Beyond Refusal: Activation Steering as a Stress Test for Malware-Related Code Generation in Open-Weight LLMs

This repository contains the code, configurations, and supporting materials associated with the paper:

Beyond Refusal: Activation Steering as a Stress Test for Malware-Related Code Generation in Open-Weight LLMs

Authors

• Ronghao Pan
  Department of Computer Science and Systems, University of Murcia
  ORCID: 0009-0008-7317-7145

• José Antonio García-Díaz
  Department of Computer Science and Systems, University of Murcia
  ORCID: 0000-0002-3651-2660

• Rafael Valencia-García
  Department of Computer Science and Systems, University of Murcia
  ORCID: 0000-0003-2457-1791
  Corresponding author

Abstract

Open-weight Large Language Models (LLMs) are increasingly capable of generating functional source code, including code with dual-use or security-sensitive behavior. While their openness enables reproducible research and transparent evaluation, it also exposes a distinct safety challenge: users with white-box access can modify the inference process directly, potentially weakening safeguards that rely on refusal behavior.

This paper investigates whether activation steering can expose or amplify latent malware-related code-generation capabilities in open-weight LLMs. We evaluate a set of code-specialized and general-purpose models, including Qwen3, Qwen3-Coder, CodeLlama, CodeGemma, DeepSeek-Coder, and NextCoder variants, on MalwareBench, comparing baseline generations with outputs produced under inference-time activation interventions.

To characterize both behavioral and operational effects, we combine rule-based diagnostics for code generation, refusal, non-code responses, and degenerate generation with a multidimensional LLM-as-a-Judge framework that scores generated code along four cybersecurity dimensions: offensive intent, operational sophistication, operational impact, and stealth/evasion.

Our results show that several open-weight LLMs contain malware-related capabilities that are not fully captured by their default refusal behavior. Activation steering reduces refusals and increases code-generation rates for several models. The strongest safety-relevant effects are observed for Qwen3-32B and Qwen3-14B, where steering increases both code generation and judge-based operational severity. In contrast, for models such as NextCoder-14B and DeepSeek-Coder-V2-Lite, steering often increases compliance or code-like output without consistently increasing severity.

These findings indicate that surface-level refusal is an insufficient proxy for capability absence in white-box settings. More broadly, activation steering provides a useful stress test for evaluating the robustness of open-weight LLM safeguards against representation-level manipulation.

Repository status

The repository is currently under preparation. Code, configuration files, evaluation scripts, and reproducibility instructions will be progressively added.

Planned contents include:

• activation extraction and steering-vector construction;
• layer ranking and intervention-layer selection;
• inference-time activation steering;
• heuristic hyperparameter search;
• rule-based behavioral diagnostics;
• LLM-as-a-Judge evaluation;
• scripts for reproducing tables and figures.

Citation

The paper is currently under review. Citation information will be added once a public preprint or final publication record becomes available.

@article{pan2026beyond,
  title   = {Beyond Refusal: Activation Steering as a Stress Test for Malware-Related Code Generation in Open-Weight LLMs},
  author  = {Pan, Ronghao and García-Díaz, José Antonio and Valencia-García, Rafael},
  year    = {2026},
  note    = {Manuscript under review}
}

Acknowledgments

This work is part of the research projects LaTe4PoliticES (PID2022-138099OB-I00) and EmpaTIC-ES (PID2025-169617OB-I00), funded by MICIU/AEI/10.13039/501100011033 and the European Regional Development Fund (ERDF/EU), “A way of making Europe.”

Responsible use

This repository is intended exclusively for research into the evaluation and robustness of safeguards in open-weight language models.

The materials are provided to support reproducible safety research, analysis of representation-level interventions, and the development of more robust evaluation and mitigation methods. They should not be used to develop, deploy, or facilitate malicious software or unauthorized offensive activity.

License

A license has not yet been selected. Usage and redistribution conditions will be specified before the public release of the complete repository.

Contact

For questions about the project, please contact:

Rafael Valencia-García
University of Murcia
valencia@um.es