Guardrail Vectors: Bidirectional Steering and Framing-Induced Safety Failures

This paper studies framing-induced safety failures, under the assumption that if a model is intended to refuse disclosing harmful operational details to a user when asked directly, it should also refuse to disclose the details when the prompt is wrapped in a simple contextual frame. We quantify the phenomenon on two models, Qwen2.5-7B-Instruct and Llama-3.1-8B-Instruct, across five framing categories: fiction, research, educational, journalism, and historical. Training probes to identify where these failures are decodable, we isolate a framing-specific direction and a generic comply/refuse vector. Steering along the comply/refuse vector controls behavior bidirectionally, both inducing operational leakage from otherwise refused framed prompts and suppressing it from otherwise vulnerable ones. The framing-specific direction, by contrast, is decodable on both models but practically inert for causal intervention on Llama and is only able to induce leakage on Qwen. We also compare steering-based safety against the baseline of stronger system prompts, which reduce leakage but less than steering does.