FaithSteer-BENCH: A Deployment-Aligned Stress-Testing Benchmark for Inference-Time Steering

Zikang Ding; Qiying Hu; Yi Zhang; Hongji Li; Junchi Yao; Hongbo Liu; Lijie Hu

cs.AIMar 18, 2026

FaithSteer-BENCH: A Deployment-Aligned Stress-Testing Benchmark for Inference-Time Steering

Authors: Zikang Ding, Qiying Hu, Yi Zhang, Hongji Li, Junchi Yao, Hongbo Liu, Lijie Hu

Organizations: University of Electronic Science and Technology of China · Mohamed bin Zayed University of Artificial Intelligence · South China University of Technology

Abstract

Inference-time steering is widely regarded as a lightweight and parameter-free mechanism for controlling large language model (LLM) behavior, and prior work has often suggested that simple activation-level interventions can reliably induce targeted behavioral changes. However, such conclusions are typically drawn under relatively relaxed evaluation settings that overlook deployment constraints, capability trade-offs, and real-world robustness. We therefore introduce FaithSteer-BENCH, a stress-testing benchmark that evaluates steering methods at a fixed deployment-style operating point through three gate-wise criteria: controllability, utility preservation, and robustness. Across multiple models and representative steering approaches, we uncover several systematic failure modes that are largely obscured under standard evaluation, including illusory controllability, measurable cognitive tax on unrelated capabilities, and substantial brittleness under mild instruction-level perturbations, role prompts, encoding transformations, and data scarcity. Gate-wise benchmark results show that existing methods do not necessarily provide reliable controllability in deployment-oriented practical settings. In addition, mechanism-level diagnostics indicate that many steering methods induce prompt-conditional alignment rather than stable latent directional shifts, further explaining their fragility under stress. FaithSteer-BENCH therefore provides a unified benchmark and a clearer analytical lens for future method design, reliability evaluation, and deployment-oriented research in steering.

Figures & tables

Figure 1: Steering evaluation landscape and the deployment-reliability gap addressed by FaithSteer-BENCH.

Figure 2: Overview of FaithSteer-BENCH . Steering methods are evaluated through three stages: clean controllability, capability preservation, and robustness under stress. The results are then converted into gate-wise deployment verdicts.

Gate	Setting	Evaluation Metrics	Outcome / Verdict
Gate 1 (Controllability)	Clean	ACC, APC, $\Delta$ ACC, $\Delta$ APC, VAR	Controllable / Non-Controllable
Gate 2 (Utility)	Clean	ACC ${}_{\text{cap}}$ , $\Delta$ ACC ${}_{\text{cap}}$	Utility / Costly
Gate 3 (Robustness)	Stress	Ret ${}_{\text{APC}}$	Robust / Brittle

Table 1: Three-Gate evaluation protocol at the calibrated operating point

\alpha^{*}(\mathcal{S})

. The benchmark profile is the combination of Gate outcomes.

Figure 3: General capability under steering across four base models. Bars show the average capability score over RACE, MMLU, OpenBookQA, and GLUE, further averaged over the eight steering tasks. Higher is better.

Task	Method	Llama-2-7B-Chat			Llama-2-13B-Chat			Qwen2.5-7B			Gemma-7B
Task	Method	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var
Hallucination	Base	0.58	0.59	0.00	0.58	0.53	0.00	0.52	0.46	0.00	0.72	0.66	0.00
	CAA	0.84	0.78	0.04	0.58	0.60	0.01	0.56	0.52	0.00	0.88	0.80	0.02
	PCA	0.28	0.36	0.19	0.50	0.51	0.08	0.50	0.47	0.00	0.72	0.67	0.05
	TopPC	0.28	0.36	0.16	0.52	0.55	0.06	0.54	0.48	0.00	0.74	0.68	0.05
	ITI	0.88	0.83	0.07	0.70	0.66	0.08	0.52	0.51	0.00	0.78	0.75	0.01

Table 2: Clean steering and stability at the reference operating point

\alpha^{*}(S)

. Full results are provided in Appendix F Tables 9 and 10 .

Dataset	Method	Setting	Llama2-7B		Llama2-13B		Qwen2.5-7B		Gemma-7B
Dataset	Method	Setting	APC	$\Delta$	APC	$\Delta$	APC	$\Delta$	APC	$\Delta$
Halluc.	CAA	Previous	0.78	–	0.60	–	0.52	–	0.80	–
		Role Attack	0.67	-0.11	0.55	-0.05	0.53	+0.01	0.75	-0.05
		Template Atk.	0.72	-0.06	0.62	+0.02	0.54	+0.02	0.78	-0.02
		Base64 Attack	0.49	-0.29	0.50	-0.10	0.51	-0.01	0.49	-0.31
	ITI	Previous	0.83	–	0.66	–	0.51	–	0.75	–

Table 3: Stress Robustness on the Common Evaluation Set (Hallucination & Refusal)

Model	Method	Gate 1	Gate 2	Stress robustness	Benchmark profile
Llama-2-7B-Chat	CAA	Fail	Pass	Mean/Worst $RetAPC$ : 0.920 / 0.662 (Fail)	Utility-preserving only
Llama-2-7B-Chat	ITI	Fail	Fail	Mean/Worst $RetAPC$ : 0.872 / 0.662 (Fail)	None
Llama-2-13B-Chat	CAA	Fail	Pass	Mean/Worst $RetAPC$ : 0.949 / 0.640 (Fail)	Utility
Llama-2-13B-Chat	ITI	Fail	Fail	Mean/Worst $RetAPC$ : 0.976 / 0.653 (Fail)	None
Qwen2.5-7B	CAA	Fail	Pass	Mean/Worst $RetAPC$ : 0.881 / 0.758 (Fail)	Utility
Qwen2.5-7B	ITI	Fail	Fail	Mean/Worst $RetAPC$ : 0.918 / 0.754 (Fail)	None

Table 4: FaithSteer-BENCH gate profile on the maximal common stress subset ( Refusal ).

Figure 4: Mechanism-level diagnostics for three representative cases.

Appendix figures & tables22 assets

Supplementary material from the paper’s appendix.

Appendix

Axis	Prop.	Metric	What it measures	Level
Controllability	$\mathsf{C}$	ACC	Multiple-choice ACCuracy on the control objective	Output
		APC	Average probability of matching the target behavior	Output
		$\Delta$ ACC	Change in control ACCuracy relative to the unsteered baseline	Output
		$\Delta$ APC	Change in matching probability relative to the unsteered baseline	Output
		VAR	Sample-wise variance of $\Delta$ APC (control stability across inputs)	Output
		Align	Alignment between steering vector and induced activation shift	Mechanism

Appendix

Table 5: Overview of evaluation axes and metrics used in FaithSteer-BENCH.

M	S	Candidate set $A(S)$	$\alpha^{*}(S)$
A	i	$\{-2,-1.5,\dots,2\}$	1
	ii	$\{-2,0,2,\dots,24\}$	20
	iii	$\{-2,0,2,\dots,24\}$	20
	iv	$\{-2,0,2,\dots,24\}$	20
B	i	$\{-2,-1.5,\dots,2\}$	1
	ii	$\{-2,0,2,\dots,24\}$	20

Appendix

Table 6: Reference operating point selection. Models : A : Llama-2-7B, B : Llama-2-13B, C : Qwen2.5-7B, D : Gemma-7B. Methods : i : CAA, ii : PCA, iii : TopPC, iv : ITI.

Gate	Acceptance criterion	Threshold
Gate 1 (Clean control)
	$\mathrm{APC}_{\mathrm{clean}}\geq\tau_{\mathrm{APC}}$	$0.70$
	$\Delta\mathrm{APC}_{\mathrm{clean}}\geq\tau_{\Delta\mathrm{APC}}$	$0.15$
	$\Delta\mathrm{ACC}_{\mathrm{clean}}\geq\tau_{\Delta\mathrm{ACC}}$	$0.05$
	$\mathrm{VAR}_{\mathrm{clean}}\leq\tau_{\mathrm{VAR}}$	$0.020$
Gate 2 (Clean utility)

Appendix

Table 7: Acceptance thresholds for Gate-wise evaluation in FaithSteer-BENCH. Thresholds are shared across methods and set once on held-out development data; all evaluations use the fixed operating point

\alpha^{*}(\mathcal{S})

Llama-2-7B-Chat
Method	$\Delta$ RACE	$\Delta$ MMLU	$\Delta$ OBQA	$\Delta$ GLUE
CAA	-0.00250	+0.00125	+0.01000	-0.00375
PCA	-0.20375	-0.14375	-0.16250	+0.03625
TopPC	-0.19875	-0.14000	-0.15750	+0.03375
ITI	-0.09625	-0.05250	-0.05375	+0.00375
Llama-2-13B-Chat

Appendix

Table 8: Capability preservation on clean inputs. Mean

\Delta

vs Base on RACE/MMLU/OBQA/GLUE.

\Delta=ACC_{\mathrm{cap}}(\text{method})-ACC_{\mathrm{cap}}(\text{Base})

, averaged over 8 steering tasks.

Task	Method	Steering & Controllability
		Llama-2-7B-chat			Llama-2-13B-chat			Qwen2.5-7B			Gemma-7B
		ACC $\uparrow$	APC $\uparrow$	Var $\downarrow$	ACC $\uparrow$	APC $\uparrow$	Var $\downarrow$	ACC $\uparrow$	APC $\uparrow$	Var $\downarrow$	ACC $\uparrow$	APC $\uparrow$	Var $\downarrow$
Data1	Base	0.38	0.37	0.00	0.34	0.34	0.00	0.36	0.47	0.00	0.52	0.57	0.00
	CAA	0.60	0.52	0.03	0.48	0.47	0.06	0.50	0.52	0.00	0.72	0.67	0.02
	PCA	0.46	0.49	0.14	0.46	0.43	0.12	0.38	0.46	0.01	0.56	0.56	0.08
	TopPC	0.54	0.50	0.16	0.48	0.45	0.13	0.38	0.46	0.01	0.56	0.56	0.08

Appendix

Table 9: Faithful steering benchmark: Steering & Controllability comparison across four models. Tasks : steering datasets (abbr.), where Data1 = coordinate-other-ais, Data2 = corrigible-neutral-HHH, Data3 = hallucination, Data4 = myopic-reward, Data5 = one-box-tendency, Data6 = refusal, Data7 = self-awareness, Data8 = survival-instinct. Rows : Base (no steering) + CAA, PCA, TopPC, ITI. Metrics : ACC, APC, Var.

Task	Method	General Capability Shift
		Llama-2-7B-chat				Llama-2-13B-chat				Qwen2.5-7B				Gemma-7B
		RACE	MMLU	OBQA	GLUE	RACE	MMLU	OBQA	GLUE	RACE	MMLU	OBQA	GLUE	RACE	MMLU	OBQA	GLUE
Data1	Base	0.55	0.66	0.46	0.32	0.61	0.59	0.44	0.44	0.84	0.68	0.73	0.78	0.72	0.71	0.66	0.29
	CAA	0.55	0.66	0.46	0.32	0.60	0.60	0.47	0.43	0.83	0.68	0.73	0.76	0.73	0.71	0.65	0.29
	PCA	0.43	0.49	0.34	0.39	0.56	0.60	0.42	0.36	0.84	0.67	0.71	0.75	0.69	0.67	0.58	0.34
	TopPC	0.43	0.49	0.35	0.39	0.56	0.61	0.43	0.36	0.84	0.67	0.70	0.75	0.68	0.67	0.57	0.35

Appendix

Table 10: Faithful steering benchmark: General Capability Shift comparison across four models. Tasks : steering datasets (abbr.), where Data1 = coordinate-other-ais, Data2 = corrigible-neutral-HHH, Data3 = hallucination, Data4 = myopic-reward, Data5 = one-box-tendency, Data6 = refusal, Data7 = self-awareness, Data8 = survival-instinct. Rows : Base (no steering) + CAA, PCA, TopPC, ITI. Metrics : relative capability on RACE, MMLU, OpenBookQA, and GLUE.

Figure 5: Radar plots of steering performance (ACC and APC) on eight datasets. Columns denote different backbone models and rows correspond to ACC (top) and APC (bottom). Each plot compares Base (no steering) with CAA, PCA, TopPC, and ITI. Larger areas indicate better steering performance.

Panel of Figure 6 — Figure 6: Steering vector ablations across five models and four extraction methods. Each row corresponds to a model, and each column corresponds to a steering vector construction method. The x-axis denotes the steering vector multiplier and the y-axis shows the probability of matching the target behavior.

Dataset	Setting	Method	Llama-2-7b-chat-hf			Llama-2-13b-chat-hf			Qwen2.5-7B			Gemma-7B
Dataset	Setting	Method	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var
Hallucination	Previous	CAA	0.84	0.78	0.04	0.58	0.60	0.01	0.56	0.52	0.00	0.88	0.80	0.02
		PCA	0.28	0.36	0.19	0.50	0.51	0.08	0.50	0.47	0.00	0.72	0.67	0.05
		TopPC	0.28	0.36	0.16	0.52	0.55	0.06	0.54	0.48	0.00	0.74	0.68	0.05
		ITI	0.88	0.83	0.07	0.70	0.66	0.08	0.52	0.51	0.00	0.78	0.75	0.01
	FS (10%)	CAA	0.69	0.69	0.03	0.61	0.61	0.02	0.57	0.52	0.00	0.82	0.79	0.02

Appendix

Table 11: OOD stress: few-shot prompt minimality.

Dataset	Setting	Method	Llama-2-7b-chat-hf			Llama-2-13b-chat-hf			Qwen2.5-7B			Gemma-7B
Dataset	Setting	Method	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var
Hallucination	Previous	CAA	0.84	0.78	0.04	0.58	0.60	0.01	0.56	0.52	0.00	0.88	0.80	0.02
		PCA	0.28	0.36	0.19	0.50	0.51	0.08	0.50	0.47	0.00	0.72	0.67	0.05
		TopPC	0.28	0.36	0.16	0.52	0.55	0.06	0.54	0.48	0.00	0.74	0.68	0.05
		ITI	0.88	0.83	0.07	0.70	0.66	0.08	0.52	0.51	0.00	0.78	0.75	0.01
	Role Attack	CAA	0.70	0.67	0.02	0.56	0.55	0.03	0.64	0.53	0.00	0.80	0.75	0.02

Appendix

Table 12: Red-teaming stress: role attack.

Dataset	Setting	Method	Llama-2-7b-chat-hf			Llama-2-13b-chat-hf			Qwen2.5-7B			Gemma-7B
Dataset	Setting	Method	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var
Hallucination	Previous	CAA	0.84	0.78	0.04	0.58	0.60	0.01	0.56	0.52	0.00	0.88	0.80	0.02
		PCA	0.28	0.36	0.19	0.50	0.51	0.08	0.50	0.47	0.00	0.72	0.67	0.05
		TopPC	0.28	0.36	0.16	0.52	0.55	0.06	0.54	0.48	0.00	0.74	0.68	0.05
		ITI	0.88	0.83	0.07	0.70	0.66	0.08	0.52	0.51	0.00	0.78	0.75	0.01
	Standpoint Attack	CAA	0.64	0.64	0.02	0.44	0.44	0.03	0.46	0.46	0.00	0.80	0.73	0.02

Appendix

Table 13: Red-teaming stress: standpoint interference).

Dataset	Setting	Method	Llama-2-7b-chat-hf			Llama-2-13b-chat-hf			Qwen2.5-7B			Gemma-7B
Dataset	Setting	Method	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var
Hallucination	Previous	CAA	0.84	0.78	0.04	0.58	0.60	0.01	0.56	0.52	0.00	0.88	0.80	0.02
		PCA	0.28	0.36	0.19	0.50	0.51	0.08	0.50	0.47	0.00	0.72	0.67	0.05
		TopPC	0.28	0.36	0.16	0.52	0.55	0.06	0.54	0.48	0.00	0.74	0.68	0.05
		ITI	0.88	0.83	0.07	0.70	0.66	0.08	0.52	0.51	0.00	0.78	0.75	0.01
	Template Attack	CAA	0.72	0.72	0.04	0.64	0.62	0.05	0.56	0.54	0.00	0.80	0.78	0.01

Appendix

Table 14: Red-teaming stress: template reframing.

Dataset	Setting	Method	Llama-2-7b-chat-hf			Llama-2-13b-chat-hf			Qwen2.5-7B			Gemma-7B
Dataset	Setting	Method	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var
Hallucination	Previous	CAA	0.84	0.78	0.04	0.58	0.60	0.01	0.56	0.52	0.00	0.88	0.80	0.02
	Previous	ITI	0.88	0.83	0.07	0.70	0.66	0.08	0.52	0.51	0.00	0.78	0.75	0.01
	Base64 Attack	CAA	0.50	0.49	0.00	0.50	0.50	0.00	0.50	0.51	0.00	0.50	0.49	0.01
	Base64 Attack	ITI	0.48	0.48	0.03	0.50	0.50	0.00	0.50	0.51	0.00	0.50	0.49	0.01
Refusal	Previous	CAA	0.78	0.77	0.05	0.76	0.75	0.03	0.82	0.66	0.00	0.54	0.58	0.02

Appendix

Table 15: Hybrid stress: base64 encoding wrapper.

Dataset	Setting	Method	Llama-2-7b-chat-hf			Llama-2-13b-chat-hf			Qwen2.5-7B			Gemma-7B
Dataset	Setting	Method	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var	ACC	APC	Var
Refusal	Previous	CAA	0.78	0.77	0.05	0.76	0.75	0.03	0.82	0.66	0.00	0.54	0.58	0.02
	Previous	ITI	0.82	0.77	0.11	0.76	0.75	0.03	0.76	0.65	0.01	0.74	0.64	0.03
	Language Attack	CAA	0.74	0.72	0.08	0.66	0.67	0.02	0.58	0.56	0.02	0.68	0.60	0.00
	Language Attack	ITI	0.74	0.71	0.20	0.68	0.68	0.10	0.64	0.61	0.03	0.68	0.60	0.01

Appendix

Table 16: OOD stress: language/translation shift.

Panel of Figure 7 — Figure 7: Impact of Standpoint-based jailbreak attacks on faithful steering performance.

Panel of Figure 8 — Figure 8: Impact of Base64-based jailbreak attacks on faithful steering performance.

Figure 9: Impact of Role attacks on faithful steering performance.

Panel of Figure 10 — Figure 10: Impact of few shot stress testing on faithful steering performance.

Model	Method	$APC_{\mathrm{clean}}$	$\Delta APC_{\mathrm{clean}}$	$\Delta ACC_{\mathrm{clean}}$	$VAR_{\mathrm{clean}}$	Gate 1	$\Delta ACC_{\mathrm{cap,clean}}$	Gate 2
Llama-2-7B-Chat	CAA	0.77	0.12	0.12	0.05	Fail	+0.0150	Pass
Llama-2-7B-Chat	ITI	0.77	0.12	0.16	0.11	Fail	-0.1125	Fail
Llama-2-13B-Chat	CAA	0.75	0.08	0.08	0.03	Fail	-0.0050	Pass
Llama-2-13B-Chat	ITI	0.75	0.08	0.08	0.03	Fail	-0.0600	Fail
Qwen2.5-7B	CAA	0.66	0.04	0.08	0.00	Fail	-0.0175	Pass
Qwen2.5-7B	ITI	0.65	0.03	0.02	0.01	Fail	-0.0725	Fail

Appendix

Table 17: Detailed Gate 1 and Gate 2 metrics on the maximal common stress subset ( Refusal only). We report the decisive clean-stage metrics used by Gate 1 (clean controllability and stability) and Gate 2 (clean capability preservation) for the common subset used in the main-text FaithSteer-BENCH summary. Gate 1 is evaluated using

APC_{\mathrm{clean}}

\Delta APC_{\mathrm{clean}}

\Delta ACC_{\mathrm{clean}}

, and

VAR_{\mathrm{clean}}

; Gate 2 is evaluated using

\Delta ACC_{\mathrm{cap,clean}}

Model	Method	FS	Role	Standpoint	Template	Base64	Language	Mean $RetAPC$	Worst-case $RetAPC$	Gate 3
Llama-2-7B-Chat	CAA	1.039	1.039	0.818	1.026	0.662	0.935	0.920	0.662	Fail
Llama-2-7B-Chat	ITI	0.987	0.935	0.766	0.961	0.662	0.922	0.872	0.662	Fail
Llama-2-13B-Chat	CAA	0.987	1.147	1.000	1.027	0.640	0.893	0.949	0.640	Fail
Llama-2-13B-Chat	ITI	1.040	1.173	1.027	1.053	0.653	0.907	0.976	0.653	Fail
Qwen2.5-7B	CAA	1.000	0.924	0.833	0.924	0.758	0.848	0.881	0.758	Fail
Qwen2.5-7B	ITI	1.000	0.985	0.908	0.923	0.754	0.938	0.918	0.754	Fail

Appendix

Table 18: Detailed Gate 3 retention metrics on the maximal common stress subset. The full stress-suite intersection across all six stress settings is Refusal

\times

{CAA, ITI}. We report per-stressor

RetAPC=APC_{\mathrm{stress}}/APC_{\mathrm{clean}}

, together with the mean and worst-case

RetAPC

across the full stress suite. The Gate 3 verdict is determined by the worst-case

RetAPC

threshold.

Case	Method	Model	Behavior	Stress	Align (clean)	Align (stress)	FOS (clean)	FOS (stress)	LDC (clean)	LDC (stress)	Supporting verdict
Case 1	ITI	Llama-2-13B-Chat	Refusal	Base64	54.7308	62.3972	0.02039	0.00747	0.5951	0.9074	Mean/Worst $RetAPC$ : 0.976 / 0.653 (Gate 3 Fail)
Case 3	CAA	Gemma-7B	Refusal	Base64	16.8617	30.7537	0.0074	0.0059	0.7484	0.9488	Mean/Worst $RetAPC$ : 0.951 / 0.828 (Gate 3 Pass)

Appendix

Table 19: Mechanism-level diagnostics for stress-based case studies. We report clean and stressed values of Align , FOS , and LDC for the Base64-based case studies discussed in Section 4.6, together with mean and worst-case

RetAPC

. These diagnostics are used only to interpret the benchmark verdicts and do not affect the gate decisions.

Method	Model	Behavior	Align	FOS	LDC	$\Delta ACC_{\mathrm{cap,clean}}$	Gate 2
CAA	Llama-2-7B-Chat	Refusal	0.9232	0.0781	0.2556	+0.0150	Pass
ITI	Llama-2-7B-Chat	Refusal	59.3823	0.0861	0.7352	-0.1125	Fail

Appendix

Table 20: Mechanism-level diagnostics for the clean CAA–ITI contrast on Llama-2-7B-Chat . We report Align , FOS , and LDC for CAA and ITI on Refusal in the clean setting, together with the corresponding

\Delta ACC_{\mathrm{cap,clean}}

values used for Gate 2.

Language Model Steering

Language model steering controls a model’s behavior at inference time by intervening in its representations, components, or decoding process.

See all 279 papers

Does Steering Break Your Model? A Multi-Dimensional Evaluation Suite for LLM Steering Methods
Oct 6, 2026Haotian Yang, Huikang Jiang, Yucheng Wu +4LLM Evaluation Language Model Steering
State Key Laboratory of Multimedia Information Processing, Peking University · School of Computer Science, Peking University · Columbia University +2
FineSteer: A Unified Framework for Fine-Grained Inference-Time Steering in Large Language Models
Apr 16, 2026Zixuan Weng, Jinghuai Zhang, Kunlin Cai +3Language Model Steering LLM Safety
University of California, Los Angeles
RealControlBench: A Benchmark for Interpretability-Informed Fine-Grained Control of LLMs and Agents
Oct 19, 2026Xinying Cai, Bin Hu, Mingyu Jin +16Language Model Steering Language Model-Based Control
University of California, San Diego · Rutgers University · NEC Laboratories America +8

Oct 6, 2026J/K move · Enter open · S save

Does Steering Break Your Model? A Multi-Dimensional Evaluation Suite for LLM Steering Methods

Haotian Yang, Huikang Jiang, Yucheng Wu, Wen-Jie Jiang+3

State Key Laboratory of Multimedia Information Processing, Peking University · School of Computer Science, Peking University · Columbia University+2

LLM Evaluation Language Model Steering Language Model Safety Evaluation Activation Steering

Open paper AskPDF arXiv

Activation steering provides a lightweight and flexible way to control large language model (LLM) behavior. However, effective steering requires more than inducing the intended behavior: it should also limit unintended changes and remain robust across inputs and training data. Existing evaluations cover these dimensions only in fragments. As a result, the trade-offs between efficacy and side effects have not been systematically characterized. We introduce SteerScope, a two-axis, multi-dimensional evaluation suite that jointly characterizes steering outcomes and method properties through 15 metrics. We score target efficacy and side effects on language quality, task capabilities, and safety and reliability, and further assess generalization and data dependence through steering-specific metrics for sample efficiency and sample sensitivity. Rather than comparing methods at a single operating point, we characterize the trade-offs between efficacy and side effects. Under matched models, tasks, and evaluation protocols, we benchmark 23 methods spanning 4 families, including prompting, LoRA, and SFT as baseline methods, and release the suite as an extensible codebase. We find that current activation steering methods do not yet surpass the Prompt Steering baseline in their overall balance between steering efficacy and side effects: across both model scales, no evaluated activation steering method achieves higher efficacy without incurring greater composite side effects. We further uncover a consistent coupling between steering efficacy and side effects. Under OOD prompts, target efficacy is often preserved, whereas side effects tend to become more pronounced, particularly through declines in instruction relevance and fluency. Methods also exhibit sharply different sample-efficiency profiles.

Abstract

Language Model Steering

Explore similar work

Does Steering Break Your Model? A Multi-Dimensional Evaluation Suite for LLM Steering Methods

FineSteer: A Unified Framework for Fine-Grained Inference-Time Steering in Large Language Models

RealControlBench: A Benchmark for Interpretability-Informed Fine-Grained Control of LLMs and Agents