Global PID Steering
One averaged refusal vector beats per-layer PID at defending Gemma-2 without wrecking it on benign prompts.
- Model
- Gemma-2-2B-it
- Method
- One averaged refusal vector, over a verified persistence window
- Benign refusals
- 3.5% vs 96% for full-depth per-layer PID (1.5% unsteered)
- Caveat
- Both block all 104 GCG attacks, largely the model's existing alignment rather than the steering