Prompting guides language model behavior through the initial context, whereas activation steering often intervenes throughout generation. A natural question is whether steering can produce effects on subsequent computation similar to those of prompting. Under fixed-state attention assumptions, we establish sufficient conditions for single- and multi-token steering to match prompt-induced attention-head outputs, and characterize how changes in input representations affect this match and its approximation error. This attention-level connection leads us to ask whether, at the behavioral level, steering can also guide subsequent generation through a brief initial intervention. We study Prefix Steering, which applies existing steering directions and operators over a short span starting at the final prompt token, with no further direct intervention afterward. We examine how intervention duration and strength jointly shape the control-capability trade-off. Across four models and five tasks, intervention over a short span, even a single token, often retains much of full steering's behavioral control while better preserving general capabilities, offering a trade-off competitive with, and in some settings better than, prompting and alternative steering-strength policies. Prefix Steering also remains effective on final-answer formatting tasks after reasoning, suggesting that a brief initial intervention can influence behavior expressed well after steering ends. These findings challenge the common practice of steering every generated token and motivate a more dynamical view of activation steering, in which a brief intervention can alter the trajectory of subsequent generation without continued intervention.
Figures & tables
Figure 1: One token can be enough. Prompting guides generation through the initial context, whereas activation steering often intervenes throughout generation. Can steering produce effects similar to prompting? We establish conditions under which steering can match prompt-induced attention outputs. This connection motivates Prefix Steering, which confines intervention to a short span starting at the final prompt token. Across our evaluations, even single-token steering often achieves a more favorable control–capability trade-off than full steering, preserving more capability at comparable behavioral control.
Figure 2: Matching geometry and attention-output error on OLMo 3 7B. Results use 100 examples. (a) Dimension of U⊥ versus the number of prompt or steered tokens. (b) Attention-output error versus distance from U⊥ for perturbations to WQh sampled from U (Sensitive) or the full projected space (Random). (c) Attention-output error versus token count for input-only steering, steering four input tokens plus generated tokens, and prompting. Lines and bands show the mean and sample standard deviation.
Figure 3: Behavioral control with Prefix Steering. Left: An illustrative response that continues as a refusal after single-token steering of the final prompt token; red marks the first subsequently generated token. Right: Control–capability trade-offs on OLMo 3 7B. Each teal point represents a steering duration with its selected strength; numeric labels indicate the number of steered tokens. Full steering, prompting, and the unsteered model are shown for comparison.
Figure 4: Steering duration and strength on OLMo 3 7B. (a) Safety on HarmBench versus capability on MMLU-Pro. Point size indicates strength; break marks indicate a compressed axis interval. (b) Attention-output error between full ( k=128 , λ=0.1 ) and single-token steering on HarmBench. Single-token strength β is normalized by the predicted matching strength β⋆ from Lemma 5 ; the dashed line at 1 marks this prediction. Line and band show the mean and sample standard deviation over 100 examples.
Figure 5: Control–capability trade-offs across four models and five tasks. Using Additive steering and COAST, we compare one- and five-token Prefix Steering with full steering, prompting, and unsteered baselines. Prefix Steering generally achieves effective control while better preserving general capabilities than full steering. Vertical axes use piecewise scaling and omit empty intervals.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Figure 7: Cosine similarity between the DiM direction and the constructed displacement r across relative layer depths in OLMo 3 7B.
Large language models can be steered at inference time through prompting or activation interventions, but activation steering methods often underperform compared to prompt-based approaches. We propose a framework that formulates prompt steering as a form of activation steering and investigates whether distilling successful prompt steering behavior into simpler, interpretable models can close this gap. Our analysis reveals that popular activation steering methods are not faithful to the mechanics of prompt steering, which applies strong interventions on some tokens while barely affecting others. Based on these insights, we introduce Prompt Steering Replacement (PSR) models that estimate token-specific steering coefficients from the activations themselves and are trained to imitate prompt-based interventions. Experiments on three steering benchmarks across multiple language models show that PSR models outperform existing activation steering methods, especially when controlling for high-coherence completions, and also compare favorably to prompting on AxBench and persona steering.
Activation steering controls language model behavior by adding directions to internal representations at inference time, but standard residual-stream steering can fail in stateful dialogue. We identify KV-cache contamination as a key failure mode: steered token states are stored and repeatedly reused, turning a local perturbation into cumulative coherence degradation. To address this challenge, we propose Gated Cropped Attention-Delta steering (GCAD), which extracts steering signals from system-prompt contributions to self-attention and applies them with token-level gating. Across persona-steering experiments, GCAD preserves trait control while substantially improving long-horizon coherence. On the main multi-turn benchmark, GCAD improves average coherence drift from -18.6 to -1.9 and raises turn-10 trait expression from 78.0 to 93.1. These results suggest that activation steering becomes more reliable when interventions follow the prompt-mediated pathways that models already use for behavioral control.
Diancheng Kang, Zheyuan Liu, Ningshan Ma +3
1Southern University of Science and Technology · University of Notre Dame · 3Massachusetts Institute of Technology
Activation steering controls language models by adding vectors or features to hidden states at inference time, but the upstream source of these steering signals is often treated as a secondary detail. We study this source choice as activation source selection: the combination of source context and activation readout policy used to collect the hidden states from which a steering signal is built. Holding the downstream intervention fixed, we show across three instruction-tuned models and four steering task families that changing only the source activations substantially changes steering success. We further find that effective steering is not explained simply by whether the desired behavior appears in the source text. Instead, strong signals come from execution-boundary states, where the model is about to produce or continue the target behavior. This pre-/post-realization distinction explains why answer-based sources sometimes work: their useful component aligns with execution-boundary directions rather than target appearance alone. Building on this view, we introduce tail subtraction, which removes shared prompt and continuation semantics from boundary states and yields cleaner, more stable steering signals. Overall, our results suggest that steering depends on representations of what the model is about to do, not merely on what has already appeared.
Jiaran Ye, Lingxu Ran, Zijun Yao +5
1MOE Key Laboratory of Computational Linguistics, Peking University · Department of Computer Science and Technology, Tsinghua University · 6YiXin-AILab, YIXIN, Beijing, China +3