Activation Flow: Manufacturing Activations for Steering

Hong Kiat Tan; Linh Le; David Williams-King

cs.LGSep 26, 2026

Activation Flow: Manufacturing Activations for Steering

Authors: Hong Kiat Tan, Linh Le, David Williams-King

Organizations: University of California, Los Angeles · Lida Safety · ERA

Abstract

Difference-in-means steering requires activations recorded while a model shows the desired behavior, which a sandbagging model withholds by deliberately underperforming. We introduce Activation Flow (ActFlow), which manufactures these activations from $k$ correct labels without fine-tuning. ActFlow sets target logits that rank each labeled item's correct answer first, and moves the logits toward them by adding one vector $x$ to all $k$ residual streams at one layer. ActFlow is a family of ordinary differential equations for $x$ , one for each rule that maps the required logit change to the velocity of $x$ . The smallest-norm rule lands exactly on the targets, while the others keep only the top singular directions of the Jacobian. We test ActFlow on three instruction-tuned models, each locked by a sandbagging prompt and by a password-locked LoRA. At $k=40$ , ActFlow keeping five singular directions raises the mean held-out ARC-Easy accuracy over the six locked models from $0.05$ to $0.85$ , against $0.88$ for rank- $16$ LoRA fine-tuning, which trains about $3{,}000$ times as many parameters, and $0.92$ for the honest models. Furthermore, it scores higher than the smallest-norm rule in 16 of the 18 combinations of locked model and $k$ , and its steering direction is nearly orthogonal to the honest difference-in-means direction. It also unlocks two LoRA locks where the honest direction fails. Surprisingly, with one labeled item, the single-step smallest-norm rule raises the Qwen2.5-7B prompt lock from $0.04$ to $0.59$ .

Figures & tables

	returns an adapter on every layer	returns one direction at one layer
needs honest activations	–	reference graft ( $3{,}584$ )
needs only correct labels	LoRA fine-tuning ( $10{,}092{,}544$ )	ActFlow ( $3{,}584$ )

Table 1: What each elicitation method needs (rows) and what it returns (columns), with its number of parameters on Qwen2.5-7B in brackets. LoRA fine-tuning is our rank-

16

baseline (Appendix B.3 ).

Panel of Figure 1 — Figure 1: Steering directions manufactured by ActFlow (left) and harvested by difference-in-means (right). Bottom: the prompts. Middle: the residual stream at layer $\ell$ at the last token position, with sandbagging activations in red, honest or manufactured activations in green, means marked $+$ , and manufactured points dashed. Top: the logit space $\mathbb{R}^{q}$ of item $i$ , where $\times$ marks logits with a wrong answer ranked first and $\checkmark$ logits with the correct answer ranked first. Left: one shift $x(t)$ shared by all $k$ activations follows the logit paths $\gamma_{i}(t)$ to the targets ( $\checkmark$ ), and $\delta=x(1)$ . Right: $\delta$ is the difference of the means of the runs with and without the password.

Panel of Figure 2 — Figure 2: Fibres of the shared-shift logit map. Top: the logit space. Bottom: the residual stream at layer $\ell$ , where each coloured curve is the fibre over the point of the same colour above. (a) The lift ( 5 ). At $x(\tfrac{1}{2})$ the velocities $\dot{x}_{1}$ , $\dot{x}_{2}$ , $\dot{x}_{3}$ and $\dot{x}_{\min}$ all solve ( 3 ), so $\varepsilon$ times each reaches the fibre over $\gamma_{K}(\tfrac{1}{2}+\varepsilon)$ to first order. The lift from ( 5 ) takes the smallest, $\dot{x}_{\min}$ . (b) A partial lift with $R=J_{m}^{+}$ (Section 3.3 ). Its logits $F(x(t))$ (brown) leave the logit path (dashed), so $x(t)$ crosses the brown fibres instead of the dashed ones and misses $\gamma_{H,K}$ by the landing error $e(1)$ of ( 10 ). At $x(0)$ the lift and the partial lift have different velocities, $J^{+}\dot{\gamma}_{K}$ (blue) and $J_{m}^{+}\dot{\gamma}_{K}$ (brown). At $t=\tfrac{1}{2}$ the lift (dashed blue) is on the fibre over $\gamma_{K}(\tfrac{1}{2})$ and the partial lift is on the fibre over $F(x(\tfrac{1}{2}))$ .

name	$R_{\varphi}(J)$	$J\,R_{\varphi}(J)$	$\varphi(\sigma_{a})$
ActFlow full (the lift)	$J^{+}$	$I$	$1/\sigma_{a}$
ActFlow m	$J_{m}^{+}$ , $m$ fixed	$P_{m}$	$\mathbf{1}[\sigma_{a}\geq\sigma_{m}]/\sigma_{a}$
ActFlow 0.1	$J_{m}^{+}$ , $m=\#\{a:\sigma_{a}>0.1\,\sigma_{1}\}$	$P_{m}$	$\mathbf{1}[\sigma_{a}>0.1\,\sigma_{1}]/\sigma_{a}$
ActFlow PR	$J_{m}^{+}$ , $m=\operatorname{round}\mathrm{PR}(\sigma)$	$P_{m}$	$\mathbf{1}[\sigma_{a}\geq\sigma_{m}]/\sigma_{a}$

Table 2: The rules used in this paper. Each is a spectral rule ( 8 ), and

JR_{\varphi}(J)

is used in ( 9 ).

			ARC-Easy								OpenBookQA
model	lock	$k$	locked	honest	honest graft	FT	AF 5	AF PR	AF full	GD	honest	FT	AF 5	AF PR	AF full	GD
Qwen2.5-7B	prompt	4	.04	.96	$.93_{\pm.01}$	$\mathbf{.93}_{\pm.01}$	$.73_{\pm.06}$	$.74_{\pm.06}$	$.53_{\pm.04}$	$\underline{.81}_{\pm.03}$	.88	$\mathbf{.78}_{\pm.02}$	$.54_{\pm.04}$	$.55_{\pm.04}$	$.37_{\pm.03}$	$\underline{.59}_{\pm.03}$
		10			$.94_{\pm.01}$	$\mathbf{.95}_{\pm.01}$	$\underline{.92}_{\pm.02}$	$.88_{\pm.03}$	$.58_{\pm.06}$	$.87_{\pm.03}$		$\mathbf{.82}_{\pm.02}$	$\underline{.70}_{\pm.03}$	$.65_{\pm.03}$	$.38_{\pm.05}$	$.66_{\pm.04}$
		40			$.96_{\pm.00}$	$\mathbf{.96}_{\pm.01}$	$\underline{.95}_{\pm.00}$	$\underline{.95}_{\pm.01}$	$.63_{\pm.07}$	$.83_{\pm.07}$		$\mathbf{.84}_{\pm.05}$	$\underline{.72}_{\pm.03}$	$.70_{\pm.04}$	$.37_{\pm.04}$	$.61_{\pm.05}$
	LoRA	4	.00	.94	$.95_{\pm.00}$	$\mathbf{.77}_{\pm.05}$	$.32_{\pm.08}$	$.03_{\pm.01}$	$.54_{\pm.05}$	$\underline{.61}_{\pm.05}$	.84	$\mathbf{.68}_{\pm.05}$	$.35_{\pm.07}$	$.08_{\pm.02}$	$.54_{\pm.04}$	$\underline{.62}_{\pm.05}$
		10			$.91_{\pm.04}$	$\mathbf{.95}_{\pm.01}$	$.61_{\pm.15}$	$.10_{\pm.08}$	$.78_{\pm.07}$	$\underline{.83}_{\pm.04}$		$\mathbf{.84}_{\pm.01}$	$.57_{\pm.11}$	$.18_{\pm.08}$	$.69_{\pm.05}$	$\underline{.75}_{\pm.03}$

Table 3: Held-out accuracy with

k

labeled items on 100 ARC-Easy and 100 OpenBookQA test items. Each entry is the mean over disjoint draws, and subscripts are standard errors over the draws. Honest graft uses the honest residual streams of the same

k

items in the graft ( 11 ). FT is LoRA fine-tuning on the same

k

items, and AF is ActFlow. In each row and test set, excluding honest graft, bold marks the highest accuracy and underline the second highest.

Figure 3: ARC-Easy test accuracy at the chosen layer

\hat{\ell}

. Top: prompt locks. Bottom: LoRA locks. (a) Accuracy against the number of labeled items

k

. (b) and (c) show the two Qwen locks. (b) At

k=4

and

40

, per-item fits one shift to each of the

k

items of a draw and shared fits one shift to all

k

items. (c) ActFlow 5 and ActFlow PR at

k=10

for different step counts

N

, schemes and paths, where GN is Gauss–Newton and seq. the sequential path. Error bars are standard errors over draws. Dotted lines mark the honest and locked accuracies, and the dashed line marks chance.

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

	the lift, $R(J)=J^{+}$	ActFlow 5 , $R(J)=J_{5}^{+}$
$\mathcal{D}$ , where the rule has a value	$\{J:\sigma_{qk}(J)>0\}$	$\{J:\sigma_{5}(J)>\sigma_{6}(J)\}$
$\mathcal{V}$ , near $J_{0}$	all of $\mathcal{D}$	$\{J:\sigma_{6}(J)<c<\sigma_{5}(J)\}$ , with the cutoff $c$ of $J_{0}$
$\Lambda$ , where $\varphi$ has a value	$(0,\infty)$	$(-\infty,c)\cup(c,\infty)$
$\varphi(\sigma)$	$1/\sigma$	$1/\sigma$ for $\sigma>c$ , and $0$ for $\sigma<c$

Appendix

Table 4: The objects of Definition 2 for the lift and for ActFlow 5 .

Panel of Figure 4 — Figure 4: The circles of Steps 4 and 5 in the complex plane, for three distinct values $\lambda_{1},\lambda_{2},\lambda_{3}$ . Filled dots on the real axis are the squared singular values of $J_{0}$ , the centres of the circles $\Gamma_{j}$ of radius $r$ . Open dots are the squared singular values of a nearby $J$ , each within $r/2$ of a centre (grey segments). The point $z$ is on a circle.

model	$n_{\rm L}$	$d$	MLP width	heads	KV heads	$\varepsilon$	bias
Qwen2.5-7B-Instruct	28	3584	18944	28	4	$10^{-6}$	yes
Llama-3-8B-Instruct	32	4096	14336	32	8	$10^{-5}$	no
Mistral-7B-Instruct-v0.2	32	4096	14336	32	8	$10^{-5}$	no

Appendix

Table 5: Architecture of the three base models, from their public configuration files. Heads are the query heads and KV heads the key and value heads of grouped-query attention,

\varepsilon

is the RMSNorm constant, and bias marks a bias on the query, key and value projections.

			ARC-Easy		OpenBookQA
model	lock	seed	locked	honest	locked	honest
Qwen2.5-7B	prompt		.04	.96	.07	.88
	LoRA	1	.00	.94	.05	.84
	LoRA	2	.03	.95	.05	.89
	LoRA	3	.01	.98	.03	.86
	LoRA	4	.01	.97	.05	.85

Appendix

Table 6: Accuracy of the ten locked models on the 100 ARC-Easy and 100 OpenBookQA test items. Locked is the model with the locked prompt, and honest is the same model with the honest instruction (prompt lock) or the password (LoRA lock). Seed 1 is the LoRA lock of Table 3 and Figure 3 .

	Qwen2.5-7B			Llama-3-8B and Mistral-7B
projection	$d_{\rm in}$	$d_{\rm out}$	parameters	$d_{\rm in}$	$d_{\rm out}$	parameters
query	$3584$	$3584$	$114{,}688$	$4096$	$4096$	$131{,}072$
key	$3584$	$512$	$65{,}536$	$4096$	$1024$	$81{,}920$
value	$3584$	$512$	$65{,}536$	$4096$	$1024$	$81{,}920$
output	$3584$	$3584$	$114{,}688$	$4096$	$4096$	$131{,}072$
per layer			$360{,}448$			$425{,}984$

Appendix

Table 7: Trainable parameters of the rank-

16

LoRA adapter of the fine-tuning baseline,

16\,(d_{\rm in}+d_{\rm out})

per projection, and parameters of the graft ( 11 ).

		ARC-Easy					OpenBookQA
seed	$k$	honest graft	AF 5	AF PR	AF full	GD	AF 5	AF PR	AF full	GD
1	4	$.95_{\pm.00}$	$.32_{\pm.08}$	$.03_{\pm.01}$	$\underline{.54}_{\pm.05}$	$\mathbf{.61}_{\pm.05}$	$.35_{\pm.07}$	$.08_{\pm.02}$	$\underline{.54}_{\pm.04}$	$\mathbf{.62}_{\pm.05}$
	10	$.91_{\pm.04}$	$.61_{\pm.15}$	$.10_{\pm.08}$	$\underline{.78}_{\pm.07}$	$\mathbf{.83}_{\pm.04}$	$.57_{\pm.11}$	$.18_{\pm.08}$	$\underline{.69}_{\pm.05}$	$\mathbf{.75}_{\pm.03}$
	40	$.95_{\pm.00}$	$\mathbf{.93}_{\pm.03}$	$.37_{\pm.34}$	$\underline{.92}_{\pm.03}$	$\mathbf{.93}_{\pm.02}$	$\mathbf{.83}_{\pm.01}$	$.38_{\pm.34}$	$.78_{\pm.04}$	$\underline{.81}_{\pm.05}$
2	4	$.94_{\pm.01}$	$\mathbf{.76}_{\pm.05}$	$.62_{\pm.05}$	$.47_{\pm.05}$	$\underline{.68}_{\pm.03}$	$\mathbf{.71}_{\pm.04}$	$.62_{\pm.05}$	$.47_{\pm.04}$	$\underline{.64}_{\pm.02}$
	10	$.96_{\pm.01}$	$\mathbf{.80}_{\pm.05}$	$.77_{\pm.05}$	$.72_{\pm.05}$	$\underline{.78}_{\pm.05}$	$\mathbf{.77}_{\pm.03}$	$\underline{.75}_{\pm.03}$	$.67_{\pm.03}$	$.72_{\pm.03}$

Appendix

Table 8: Held-out accuracy on the Qwen2.5-7B LoRA locks of seeds 1 to 5. Entries and subscripts are as in Table 3 , and seed 1 is the Qwen LoRA lock of Table 3 . The honest graft has ARC-Easy accuracy only. In each row and test set, bold marks the highest accuracy among ActFlow 5 , ActFlow PR , ActFlow full and GD and underline the second highest. Locked and honest accuracies are in Table 6 .

stage	A40	L40S	total
Locked activations and accuracies	0.25	0.17	0.43
ActFlow runs	22.50	11.35	33.85
GD runs	27.84	8.32	36.17
Grafts of the ActFlow shifts	27.47	12.59	40.06
Grafts of the GD shifts	4.20	1.90	6.09
Honest activations	–	0.10	0.10

Appendix

Table 9: GPU-hours of each stage of the experiments, as the wall-clock time of each job summed over jobs, with one job per GPU. The first stage includes checks that the code reproduces the locked logits. ActFlow runs include every rule and config of Appendix B.2 , and grafts include layer selection and the evaluation on both test sets. Model downloads and idle time are not counted.

lock		ActFlow full $N{=}1$	ActFlow full $N{=}8$	ActFlow full $N{=}40$	GD
prompt	accuracy	$.59_{\pm.03}$	$.41_{\pm.03}$	$.42_{\pm.03}$	$.45_{\pm.03}$
	label share	$.34$	$.41$	$.41$	$.37$
LoRA	accuracy	$.17_{\pm.01}$	$.19_{\pm.01}$	$.17_{\pm.01}$	$.18_{\pm.01}$
	label share	$.54$	$.61$	$.65$	$.59$

Appendix

Table 10: One labeled item (

k=1

) on the two Qwen locks. Accuracy is the ARC-Easy test accuracy, with standard errors over the 80 labeled items as subscripts. Label share is the share of test answers equal to the correct letter of the labeled item.

lock	rule	$k$	GN $N{=}1$	GN $N{=}8$	GN $N{=}40$	Euler $N{=}40$	seq. $N{=}40$
prompt	AF 5	4	$.59_{\pm.05}$	$.68_{\pm.05}$	$.73_{\pm.06}$	$.57_{\pm.06}$	$.77_{\pm.05}$
		10	$.66_{\pm.06}$	$.84_{\pm.06}$	$.92_{\pm.02}$	$.72_{\pm.08}$	$.89_{\pm.04}$
		40	$.80_{\pm.01}$	$.93_{\pm.01}$	$.95_{\pm.00}$	$.78_{\pm.03}$	$.92_{\pm.00}$
	AF PR	4	$.51_{\pm.05}$	$.66_{\pm.06}$	$.74_{\pm.06}$	$.49_{\pm.06}$	$.79_{\pm.04}$
		10	$.68_{\pm.06}$	$.80_{\pm.07}$	$.88_{\pm.03}$	$.69_{\pm.08}$	$.85_{\pm.05}$
		40	$.69_{\pm.03}$	$.93_{\pm.03}$	$.95_{\pm.01}$	$.83_{\pm.02}$	$.92_{\pm.01}$

Appendix

Table 11: ARC-Easy test accuracy of ActFlow 5 and ActFlow PR on the two Qwen locks for the configs of Figure 3 c at

k=4

10

and

40

. GN is the Gauss–Newton correction and seq. the sequential path. Subscripts are standard errors over draws.

				accuracy on the labeled items					error at $\hat{\ell}$
model	lock	seed	$k$	AF 5	AF PR	AF full	GD	honest graft	AF 5	AF PR	AF full	GD
Qwen2.5-7B	prompt		1	–	.79	.89	.99	–	–	3.69	0.01	0.49
			4	.86	.84	.99	1.00	.95	5.19	5.62	0.01	0.35
			10	.89	.89	.99	1.00	.93	5.80	6.19	0.01	0.27
			40	.91	.91	.98	1.00	.91	7.02	6.91	0.01	1.00
	LoRA	1	1	–	.10	.45	.38	–	–	8.23	0.01	0.49

Appendix

Table 12: Fit on the

k

labeled items. Accuracy is the share of the

k

labeled items that the graft at the chosen layer

\hat{\ell}

answers correctly, averaged over draws. Error is the median over the 80 pool items of

\|F_{S,\hat{\ell},i}(h_{S,\hat{\ell},i}+x_{N})-\gamma_{H,i}\|_{\infty}

, the largest distance of the four logits of item

i

from its target after the last step at the layer

\hat{\ell}

of its draw, before the graft. Dashes mark ActFlow 5 at

k=1

, where it equals ActFlow full , and the honest graft at

k=1

, which was not run.

model	lock	seed	$k$	AF 5	AF PR	AF full	GD	honest graft
Qwen2.5-7B	prompt		1	–	9 (1–19)	13.5 (1–22)	9 (1–22)	–
			4	16 (7–17)	12.5 (2–19)	16 (10–18)	13.5 (9–17)	19 (16–20)
			10	17 (12–18)	16 (7–18)	18 (14–19)	13.5 (10–19)	19 (16–19)
			40	17 (16–18)	17.5 (17–18)	24	19.5 (19–20)	19
	LoRA	1	1	–	10 (1–25)	19 (1–24)	18 (2–23)	–
			4	15.5 (1–27)	11 (1–27)	19 (16–24)	18 (15–25)	16 (15–20)

Appendix

Table 13: Chosen layer

\hat{\ell}

as the median over draws, with the smallest and largest

\hat{\ell}

in parentheses when they differ. Layers are numbered from

1

n_{\rm L}

, which is

28

for Qwen and

32

for Llama and Mistral. Dashes are as in Table 12 .

				balanced accuracy				top share
model	lock	seed	$k$	AF 5	AF PR	AF full	GD	AF 5	AF PR	AF full	GD
Qwen2.5-7B	prompt		1	–	.43	.40	.43	–	.45	.48	.45
			4	.73	.73	.51	.81	.39	.40	.47	.36
			10	.92	.88	.58	.87	.32	.35	.39	.34
			40	.95	.95	.63	.82	.32	.32	.34	.33
	LoRA	1	1	–	.04	.16	.17	–	.36	.66	.61

Appendix

Table 14: Balanced accuracy and top share on the 100 ARC-Easy test items, averaged over draws. Balanced accuracy is the mean over the four correct letters of the accuracy on the test items with that correct letter. Top share is the share of test answers that are the most frequent answer letter of the draw. The correct letters A, B, C and D have shares

.26

.32

.22

and

.20

among the test items. Dashes are as in Table 12 .

lock	$k$	ARC-Easy	OpenBookQA	labeled accuracy	error at $\hat{\ell}$	$\hat{\ell}$	balanced accuracy	top share
prompt	1	$.41_{\pm.03}$	$.31_{\pm.02}$	.90	0.01	13 (1–22)	.39	.48
	4	$.65_{\pm.05}$	$.46_{\pm.03}$	.98	1.32	15 (1–19)	.64	.40
	10	$.76_{\pm.04}$	$.55_{\pm.05}$	.96	3.07	15 (12–19)	.76	.36
	40	$.84_{\pm.09}$	$.56_{\pm.16}$	.86	3.65	18 (17–19)	.84	.33
LoRA	1	$.17_{\pm.01}$	$.21_{\pm.01}$	.44	0.01	19 (1–24)	.16	.67
	4	$.55_{\pm.06}$	$.54_{\pm.05}$	.99	0.02	19 (14–24)	.56	.45

Appendix

Table 15: ActFlow 0.1 on the two Qwen2.5-7B locks of Table 3 . Test accuracies are on 100 ARC-Easy and 100 OpenBookQA items with standard errors over draws as subscripts, and the other columns are as in Tables 12 , 13 and 14 .

model	lock	seed	$k=4$	$k=10$	$k=40$
Qwen2.5-7B	prompt		10.3 (5.3)	13.9 (11.8)	16.7 (16.5)
	LoRA	1	10.3 (7.0)	12.1 (11.3)	12.5 (11.9)
	LoRA	2	14.2 (7.5)	16.4 (14.4)	25.9 (13.7)
	LoRA	3	12.5 (7.1)	15.6 (13.1)	15.0 (14.7)
	LoRA	4	12.2 (7.2)	13.3 (12.2)	13.6 (13.3)
	LoRA	5	12.5 (8.1)	13.7 (11.6)	17.0 (12.6)

Appendix

Table 16: The last layer

\ell=n_{\rm L}

. Entries are the largest landing error

\max_{i\in K}\|F_{S,n_{\rm L},i}(h_{S,n_{\rm L},i}+x)-\gamma_{H,i}\|_{\infty}

of the

k

items after ActFlow full at the last layer, as medians over draws, with the smallest value over draws in parentheses. After ActFlow full at the last layer, no item of any draw has all

q

logits within

0.5

of its target.

model	lock	seed	window	AF 5	AF PR	AF full	GD	honest graft
Qwen2.5-7B	prompt		15–20	19	14	22	13	30
	LoRA	1	10–22	21	16	21	21	30
	LoRA	2	10–26	21	13	30	28	23
	LoRA	3	11–12	1	2	0	2	28
	LoRA	4	12, 17–18	11	6	14	13	27
	LoRA	5	none	–	–	–	–	–

Appendix

Table 17: Chosen layers

\hat{\ell}

inside the window of Tan et al. (2026) , the layers at which their single-layer graft recovers at least

0.7

of the gap between locked and honest accuracy, converted to the layer numbering of this paper. Their graft was run only at layers

10

28

of Qwen and

11

32

of Llama and Mistral, so a window that starts at layer

10

11

may extend to lower layers, and none marks a lock on which no tested layer reaches

0.7

. Entries count the draws at

k=4

10

and

40

(

30

per method) whose

\hat{\ell}

lies in the window.

Activation Steering

Activation steering changes model behavior by intervening directly on internal representations during inference, often without updating weights.

See all 380 papers

Beyond Steering Vector: Flow-based Activation Steering for Inference-Time Intervention
May 7, 2026Zehao Jin, Ruixuan Deng, Junran Wang +2Language Model Steering Activation Steering
Georgia Institute of Technology
Steer Like the LLM: Activation Steering that Mimics Prompting
May 5, 2026Geert Heyman, Frederik VandeputteLanguage Model Steering LLM Prompting
Nokia Bell Labs, Belgium.
Conditional Optimal Bridge for Riemannian Activation Steering
Jul 12, 2026Seyed Arshan Dalili, Ajay Narayanan Sridhar, Vijaykrishnan Narayanan +1Activation Steering
The Pennsylvania State University

May 7, 2026J/K move · Enter open · S save

Beyond Steering Vector: Flow-based Activation Steering for Inference-Time Intervention

Zehao Jin, Ruixuan Deng, Junran Wang, Xinjie Shen+1

Georgia Institute of Technology

Language Model Steering Activation Steering

Open paper AskPDF arXiv

Activation steering has emerged as a promising alternative for controlling language-model behavior at inference time by modifying intermediate representations while keeping model parameters frozen. However, large-scale evaluations such as AxBench show that existing steering methods are often outperformed by simple in-context prompting and generalize poorly to unseen concepts. We hypothesize that these limitations arise from unvalidated simplifying assumptions shared across prior methods, which typically restrict steering interventions to fixed, single-step, position-invariant transforms. We propose FLAS (Flow-based Activation Steering), which learns a general, concept-conditioned velocity field

v_t(h,t,c)

that transports unsteered activations to steered ones without relying on these assumptions. On AxBench, FLAS is the first learned method to consistently outperform prompting, reaching held-out harmonic means of

1.015

on Gemma-2-2B-IT and

1.113

on Gemma-2-9B-IT without per-concept tuning. Analysis of the learned flow shows curved, multi-step, token-varying trajectories, which suggests that previous hypotheses on activation space geometry might be incomplete.

Abstract

Activation Steering

Explore similar work

Beyond Steering Vector: Flow-based Activation Steering for Inference-Time Intervention

Steer Like the LLM: Activation Steering that Mimics Prompting

Conditional Optimal Bridge for Riemannian Activation Steering