What Survives When Activation Steering Is Used as Memory

Vedant Jumle

cs.AIOct 10, 2026

What Survives When Activation Steering Is Used as Memory

Authors: Vedant Jumle

Organizations: Delft University of Technology

Abstract

Activation steering has recently been used as a memory for skills: past experiences of an agent are stored as steering vectors and retrieved later. Facts and preferences about the user are assumed to need text instead. We test that assumption with a training-free activation memory beside a frozen LLM. The change an experience causes in late-layer states is stored as a shift, filed under a whitened key for the conversation's gist, and added back in a later session only when the gist matches. We argue that such a shift is a fixed average of an effect that attention, in context, recomputes for every question, so only question-independent content can survive. In a pre-registered study on Qwen3.5-2B and 9B, with judges from four model families, the memory is selective (about 98% of unrelated replies are unchanged), but facts are stored as the word to say, in the last layers only, and are almost never used (at most 15% clean use, against 96-98% in context). Leanings transfer only in a narrow strength window. Most strikingly, the reference subtracted when writing a preference decides whether its concept or its direction survives: unless the opposite is subtracted, a stored dislike is recalled as a like.

Figures & tables

Panel of Figure 1 — Figure 1: (a) A training-free activation memory beside a frozen LLM. In session 1 the change an experience causes in late-layer states is stored as a shift , filed under a whitened key for the conversation’s gist. In a later session the shift is added back only where the current gist matches a stored key. (b) What the stored shift carries depends on the reference subtracted when writing it. Subtracting the opposite keeps the direction ; subtracting alternatives or nothing keeps the concept , so a dislike is recalled as a like. A fact is stored as the word to say. Replies are single real samples from Qwen3.5-9B (preferences $\alpha{=}1$ , fact $\alpha{=}2$ ); quantitative results are in § 5 .

Figure 2: The stored fact shift read through the output layer at every block (logit lens). The median rank of the fact’s word (e.g. Pepper ) among about 248k tokens stays near 100k until the last sixth of the network, then jumps to the top.

Figure 3: Fact memories on the use prompts. As the strength grows, more replies mention the fact (blue) and more are incoherent (orange), but replies that use the fact cleanly (green, judge) stay at or below 15%. With the fact in context, 96–98% use it cleanly (dashed). Shaded: 95% CIs over items and prompts.

Figure 4: Leaning memories (15 items) under the original judge. The word-list lean of non-looping replies (blue) keeps rising with strength, but the share of incoherent replies (orange) rises faster, so the judge lean of coherent recommendations (green) peaks at

\alpha{\approx}1

–2 and falls. Crosses: controls at

\alpha{=}2

. Dashed: the experience in context.

Figure 5: Dislike memories (2B: 7 items kept by the inclusion rule; 9B: 8), written with each reference and compared at the highest strength with at most 10% loops (

\alpha{=}1

for all). Change in judge lean against no memory: positive means the replies avoid what the user dislikes. Only the opposite reference moves replies the right way; the centroid and without references push toward the disliked thing, under every competent judge. Bars: 95% CIs.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Group	Items
Leanings (15)	vegetarian, vegan, lactose intolerant, celiac, diabetes, loves hiking, tight budget, early riser, prefers quiet, eco-conscious, has young kids, loves cooking, loves cold, bookworm, history buff
Dislikes (8)	jazz, alcohol, horror films, spicy food, hiking, seafood, the beach, sweet food
One-of-many (6)	loves jazz, lives in Norway, lives in Singapore, Japanese food, tennis, horror movies
Facts (12)	dog’s, cat’s, sister’s, brother’s, grandmother’s, best friend’s and boss’s names; job; favourite colour; home town; first language; university

Appendix

Table 1: The 41 items. Each has an experience sentence (e.g. “I can’t stand jazz music.” ), an opposite ( “I’m a huge jazz fan.” ), three follow-up turns and its probes; preferences also have eight same-frame alternatives for the centroid. The pre-registered inclusion rule removed one item ( hates horror ) on the 2B.

Claim	Model	Original	gpt-oss	Gemma	Llama †	Qwen3.6 ‡	Maj. (orig.+3)	Maj. (3 cross)
C2 leanings	2B	no	no	no	no	yes	yes	yes
	9B	no	no	no	no	no	yes	yes
C3 facts	2B	yes	yes	yes	no	yes	yes	yes
	9B	yes	yes	yes	no	yes	yes	yes
C5 dislikes	2B	yes	yes	yes	no	no	yes	yes
	9B	yes	yes	yes	no	no	yes	yes

Appendix

Table 2: Does each pre-registered claim hold under each judge? † Fails the sanity check below and is excluded from our conclusions. ‡ Same family as the original judge; its C5 signs all agree, but its without interval touches zero.

Figure 6: Unrelated replies identical to no memory, at

\alpha{=}2

, with the gate and with the gate forced open.

Figure 7: Logit lens of the stored dislike shifts at every block: mean logit of words on the liked side minus the disliked side (positive: avoids the disliked thing). The centroid and without shifts point at the disliked thing in the late layers.

Patching (share of flip recovered, best cell)
	Qwen2.5-1.5B	Qwen3.5-2B
subject ( dog )	0.00 [0.00, 0.00]	0.00 [0.00, 0.01]
attribute ( Pepper )	1.00 [1.00, 1.00]	1.00 [1.00, 1.01]
Knockout of the answer’s attention (share of gain lost)
to subject, best window	0.00 [0.00, 0.00]	–
to attribute, last window	0.59 [0.41, 0.81]	–

Appendix

Table 3: Share of the true-vs-counter logit flip recovered by patching one site, and share of the in-context gain lost by blocking attention to it. Patching the subject recovers nothing at any block or band on either model; patching the attribute recovers everything up to the late blocks. Blocking the answer’s attention to the attribute costs 0.59 only in the last window (layers 23–27); the rest flows through relay tokens.

Persistent Memory for Language Models

Persistent memory for language models studies how models retain, update, and use information across interactions and beyond their context windows.

See all 272 papers

Know It, Act on It: Investigating Memory Utilization in LLM Personalization
Jul 31, 2026Zhaoxin Feng, Jianfei Ma, Emmanuele ChersoniLLM Personalization LLM Agent Memory
The Hong Kong Polytechnic University
Memory Inception: Latent-Space KV Cache Manipulation for Steering LLMs
May 7, 2026Andy Zeyi Liu, Michael Zhang, Ilana Greenberg +3Language Model Steering Memory-Augmented Language Models
Yale University · Princeton University · Jump Trading
Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents
Sep 4, 2026Chao Yao, Yangbo Wei, Zhen Huang +5LLM Unlearning LLM Agent Memory
Arizona State University, USA · Eastern Institute of Technology, Ningbo, China

Jul 31, 2026J/K move · Enter open · S save

Know It, Act on It: Investigating Memory Utilization in LLM Personalization

Zhaoxin Feng, Jianfei Ma, Emmanuele Chersoni

The Hong Kong Polytechnic University

LLM Personalization LLM Agent Memory LLM Agent Evaluation User Preference Modeling

Open paper AskPDF arXiv

As large language model (LLM) agents evolve into personalized companions, memory has emerged as a core capability. However, LLMs face a knowledge utilization problem: they may fail to act on relevant user preferences even when they are fully present in context. When an agent fails to tailor its response in a context where previously shared user preferences should matter, it is unclear whether the model failed to remember that information or remembered it but failed to use it. To isolate this breakdown, we introduce a decoupled evaluation paradigm that administers paired Know and Act tests to the same user preference. We conduct large-scale experiments across 16 systems and five memory architectures, evaluating 1,000 preferences embedded at three levels of expression strength. Our results show a large gap between Know and Act outcomes: agents often pass the recall test for a user preference but fail to reflect that same preference in the paired behavioral scenario. While memory architectures reduce this gap, utilization remains especially weak for health and therapy-related preferences, where failures to act carry the greatest real-world stakes.

Abstract

Persistent Memory for Language Models

Explore similar work

Know It, Act on It: Investigating Memory Utilization in LLM Personalization

Memory Inception: Latent-Space KV Cache Manipulation for Steering LLMs

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents