TEE-based model protection for on-device LLMs obfuscated only the output side, and that was enough to break it

Activation steering controls model behaviour at inference time by adding a vector to the residual stream, but it also changes the generated text in ways nobody asked for. Prior work measured those side effects with coarse signals like perplexity. This paper shows that steering systematically shifts discourse dimensions such as formality, use of evidence and ambiguity, and proposes countering it with a second complementary vector targeting the affected dimension. That intervention restores about 78 percent of the unintended discourse changes while preserving the intended steering behaviour in about 93 percent of generations. The limitation is that the method needs a second steering vector chosen per affected dimension, so it adds configuration work to the pipeline, and the reported percentages come from the paper's own evaluation of steering-induced discourse shifts rather than from a general measure of side-effect-free steering.

Vision-language agents that expose intermediate tool output for inspection are often assumed safer than single-shot models, but that only holds if the channels are independent. This paper tests the assumption where the sensor reading itself is untrusted, so the tool and reasoning channels share a common visual fault. On a dermatology agent built from segmentation, contrastive retrieval and an iterative vision-language reasoner, the authors define a coupling taxonomy separating single-channel errors from joint errors that agree or disagree. Typographic injection produced detectable directional retrieval capture while physical corruption did not. Crop-first retrieval preserved the payload at a readable scale and produced 55 percent joint wrong agreement across all cases, 71 percent of faulty cases, versus 35 percent and 43 percent for full-image retrieval. Under a binary decision, if both channels are wrong their predictions must agree, so hard-label channel comparison cannot detect joint failures at all: disagreement recall was limited to 0.29 for crop-first versus 0.57 for full-image. The limitation is the domain, PAD-UFES-20 plus an independent HIBA test set, which is dermatology specifically.

Multi-turn jailbreak attackers typically condition on the same conversation history as the target model, which means they keep re-reading their own failures. Reject, Remember, Retry conditions the attacker on a compact state instead: turns that fail to raise the attack risk score are removed from the target's context but remembered by the attacker along with the reason for failure, an asymmetry the authors call asymmetric memory. Across two benchmarks and six target LLMs, R3 outperformed state-of-the-art baselines by up to 53 percent in ASR@5 under matched query budgets, and a low-capacity attacker given R3's state beat high-capacity attackers without it by up to 34 percent in ASR@5. Ablations attribute most of the gain to remembering rejected turns, and the risk score acts as a coarse threshold rather than a progress measure. This is red-team research on a benchmark rather than a live attack, and the evaluation spans two benchmarks and six targets.