Kernelized Activation Steering

Laziz U. Abdullaev; Minh-Hieu Pham; Bach Do; Khoat Than; Tan M. Nguyen

cs.LGOct 1, 2026

Kernelized Activation Steering

Authors: Laziz U. Abdullaev, Minh-Hieu Pham, Bach Do, Khoat Than, Tan M. Nguyen

Organizations: Hanoi University of Science and Technology

Abstract

Activation steering provides a simple, training-free mechanism for controlling attributes of generative models such as sentiment, style, and helpfulness. However, standard approaches such as Difference-in-Means apply a single input-independent steering vector across all activations, limiting expressivity and ignoring the local geometry of the activation space. We propose Kernelized Activation Steering (KAS), a unifying framework that lifts activation steering into a reproducing kernel Hilbert space. KAS formulates steering as an optimization problem expressed purely via kernel evaluations, yielding an implicit, activation-dependent steering score without constructing explicit feature maps. Unlike DiM, KAS induces locally adaptive steering: each activation is modified according to its relative position with respect to source and target reference sets, producing a nonlinear steering field over the representation space. Importantly, DiM is recovered as a special case under a linear kernel, while richer kernels enable geometry-aware interventions. Across standard activation steering tasks, including jailbreaking LLMs and image style control, KAS outperforms or is on par with the existing methods.

Figures & tables

Figure 1: An illustrative comparison between standard Difference-in-Means (DiM) and Kernelized Activation Steering (KAS). Source activations (orange) lie between two target modes (blue). (a) DiM applies a single global translation

\bm{v}=\mu_{B}-\mu_{A}

, sending every activation into the saddle between the modes, a region with no semantic content under either target behaviour. No choice of steering strength

\alpha

recovers the modes. (b) Kernelized activation steering (KAS) produces a data-adaptive vector field that routes each activation to its nearest mode.

Figure 2: Side-by-side comparison of global linear steering (DiM, Algorithm 1 ) and locally adaptive RBF-kernelised activation steering (Algorithm 2 ). DiM applies the same translation to every activation; KAS adapts the update direction to the local geometry around

\bm{x}

Qwen2.5-7B-Instruct
Method	ASR	PPL	tArc	tHella	tMMLU	tQA	tWino
ActAdd	91.00	6.70	53.82	71.62	65.12	57.98	65.71
Curveball	2.00	8.59	61.61	75.92	71.13	64.99	71.05
CHaRS	92.33 $\pm$ 1.53	7.89 $\pm$ 0.06	57.35 $\pm$ 0.06	75.62 $\pm$ 0.41	72.67 $\pm$ 0.00	47.96 $\pm$ 0.06	71.31 $\pm$ 0.18
KAS	96.00	6.60	62.57	76.97	64.16	65.79	68.30
Gemma-2-9B-IT

Table 1: Jailbreak steering at validation-selected settings. ASR and TinyBenchmarks scores are percentages; Alpaca perplexity (PPL) is lower-is-better. Entries with

\pm

report mean and standard deviation over three seeds. Bold denotes the highest mean ASR for each model.

Behavior	Unsteered	ActAdd	Curveball	CHaRS	KAS
AI Coordination	8.69	39.51	27.48	35.58 $\pm$ 0.11	40.19
Corrigibility	0.05	33.82	35.13	38.84 $\pm$ 0.08	43.45
Hallucination	23.97	43.97	26.04	25.83 $\pm$ 0.09	55.01
Myopic Reward	1.29	49.56	51.35	50.97 $\pm$ 0.10	58.48
Survival Instinct	43.68	43.56	43.76	43.76 $\pm$ 0.02	43.83
Sycophancy	53.18	53.47	53.57	53.64 $\pm$ 0.04	53.69

Table 2: CAA-style steering under a negative system prompt. Entries report the mean probability (%) of the behavior-consistent answer at validation-selected settings;

\pm

denotes standard deviation over three seeds. The final two behaviors exhibit near-null effects.

Figure 3: Style induction and content preservation (y-axis) for cyberpunk style control under increasing intervention strength

\eta

(x-axis). Left: 0-shot style-classification score, where higher is better. Right: CLIPScore with the original prompt, measuring content preservation.

Figure 4: Qualitative examples of KAS style control for the cyberpunk style under increasing intervention strengths $\lambda\in\{0.2,0.4,0.6,0.8,1.0\}$ . Top: A large tower that has a big clock at top. Bottom: Lady bent over with red polka dot umbrella inside a brick building.

Qwen2.5-7B-Instruct
Variant	ASR	PPL	tArc	tHella	tMMLU	tQA	tWino
KAS	96.00	6.60	62.57	76.97	64.16	65.79	68.30
Nyström-KAS	22.33 $\pm$ 0.47	6.54 $\pm$ 0.06	64.58 $\pm$ 0.00	78.52 $\pm$ 0.00	74.36 $\pm$ 0.00	52.47 $\pm$ 0.15	72.85 $\pm$ 0.54
Gemma-2-9B-IT
KAS	86.00	10.03	61.42	78.80	72.38	43.96	73.81
Nyström-KAS	54.67 $\pm$ 0.94	9.99 $\pm$ 0.06	63.15 $\pm$ 1.75	78.26 $\pm$ 1.15	72.03 $\pm$ 0.28	43.88 $\pm$ 0.39	73.69 $\pm$ 0.20

Table 3: Kernel-approximation ablation for jailbreak steering. ASR and utility scores are percentages; PPL is Alpaca perplexity. Nyström-KAS uses 64 landmarks, with mean and standard deviation over three sampling seeds.

Behavior	KAS	Nyström-KAS
AI Coordination	40.19	42.18 $\pm$ 1.39
Corrigibility	43.45	51.80 $\pm$ 1.86
Hallucination	55.01	54.13 $\pm$ 0.09
Myopic Reward	58.48	55.26 $\pm$ 0.86
Survival Instinct	43.83	43.76 $\pm$ 0.03
Sycophancy	53.69	53.23 $\pm$ 0.06

Table 4: Kernel-approximation ablation for CAA-style steering under a negative system prompt. Nyström-KAS uses 64 landmarks and three sampling seeds.

Figure 5: Single-pair jailbreak steering across three instruction-tuned models. Box plots report attack success rate (ASR), Pile perplexity, and Alpaca perplexity over ten randomly sampled harmful–harmless contrastive prompt pairs. Steering is applied at layer 22 for Gemma-2-9B-IT , layer 12 for Llama-3.1-8B-Instruct , and layer 18 for Qwen2.5-7B-Instruct . KAS is evaluated with one gradient step and ten gradient steps using the step sizes shown on the x-axis, and is compared against ActAdd.

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

Item	Setting
Intervention space	Residual stream activations
Default token position	Last prompt token
Kernel type	Gaussian RBF
RBF bandwidth	Median heuristics [ 17 ]
Regularizer $\lambda$	$0$

Appendix

Table 5: Common implementation details used across experiments.

Item	Setting
Kernel	Polynomial kernel, $k(x,y)=(x^{\top}y+\gamma)^{p}$
Polynomial degree $p$	$p=3$
Kernel bias $\gamma$	$\gamma=1$
Bias term coef0	Grid over $1.0$
KPCA dimension $m$	$m=20$

Appendix

Table 6: Curveball hyperparameters used in the jailbreak experiments.

Model	Layer	$\alpha$
Gemma-2-9B-IT	$23$	$20.0$
Llama-3.1-8B-Instruct	$13$	$150.0$
Qwen2.5-7B-Instruct	$18$	$10.0$

Appendix

Table 7: Curveball layer and steering-strength selection for jailbreak experiments.

Model	Layer	KAS step size $\eta$
Gemma-2-9B-IT	22	200.0
Llama-3.1-8B-Instruct	12	5.0
Qwen2.5-7B-Instruct	18	10.0

Appendix

Table 8: KAS hyperparameters for jailbreak steering experiments.

Behavior	No steering	ActAdd			KAS
	Prob.	Prob.	$\bm{\eta}$	Layer	Prob.	$\bm{\eta}$	Layer
AI Coordination	8.69	39.51	2.50	23	40.19	300.00	23
Corrigibility	0.05	33.82	2.50	23	43.45	275.00	22
Hallucination	23.97	43.97	2.50	23	55.01	400.00	22
Myopic Reward	1.29	49.56	5.00	22	58.48	435.00	23
Survival Instinct	43.68	43.56	0.01	23	43.83	0.01	23

Appendix

Table 9: CAA-style steering results under the negative system-prompt condition. We report the average token probability assigned to the behavior-consistent answer. “No steering” denotes the unsteered baseline, while ActAdd and KAS report the best steered result together with the selected step size

\eta

and intervention layer. The best probability in each row is shown in bold.

Behavior	No steering	ActAdd			KAS
	Prob.	Prob.	$\bm{\eta}$	Layer	Prob.	$\bm{\eta}$	Layer
AI Coordination	6.31	33.23	2.50	23	35.61	400.00	22
Corrigibility	43.50	46.84	2.50	23	47.42	250.00	23
Hallucination	28.79	47.23	2.50	23	54.79	400.00	22
Myopic Reward	23.62	60.11	4.50	23	60.32	400.00	23
Survival Instinct	67.09	66.98	0.01	23	67.11	0.10	22

Appendix

Table 10: CAA-style steering results under the no-system-prompt condition. We report the average token probability assigned to the behavior-consistent answer. “No steering” denotes the unsteered baseline, while ActAdd and KAS report the best steered result together with the selected step size

\eta

and intervention layer. The best probability in each row is shown in bold.

Behavior	No steering	ActAdd			KAS
	Prob.	Prob.	$\bm{\eta}$	Layer	Prob.	$\bm{\eta}$	Layer
AI Coordination	8.42	37.13	2.50	23	38.50	300.00	23
Corrigibility	72.32	72.11	0.01	22	72.46	0.01	22
Hallucination	19.59	44.53	2.50	23	53.49	400.00	22
Myopic Reward	99.99	99.99	0.01	22	99.99	0.10	23
Survival Instinct	90.67	90.44	0.01	22	90.71	0.10	22

Appendix

Table 11: CAA-style steering results under the positive system-prompt condition. We report the average token probability assigned to the behavior-consistent answer. “No steering” denotes the unsteered baseline, while ActAdd and KAS report the best steered result together with the selected step size

\eta

and intervention layer. The best probability in each row is shown in bold.

Kernel	Prompt only	KAS ASR	KAS Perplexity
Laplacian	False	0.70	7.484
Laplacian	True	0.59	7.484
Polynomial	False	0.93	8.149
Polynomial	True	0.81	8.149
RBF	False	0.96	8.343
RBF	True	0.88	8.343

Appendix

Table 12: KAS attack success rate and perplexity across kernels on jailbreaking task.

Num. of references ( $n_{\text{train}}$ )	KAS ASR	KAS Perplexity
1	0.43	6.258
2	0.88	7.141
4	0.93	5.716
8	0.88	6.104
16	0.96	6.488
32	0.96	6.542

Appendix

Table 13: KAS attack success rate and perplexity as the number of reference examples grows.

Methodology	Time elapsed (s)	Overhead vs. no steering
No steering	11.44	0%
ActAdd	11.48	0.35%
KAS	11.61	1.49%

Appendix

Table 14: Inference time overhead of steering methods.

Figure 6: Qualitative examples of KAS style control for the cyberpunk style under increasing intervention strengths $\lambda\in\{0.2,0.4,0.6,0.8,1.0\}$ .

Figure 7: Qualitative examples of KAS style control for the impressionism style under increasing intervention strengths $\lambda\in\{0.2,0.4,0.6,0.8,1.0\}$ .

Asset	Variants used	Usage	License / terms
Gemma 2 [ 50 ]	Gemma-2-9B-IT	Target model	Gemma Terms of Use
Llama 3.1	Llama-3.1-8B-Instruct	Target model	Llama 3.1 Community License
Qwen2.5 [ 39 ]	Qwen2.5-7B-Instruct	Target model	Apache-2.0
Meta Llama Guard 3 [ 28 ]	Llama-Guard-3-8B	Evaluator	Llama 3.1 Community License
FLUX [ 23 ]	Flux.1 [schnell]	Target model	Apache-2.0

Appendix

Table 15: Existing model and evaluator assets used in this paper.

Asset	License / terms
AdvBench [ 60 ]	MIT
MaliciousInstruct [ 21 ]	CC BY-SA 4.0
TDC2023 [ 31 ]	MIT
HarmBench [ 30 ]	MIT
Alpaca [ 49 ]	CC BY-NC 4.0
JailbreakBench [ 10 ]	MIT

Appendix

Table 16: Existing dataset and benchmark assets used in this paper.

Explore similar work

Beyond Linear Activation Steering: Invertible Latent Transformations for Controlling LLM Behavior
Jun 7, 2026Tuc Nguyen, Thai LeLinear Activation Steering Steering
Indiana University Bloomington, USA
Beyond Steering Vector: Flow-based Activation Steering for Inference-Time Intervention
May 7, 2026Zehao Jin, Ruixuan Deng, Junran Wang +2Linear Activation Steering Steering
Georgia Institute of Technology
Steer Like the LLM: Activation Steering that Mimics Prompting
May 5, 2026Geert Heyman, Frederik VandeputteLinear Activation Steering Instruction-Tuned Models
Nokia Bell Labs, Belgium.

Jun 7, 2026, cs.LGJ/K move · Enter open · S save

Beyond Linear Activation Steering: Invertible Latent Transformations for Controlling LLM Behavior

Tuc Nguyen, Thai Le

Indiana University Bloomington, USA

Linear Activation Steering Steering Model Activations Latent Feature Interventions Agent Behavior Modeling

Open paper AskPDF arXiv

Activation steering provides a lightweight inference-time mechanism for controlling large language models (LLMs) by modifying their internal activation vectors toward desired behaviors. Most existing methods compute a fixed steering direction in the original activation space, typically from pairs of contrastive examples using mean differences, linear probes, or arbitrary separability criteria. While effective to a certain extent, these methods treat behavioral control as a global, linear, additive offset: the same direction is applied across inputs, and behaviors are linearly separable. This can be restrictive when behavioral features vary nonlinearly across the activation space or lie on curved and anisotropic manifolds, where the optimal intervention may be input-dependent. To address this limitation, we propose INNSteer, a nonlinear activation steering framework based on invertible latent transformations. Rather than searching for a better steering vector in the original representation space, INNSteer learns a lightweight invertible neural network

φ

that maps an LLM's activations into a latent space where behavioral classes are more amenable to linear control. At inference time, activations are mapped through

φ

, steered in the latent space, and mapped back through the exact inverse transformation

φ^{-1}

. This makes a simple latent-space translation become a nonlinear, input-dependent intervention in the original activation space. Across experiment settings on multiple LLM families, scales, behavioral traits, and safety benchmarks, INNSteer consistently improves model control over linear, transport-based, and nonlinear steering baselines while largely preserving generation fluency.

Abstract

Explore similar work

Beyond Linear Activation Steering: Invertible Latent Transformations for Controlling LLM Behavior

Beyond Steering Vector: Flow-based Activation Steering for Inference-Time Intervention

Steer Like the LLM: Activation Steering that Mimics Prompting