi Liu, Chongyang Liu, Ling Shi, Xiaoning Ren, and Yaowen Zheng. 2024a. A cross-language investigation into jailbreak attacks in large language models. Preprint, arXiv:2401.16765. — [arXiv:2401.16765](https://arxiv.org/abs/2401.16765) find
  19. William B Dolan and Chris Brockett. 2005. Automatically constructing a corpus of sentential paraphrases. In Proceedings of the International Workshop on Paraphrasing.
  20. Yuxi Li, Yi Liu, Yuekang Li, Ling Shi, Gelei Deng, Shengquan Chen, and Kailong Wang. 2024b. Lock-picking llms: A logit-based jailbreak using token-level manipulation. Preprint, arXiv:2405.13068. — [arXiv:2405.13068](https://arxiv.org/abs/2405.13068) find
  21. Nelson Elhage, Tristan Hume, Catherine Olsson, Nicholas Schiefer, Tom Henighan, Shauna Kravec, Zac Hatfield-Dodds, Robert Lasenby, Dawn Drain, Carol Chen, and 1 others. 2022. Toy models of superposition. arXiv preprint arXiv:2209.10652. find
  22. Fan Liu, Zhao Xu, and Hao Liu. 2024a. Adversarial tuning: Defending against jailbreak attacks for llms. arXiv preprint arXiv:2406.06622. — [arXiv:2406.06622](https://arxiv.org/abs/2406.06622) find
  23. Clémentine Fourrier, Nathan Habib, Alina Lozovskaya, Konrad Szafer, and Thomas Wolf. 2024. Open llm leaderboard v2. https://huggingface.co/spaces/open-llm-leaderboard/open_llm_ leaderboard. ↗
  24. Leo Gao, Jonathan Tow, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Kyle McDonell, Niklas Muennighoff, Jason Phang, Laria Reynolds, Eric Tang, Anish Thite, Ben Wang, Kevin Wang, and Andy Zou. 2021. A framework for few-shot language model evaluation. find
  25. Mor Geva, Roei Schuster, Jonathan Berant, and Omer Levy. 2021. Transformer feed-forward layers are key-value memories. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 5484–5495, Online and Punta Cana, Dominican Republic. Association for Computational… find
  26. Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, and 1 others. 2025. Deepseekr1: Incentivizing reasoning capability in llms via reinforcement learning. Preprint, arXiv:2501.12948.
  27. Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. 2024b. Jailbreaking chatgpt via prompt engineering: An empirical study. Preprint, arXiv:2305.13860.
  28. Yi Liu, Junzhe Yu, Huijia Sun, Ling Shi, Gelei Deng, Yuqi Chen, and Yang Liu. 2024c. Efficient detection of toxic prompts in large language models. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, pages 455–467. find
  29. Zihan Liu, Ruinan Zeng, Dongxia Wang, Gengyun Peng, Jingyi Wang, Qiang Liu, Peiyu Liu, and Wenhai Wang. 2024d. Agents4plc: Automating closed-loop plc code generation and verification in industrial control systems using llm-based agents. arXiv preprint arXiv:2410.14209. — [arXiv:2410.14209](https://arxiv.org/abs/2410.14209) find
  30. Microsoft, :, Abdelrahman Abouelenin, Atabak Ashfaq, Adam Atkinson, Hany Awadalla, Nguyen Bach, Jianmin Bao, Alon Benhaim, Martin Cai, Vishrav Chaudhary, Congcong Chen, Dong Chen, Dongdong Chen, Junkun Chen, Weizhu Chen, Yen-Chun Chen, Yi ling Chen, Qi Dai, and 57 others. 2025. Phi-4-mini technical…
  31. OpenAI. 2024. Gpt-4 technical report. arXiv:2303.08774.
  32. Preprint, Fabian Pedregosa, Gaël Varoquaux, Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, and 1 others. 2011. Scikit-learn: Machine learning in python. the Journal of machine Learning research, 12:2825–2830. find
  33. Sophie Xhonneux, Alessandro Sordoni, Stephan Günnemann, Gauthier Gidel, and Leo Schwinn. 2024. Efficient adversarial training in llms with continuous attacks. Advances in Neural Information Processing Systems, 37:1502–1530. find
  34. R. Penrose. 1955. A generalized inverse for matrices. Mathematical Proceedings of the Cambridge Philosophical Society, 51(3):406–413. find
  35. An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, and 40 others. 2024a. Qwen2 technical report. arXiv preprint arX… find
  36. Ruchira Ray and Ruchi Bhalani. 2024. Mitigating exaggerated safety in large language models. arXiv preprint arXiv:2405.05418. — [arXiv:2405.05418](https://arxiv.org/abs/2405.05418) find
  37. Yifan Yang, Qiao Jin, Furong Huang, and Zhiyong Lu. 2024b. Adversarial attacks on large language models in medicine. Preprint, arXiv:2406.12259. — [arXiv:2406.12259](https://arxiv.org/abs/2406.12259) find
  38. Paul Röttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. Preprint, arXiv:2308.01263.
  39. Xiaohan Yuan, Jinfeng Li, Dongxia Wang, Yuefeng Chen, Xiaofeng Mao, Longtao Huang, Jialuo Chen, Hui Xue, Xiaoxia Liu, Wenhai Wang, Kui Ren, and Jingyi Wang. 2025. S-eval: Towards automated and comprehensive safety evaluation for large language models. Proceedings of the ACM on Software Engineering,… find
  40. Leheng Sheng, Changshuo Shen, Weixiang Zhao, Junfeng Fang, Xiaohao Liu, Zhenkai Liang, Xiang Wang, An Zhang, and Tat-Seng Chua. 2025. Alphasteer: Learning refusal steering with principled null-space constraint. arXiv preprint arXiv:2506.07022. — [arXiv:2506.07022](https://arxiv.org/abs/2506.07022) find
  41. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, pages 1631–…
  42. Nisan Stiennon, Long Ouyang, Jeffrey Wu, Daniel Ziegler, Ryan Lowe, Chelsea Voss, Alec Radford, Dario Amodei, and Paul F Christiano. 2020. Learning to summarize with human feedback. Advances in neural information processing systems, 33:3008– 3021. find
  43. Gemma Team. 2024a. Gemma. find
  44. Qwen Team. 2024b. Qwen2.5: A party of foundation models. find
  45. Qwen Team. 2025. Qwen3 technical report. Preprint, arXiv:2505.09388.
  46. Alex Warstadt, Amanpreet Singh, and Samuel R. Bowman. 2018. Neural network acceptability judgments. arXiv preprint 1805.12471. find
  47. Haonan Zhang, Dongxia Wang, Yi Liu, Kexin Chen, Jiashui Wang, Xinlei Ying, Long Liu, and Wenhai Wang. 2025a. Orfuzz: Fuzzing the "other side" of llm safety – testing over-refusal. Preprint, arXiv:2508.11222. — [arXiv:2508.11222](https://arxiv.org/abs/2508.11222) find
  48. Shenyi Zhang, Yuchen Zhai, Keyan Guo, Hongxin Hu, Shengnan Guo, Zheng Fang, Lingchen Zhao, Chao Shen, Cong Wang, and Qian Wang. 2025b. Jbshield: Defending large language models from jailbreak attacks through activated concept analysis and manipulation. arXiv preprint arXiv:2502.07557. — [arXiv:2502.07557](https://arxiv.org/abs/2502.07557) find
  49. Haiquan Zhao, Chenhan Yuan, Fei Huang, Xiaomeng Hu, Yichang Zhang, An Yang, Bowen Yu, Dayiheng Liu, Jingren Zhou, Junyang Lin, and 1 others. 2025. Qwen3guard technical report. arXiv preprint arXiv:2510.14276.
  50. Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, and 1 others. 2023a. Representation engineering: A top-down approach to ai transparency. arXiv preprint arXiv:2310.01405.
  51. Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. 2023b. Universal and transferable adversarial attacks on aligned language models. Preprint, arXiv:2307.15043.
  52. Adina Williams, Nikita Nangia, and Samuel Bowman. 2018. A broad-coverage challenge corpus for sentence understanding through inference. In Proceedings of the 2018 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long pa…
  53. A Angles between Answer Vectors and Benign Vectors As shown in Figure 9, the angles between the answer vectors and benign vectors of different LLMs are approximately 90 ◦ , indicating that they are nearly orthogonal. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/zhang-2026-llm-va-resolving-jailbreak-overrefusal/