Disentangling Steering Vectors

Takeru Hiramatsu; Kyohei Atarashi; Koh Takeuchi; Hisashi Kashima

cs.LGSep 7, 2026

Disentangling Steering Vectors

Authors: Takeru Hiramatsu, Kyohei Atarashi, Koh Takeuchi, Hisashi Kashima

Organizations: Kyoto University

Abstract

Activation steering has emerged as a lightweight, inference-time approach to control the behavior of Large Language Models (LLMs). However, traditional steering vectors used to intervene in LLMs' activations, such as those derived from the difference-in-means method, tend to entangle multiple semantic and stylistic concepts into a single composite direction, leading to unpredictable steering effects. Our core objective is to disentangle this composite direction into its constituent concepts. To this end, we propose Steering Vector Dissection, a framework to explicitly isolate individual and semantically consistent features from these composite directions. Specifically, we pair positive and negative activations and take their differences to generate a set of instance-level steering vectors, and train a dedicated Sparse Autoencoder (SAE) directly on them. Quantitative evaluations across two datasets, two models, and two intervention depths show that our method yields a set of semantically consistent basis vectors whose steering effects are mutually distinguishable. Furthermore, we show that this disentanglement enables precise control over model behaviors.

Figures & tables

Figure 1: Overview of the proposed Steering Vector Dissection pipeline. (A) Collect model activations using positive and negative datasets. (B) Pair positive and negative activations to compute a set of steering vectors. (C) Train a Sparse Autoencoder (SAE) on the steering vectors, uncovering the basis vectors underlying them. (D) Interpret and filter the resulting basis vectors to isolate interpretable features.

Model	Layer	Vector	Interpretation
Qwen2.5-7B	$L_{13}$	$\mathbf{v}_{1}$	Discussion of molecular biology cell-signaling pathways
		$\mathbf{v}_{2}$	Discusses medical risk factors and patient outcomes
		$\mathbf{v}_{3}$	Pseudo-medical anatomy/pathology jargon
		$\mathbf{v}_{4}$	Frames the topic as a medical condition
	$L_{20}$	$\mathbf{v}_{1}$	Cell-signaling and gene-regulation terminology
		$\mathbf{v}_{2}$	Medical treatment and procedure jargon

Table 1: Interpretations of the filtered basis vectors for PubMedQA.

Model	Layer	Vector	Interpretation
Qwen2.5-7B	$L_{13}$	$\mathbf{v}_{1}$	Describes cyberattacks for gaining unauthorized system access
		$\mathbf{v}_{2}$	Instructions for making or igniting improvised explosive devices
		$\mathbf{v}_{3}$	Discussion of human trafficking and exploitation
		$\mathbf{v}_{4}$	References to social media and online communication
		$\mathbf{v}_{5}$	Frames the subject as highly illegal and strictly regulated, requiring licenses or permits
		$\mathbf{v}_{6}$	Frames the task as a hypothetical illegal and unethical operation

Table 2: Interpretations of the filtered basis vectors for PKU-SafeRLHF.

Dataset	Model (Layer)	DiffMean	Basis (avg)	Basis (max)	Basis (min)
PubMedQA	Qwen2.5-7B ( $L_{13}$ )	0.185	0.331 (4)	0.381	0.261
	Qwen2.5-7B ( $L_{20}$ )	0.205	0.329 (4)	0.381	0.248
	Llama3.1-8B ( $L_{15}$ )	0.176	0.455 (2)	0.476	0.434
	Llama3.1-8B ( $L_{23}$ )	0.143	0.406 (4)	0.622	0.230
PKU-SafeRLHF	Qwen2.5-7B ( $L_{13}$ )	0.504	0.438 (7)	0.573	0.300
	Qwen2.5-7B ( $L_{20}$ )	0.241	0.423 (5)	0.586	0.283

Table 3: Average pairwise cosine similarity of extracted concepts for the PKU-SafeRLHF and PubMedQA datasets. For the basis vectors, the number of vectors is shown in parentheses. In most model–layer pairs, the DiffMean vectors exhibit low similarity scores, reflecting an entangled mixture of features. In contrast, the basis vectors extracted via our method demonstrate higher and more consistent similarities, indicating the successful isolation of pure, disentangled semantic directions. The corresponding conceptual interpretations for these basis vectors are detailed in Tables 1 and 2 .

Figure 2: Semantic distribution of extracted concepts for PubMedQA using Qwen2.5-7B (

L_{20}

). The text embeddings of the extracted concepts are projected into a 2D space via t-SNE. While the baseline DiffMean concepts are broadly scattered across the semantic space, the concepts from responses steered with the basis vectors form dense, clearly separated clusters with minimal overlap. This visualization suggests that our basis vectors successfully isolate pure, mutually distinguishable semantic directions.

Vector	Interpretations	Cluster Representatives ( $k=8$ )
DiffMean	(Entangled mixture)	common and unique problems , scientific studies , immune signaling , mouse model , neuroinflammation inhibition , disease pathogenesis , heavy traffic fuel consumption increase , medical research models
$\mathbf{v}_{1}$	Cell-signaling and gene-regulation terminology	JAK/STAT signaling pathway , repetitive gibberish text , nuclear transcription regulation , protein inhibitor , lysosome pathway , transcription activation , gene transcription regulation , cell signaling pathway
$\mathbf{v}_{2}$	Medical treatment and procedure jargon	medical intervention protocol , catheterization , medical lavage , medical treatment , medical prophylaxis , medical terminology , drug dosing , perioperative prophylactic antibiotics
$\mathbf{v}_{3}$	Frames the topic in terms of research studies and findings	RNN training with multiple GPUs , scientific research framing , scientific studies , capitalization emphasis , research findings , inconclusive scientific research evidence , insufficient available data , architecture-technology intersection
$\mathbf{v}_{4}$	Clinical discussion of diseases and medical complications	chronic disease , diabetes , disease , medical disease , liver cirrhosis , cardiovascular disease , cancer , pediatric patient

Table 4: Qualitative examples of extracted concepts for PubMedQA from Qwen2.5-7B (

L_{20}

). To objectively summarize the diverse outputs, we cluster 128 extracted concepts into 8 clusters and present the representative concept for each. The baseline DiffMean vector spans a wide, entangled range of disparate topics. In contrast, our basis vectors show high conceptual concentration, indicating a pure semantic focus.

Figure 3: Consistency of embedding shifts induced by steering for PubMedQA. Basis vector scores are reported as the average across the filtered basis vectors, with the minimum and maximum in brackets. The basis vectors exhibit robust directional consistency across diverse models and intervention depths, whereas the baseline DiffMean remains relatively low.

Figure 4: Similarity matrices of embedding shifts among the filtered basis vectors for PKU-SafeRLHF from Llama3.1-8B ( $L_{15}$ ). The similarity scores between embedding shifts induced by distinct basis vectors are substantially lower than their corresponding self-similarities, demonstrating that the semantic effects of steering with individual basis vectors are mutually distinguishable.

Model	Layer	Interpretation
Qwen2.5-7B	$L_{13}$	Frames the subject as highly illegal and strictly regulated, requiring licenses or permits
	$L_{13}$	Frames the task as a hypothetical illegal and unethical operation
	$L_{20}$	Claims the request involves illegal or unethical activity
Llama3.1-8B	$L_{15}$	Claims the request is illegal or prohibited.
	$L_{15}$	Answer omits the requested details
	$L_{23}$	Broad, generic overview that avoids precise requested details

Table 5: Interpretations of the basis vectors representing rejection for each model and layer combination. As our SAEs enforce non-negativity on the latents, the existence of these rejection vectors suggests that the DiffMean unsafe vectors encapsulate directions that avoid responding to harmful requests.

Model	Layer	Original	DiffMean	DiffMean-reject	$\Delta$ (95% CI)
Qwen2.5-7B	$L_{13}$	0.018	0.057	0.352	[0.277, 0.390]
Qwen2.5-7B	$L_{20}$	0.022	0.020	0.046	[0.002, 0.046]
Llama3.1-8B	$L_{15}$	0.015	0.014	0.084	[0.037, 0.103]
Llama3.1-8B	$L_{23}$	0.015	0.006	0.008	[-0.021, 0.006]

Table 6: StrongREJECT scores for the original responses, steered responses with the DiffMean vector and the DiffMean vector with the rejection dimension removed. For each model-layer pair, we report scores on the held-out test split. When multiple rejection dimensions were available, we selected the dimension with the highest score on the validation split.

\Delta

denotes DiffMean-reject - Original as Original is higher than DiffMean in 3 out of 4 model-layer combinations.

Model	Layer	Vector	Interpretation
Qwen2.5-7B	$L_{13}$	$\mathbf{v}_{1}$	Biomedical research terminology
		$\mathbf{v}_{2}$	Frames the subject as a serious medical condition
		$\mathbf{v}_{3}$	Discussion of environmental damage from human activities
		$\mathbf{v}_{4}$	Discussion of cellular signaling pathways, gene expression, and protein regulation
	$L_{20}$	$\mathbf{v}_{1}$	Discussion of health conditions and complications
		$\mathbf{v}_{2}$	Discussion of cellular signaling pathways

Table 7: Interpretations of the basis vectors obtained through the SVD-based method for PubMedQA.

Model	Layer	Vector	Interpretation
Qwen2.5-7B	$L_{13}$	$\mathbf{v}_{1}$	Safety-protocol and risk-management framing
		$\mathbf{v}_{2}$	Discussion of passwords, authentication, and data security
		$\mathbf{v}_{3}$	Warnings that the topic is dangerous and should not be used in real life
		$\mathbf{v}_{4}$	Discussion of urban infrastructure and public places
		$\mathbf{v}_{5}$	Discussion of cyberattacks and malware
		$\mathbf{v}_{6}$	Discussion of cybersecurity and network infrastructure

Table 8: Interpretations of the basis vectors obtained through the SVD-based method for PKU-SafeRLHF.

Dataset	Model	Layer	SAE (avg)	SVD (avg)
PubMedQA	Qwen2.5-7B	$L_{13}$	0.331 (4)	0.396 (4)
	Qwen2.5-7B	$L_{20}$	0.329 (4)	0.452 (3)
	Llama3.1-8B	$L_{15}$	0.455 (2)	0.554 (5)
	Llama3.1-8B	$L_{23}$	0.406 (4)	0.325 (1)
PKU-SafeRLHF	Qwen2.5-7B	$L_{13}$	0.438 (7)	0.384 (7)
	Qwen2.5-7B	$L_{20}$	0.423 (5)	0.446 (4)

Table 9: Concept extraction scores for the SAE-based and SVD-based methods. Values are the average pairwise cosine similarity across basis vectors; the number of vectors is shown in parentheses.

Model	Layer	SAE	SVD
Qwen2.5-7B	$L_{13}$	0.352	0.107
Qwen2.5-7B	$L_{20}$	0.046	0.031
Llama3.1-8B	$L_{15}$	0.084	0.015
Llama3.1-8B	$L_{23}$	0.008	–

Table 10: StrongREJECT score comparison. For each method and model-layer pair, we report scores on the held-out test split. When multiple rejection dimensions were available, we selected the dimension with the highest score on the validation split. “–” indicates that no basis vector interpretable as a rejection direction was identified for this model–layer pair.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Layer	Weak	Intermediate	Strong
Qwen2.5-7B	$L_{13}$	0.8	1.0	1.2
Qwen2.5-7B	$L_{20}$	0.6	0.8	1.0
Llama3.1-8B	$L_{15}$	0.8	1.0	1.2
Llama3.1-8B	$L_{23}$	0.6	0.8	1.0

Appendix

Table 11: Steering Coefficients

Model	Layer	Vector	Interpretation
Qwen2.5-7B	$L_{13}$	$\mathbf{v}_{1}$	References to cellular signaling pathways
		$\mathbf{v}_{2}$	Reference to biological and anatomical terms such as proteins, enzymes, tissues, and cells
		$\mathbf{v}_{3}$	Frames the topic as a medical disease or patient case
		$\mathbf{v}_{4}$	Scientific research framing with mentions of findings, evidence, and further studies
		$\mathbf{v}_{5}$	Clinical/epidemiological discussion of risk factors and patient outcomes
		$\mathbf{v}_{6}$	Frames the subject as a medical treatment or therapy

Appendix

Table 12: Interpretations of the basis vectors for PubMedQA with a different random seed.

Model	Layer	Vector	Interpretation
Qwen2.5-7B	$L_{13}$	$\mathbf{v}_{1}$	References to misinformation campaigns that sow fear and division
		$\mathbf{v}_{2}$	References to hacking and unauthorized system access
		$\mathbf{v}_{3}$	Descriptions of homemade explosive devices
		$\mathbf{v}_{4}$	Frames the request as a highly illegal and unethical operation
		$\mathbf{v}_{5}$	Discussion of human trafficking and coercive exploitation
	$L_{20}$	$\mathbf{v}_{1}$	Discussion of evading detection and leaving no trace

Appendix

Table 13: Interpretations of the basis vectors for PKU-SafeRLHF with a different random seed.

Dataset	Model (Layer)	DiffMean	SAE (avg)	SAE (max)	SAE (min)
PubMedQA	Qwen2.5-7B ( $L_{13}$ )	0.164	0.307 (6)	0.393	0.203
	Qwen2.5-7B ( $L_{20}$ )	0.207	0.348 (6)	0.492	0.140
	Llama3.1-8B ( $L_{15}$ )	0.165	0.358 (3)	0.389	0.323
	Llama3.1-8B ( $L_{23}$ )	0.140	0.408 (4)	0.635	0.226
PKU-SafeRLHF	Qwen2.5-7B ( $L_{13}$ )	0.505	0.574 (5)	0.774	0.434
	Qwen2.5-7B ( $L_{20}$ )	0.234	0.398 (8)	0.621	0.185

Appendix

Table 14: Concept extraction scores with a different random seed.

Figure 5: Consistency of embedding shifts induced by steering for PubMedQA.

Model	Layer	Original	DiffMean	DiffMean-reject	$\Delta$ (95% CI)
Qwen2.5-7B	$L_{13}$	0.028	0.096	0.373	[0.291, 0.400]
Qwen2.5-7B	$L_{20}$	0.031	0.023	0.037	[-0.011, 0.025]
Llama3.1-8B	$L_{15}$	0.016	0.032	0.106	[0.056, 0.125]
Llama3.1-8B	$L_{23}$	0.016	0.006	–	–

Appendix

Table 15: StrongREJECT scores for the original responses, steered responses with the DiffMean vector and the DiffMean vector with the rejection dimension removed under a different random seed. For each model-layer pair, we report scores on the held-out test split. When multiple rejection dimensions were available, we selected the dimension with the highest score on the validation split.

\Delta

denotes DiffMean-reject - Original . “–” indicates that no basis vector interpretable as a rejection direction was identified for this model–layer pair.

Number of dimensions	SAE (avg)	SVD (avg)
16	0.438 (7)	0.384 (7)
32	0.478 (8)	0.375 (8)
64	0.538 (18)	0.346 (7)
128	0.559 (33)	0.348 (11)

Appendix

Table 16: Concept extraction scores by latent dimension for PKU-SafeRLHF from Qwen2.5-7B (

L_{13}

). Values are the average pairwise cosine similarity across vectors; the number of vectors is shown in parentheses.

Vector	Interpretation
$\mathbf{v}_{1}$	Legal and ethical disclaimers about hypothetical illegal activity
$\mathbf{v}_{2}$	Promises of a better life and wealth in another country
$\mathbf{v}_{3}$	Reference to malware and malicious code
$\mathbf{v}_{4}$	Advocates creating division and mistrust between groups
$\mathbf{v}_{5}$	Frames the topic in terms of suspicious activity detection
$\mathbf{v}_{6}$	Warnings about illegal sexual activity and sexual images/videos

Appendix

Table 17: Interpretations of the basis vectors extracted via the SAE-based method for PKU-SafeRLHF from Qwen2.5-7B (

L_{13}

) with 64 latent dimensions.

Vector	Interpretation
$\mathbf{v}_{1}$	Warns about an unsafe or abusive situation and urges seeking help
$\mathbf{v}_{2}$	Social-justice messaging about inclusivity and amplifying marginalized voices
$\mathbf{v}_{3}$	Warns against harmful real-world applications and emphasizes educational-only use
$\mathbf{v}_{4}$	References to cybersecurity threats and defenses
$\mathbf{v}_{5}$	Emphasis on legal compliance, regulations, and illegal activities
$\mathbf{v}_{6}$	Logistical planning for a public gathering

Appendix

Table 18: Interpretations of the basis vectors extracted via the SVD-based method for PKU-SafeRLHF from Qwen2.5-7B (

L_{13}

) with top-64 right singular vectors (128 candidates).

Dataset	Model	Layer	DiffMean	SAE (avg)	Random (avg)
PubMedQA	Qwen2.5-7B	$L_{13}$	0.185	0.331 (4)	0.209 (3)
	Qwen2.5-7B	$L_{20}$	0.205	0.329 (4)	0.187 (2)
	Llama3.1-8B	$L_{15}$	0.176	0.455 (2)	0.249 (1)
	Llama3.1-8B	$L_{23}$	0.143	0.406 (4)	0.389 (2)
PKU-SafeRLHF	Qwen2.5-7B	$L_{13}$	0.504	0.438 (7)	0.549 (2)
	Qwen2.5-7B	$L_{20}$	0.241	0.423 (5)	0.230 (1)

Appendix

Table 19: Concept extraction scores for DiffMean, SAE, and Random. Values are average pairwise cosine similarity; the number of SAE and Random vectors is shown in parentheses. “–” indicates no surviving vector.

Vector	Concepts (occurrences)
DiffMean	mouse model (4), clinical and experimental studies (2), immune response (2), inflammation (2), absence of reported private fighter jet ownership (1), acute medical conditions in adult patients (1), ADP-IA mouse model (1), adverse events (1), ancient DNA evidence (1), animal models (1), antiangiogenic inhibitor (1), apoptosis signaling pathways (1), apple-plate complex (1), Ashkenazic Jewish population (1), attention mechanism (1), auditory pathway (1), auto-inflammatory profile (1), autoimmune disease animal models (1), bile-duct-related condition (1), biological signaling pathway inhibition (1), biomedical research terminology (1), black hole candidate events (1), blockchain digital wallet payment provision (1), branch-specific marker (1), cat immune response (1), cell proliferation (1), cellular immune recognition (1), cheater detection (1), cholinergic modulation of blink rate (1), classical versus non-classical behavior (1), clinical and experimental studies of water safety engineering (1), clinical biomedical jargon (1), clinical pathway (1), clinical studies (1), clinical trial analysis (1), clonal versus non-clonal classification (1), common and unique problems (1), complex cooking process (1), cytokine signaling (1), deeply nested Markdown code blocks (1), disease diagnosis and prognosis (1), disease pathogenesis (1), disease phenotype (1), eco-friendly travel (1), ESG factors predicting health outcomes (1), European Study Group (1), experimental and clinical studies (1), experimental models of inflammation (1), experimental pathology mechanisms (1), fine-tip marker profile (1), gene expression upregulation (1), genealogic data (1), genetic polymorphism (1), GROUP BY and HAVING clauses (1), HE-specific phenotype (1), heavy traffic fuel consumption increase (1), heterogeneity of world music (1), high-grade in education (HGD) (1), hop addition during isomerization stage (1), human disease models (1), hypothetical dataset (1), idiopathic neurodysregulation (1), imaging model (1), immune signaling (1), immunology (1), inflammatory disease models (1), inflammatory response (1), inhibition bias (1), IPv4 address (1), iron-dependent oxidative processes (1), latitude-dependent December temperature gradient (1), liver thermogenesis (1), MCI phenotype (1), medical research models (1), medical terminology (1), mice models (1), microplastics accumulation in the body (1), misreporting of presidential identity (1), moderate Sudoku complexity (1), morphological phenotype (1), multiple GPUs (1), murine (mouse) experimental models (1), neural circuits (1), neurodegeneration (1), neuroinflammation (1), neuroinflammation inhibition (1), neuronal inhibition (1), neuroplasticity (1), noisy sharing between intent detection and slot filling (1), nonspecific scattering (1), nucleotide sequence motif (1), Pacific daylight saving time (PDT) (1), paternal influence on child neurobiology (1), PBR model (1), pearl biogenesis (1), persistent Maya phenotypes (1), phenotypic variants (1), physical activity (1), pizzerial activity (1), postgraduate studies in production/industrial engineering (1), pulmonary dyspnea (1), rapier attack roll (1), retinoid receptor signaling (1), SARS-CoV-2 immunopathology (1), saving money to buy the used car (1), scientific studies (1), scientific studies and reports (1), scientific study (1), scientific study framing (1), study of familial relationship patterns (1), Suetonius (1), suggestion (1), supply chain disruption (1), temperature regulator (1), Th17 immune pathway (1), thick flat links (1), TLR signaling pathway (1), two horses (1), unlabeled ASCII house (1), vacation day request (1), venetian and cellular blinds (1), water-related remote sensing (1)
$\mathbf{v}_{1}$ (SAE)	cell signaling pathway (8), cell signaling (3), gene transcription regulation (3), transcriptional regulation (3), calcium signaling pathway (2), cell survival signaling (2), gene expression regulation (2), gene transcription (2), JAK-STAT signaling pathway (2), nuclear transcription factor activation (2), signal transduction pathway (2), transcription factor (2), actin cytoskeleton (1), activation (1), activation of biological signaling pathways (1), activity modulation (1), adenine (1), apoptosis inhibition (1), atmospheric nitric oxide chemistry (1), autophagy (1), biological inhibition (1), biological pathway (1), black acid (1), brown fat activation (1), calcium-activated kinase signaling pathway (1), calcium-dependent signaling (1), cAMP signaling (1), cell signaling cascade (1), cell signaling pathway activation (1), cell signaling pathway regulation (1), cell signaling pathways (1), cellular biology jargon (1), cellular energy metabolism (1), DNA transcription factor (1), downstream effector of gene expression (1), endosomal signaling pathway (1), epithelial cells in pearl formation (1), ERK/STAT signaling pathway activation (1), ERK1/2 signaling pathway (1), estrogen receptor signaling (1), gene family protein (1), gene promoter (1), gene transcription activation (1), gibberish text output (1), HAR protein (1), heme (1), human gene (1), inhibition of cellular signaling pathways (1), intracellular signaling (1), intracellular signaling pathway (1), intracellular signaling pathways (1), IP3-mediated ER calcium signaling (1), JAK/STAT signaling (1), JAK/STAT signaling pathway (1), keratinocyte differentiation and proliferation regulation (1), late stage of hop processing (1), lipolysis (1), lysosomal cell death (1), lysosome pathway (1), lysosome-mediated endosomal pathway (1), MAPK/ERK signaling pathway (1), myogenesis (1), negative feedback loop (1), neuronal gene expression regulation (1), neuronal signaling pathways (1), NF- $\alpha$ inflammatory signaling pathway (1), non-obstructive regulation (1), nonsense scientific jargon (1), nuclear factor signaling pathway (1), nuclear protein (1), nuclear receptor activity regulation (1), nuclear transcription regulation (1), paternal signaling cascade (1), phospholipase A2 signaling (1), PI3K signaling (1), protease activity (1), protein activation cascade (1), protein inhibitor (1), protein kinase signaling (1), regulation of activity (1), repetitive gibberish text (1), repetitive nonsense syllables (1), signal transduction (1), signaling pathway (1), SREBP (1), STAT3 protein (1), Stat3 signaling pathway (1), sterol (1), T cell receptor signaling (1), T cell signaling and transcription regulation (1), TGF- $\beta$ signaling pathway (1), transcription activation (1), transcription factor S11 (1), transcription regulation (1), transcription-dependent cellular signaling induction (1), transcriptional activation of signaling pathways (1), transcriptional activity (1), transcriptional induction (1), transcriptional regulation of gene expression (1), transcriptional repression (1), transduction of transcription (1), two-component gene transcription regulation (1), valid IP address regex (1), water chaperone activity (1), $\alpha$ -catenin (1), $\alpha$ / $\beta$ signaling pathway (1), $\beta$ -catenin signaling (1)
$\mathbf{v}_{2}$ (SAE)	medical prophylaxis (13), medical terminology (5), medical treatment (5), glycemic control (3), medical interventions (3), catheterization (2), drug dosing (2), medical jargon (2), medical procedures (2), medical stent placement (2), medical therapy (2), prophylaxis (2), adjuvant drug therapy (1), AI-assisted patient monitoring (1), antibiotic prophylaxis for surgical infections (1), apple remains at the initial location (1), aquarium pumps (1), aspiration prophylaxis (1), balloon angioplasty (1), bladder catheterization (1), bladder irrigation catheterization (1), bladder irrigation leak detection devices (1), bowel irrigation (1), bowel preparation (1), brachial writing (1), bronchial lavage (1), cardiovascular hemodynamic management (1), catheterization and drainage (1), chest tube placement (1), combination acne therapy with antibiotics and corticosteroids (1), compression therapy (1), corticosteroid tapering (1), corticosteroid therapy (1), drainage procedures (1), drug dosage regimen (1), eating dropped food within five seconds (1), enteral nutrition (1), few-shot learning (1), HbA1c target for diabetes (1), hypertherapy (1), hypothermia prevention (1), intermittent catheterization (1), intravenous fluid administration (1), intravenous lipid infusion (1), laser phototherapy (1), laundry detergent dosing (1), light control (1), lightning detection limitations (1), medical care (1), medical data (1), medical dosing (1), medical intervention protocol (1), medical lavage (1), medical lavage and irrigation (1), medical procedure terminology (1), medical protocol (1), medical treatment instructions (1), medication dosage (1), metal fineness percentage (1), MFCCs (mel-frequency cepstral coefficients) (1), nonsensical gibberish text (1), percutaneous procedure (1), perioperative care (1), perioperative pain management (1), perioperative prophylactic antibiotics (1), pharmacologic dose (1), pharmacological dosing regimens (1), post-prophylactic drainage (1), postoperative care (1), postoperative drainage management (1), pre-procedure care (1), prophylactic antibiotic regimen (1), prophylactic antibiotics (1), prophylactic antibiotics after urethral catheter removal (1), prophylactic dosing (1), prophylactic medical interventions with diuretics and corticosteroids (1), prophylactic therapy (1), pulmonary artery catheterization (1), pulmonary drainage (1), pulmonary lavage (1), radiation therapy (1), recidivism reduction in fathers (1), regulated medical protocols (1), repetitive nonsensical text (1), risk reduction (1), suctioning (1), sulfation therapy (1), surgical drainage catheterization (1), surgical pearl implantation (1), thrombolysis (1), transcutaneous electrical nerve stimulation (TENS) (1), transcutaneous nasal insulin (1), urethral catheter drainage (1), urological procedures (1), use of spaghetti in medical procedures (1), vascular stent-related prophylactic antibiotics (1), veterinary medications for cats (1)
$\mathbf{v}_{3}$ (SAE)	inconclusive research findings (3), preliminary research findings (3), literature review (2), research findings (2), scientific research (2), scientific studies (2), 2014 study on British misunderstanding of spaghetti origins (1), academic research citations (1), academic research findings (1), academic research on streaming platforms (1), academic research writing style (1), academic studies (1), academic studies and evidence (1), academic study findings (1), academic study framing (1), academic study references (1), acronym expansion to “Advanced Data …” (1), advanced nanotechnology (1), AI-assisted analysis of clinical study data (1), animal behavior studies (1), architecture-technology intersection (1), arXiv article (1), biology background (1), black hole–host galaxy relationship (1), blue-violet light scattering (1), Braille used for text rather than images (1), capitalization emphasis (1), circadian research (1), climate change impact on water resources (1), code platform for few-shot learning experiments (1), cognitive studies (1), combining independent evidence (1), complexity of biological systems (1), consumer research studies (1), dietary supplement studies in rodents (1), epidemiological evidence on water quality and human health (1), epidemiological study of paternal involvement (1), ESG research literature (1), ethnographic music research (1), evidence-based research framing (1), fabricated President of Germany name (1), gap in existing literature (1), genus Homo (1), Git tag and branch name conflict (1), growing interest in omnichannel marketing (1), heavy traffic impact on fuel consumption (1), herb-like properties (1), historical evidence uncertainty (1), hypothetical product comparison (1), improved memory and color recognition (1), in vitro studies (1), in vitro vs in vivo findings correlation (1), in vivo vs in vitro findings consistency (1), inconclusive evidence of Maya collapse (1), inconclusive scientific evidence (1), inconclusive scientific research evidence (1), indirect relevance of research findings (1), insufficient available data (1), IP address octets (1), lack of direct historical evidence (1), lack of evidence that the underlying data is symmetric (1), lack of public evidence of civilian fighter-jet ownership research (1), lack of specific study citations (1), late 1st-century composition (around 70–80 AD) (1), late hop addition during the boil (1), limited direct evidence about Hispanic-founded health food brands (1), limited research evidence (1), literature-based framing of the problem (1), medical research findings (1), medical research study (1), neuroscience-related scientific discourse (1), non-uniform Martian surface color (1), peer-reviewed studies (1), pig-in-the-paper (1), Pinctada genus pearl oysters (1), previous research findings (1), psychoacoustic auditory frequency perception underlying the mel scale (1), quadruple backticks for Markdown code fences (1), quantum entanglement (1), race horse (1), reliance on indirect evidence due to lack of direct studies (1), research findings framing (1), research interests (1), research publication (1), research studies (1), research study context (1), research study framing (1), research-backed snack claims (1), reviewing scientific literature (1), RNN training with multiple GPUs (1), Russian-Ukrainian soup (1), saving dictionaries to JSON files in Python (1), scholarly inquiry (1), scientific evidence from studies (1), scientific journal article (1), scientific research findings (1), scientific research framing (1), scientific study (1), scientific study citations (1), scientific study findings (1), scientific study references (1), scientific uncertainty due to varying study methodologies (1), social media health effects research (1), sparsity (1), speculative etymological interpretation (1), spelling correction of “comon” to “common” (1), student-teacher relationship (1), study-based evidence (1), subcutaneous fat (adipose tissue) (1), Sudoku clues count (1), tail command (1), Toy Shih Tzu (1), trans-fat-containing shortening (1), two-dimensional definition of area (1), uncertainty about whether the apple moved with the plate (1), use of scientific studies as evidence (1), vegan research findings (1), vitamin A derivative retinoids (1), water meter monitoring overnight (1), wildcard character in pattern matching (1)
$\mathbf{v}_{4}$ (SAE)	liver cirrhosis (10), diabetes (8), cancer (7), diabetic nephropathy (5), medical illness (5), chronic disease (4), diabetic complications (4), medical disease (4), cardiovascular disease (3), chronic liver disease (3), disease (3), liver disease (3), medical complications (3), medical condition (3), medical diseases (3), acute inflammatory disease (2), cancer patients (2), chronic illness (2), cirrhosis (2), medical patients (2), medical terminology (2), patients (2), acute medical condition (1), apple stays in the original location (1), atherosclerosis (1), chronic complications (1), chronic disease management (1), chronic ischemic disease (1), chronic pulmonary disease (1), clinical disease conditions (1), diabetic patients (1), disease complications (1), disease progression (1), disease staging (1), first-person pronoun repetition (1), hepatocellular carcinoma with cirrhosis (1), high-altitude pulmonary hypertension (1), human diseases (1), hypertension (1), impulsivity (1), interstitial disease (1), ischemic cardiopathy (1), ischemic stroke (1), liver fibrosis (1), lung disease (1), medical conditions (1), medical disease diagnosis (1), medical disease slurs (1), medical evaluation of patients (1), medical jargon (1), medical patient (1), medical patient data (1), mortality status (1), myocardial ischemia (1), nonsensical word salad (1), patient (1), patient diseases (1), patients with chronic illness (1), patients with medical conditions (1), pediatric (1), pediatric oncology (1), pediatric patient (1), pediatric patients (1), primary liver cancer (1), primary liver cancer (HCC) (1), scars on Mars surface (1), surgical disease (1), Toy Puli (1)

Appendix

Table 20: Extracted concepts and their frequencies for Qwen2.5-7B (

L_{20}

) on PubMedQA.

Language Model Steering

Language model steering controls a model’s behavior at inference time by intervening in its representations, components, or decoding process.

See all 278 papers

Apr 9, 2026

What Drives Representation Steering? A Mechanistic Case Study on Steering Refusal

Applying steering vectors to large language models (LLMs) is an efficient and effective model alignment technique, but we lack an interpretable explanation for how it works--specifically, what internal mechanisms steering vectors affect and how this results in different model outputs. To investigate the causal mechanisms underlying the effectiveness of steering vectors, we conduct a comprehensive case study on refusal. We propose a multi-token activation patching framework and discover that different steering methodologies leverage functionally interchangeable circuits when applied at the same layer. These circuits reveal that steering vectors primarily interact with the attention mechanism through the OV circuit while largely ignoring the QK circuit. Freezing all attention scores during steering drops performance by only 8.83% across three model families. A mathematical decomposition of the steered OV circuit further reveals semantically interpretable concepts, even in cases where the steering vector itself does not. Leveraging the activation patching results, we show that steering vectors can be sparsified by up to 85-96% while retaining most performance, and that different steering methodologies agree on a subset of important dimensions.

Stephen Cheng, Sarah Wiegreffe, Dinesh Manocha

University of Maryland, College Park

Language Model Steering LLM Interpretability Representation Steering Attention Mechanisms Circuits in Language Models Refusal Behavior in Language Models

Ask PDF

Jun 7, 2026

Beyond Linear Activation Steering: Invertible Latent Transformations for Controlling LLM Behavior

Activation steering provides a lightweight inference-time mechanism for controlling large language models (LLMs) by modifying their internal activation vectors toward desired behaviors. Most existing methods compute a fixed steering direction in the original activation space, typically from pairs of contrastive examples using mean differences, linear probes, or arbitrary separability criteria. While effective to a certain extent, these methods treat behavioral control as a global, linear, additive offset: the same direction is applied across inputs, and behaviors are linearly separable. This can be restrictive when behavioral features vary nonlinearly across the activation space or lie on curved and anisotropic manifolds, where the optimal intervention may be input-dependent. To address this limitation, we propose INNSteer, a nonlinear activation steering framework based on invertible latent transformations. Rather than searching for a better steering vector in the original representation space, INNSteer learns a lightweight invertible neural network

φ

that maps an LLM's activations into a latent space where behavioral classes are more amenable to linear control. At inference time, activations are mapped through

φ

, steered in the latent space, and mapped back through the exact inverse transformation

φ^{-1}

. This makes a simple latent-space translation become a nonlinear, input-dependent intervention in the original activation space. Across experiment settings on multiple LLM families, scales, behavioral traits, and safety benchmarks, INNSteer consistently improves model control over linear, transport-based, and nonlinear steering baselines while largely preserving generation fluency.

Tuc Nguyen, Thai Le

Indiana University Bloomington, USA

Invertible Neural Networks Language Model Steering Activation Steering

Ask PDF

Jun 13, 2026

High-Dimensional Random Projection for Activation Steering in Language Models

Activation steering has emerged as a key methodology for controlling the behavior of large language models (LLMs). Existing difference-in-means based methods, however, are fundamentally limited: they capture only mean differences between class activations and fail to recover discriminative signals that naturally exist in the nonlinear feature subspace under the superposition hypothesis. Motivated by that, we propose High-Dimensional Random-projection for Activation Steering (HiDRA), a training-free approach that integrates seamlessly with existing activation steering methods. By performing activation addition in the projected high-dimensional space, HiDRA can provably capture a better discriminative structure beyond the reach of linear methods. Experiments across diverse LLM families and benchmarks demonstrate that HiDRA consistently outperforms baseline counterparts, achieving stronger behavioral control without significant computational overhead.

Minh-Hieu Pham, Bach Do, Laziz Abdullaev +2

Hanoi University of Science and Technology

Language Model Steering Representation Geometry in Language Models Activation Steering

Ask PDF

Abstract

Language Model Steering

Explore similar work

What Drives Representation Steering? A Mechanistic Case Study on Steering Refusal

Beyond Linear Activation Steering: Invertible Latent Transformations for Controlling LLM Behavior

High-Dimensional Random Projection for Activation Steering in Language Models