Steerable but Not Decodable: Function Vectors Operate Beyond the Logit Lens

Mohammed Suhail B Nadaf

cs.LGApr 3, 2026

Steerable but Not Decodable: Function Vectors Operate Beyond the Logit Lens

Authors: Mohammed Suhail B Nadaf

Organizations: Independent

Abstract

Activation steering presupposes that task-relevant behaviors correspond to linear directions in activation space -- directions that should both steer the model and be readable along the unembedding. Function vectors (FVs), extracted as mean differences across ICL demonstrations, are the canonical test case; the prediction: steering and decoding succeed or fail together. Across 12 tasks, 6 models from 3 families, and 4,032 directed cross-template pairs, we find the opposite. FV steering routinely succeeds where the logit lens cannot decode the correct answer at any intermediate layer, while the converse -- decodable without steerable -- is nearly empty (3 of 72). The gap is not representational dialect. A diagonal tuned lens closes 1 of 14 steerable-not-decodable cases; a 2-layer MLP probe with a Hewitt & Liang control closes 5 of 10 via nonlinearly encoded structure but leaves 5 invisible to every decoder tested. Even at $> 0.90$ steering accuracy, projecting the FV through the unembedding yields incoherent token distributions: FVs encode computational instructions, not answer directions. A model-family asymmetry sharpens the picture. Mistral FVs rewrite intermediate representations, while Llama and Gemma FVs steer the final output without leaving a logit-lens-visible trace, corroborated by three signals (post-steering deltas, activation-patching recovery, FV norm-transfer correlations). A previously reported negative cosine-transfer correlation dissolves at scale, adding at most $ΔR^2 = 0.011$ beyond task identity. These results decompose the linear representation hypothesis into linear decodability and linear steerability and show they come apart opposite to intuition, with implications for safety monitoring: vocabulary-projection tools are blind to FV-style interventions on widely deployed model families.

Figures & tables

Category	Task	$n$	Eval	Expected IID	Role	Tok
Lexical Retrieval	antonym	95	substr	0.45–0.60	Positive control	5
	synonym	88	substr	0.20–0.40	Moderate test	5
	hypernym	86	substr	0.25–0.45	Moderate test	5
Factual Retrieval	country_capital	90	substr	0.40–0.65	Positive control	5
	english_spanish	88	substr	0.25–0.50	Moderate test	5
	object_color	85	substr	0.30–0.55	Moderate test	5

Table 1: Task battery: 12 tasks across 5 computational categories. “Expected IID” is the pre-registered difficulty prediction (Appendix K ), formulated before running any experiments.

n

is the number of input–output pairs. Eval: substring match (case-sensitive for capitalize ); polarity classification for sentiment_flip (§ 3.4 , Appendix Q ). Tok: maximum new tokens.

	FV steering succeeds	FV steering fails
Logit lens succeeds	Decodable + steerable	Decodable without steerability
Logit lens fails	Steerable without decodability	Information absent

Table 2: The steerability–decodability matrix. “Logit lens succeeds” means best-layer top-10 accuracy exceeds 0.10; “FV steering succeeds” means mean IID accuracy exceeds

\tau=0.10

. Naive intuition predicts the upper-right cell (decodable without steerable) would be populated. Our data invert the prediction.

Figure 1: IID steering accuracy across all 12 tasks and 6 models (mean across 8 templates at the best layer and best $\alpha$ ). Red borders mark cells failing the IID gate ( $\tau=0.10$ ); orange stars indicate falsified negative-control predictions ( capitalize , first_letter ). Morphological tasks ( past_tense , plural ) dramatically exceed predictions across all models. hypernym shows the largest cross-model divergence (0.085 on Llama Base vs. 0.902 on Gemma Base), indicating task category predicts FV success only as a proxy for model competence. Per-template numerical values for Llama Base are in Appendix C .

Cat.	Task	IID	OOD	Gap
Lex.	antonym	0.738	0.744	$+$ 0.007
Lex.	synonym	0.357	0.316	$-$ 0.041
Fact.	country_capital	0.665	0.632	$-$ 0.033
Fact.	english_spanish	0.833	0.656	$-$ 0.176
Fact.	object_color	0.357	0.365	$+$ 0.008
Morph.	past_tense	0.892	0.793	$-$ 0.099

Table 3: Cross-template transfer for Llama-3.1-8B Base (tasks passing the IID gate). OOD accuracy is the mean across all 56 directed cross-template pairs at the best layer and

\alpha

. Per-model transfer tables are in Appendix E .

Model	$R^{2}_{\text{task}}$	$R^{2}_{\text{task}+\text{cos}}$	$\Delta R^{2}$	Cos. coef
Gemma-2 Base	0.481	0.481	$<$ 0.001	$-0.002$
Gemma-2 IT	0.528	0.530	0.003	$+0.131$
Llama-3.1 Base	0.402	0.410	0.009	$+0.153$
Llama-3.1 IT	0.512	0.523	0.011	$+0.235$
Mistral Base	0.527	0.533	0.006	$+0.191$
Mistral IT	0.585	0.586	0.002	$+0.118$

Table 4: Hierarchical regression: task identity vs. cosine as predictors of OOD transfer accuracy (computed from raw cross-template pairs). Cosine contributes at most 1.1 percentage points of

R^{2}

beyond task identity on every model.

Figure 2: The populated

2\times 2

steerability–decodability matrix across all 72 task

\times

model instances. Circle area reflects count. The predicted upper-right cell (decodable without steerable) is nearly empty (3/72, all on Mistral); the actual finding populates the lower-left cell (steerable without decodable, 10/72). The most dramatic dissociation is country_capital on Llama Base: FV steering reaches 0.880 accuracy at L4 while logit-lens top-10 readability is only 0.056 at L32—an 82-point gap.

Model	Both succeed	Decodable, not steerable	Steerable, not decodable	Both fail
Gemma-2 Base	12	0	0	0
Gemma-2 IT	10	0	2	0
Llama-3.1 Base	8	0	4	0
Llama-3.1 IT	11	0	1	0
Mistral Base	9	2	0	1
Mistral IT	8	1	3	0

Table 5: Populated

2\times 2

steerability–decodability matrix across all 6 models (72 task

\times

model pairs total). The lower-left cell (steerable without decodability) is the central empirical finding. sentiment_flip readability uses polarity-classification accuracy, not first-token top-

k

match (§ 3.4 ).

Figure 3: Layer-wise FV steering accuracy (blue) vs. logit-lens top-10 accuracy (green dashed) for 4 representative tasks across 3 model families. Pink shading marks the steerability–decodability gap; yellow borders mark steerable-not-decodable panels. FV steering peaks at early layers (L2–L8) while logit-lens readability emerges only at late layers (L28–L32). For country_capital and first_letter , the logit lens is near zero at every layer while FV steering succeeds—demonstrating pure steerability-without-decodability across model families. The full 12-panel version is in Appendix P .

Model	S&ND tasks	Closed	Persist
Llama-3.1 Base	5	0	5
Llama-3.1 Instruct	1	1	0
Mistral Base	0	0	0
Mistral Instruct	4	0	4
Gemma-2 Base	1	0	1
Gemma-2 Instruct	3	0	3

Table 6: Gap persistence under tuned-lens dialect correction. “S&ND” = steerable-not-decodable task

\times

model pairs under the logit lens. “Closed” = tuned-lens top-10 accuracy crosses

\tau=0.10

. “Persist” = gap remains. Counts are consistent with the expanded

2\times 3

matrix (Appendix L ).

Figure 4: Nonlinear-decoder follow-up. (A) Decoder ladder across 72 (model, task) cells: 61 are decodable by the logit lens, 1 by the tuned lens only, 5 by the MLP probe only (closing 5 of 10 SAND cases by recovering nonlinearly encoded information), and 5 remain invisible to every decoder we tried . (B) The cleanest closure: Gemma-2-9B IT

\times

first_letter . Logit lens 0.081 and tuned lens 0.081 both miss the answer at every layer; the MLP probe reaches 0.912 top-10 at layer 38 with control top-10 only 0.346 (selectivity

+0.57

), while FV steering reaches 1.00. Character-level information is computed near the model’s output but in a direction the unembedding cannot read.

Bucket	Count	Interpretation
Logit-lens decodable	61 (84.7%)	Easy case; baseline decoder suffices.
Tuned-lens only	1 (1.4%)	Borderline (Llama IT/ first_letter ).
MLP probe only	5 (6.9%)	SAND closed; FV uses nonlinear subspace.
Invisible to every decoder	5 (6.9%)	SAND persists; central claim strengthened.
Total	72

Table 7: Updated 4-bucket decoder ladder across all 72 (model, task) cells. The MLP-only and “invisible to all decoders” rows decompose the SAND set into nonlinearly-encoded cases and genuinely undecodable cases. Per-model breakdown: Appendix M , Table 28 .

Figure 5: Model-family mechanistic divergence. (A) Maximum post-steering logit-lens delta per task (post-steering top-10 minus zero-shot top-10): Mistral Instruct FVs massively rewrite intermediate representations (delta up to

+1.000

), while Llama and Gemma FVs produce near-zero changes on steerable-not-decodable tasks despite successful steering. (B) Dialect correction magnitude by family (Gemma 2.8%, Llama 10.8%, Mistral 24.9%): despite a

\sim

\times

range in dialect, 93% of steerable-not-decodable gaps persist under the tuned lens; correction magnitude anti-correlates with readability improvement (

r=-0.478

p<10^{-6}

Model	Cases	Skipped	Mean recovery	Median
Llama-3.1 Base	60	2,041	0.275	0.067
Llama-3.1 Instruct	60	360	0.295	0.067
Gemma-2 Base	60	570	0.207	0.000
Gemma-2 Instruct	60	161	0.101	0.000
Mistral Base	45	3,095	0.220	0.000
Mistral Instruct	55	1,723	0.177	0.000

Table 8: Activation patching recovery accuracy summary (max across layers per case, then aggregated; the displayed mean and median are global statistics across all (case, layer) entries). “Skipped” = pairs failing the IID gate. Tasks with strong IID steering achieve perfect recovery on multiple models; genuinely hard tasks show zero recovery everywhere. Fewer cases for Mistral Base (45) and Mistral IT (55) reflect tasks failing the IID gate. Per-task and per-layer results are in Appendix O .

Appendix figures & tables35 assets

Supplementary material from the paper’s appendix.

Appendix

Task	ID	Style	Template
antonym	T1	Natural	The opposite of {X} is
antonym	T2	Natural	{X} has the opposite meaning of
antonym	T3	Symbolic	antonym({X}) =
antonym	T4	Symbolic	opposite: {X} $\to$
antonym	T5	Question	What is the antonym of {X}?
antonym	T6	Question	What word means the opposite of {X}?

Appendix

Table 9: Complete template specifications for all 12 tasks. Curly braces enclose the input slot.

		Llama Base			Llama Instruct
Cat.	Task	Zero	5-shot	IID	Zero	5-shot	IID
Lex.	antonym	0.46	0.76	0.738	0.56	0.86	0.870
	synonym	0.20	0.58	0.357	0.22	0.51	0.625
	hypernym	0.04	0.09	0.085	0.08	0.37	0.412
Fact.	country_capital	0.08	0.84	0.665	0.14	0.86	0.920
	english_spanish	0.56	0.86	0.833	0.64	0.85	0.882

Appendix

Table 10: Baselines and IID accuracy for Llama-3.1-8B Base and Instruct. Zero-shot and 5-shot ICL are measured independently of FV extraction; IID is the mean across 8 templates at the best layer and best

\alpha

. Bold-red entries fail the IID gate (

\tau=0.10

		Gemma-2 Base			Gemma-2 IT
Cat.	Task	Zero	5-shot	IID	Zero	5-shot	IID
Lex.	antonym	0.59	0.68	0.867	0.63	0.68	0.880
	synonym	0.17	0.48	0.440	0.29	0.57	0.675
	hypernym	0.21	0.92	0.902	0.14	0.88	0.897
Fact.	country_capital	0.42	1.00	0.930	0.53	1.00	0.982
	english_spanish	0.61	1.00	0.897	0.62	0.99	0.905

Appendix

Table 11: Baselines and IID accuracy for Gemma-2-9B Base and Instruct. Format matches Table 10 .

		Mistral Base			Mistral Instruct
Cat.	Task	Zero	5-shot	IID	Zero	5-shot	IID
Lex.	antonym	0.02	0.68	0.740	0.02	0.66	0.780
	synonym	0.01	0.16	0.138	0.09	0.18	0.367
	hypernym	0.09	0.12	0.315	0.07	0.12	0.435
Fact.	country_capital	0.14	0.18	0.240	0.02	0.10	0.265
	english_spanish	0.59	0.76	0.818	0.60	0.77	0.797

Appendix

Table 12: Baselines and IID accuracy for Mistral-7B-v0.3 Base and Instruct. Mistral zero-shot accuracies are notably lower than Llama and Gemma for lexical tasks, reflecting weaker few-shot formatting sensitivity.

Task	T1	T2	T3	T4	T5	T6	T7	T8	Mean
antonym	.90	.10	.60	.88	.76	.86	.88	.92	.738
synonym	.54	.60	.04	.28	.38	.42	.32	.28	.357
hypernym	.14	.02	.40	.00	.02	.02	.04	.04	.085
country_capital	.86	.22	.34	.88	.58	.76	.84	.84	.665
english_spanish	.94	.92	.56	.90	.72	.80	.90	.92	.833
object_color	.34	.48	.28	.32	.30	.40	.38	.36	.357

Appendix

Table 13: Per-template IID accuracy for Llama-3.1-8B Base. Each cell is the best accuracy across all

\alpha

values and layers for the (task, template) pair.

Model	Within-style mean	Across-style mean	$t$	$p$
Gemma-2 Base	0.613	0.644	$-0.84$	0.40
Gemma-2 IT	0.723	0.735	$-0.35$	0.72
Llama-3.1 Base	0.424	0.438	$-0.36$	0.72
Llama-3.1 IT	0.663	0.663	$+0.01$	0.99
Mistral Base	0.400	0.416	$-0.42$	0.67
Mistral IT	0.456	0.478	$-0.56$	0.58

Appendix

Table 14: Within-style vs. across-style mean OOD transfer accuracy. All 6 models show no significant style effect (

p>0.30

Model	$r$ ( source IID , OOD )	Mean IID–OOD gap	Pairs analyzed
Llama-3.1 Base	$+0.87$	$-0.043$	4,616
Llama-3.1 Instruct	$+0.81$	$-0.039$	5,352
Gemma-2 Base	$+0.93$	$-0.024$	6,099
Gemma-2 Instruct	$+0.91$	$-0.019$	5,352
Mistral Base	$+0.80$	$-0.058$	4,044
Mistral Instruct	$+0.85$	$-0.041$	4,417

Appendix

Table 15: Source-template IID quality strongly predicts OOD transfer accuracy across all 6 models. “Mean OOD gap” is averaged over tasks passing the IID gate (

\tau=0.10

). Negative gap indicates OOD is below IID; positive gap indicates the opposite (e.g., plural on Gemma where OOD slightly exceeds IID due to template-specific noise).

Cat.	Task	$r$	$p$
Lex.	antonym	$+0.053$	0.116
Lex.	synonym	$-0.008$	0.800
Lex.	hypernym	$-0.510$	$2.3\times 10^{-60}$
Fact.	country_capital	$+0.050$	0.137
Fact.	english_spanish	$-0.118$	$3.9\times 10^{-4}$
Fact.	object_color	$+0.276$	$4.2\times 10^{-17}$

Appendix

Table 16: Within-task alignment–transfer correlations (Llama-3.1-8B Base). Pooled

r=+0.013

(

p=0.16

, not significant). The hypernym within-task correlation (

r=-0.510

) is a floor-effect artifact: hypernym fails the IID gate on Llama Base (mean IID 0.085), so its within-task variation is dominated by noise.

		Gemma Base		Gemma IT
Cat.	Task	$r$	$p$	$r$	$p$
Lex.	antonym	$+0.142$	$1.1\times 10^{-6}$	$+0.340$	$3.0\times 10^{-33}$
Lex.	synonym	$+0.007$	0.82	$-0.114$	$8.3\times 10^{-5}$
Lex.	hypernym	$+0.040$	0.17	$+0.009$	0.75
Fact.	country_capital	$-0.267$	$1.2\times 10^{-20}$	$-0.036$	0.22
Fact.	english_spanish	$-0.081$	$5.4\times 10^{-3}$	$+0.002$	0.95

Appendix

Table 17: Within-task alignment–transfer correlations for Gemma-2-9B Base and Instruct.

		Mistral Base		Mistral IT
Cat.	Task	$r$	$p$	$r$	$p$
Lex.	antonym	$+0.255$	$9.3\times 10^{-15}$	$+0.281$	$9.6\times 10^{-18}$
Lex.	synonym	$+0.067$	0.045	$-0.023$	0.50
Lex.	hypernym	$-0.461$	$2.0\times 10^{-48}$	$+0.071$	0.034
Fact.	country_capital	$+0.017$	0.62	$+0.280$	$1.3\times 10^{-17}$
Fact.	english_spanish	$-0.028$	0.41	$+0.035$	0.29

Appendix

Table 18: Within-task alignment–transfer correlations for Mistral-7B-v0.3. Pooled

r

is negative for both, yet Mistral IT mean within-task

r=+0.139

—a genuine Simpson’s paradox.

Model	High-Align Pairs	$N_{\text{dissociation}}$	Rate	IID-Viable
Llama Base	4,470	6,657	0.745	4,616
Llama IT	3,197	2,705	0.423	2,345
Gemma Base	6,351	6,669	0.525	6,099
Gemma IT	5,535	3,860	0.349	3,699
Mistral Base	4,600	7,139	0.776	4,044
Mistral IT	4,212	6,140	0.729	4,417

Appendix

Table 19: Geometric dissociation: cross-template pairs with cosine

>0.80

but transfer accuracy

<0.40

. “IID-Viable” = dissociations where the source template passes the IID gate, isolating geometry–behavior dissociation from extraction failure.

Cat.	Task	PC1 Range	Mean PC1
Char.	reverse_word	0.55–0.97	0.80
Lex.	antonym	0.52–0.92	0.72
Morph.	plural	0.44–0.80	0.63
Char.	capitalize	0.42–0.84	0.60
Morph.	past_tense	0.38–0.73	0.55
Fact.	english_spanish	0.35–0.68	0.50

Appendix

Table 20: PC1 variance explained (range across 6 models) for each task. Tasks sorted by mean PC1.

Model	Mean Norm	$r(\text{norm, transfer})$	$p$
Llama-3.1 Base	20.50	$-0.089$	$1.9\times 10^{-20}$
Llama-3.1 IT	16.39	$-0.077$	$1.9\times 10^{-15}$
Gemma-2 Base	283.12	$-0.034$	$6.5\times 10^{-5}$
Gemma-2 IT	277.09	$-0.046$	$3.6\times 10^{-8}$
Mistral Base	9.71	$-0.013$	0.18
Mistral IT	12.64	$+0.132$	$5.8\times 10^{-43}$

Appendix

Table 21: FV L2 norms (mean across all extracted FVs at the best steering layer) and norm–transfer Pearson correlations across all cross-template pairs (

n\approx

10,752–14,112 pairs per model).

Task	Gemma $\Delta$	Llama $\Delta$	Mistral $\Delta$
antonym	$+0.013$	$+0.132$	$+0.040$
synonym	$+0.235$	$+0.268$	$+0.229$
hypernym	$-0.005$	$+0.327$	$+0.120$
country_capital	$+0.052$	$+0.255$	$+0.025$
english_spanish	$+0.008$	$+0.049$	$-0.021$
object_color	$+0.053$	$+0.363$	$+0.110$

Appendix

Table 22: Instruction-tuning effect on IID steering accuracy (

\Delta=

Instruct

-

Base).

Task	Predicted	Observed	Status	Notes
antonym	0.45–0.60	0.813	$\times$	Exceeded range
synonym	0.20–0.40	0.434	$\sim$	Slightly above
hypernym	0.25–0.45	0.508	$\sim$	Strongly model-dependent
country_capital	0.40–0.65	0.667	$\sim$	Slightly above
english_spanish	0.25–0.50	0.856	$\times$	Greatly exceeded
object_color	0.30–0.55	0.573	$\sim$	Slightly above

Appendix

Table 23: Pre-registered predictions vs. observed grand mean across 6 models. ✓ = confirmed within range;

\sim

= partially confirmed (slightly above);

\times

= falsified. Predictions were committed before any model runs.

Model	$N$	LL Mean	TL Mean	$\Delta$	$t$	Cohen’s $d$
Llama-3.1 Base	1,536	0.026	0.022	$-0.004$	$-9.19^{***}$	$-0.23$
Llama-3.1 Instruct	1,536	0.044	0.036	$-0.008$	$-9.84^{***}$	$-0.25$
Mistral Base	1,536	0.057	0.048	$-0.009$	$-10.50^{***}$	$-0.27$
Mistral Instruct	1,536	0.055	0.050	$-0.005$	$-8.83^{***}$	$-0.23$
Gemma-2 Base	2,016	0.022	0.022	$+0.000$	$+1.49$	$+0.03$
Gemma-2 Instruct	2,016	0.039	0.038	$-0.001$	$-2.87^{**}$	$-0.06$

Appendix

Table 24: Paired

t

-tests: logit lens vs. tuned lens top-10 readability across all task

\times

template

\times

layer observations per model. The tuned lens slightly degrades readability on 4 of 6 models; effect sizes are small.

Model	LL Frac	TL Frac	$\Delta$	$N_{\text{impr}}$	$N_{\text{degr}}$	H4?
Llama-3.1 Base	0.004	0.002	$-0.001$	0	6	No
Llama-3.1 Instruct	0.003	0.012	$+0.009$	24	3	No
Mistral Base	0.034	0.053	$+0.019$	60	4	No
Mistral Instruct	0.035	0.037	$+0.002$	15	13	No
Gemma-2 Base	0.017	0.018	$+0.001$	4	2	No
Gemma-2 Instruct	0.014	0.014	$+0.000$	2	1	No

Appendix

Table 25: FV vocabulary projection coherence: logit lens vs. tuned lens. “Correct Frac” = fraction of top-50 projected tokens matching any correct task output. Both decoders yield negligible coherence (

<

6%); the rotated-dialect hypothesis (“H4?”) is not supported on any model.

Model	Mean Improv. (%)	Max Improv. (%)	$r$ (depth)	$p$
Llama-3.1 Base	11.4	16.5	$+0.898$	$<10^{-4}$
Llama-3.1 Instruct	10.2	15.1	$+0.867$	$<10^{-4}$
Mistral Base	23.3	31.4	$+0.892$	$<10^{-4}$
Mistral Instruct	26.5	35.8	$+0.912$	$<10^{-4}$
Gemma-2 Base	3.4	14.1	$+0.752$	$0.0001$
Gemma-2 Instruct	2.3	19.7	$+0.611$	$0.004$

Appendix

Table 26: Dialect correction magnitude by model family. “Mean Improv. (%)” = mean percentage reduction in MSE over identity translator across trained layers. “

r

(depth)” = Pearson correlation between layer depth and improvement percentage. Later layers universally require larger corrections.

	Steerable	Not Steerable	Total
Logit lens readable	54 (75.0%)	2 (2.8%)	56
Tuned lens only	1 (1.4%)	0 (0.0%)	1
Neither readable	13 (18.1%)	2 (2.8%)	15
Total	68	4	72

Appendix

Table 27: Expanded

2\times 3

steerability–decodability matrix aggregated across 6 models (72 task

\times

model pairs). A decoder “succeeds” if best top-10 accuracy exceeds 0.10 at any layer. The “tuned lens only” row is nearly empty, confirming the original

2\times 2

classification is robust.

Model	$n_{\text{probes}}$	Mean real	Mean ctrl	Mean sel.	SAND	Closed	Persist
Llama-3.1 Base	192	0.179	0.180	$-0.001$	4	2	2
Llama-3.1 Instruct	192	0.239	0.191	$+0.048$	1	1	0
Gemma-2 Base	252	0.226	0.160	$+0.066$	0	0	0
Gemma-2 Instruct	252	0.231	0.157	$+0.074$	2	1	1
Mistral Base	192	0.207	0.187	$+0.021$	0	0	0
Mistral Instruct	192	0.197	0.184	$+0.012$	3	1	2

Appendix

Table 28: Per-model MLP-probe summary. “

n_{\text{probes}}

” is the number of (task, layer) pairs in each condition (Llama/Mistral: 12 tasks

\times

16 layers

=

192; Gemma-2: 12

\times

=

252). “Mean sel.” is averaged across all probes per model (most are uninformative noise around zero, so this aggregate sits near zero by construction; the headline cases drive the per-task selectivities in Table 29 ). “SAND” columns count the SAND cells under the logit lens, the subset closed by the MLP, and the subset that persists.

Model	Task		LL	MLP real	MLP ctrl	Sel	FV IID	L*
Llama Base	antonym		0.621	0.079	0.020	$+0.06$	0.92	28/32
	capitalize		0.119	0.044	0.000	$+0.04$	0.90	8/32
	country_capital	†	0.056	0.396	0.125	$+0.27$	0.88	2/32
	english_spanish		0.420	0.229	0.111	$+0.12$	0.94	26/32
	first_letter	‡	0.000	0.331	0.309	$+0.02$	0.46	28/32
	hypernym	†	0.023	0.441	0.184	$+0.26$	0.40	6/32

Appendix

Table 29: Full per-(model, task) numerical summary of the MLP probe results. “LL” = logit lens best top-10; “MLP real” = MLP probe best top-10; “MLP ctrl” = control top-10 at the same layer; “Sel” = selectivity; “FV IID” = FV steering accuracy (mean across templates at best

\alpha

, layer); “L*” = best layer / total layers. Bold rows are the 10 logit-lens SAND cells (LL

<

0.10 and FV IID

\geq

0.10). † Closed by MLP probe. ‡ Persists under MLP probe.

Model	Real top-10	Control top-10	Selectivity	Verdict
Llama Base	0.824	0.882	$-0.059$	NULL (gate)
Llama IT	0.882	0.956	$-0.074$	NULL (gate)
Gemma-2 Base	0.882	0.963	$-0.081$	NULL (gate)
Gemma-2 IT	0.882	0.934	$-0.052$	NULL (gate)
Mistral Base	0.868	0.941	$-0.074$	NULL (gate)
Mistral IT	0.882	0.985	$-0.103$	NULL (gate)

Appendix

Table 30: The selectivity gate at work on object_color . Without the gate, every model’s MLP probe would have been declared decodable (real top-10

\geq

0.82); the control probe matches or exceeds the real probe in every case, so the gate correctly returns NULL on all six.

Model	LL	TL	MLP real	MLP ctrl	Sel.
Llama Base	0.023	0.012	0.441	0.184	$+0.26$
Llama IT	0.395	0.349	0.831	0.206	$+0.62$
Gemma-2 Base	0.558	0.558	0.934	0.199	$+0.74$
Gemma-2 IT	0.337	0.314	0.941	0.169	$+0.77$
Mistral Base	0.291	0.221	0.551	0.221	$+0.33$
Mistral Instruct	0.140	0.140	0.529	0.191	$+0.34$

Appendix

Table 31: hypernym per model: logit lens, tuned lens, MLP real, MLP control, selectivity. Mean nonlinear gain over the logit lens is

+0.43

Figure 6: Layer-wise profiles for all 10 SAND cases. Top row: 5 SAND cases closed by the MLP probe (blue borders). Bottom row: 5 SAND cases that persist under the MLP probe (amber borders). Each panel overlays the MLP-probe real and control top-10, the logit-lens best top-10 (horizontal), the tuned-lens best top-10 (horizontal), and the gate at

\tau=0.10

. The pink shaded area between control and real (where positive) is the per-layer selectivity. Closures show large positive selectivity at intermediate-to-late layers (Gemma IT

\times

first_letter at L38:

+0.57

); persistences show negative or near-zero selectivity (e.g., object_color cases where the control matches or exceeds the real).

Figure 7: Per-task best-layer selectivity (real

-

control top-10) by model. Green bars exceed the

\tau/2=0.05

gate (genuine task structure recovered); blue bars are MLP-only-decodable cases (closing SAND); grey bars are negative selectivity (label-prior shortcuts caught by the gate); light grey bars are below-gate uninformative cases. Across all 6 models, object_color sits at strongly negative selectivity, while hypernym and first_letter dominate the top of the distribution.

Figure 8: Logit-lens best top-10 vs. MLP-probe best real top-10, one point per (model, task). Triangles mark the 5 SAND cells closed by the MLP probe; X-shapes mark the 5 SAND cells that persist —red X for the 4 object_color -style cases where the probe’s top-10 is high but selectivity is negative, amber X for the borderline first_letter (Llama Base) and synonym (Mistral IT) cases where selectivity sits near zero or real falls below

\tau

. The diagonal

y=x

reference shows that for most cells the MLP and logit lens agree; the closures sit far above the line in the upper-left (low logit, high MLP).

Model	$n$	$r(\text{MaxDelta, IID})$	$p$
Gemma-2 Base	12	$+0.726$	0.008
Gemma-2 Instruct	12	$+0.524$	0.080
Llama-3.1 Base	12	$+0.844$	0.0006
Llama-3.1 Instruct	12	$+0.818$	0.001
Mistral Base	9	$+0.683$	0.04
Mistral Instruct	11	$+0.883$	$<0.001$

Appendix

Table 32: Correlation between maximum post-steering logit-lens delta and IID steering accuracy across the 12 tasks per model.

Perfect recovery on multiple models:
Cat.	Task	Gem.B	Gem.IT	Lla.B	Lla.IT	Mis.B	Mis.IT
Char.	first_letter	✓	✓	0.93	✓	✓	✓
Morph.	past_tense	✓	0.80	✓	✓	✓	✓
Morph.	plural	✓	✓	0.93	✓	0.93	0.87
Lex.	antonym	0.60	✓	✓	0.93	0.07	✓
Zero recovery everywhere:

Appendix

Table 33: Activation patching recovery accuracy (max across layers) per task per model. ✓ = perfect recovery (

\geq 0.99

) at some layer;

\times

= zero recovery (

<0.01

) everywhere; – = task failed IID gate (skipped). Numerical entries are intermediate recovery values.

Figure 9: FV steering accuracy vs. logit-lens top-10 accuracy at the best layer for all 12 tasks across all 6 models. Gap annotations show the steerability–decodability difference; orange stars mark steerable-not-decodable tasks. For every task on every model, FV steering meets or exceeds logit-lens accuracy. The most dramatic gaps are country_capital (Llama Base:

-0.82

) and first_letter (Llama IT:

-0.91

). sentiment_flip readability uses polarity classification (App. Q ).

Figure 10: Cosine similarity vs. OOD transfer accuracy for all cross-template pairs across all 6 models, colored by task. Dashed lines mark the preliminary study’s reported

r=-0.572

scatter; current pooled correlations range from

-0.199

(Mistral Base) to

+0.126

(Gemma IT), dissolving the Simpson’s paradox at 12-task scale. Points at high cosine (

>0.80

) span the full range of transfer accuracy on every model, confirming that geometric alignment does not predict functional transfer.

Figure 11: FV vocabulary projection analysis (Llama-3.1-8B Base). (A) Projection coherence vs. steering accuracy: if FVs were answer directions, points would lie on

y=x

(dashed line); instead, FVs achieving

>

0.90 steering accuracy still project to incoherent tokens (bottom-right region). (B) Top-10 projected tokens for three representative tasks: past_tense projects to garbage ( deo , aber , aday ); first_letter is the partial exception, projecting to single-character tokens but not the correct specific letters; antonym projects to morphological fragments ( nts , ible , ward ). FVs encode computational instructions, not answer directions.

Figure 12: Tuned-lens validation. (A) Gap persistence: each square is one steerable-not-decodable task

\times

model pair; red

\times

indicates the gap persists under tuned-lens correction, green ✓ indicates the gap closed (only 1 of 14). (B) The expanded

2\times 3

matrix; the “tuned lens only” row contains a single borderline entry. (C) Dialect correction magnitude by model family (Gemma 2.8%, Llama 10.8%, Mistral 24.9%): despite a

\sim

\times

range, all families show the same dissociation; correction anti-correlates with readability improvement (

r=-0.478

Figure 13: Activation-patching recovery accuracy (max across layers) for all tasks and models. ✓ = perfect recovery ( $\geq 0.99$ ) at some layer; $\times$ = zero recovery ( $\leq 0.01$ ) everywhere; light shading = task failed the IID gate. Easy tasks ( past_tense , plural , first_letter ) achieve perfect recovery on most models; hard tasks ( reverse_word , sentiment_flip ) show zero recovery everywhere—confirming that the difficulty hierarchy reflects causal localization, not statistical correlation.

Figure 14: Zero-shot vs. 5-shot ICL vs. FV-steered accuracy across all 6 models. FV steering is consistently additive or neutral on every model: aggregate destructive cases (where FV steering reduces accuracy below zero-shot) are 0–1% across all 6 models. For most tasks, FV steering matches or approaches few-shot ICL accuracy. As discussed in § 4.1 , this aggregate-task statistic is compatible with prior reports of substantial per-sample anti-steerability [ 33 , 6 ] .

Stage	Estimated time	Hardware
Zero-shot + few-shot baselines	${\sim}1$ h	GPU
FV extraction (1,536 FVs)	${\sim}3$ – $4$ h	GPU
Activation caching (zero-shot)	${\sim}0.5$ h	GPU
Logit lens + FV vocab projection	${\sim}0.3$ h	GPU
Steering evaluation ( ${\sim}98$ K configurations)	${\sim}10$ – $18$ h	GPU
Tuned-lens training + evaluation	${\sim}0.1$ h	GPU

Appendix

Table 34: Compute budget per model on NVIDIA H100 80GB. Activation patching is the dominant cost; the total per model is 15–24 hours.

Function Vectors

See all 8 papers

Jun 3, 2026

Fast & Faithful Function Vectors

Function vectors (FVs) are task representations elicited during in-context learning that can be used to steer Large Language Models (LLMs). However, design choices in their formulation remain underexplored. In this work, we study the impact of varying FV definitions for instructions along two degrees of freedom: attention head selection and steering. For head selection, using gradient-based attributions with Layer-wise Relevance Propagation (LRP) substantially improves efficiency as well as accuracy. For FV steering, applying it in a distributed manner yields a higher accuracy compared to simple aggregation. Our code is publicly available.

Minh An Pham, Anton Segeler, Thomas Wiegand +4

Fraunhofer Heinrich-Hertz-Institute, Berlin, Germany · Technische Universität Berlin, Berlin, Germany · BIFOLD – Berlin Institute for the Foundations of Learning and Data, Berlin, Germany +1

Task Vectors LLM Interpretability In-Context Learning Activation Steering Function Vectors

Ask PDF

Apr 9, 2026

What Drives Representation Steering? A Mechanistic Case Study on Steering Refusal

Applying steering vectors to large language models (LLMs) is an efficient and effective model alignment technique, but we lack an interpretable explanation for how it works--specifically, what internal mechanisms steering vectors affect and how this results in different model outputs. To investigate the causal mechanisms underlying the effectiveness of steering vectors, we conduct a comprehensive case study on refusal. We propose a multi-token activation patching framework and discover that different steering methodologies leverage functionally interchangeable circuits when applied at the same layer. These circuits reveal that steering vectors primarily interact with the attention mechanism through the OV circuit while largely ignoring the QK circuit. Freezing all attention scores during steering drops performance by only 8.83% across three model families. A mathematical decomposition of the steered OV circuit further reveals semantically interpretable concepts, even in cases where the steering vector itself does not. Leveraging the activation patching results, we show that steering vectors can be sparsified by up to 85-96% while retaining most performance, and that different steering methodologies agree on a subset of important dimensions.

Stephen Cheng, Sarah Wiegreffe, Dinesh Manocha

University of Maryland, College Park

Language Model Steering LLM Interpretability Representation Steering Attention Mechanisms Circuits in Language Models Refusal Behavior in Language Models

Ask PDF

Apr 16, 2026

Predicting Where Steering Vectors Succeed

Steering vectors work for some concepts and layers but fail for others, and practitioners have no way to predict which setting applies before running an intervention. We introduce the Linear Accessibility Profile (LAP), a per-layer diagnostic that repurposes the logit lens as a predictor of steering vector effectiveness. The key measure,

A_{\mathrm{lin}}

, applies the model's unembedding matrix to intermediate hidden states, requiring no training. Across 24 controlled binary concept families on five models (Pythia-2.8B to Llama-8B), peak

A_{\mathrm{lin}}

predicts steering effectiveness at

ρ= +0.86

+0.91

and layer selection at

ρ= +0.63

+0.92

. A three-regime framework explains when difference-of-means steering works, when nonlinear methods are needed, and when no method can work. An entity-steering demo confirms the prediction end-to-end: steering at the LAP-recommended layer redirects completions on Gemma-2-2B and OLMo-2-1B-Instruct, while the middle layer (the standard heuristic) has no effect on either model.

Jayadev Billa

Language Model Steering Representation Steering Causal Interventions in Language Models Activation Steering

Ask PDF

Abstract

Function Vectors

Explore similar work

Fast & Faithful Function Vectors

What Drives Representation Steering? A Mechanistic Case Study on Steering Refusal

Predicting Where Steering Vectors Succeed