Steering for Safety, Hijacking for Profit: Trojan Threats in the LLM Activation Steering Supply Chain

Summary

This paper audits eight mainstream open-source Steering plugin libraries and identifies three structural vulnerabilities: insufficient distribution integrity verification, excessive plugin privileges, and missing runtime monitoring. The authors build a malicious plugin, IDH, that keeps safety-refusal steering as its legitimate function while covertly steering outputs toward commercial recommendation manipulation, reaching an attack success rate of up to 97.8% across five LLMs and six brands in three commercial domains.

Mitigation

The authors propose a runtime defense framework that suppresses anomalous activation interventions and orthogonalizes inter-layer trajectory.

Related items

• HighCVE-2026-116843: Mistral Vibe remote code execution via git filter driversSimilar attack · NVD/CVE Database
• InfoI-HITL: Inalienable Human-in-the-LoopSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumMalicious downloads can trick AI coding agents into compromising themselvesSimilar attack · CSO Online
• InfoThe Target Agent Is Its Own Best Critic but a Poor Proposer: Self-Improved Red TeamingSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSentryBench: A Cost-Sensitive Benchmark for Adversarial Robustness of Tool-Using LLM Agents in Public-Safety DeploymentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)