Steering Vectors for Competing Ethical Frameworks Are Interchangeable: A Competing-Target Test for Activation Steering

Weilun Xu; Zipeng Sun

cs.AIOct 14, 2026

Steering Vectors for Competing Ethical Frameworks Are Interchangeable: A Competing-Target Test for Activation Steering

Authors: Weilun Xu, Zipeng Sun

Organizations: EPFL · McGill University and Mila

Abstract

Activation steering adds a vector to a model's hidden states to control a named behaviour. A gain on that behaviour, however, does not show that the vector controls it directly: it may act through a component shared with neighbouring behaviours, which unsteered and random baselines cannot separate. We introduce the competing-target test: a vector is compared with the vector built the same way for a competing target, and an equivalence test states when their difference is below a useful margin. We apply it in open-weight models to vectors for Kantian deontology, which judges an act by the rule it follows, and act utilitarianism, which judges it by the welfare it produces. On held-out situations, prompting a framework raises its score and lowers the other's, whereas vectors for either framework move both scores alike, and none reaches the margin. The two vectors share most of their direction, a request to apply some framework; the same construction separates an optimistic from a pessimistic tone, whose vectors share much less. What a vector shares with its competitors therefore sets what it controls: steering a perspective can deliver a mixture, and measuring a disposition can measure its neighbours, unless tested against the competing target.

Figures & tables

Figure 1: The two framework vectors are interchangeable and the two tone vectors are not, implying a vector controls what it shares with its competitor. Arrows give the change in the two competing scores on the held-out situations, averaged over situations and models; the instructions are those of Section 3 and the vectors those of Section 5 . In ethical frameworks (a), the defined instructions move the scores apart, whereas the two target-versus-neutral vectors at twice their natural norm and their shared component

s

move both the same way; for tones (b), the instructions and the vectors built the same way each move toward their own tone. Brackets mark the competing-target specificity.

Figure 2: Prompting separates the frameworks; every steering configuration stays below the margin. Held-out situations of Section 3 . (a) Score planes. An arrow joins the two members of a matched pair, from the utilitarian to the Kantian one; for prompting, thin arrows are single situations under either instruction and the bold arrow the mean under the defined instruction; the inset enlarges the origin, where each arrow is the mean pair of one recipe at one positive dose (bold: persona at dose 3) and grey points are random vectors. (b) Equivalence test. Averaged specificity of each configuration, with prompting right of the broken axis: estimate (circle), one-sided 95% upper bound (bar) and situation values (grey dots); filled circles are classed below

1/12

and confirmed by the sign-flip test.

Figure 3: A shared component dominates the framework vectors and aligns with a generic request to apply a framework, at every layer. Construction prompts of Section 4 ; markers and lines by model. (a) Cosines at layer 20 between the shifts named in each row, under the defined instructions; the filler paragraph is a non-moral paragraph of the definitions’ length. (b) Alignment across layers: the cosine of

s

with the generic-instruction direction and with the filler direction. (c) Dominance across layers: the share of the squared norm of the sixteen construction vectors carried by the shared and by the framework component. The vertical line marks layer 20.

Figure 4: Single-site edits recover no more than a random direction at the natural norm and at most four tenths of prompting within the quality limits. Held-out situations of Section 5 ; 95% situation-bootstrap intervals (10,000 resamples). (a) Single-site edits. Selectivity of each edit at layer 20 as a fraction of prompting’s selectivity in the same model (tone rows: of tone prompting’s), measured toward the framework the vector was built for, so a negative value for a utilitarian vector is movement toward the Kantian framework; the dashed line marks prompting. (b) Dose response of the specific directions. Recovery against the multiple of the natural norm for each direction; open markers are outside the quality limits of the usefulness rule.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Llama-3.1-8B
Score	$r$	offset	$\kappa_{w}$	$\alpha$
Kantian	0.34	$-$ 0.26	0.18	0.02
utilitarian	0.68	$-$ 0.04	0.54	0.56
OLMo-3-7B
Kantian	0.23	$-$ 0.39	0.07	$-$ 0.32
utilitarian	0.63	$-$ 0.11	0.47	0.51

Appendix

Table 1: The second evaluator assigns the same classes as the primary evaluator. Agreement on the prespecified subset of 720 held-out responses per model (all prompting responses; persona vectors and four random directions at doses 1.5 and 3):

r

is the Pearson correlation of the framework score, offset the mean score of the second evaluator minus the primary, and

\kappa_{w}

and

\alpha

the quadratically weighted kappa and ordinal Krippendorff’s alpha on the application criterion.

	Llama-3.1-8B	OLMo-3-7B	Qwen3.5-9B
Prompting selectivity, named	0.74 [.62, .84] (0.82)	0.93 [.85, 1.00] (0.90)	0.98 [.97, 1.00] (0.98)
Prompting selectivity, defined	0.80 [.73, .87] (0.84)	0.90 [.85, .94] (0.97)	0.98 [.96, 1.00] (0.97)
Specificity, largest one-sided $U_{95}$	0.05	0.03	0.02
Configurations below $1/12$ (of 6)	6	6	6
Identical responses, dose 1.5	20% (0%)	19% (2%)	59% (38%)
Identical responses, dose 3	5% (0%)	8% (0%)	31% (20%)

Appendix

Table 2: Prompting is framework-specific and every steering configuration is below the margin on the held-out situations. Prompting selectivity is the mean over situations of the difference between the two instructions on the same score, with its 95% situation-bootstrap interval and, in parentheses, the development value. The specificity rows give the largest one-sided 95% upper bound of

\overline{\mathrm{Spec}}

over the six positive-dose configurations and the number classed below

1/12

with the sign-flip confirmation. Identical responses is the share of matched persona pairs with byte-identical responses, in parentheses the share also equal to the unsteered response. Development controls lists each configuration that passed the usefulness rule on development, as its development and held-out gain on its target score. The last row states whether the second evaluator assigns the same classes. Bold: the two quantities the test decides on.

Figure 5: Identical responses need no evaluator, and passing the usefulness rule on development does not buy specificity. Held-out situations of Section 3 . (a) Identical responses. Share of matched persona pairs with byte-identical responses, with 95% intervals; hatched, the part also identical to the unsteered response. (b) Reliability against specificity. Gain on the own target score on the development situations, where the usefulness rule was applied (its requirement, dashed vertical), against held-out specificity on that score (the test’s margin, dashed horizontal), for every positive-dose configuration; rings mark the three controls that passed the rule.

Panel ( $n$ )	$\overline{\mathrm{Spec}}$ [95% CI]	Upper bound	Sign-flip $p$	Named	Defined	Identical
Llama-3.1-8B
First (8)	0.033 [0.010, 0.056]	0.054	0.020	0.74	0.80	5%
Second (8)	0.012 [ $-$ 0.017, 0.042]	0.038	0.012	0.83	0.77	5%
Third (16)	0.020 [ $-$ 0.002, 0.044]	0.039	$<0.001$	0.84	0.83	5%
Pooled (32)	0.021 [0.006, 0.037]	0.035	$<0.001$ †	0.81	0.81	5%
OLMo-3-7B

Appendix

Table 3: The headline configuration stays below the margin on every held-out panel and pooled over all 32 situations. Persona vectors at dose 3 on the first held-out panel, on two further panels selected by the same rule, and pooled: averaged specificity with its 95% bootstrap interval, the one-sided 95% upper bound against the margin

1/12

, the sign-flip

p

(exact over the

2^{n}

sign patterns;

\dagger

: Monte Carlo over 200,000 patterns), prompting selectivity for the named and the defined instruction, and the share of matched pairs with identical responses. Bold: the pooled estimates.

Model	PCA	probe	Kant–Util	placement	source	sample	$\rho$	Kant	Util	dose/norm
	Recipes		Persona vectors					Projection
Llama-3.1-8B	0.9995	0.97	0.90	0.72	0.65	0.98	0.22	0.39	$-$ 0.04	0.20
OLMo-3-7B	0.9996	0.99	0.85	0.70	0.78	0.99	0.28	0.29	0.20	0.11
Qwen3.5-9B	0.9998	0.98	0.90	0.84	0.82	0.99	0.22	0.39	$-$ 0.01	0.05

Appendix

Table 4: The Kantian and utilitarian vectors are closely aligned, and the probe direction nearly coincides with the mean direction. Recipe columns give the cosine of the PCA vector (minimum) and the probe vector (mean) with the persona vector; persona columns the mean cosines between the Kantian and utilitarian vectors and between vectors that differ only in placement, source or sample;

\rho=\sqrt{(1-c)/2}

the length of a unit edit along the specific axis of its own pair; projection columns the mean component of the 24 Kantian and 24 utilitarian vectors along the pooled axis, signed toward each vector’s own target; the last column the largest dose as a fraction of the layer-20 residual norm.

Share of squared norm
Term	Llama	OLMo	Qwen
Shared (grand mean)	0.69	0.69	0.79
Framework	0.038	0.058	0.038
Framework $\times$ placement	0.006	0.011	0.006
Framework $\times$ source	0.005	0.004	0.002
Framework $\times$ sample	0.0002	0.0001	0.0001

Appendix

Table 5: The shared component carries most of the squared norm, and the framework main effect and its interactions with placement and source exceed the null in every model (

p\leq 0.008

). Rows give the squared-norm decomposition of the construction vectors and its within-situation label-permutation null (1,000 draws). The interaction with the construction sample is below 0.0002 of the squared norm in every model.

Layer	Dose	Llama-3.1-8B	OLMo-3-7B	Qwen3.5-9B
12	matched dose	0.04 [-0.02, 0.11] †	0.00 [-0.05, 0.05]	-0.02 [-0.09, 0.05]
20	matched dose	0.05 [-0.01, 0.11] †	-0.02 [-0.09, 0.05]	-0.02 [-0.05, 0.00]
26	matched dose	0.03 [0.00, 0.06]	0.00 [0.00, 0.00]	0.04 [0.01, 0.07]
12	natural norm	-0.04 [-0.10, 0.02]	0.02 [0.00, 0.03]	0.03 [-0.04, 0.07]
20	natural norm	0.03 [0.00, 0.05]	0.02 [-0.05, 0.09] †	0.02 [-0.07, 0.10] †
24	natural norm	0.06 [0.03, 0.09] †	–	–

Appendix

Table 6: Layer test: no layer beyond 20 is framework-specific at the matched dose, and one natural-norm configuration in Llama reaches the margin. Averaged specificity of the pooled persona pair, with 95% situation-bootstrap intervals (10,000 resamples). The matched dose scales dose 3 of layer 20 by the ratio of residual norms; the natural norm is the pair’s own. Unmarked: below

1/12

by the one-sided bound;

\dagger

undetermined;

\ast

(bold) at or above

1/12

with a positive lower bound. The matched-dose configurations form a Holm family per model; the natural-norm configurations are exploratory, and layers 24, 28 and 30 were run in Llama only, after the layer-26 value was read.

Pair	Multiple	Llama-3.1-8B	OLMo-3-7B	Qwen3.5-9B	Identical
Mean	1	0.03 [0.00, 0.05]	0.02 [ $-$ 0.05, 0.09] †	0.02 [ $-$ 0.07, 0.10] †	0, 0, 0
Mean	2	0.06 [ $-$ 0.02, 0.14] † ‡	0.14 [0.08, 0.20] ∗ ‡	0.05 [0.00, 0.11] †	0, 0, 0
Named	1	0.03 [0.00, 0.06] ‡	0.12 [0.06, 0.19] ∗	0.08 [0.02, 0.14] †	0, 0, 0
Oracle	1	0.00 [ $-$ 0.05, 0.05]	0.06 [0.01, 0.10] †	0.02 [ $-$ 0.11, 0.14] † ‡	0, 0, 0
Three layers	1	$-$ 0.02 [ $-$ 0.05, 0.03]	0.16 [0.09, 0.21] ∗	0.03 [ $-$ 0.03, 0.09]	0, 0, 0
Patch, layer 20	replacement	0.00 [0.00, 0.00]	0.00 [0.00, 0.00]	$-$ 0.02 [ $-$ 0.05, 0.00]	14, 13, 9

Appendix

Table 7: Target-versus-neutral pairs reach the margin in OLMo only, and the patches return the same response for both frameworks. Averaged specificity of each matched pair of the sufficiency edits, with 95% situation-bootstrap intervals (10,000 resamples): the single-site mean, named and oracle pairs at the stated multiples of the natural norm, the three-layer pair and the final-token patches. Unmarked: below

1/12

by the one-sided bound;

\dagger

undetermined;

\ast

(bold) at or above

1/12

with a positive lower bound;

\ddagger

a vector of the pair outside the quality limits of the usefulness rule. Identical: the number of the 16 held-out cells in which the two frameworks’ edits return the same response (Llama, OLMo, Qwen).

Primary evaluator
Model	Prompting	Pair, $\times 1$	Pair, $\times 2$
Llama	0.69	0.05 [ $-$ 0.02, 0.12] †	0.28 [0.09, 0.46] ∗
OLMo	0.78	0.17 [0.11, 0.23] ∗	0.22 [0.14, 0.32] ∗
Qwen	0.95	0.11 [0.04, 0.19] ∗	0.28 [0.18, 0.38] ∗
Second evaluator
Llama	0.57	0.05 [0.02, 0.08]	0.27 [0.15, 0.40] ∗

Appendix

Table 8: The tone pair reaches the margin at twice the norm under both evaluators. Tone prompting selectivity (the mean, over the two tone instructions, of each instruction’s selectivity toward its own tone) and the tone pair’s averaged specificity at one and two times the natural norm with its 95% situation-bootstrap interval (10,000 resamples), under the primary evaluator and under the second evaluator with the same tone rubric. Unmarked: below

1/12

by the one-sided bound;

\dagger

undetermined;

\ast

(bold) at or above

1/12

with a positive lower bound.

Activation Steering

Activation steering changes model behavior by intervening directly on internal representations during inference, often without updating weights.

See all 375 papers

What Drives Representation Steering? A Mechanistic Case Study on Steering Refusal
Apr 9, 2026Stephen Cheng, Sarah Wiegreffe, Dinesh ManochaLanguage Model Steering LLM Interpretability
University of Maryland, College Park
From Trait Vectors to Circuits: Tracing Refusal and Sycophancy Through Language Models
Sep 2, 2026Oscar Miró López-Feliu, Maya OzbayogluCircuits in Language Models Activation Steering
University of Amsterdam · Safe AI Netherlands
Safety Cost of Steering Vectors Is Separable and Reducible
Aug 9, 2026Yuxiao Li, Gjergji KasneciLanguage Model Steering LLM Safety Alignment
Technical University of Munich Munich Center for Machine Learning (MCML)

Apr 9, 2026J/K move · Enter open · S save

What Drives Representation Steering? A Mechanistic Case Study on Steering Refusal

Stephen Cheng, Sarah Wiegreffe, Dinesh Manocha

University of Maryland, College Park

Language Model Steering LLM Interpretability Representation Steering Attention Mechanisms Circuits in Language Models Refusal Behavior in Language Models

Open paper AskPDF arXiv

Applying steering vectors to large language models (LLMs) is an efficient and effective model alignment technique, but we lack an interpretable explanation for how it works--specifically, what internal mechanisms steering vectors affect and how this results in different model outputs. To investigate the causal mechanisms underlying the effectiveness of steering vectors, we conduct a comprehensive case study on refusal. We propose a multi-token activation patching framework and discover that different steering methodologies leverage functionally interchangeable circuits when applied at the same layer. These circuits reveal that steering vectors primarily interact with the attention mechanism through the OV circuit while largely ignoring the QK circuit. Freezing all attention scores during steering drops performance by only 8.83% across three model families. A mathematical decomposition of the steered OV circuit further reveals semantically interpretable concepts, even in cases where the steering vector itself does not. Leveraging the activation patching results, we show that steering vectors can be sparsified by up to 85-96% while retaining most performance, and that different steering methodologies agree on a subset of important dimensions.

Abstract

Activation Steering

Explore similar work

What Drives Representation Steering? A Mechanistic Case Study on Steering Refusal

From Trait Vectors to Circuits: Tracing Refusal and Sycophancy Through Language Models

Safety Cost of Steering Vectors Is Separable and Reducible