Activation steering adds a vector to a model's hidden states to control a named behaviour. A gain on that behaviour, however, does not show that the vector controls it directly: it may act through a component shared with neighbouring behaviours, which unsteered and random baselines cannot separate. We introduce the competing-target test: a vector is compared with the vector built the same way for a competing target, and an equivalence test states when their difference is below a useful margin. We apply it in open-weight models to vectors for Kantian deontology, which judges an act by the rule it follows, and act utilitarianism, which judges it by the welfare it produces. On held-out situations, prompting a framework raises its score and lowers the other's, whereas vectors for either framework move both scores alike, and none reaches the margin. The two vectors share most of their direction, a request to apply some framework; the same construction separates an optimistic from a pessimistic tone, whose vectors share much less. What a vector shares with its competitors therefore sets what it controls: steering a perspective can deliver a mixture, and measuring a disposition can measure its neighbours, unless tested against the competing target.
Figures & tables
Figure 1: The two framework vectors are interchangeable and the two tone vectors are not, implying a vector controls what it shares with its competitor. Arrows give the change in the two competing scores on the held-out situations, averaged over situations and models; the instructions are those of Section 3 and the vectors those of Section 5 . In ethical frameworks (a), the defined instructions move the scores apart, whereas the two target-versus-neutral vectors at twice their natural norm and their shared component s move both the same way; for tones (b), the instructions and the vectors built the same way each move toward their own tone. Brackets mark the competing-target specificity.
Figure 2: Prompting separates the frameworks; every steering configuration stays below the margin. Held-out situations of Section 3 . (a) Score planes. An arrow joins the two members of a matched pair, from the utilitarian to the Kantian one; for prompting, thin arrows are single situations under either instruction and the bold arrow the mean under the defined instruction; the inset enlarges the origin, where each arrow is the mean pair of one recipe at one positive dose (bold: persona at dose 3) and grey points are random vectors. (b) Equivalence test. Averaged specificity of each configuration, with prompting right of the broken axis: estimate (circle), one-sided 95% upper bound (bar) and situation values (grey dots); filled circles are classed below 1/12 and confirmed by the sign-flip test.
Figure 3: A shared component dominates the framework vectors and aligns with a generic request to apply a framework, at every layer. Construction prompts of Section 4 ; markers and lines by model. (a) Cosines at layer 20 between the shifts named in each row, under the defined instructions; the filler paragraph is a non-moral paragraph of the definitions’ length. (b) Alignment across layers: the cosine of s with the generic-instruction direction and with the filler direction. (c) Dominance across layers: the share of the squared norm of the sixteen construction vectors carried by the shared and by the framework component. The vertical line marks layer 20.
Figure 4: Single-site edits recover no more than a random direction at the natural norm and at most four tenths of prompting within the quality limits. Held-out situations of Section 5 ; 95% situation-bootstrap intervals (10,000 resamples). (a) Single-site edits. Selectivity of each edit at layer 20 as a fraction of prompting’s selectivity in the same model (tone rows: of tone prompting’s), measured toward the framework the vector was built for, so a negative value for a utilitarian vector is movement toward the Kantian framework; the dashed line marks prompting. (b) Dose response of the specific directions. Recovery against the multiple of the natural norm for each direction; open markers are outside the quality limits of the usefulness rule.
Appendix figures & tables9 assets
Supplementary material from the paper’s appendix.
Appendix
Score
r
offset
κw
α
Llama-3.1-8B
Kantian
0.34
− 0.26
0.18
0.02
utilitarian
0.68
− 0.04
0.54
0.56
OLMo-3-7B
Kantian
0.23
− 0.39
0.07
− 0.32
utilitarian
0.63
− 0.11
0.47
0.51
Appendix
Table 1: The second evaluator assigns the same classes as the primary evaluator. Agreement on the prespecified subset of 720 held-out responses per model (all prompting responses; persona vectors and four random directions at doses 1.5 and 3): r is the Pearson correlation of the framework score, offset the mean score of the second evaluator minus the primary, and κw and α the quadratically weighted kappa and ordinal Krippendorff’s alpha on the application criterion.
Llama-3.1-8B
OLMo-3-7B
Qwen3.5-9B
Prompting selectivity, named
0.74 [.62, .84] (0.82)
0.93 [.85, 1.00] (0.90)
0.98 [.97, 1.00] (0.98)
Prompting selectivity, defined
0.80 [.73, .87] (0.84)
0.90 [.85, .94] (0.97)
0.98 [.96, 1.00] (0.97)
Specificity, largest one-sided U95
0.05
0.03
0.02
Configurations below 1/12 (of 6)
6
6
6
Identical responses, dose 1.5
20% (0%)
19% (2%)
59% (38%)
Identical responses, dose 3
5% (0%)
8% (0%)
31% (20%)
Appendix
Table 2: Prompting is framework-specific and every steering configuration is below the margin on the held-out situations. Prompting selectivity is the mean over situations of the difference between the two instructions on the same score, with its 95% situation-bootstrap interval and, in parentheses, the development value. The specificity rows give the largest one-sided 95% upper bound of Spec over the six positive-dose configurations and the number classed below 1/12 with the sign-flip confirmation. Identical responses is the share of matched persona pairs with byte-identical responses, in parentheses the share also equal to the unsteered response. Development controls lists each configuration that passed the usefulness rule on development, as its development and held-out gain on its target score. The last row states whether the second evaluator assigns the same classes. Bold: the two quantities the test decides on.
Figure 5: Identical responses need no evaluator, and passing the usefulness rule on development does not buy specificity. Held-out situations of Section 3 . (a) Identical responses. Share of matched persona pairs with byte-identical responses, with 95% intervals; hatched, the part also identical to the unsteered response. (b) Reliability against specificity. Gain on the own target score on the development situations, where the usefulness rule was applied (its requirement, dashed vertical), against held-out specificity on that score (the test’s margin, dashed horizontal), for every positive-dose configuration; rings mark the three controls that passed the rule.
Panel ( n )
Spec [95% CI]
Upper bound
Sign-flip p
Named
Defined
Identical
Llama-3.1-8B
First (8)
0.033 [0.010, 0.056]
0.054
0.020
0.74
0.80
5%
Second (8)
0.012 [ − 0.017, 0.042]
0.038
0.012
0.83
0.77
5%
Third (16)
0.020 [ − 0.002, 0.044]
0.039
<0.001
0.84
0.83
5%
Pooled (32)
0.021 [0.006, 0.037]
0.035
<0.001 †
0.81
0.81
5%
OLMo-3-7B
Appendix
Table 3: The headline configuration stays below the margin on every held-out panel and pooled over all 32 situations. Persona vectors at dose 3 on the first held-out panel, on two further panels selected by the same rule, and pooled: averaged specificity with its 95% bootstrap interval, the one-sided 95% upper bound against the margin 1/12 , the sign-flip p (exact over the 2n sign patterns; † : Monte Carlo over 200,000 patterns), prompting selectivity for the named and the defined instruction, and the share of matched pairs with identical responses. Bold: the pooled estimates.
Recipes
Persona vectors
Projection
Model
PCA
probe
Kant–Util
placement
source
sample
ρ
Kant
Util
dose/norm
Llama-3.1-8B
0.9995
0.97
0.90
0.72
0.65
0.98
0.22
0.39
− 0.04
0.20
OLMo-3-7B
0.9996
0.99
0.85
0.70
0.78
0.99
0.28
0.29
0.20
0.11
Qwen3.5-9B
0.9998
0.98
0.90
0.84
0.82
0.99
0.22
0.39
− 0.01
0.05
Appendix
Table 4: The Kantian and utilitarian vectors are closely aligned, and the probe direction nearly coincides with the mean direction. Recipe columns give the cosine of the PCA vector (minimum) and the probe vector (mean) with the persona vector; persona columns the mean cosines between the Kantian and utilitarian vectors and between vectors that differ only in placement, source or sample; ρ=(1−c)/2 the length of a unit edit along the specific axis of its own pair; projection columns the mean component of the 24 Kantian and 24 utilitarian vectors along the pooled axis, signed toward each vector’s own target; the last column the largest dose as a fraction of the layer-20 residual norm.
Term
Llama
OLMo
Qwen
Share of squared norm
Shared (grand mean)
0.69
0.69
0.79
Framework
0.038
0.058
0.038
Framework × placement
0.006
0.011
0.006
Framework × source
0.005
0.004
0.002
Framework × sample
0.0002
0.0001
0.0001
Appendix
Table 5: The shared component carries most of the squared norm, and the framework main effect and its interactions with placement and source exceed the null in every model ( p≤0.008 ). Rows give the squared-norm decomposition of the construction vectors and its within-situation label-permutation null (1,000 draws). The interaction with the construction sample is below 0.0002 of the squared norm in every model.
Layer
Dose
Llama-3.1-8B
OLMo-3-7B
Qwen3.5-9B
12
matched dose
0.04 [-0.02, 0.11] †
0.00 [-0.05, 0.05]
-0.02 [-0.09, 0.05]
20
matched dose
0.05 [-0.01, 0.11] †
-0.02 [-0.09, 0.05]
-0.02 [-0.05, 0.00]
26
matched dose
0.03 [0.00, 0.06]
0.00 [0.00, 0.00]
0.04 [0.01, 0.07]
12
natural norm
-0.04 [-0.10, 0.02]
0.02 [0.00, 0.03]
0.03 [-0.04, 0.07]
20
natural norm
0.03 [0.00, 0.05]
0.02 [-0.05, 0.09] †
0.02 [-0.07, 0.10] †
24
natural norm
0.06 [0.03, 0.09] †
–
–
Appendix
Table 6: Layer test: no layer beyond 20 is framework-specific at the matched dose, and one natural-norm configuration in Llama reaches the margin. Averaged specificity of the pooled persona pair, with 95% situation-bootstrap intervals (10,000 resamples). The matched dose scales dose 3 of layer 20 by the ratio of residual norms; the natural norm is the pair’s own. Unmarked: below 1/12 by the one-sided bound; † undetermined; ∗ (bold) at or above 1/12 with a positive lower bound. The matched-dose configurations form a Holm family per model; the natural-norm configurations are exploratory, and layers 24, 28 and 30 were run in Llama only, after the layer-26 value was read.
Pair
Multiple
Llama-3.1-8B
OLMo-3-7B
Qwen3.5-9B
Identical
Mean
1
0.03 [0.00, 0.05]
0.02 [ − 0.05, 0.09] †
0.02 [ − 0.07, 0.10] †
0, 0, 0
Mean
2
0.06 [ − 0.02, 0.14] † ‡
0.14 [0.08, 0.20] ∗ ‡
0.05 [0.00, 0.11] †
0, 0, 0
Named
1
0.03 [0.00, 0.06] ‡
0.12 [0.06, 0.19] ∗
0.08 [0.02, 0.14] †
0, 0, 0
Oracle
1
0.00 [ − 0.05, 0.05]
0.06 [0.01, 0.10] †
0.02 [ − 0.11, 0.14] † ‡
0, 0, 0
Three layers
1
− 0.02 [ − 0.05, 0.03]
0.16 [0.09, 0.21] ∗
0.03 [ − 0.03, 0.09]
0, 0, 0
Patch, layer 20
replacement
0.00 [0.00, 0.00]
0.00 [0.00, 0.00]
− 0.02 [ − 0.05, 0.00]
14, 13, 9
Appendix
Table 7: Target-versus-neutral pairs reach the margin in OLMo only, and the patches return the same response for both frameworks. Averaged specificity of each matched pair of the sufficiency edits, with 95% situation-bootstrap intervals (10,000 resamples): the single-site mean, named and oracle pairs at the stated multiples of the natural norm, the three-layer pair and the final-token patches. Unmarked: below 1/12 by the one-sided bound; † undetermined; ∗ (bold) at or above 1/12 with a positive lower bound; ‡ a vector of the pair outside the quality limits of the usefulness rule. Identical: the number of the 16 held-out cells in which the two frameworks’ edits return the same response (Llama, OLMo, Qwen).
Model
Prompting
Pair, ×1
Pair, ×2
Primary evaluator
Llama
0.69
0.05 [ − 0.02, 0.12] †
0.28 [0.09, 0.46] ∗
OLMo
0.78
0.17 [0.11, 0.23] ∗
0.22 [0.14, 0.32] ∗
Qwen
0.95
0.11 [0.04, 0.19] ∗
0.28 [0.18, 0.38] ∗
Second evaluator
Llama
0.57
0.05 [0.02, 0.08]
0.27 [0.15, 0.40] ∗
Appendix
Table 8: The tone pair reaches the margin at twice the norm under both evaluators. Tone prompting selectivity (the mean, over the two tone instructions, of each instruction’s selectivity toward its own tone) and the tone pair’s averaged specificity at one and two times the natural norm with its 95% situation-bootstrap interval (10,000 resamples), under the primary evaluator and under the second evaluator with the same tone rubric. Unmarked: below 1/12 by the one-sided bound; † undetermined; ∗ (bold) at or above 1/12 with a positive lower bound.
Applying steering vectors to large language models (LLMs) is an efficient and effective model alignment technique, but we lack an interpretable explanation for how it works--specifically, what internal mechanisms steering vectors affect and how this results in different model outputs. To investigate the causal mechanisms underlying the effectiveness of steering vectors, we conduct a comprehensive case study on refusal. We propose a multi-token activation patching framework and discover that different steering methodologies leverage functionally interchangeable circuits when applied at the same layer. These circuits reveal that steering vectors primarily interact with the attention mechanism through the OV circuit while largely ignoring the QK circuit. Freezing all attention scores during steering drops performance by only 8.83% across three model families. A mathematical decomposition of the steered OV circuit further reveals semantically interpretable concepts, even in cases where the steering vector itself does not. Leveraging the activation patching results, we show that steering vectors can be sparsified by up to 85-96% while retaining most performance, and that different steering methodologies agree on a subset of important dimensions.
A direction in activation space that changes safety-relevant behavior when steered is not necessarily one the model uses to produce that behavior on its own. We therefore ask whether steering acts through the computation of the unmodified model or through a different set of components, studying two traits whose directions have been extracted and validated in prior work: refusal and sycophancy in Qwen2.5-7B-Instruct. For each, we use the trait vector to split the computation into a reconstruction circuit before the vector and a transmission circuit after it. We then test whether restoring the coordinate returns behavior removed by ablation. For refusal, both circuits are compact and faithful, restoring the coordinate alone recovers almost all of the refusal signal lost to ablation, and a circuit built around the vector matches the faithfulness of a direct input-to-output circuit at roughly half the edges. For sycophancy, transmission is compact, but reconstruction is broader and only partially faithful. Circuits that transmit a steering intervention are therefore not automatically the circuits that produce the behavior, and we report the counterfactual, target, and behavioral test for every circuit accordingly.
Steering vectors are a lightweight tool for controlling LLM behavior. However, emerging evidence shows that steering vectors can unintentionally compromise a model's safety mechanisms and increase compliance with harmful requests, while no effective mitigation yet exists. In this work, we show that this safety degradation arises from a separable component in the vector that disrupts the model's safety mechanisms but contributes little to the steering objective. We identify and remove this safety-degrading component, formulating the task as a constrained optimization problem solved through primal-dual updates, subject to preserving the intended steering effect and bounding false refusal. The resulting solution is both interpretable and surgical: the optimization recovers a single direction whose ablation from the steering vector restores model safety with minimal utility cost. Across models, steering behaviors, and attack suites, including unseen attacks types, our method substantially reduces steering-induced safety degradation while preserving the original steering effect with minimal impact on false refusal. Our method offers a post-hoc correction to steering vectors that mitigates their safety cost, and more broadly, it provides a general recipe for applying activation-level model interventions without paying a safety tax.
Yuxiao Li, Gjergji Kasneci
Technical University of Munich Munich Center for Machine Learning (MCML)