RealControlBench: A Benchmark for Interpretability-Informed Fine-Grained Control of LLMs and Agents

Xinying Cai; Bin Hu; Mingyu Jin; Qiming Zhang; Yang Ouyang; Bangwei Guo; Minghao Guo; Yutong Yin

cs.CLOct 19, 2026

RealControlBench: A Benchmark for Interpretability-Informed Fine-Grained Control of LLMs and Agents

Authors: Xinying Cai, Bin Hu, Mingyu Jin, Qiming Zhang, Yang Ouyang, Bangwei Guo, Minghao Guo, Yutong Yin,

Organizations: University of California, San Diego · Rutgers University · NEC Laboratories America · Northwestern University ·

Abstract

Existing steering benchmarks are built around simplified, isolated generation tasks and evaluate a single behavioral attribute under controlled settings that do not reflect the diversity and complexity of practical deployment. As a result, performance on these benchmarks provides only a limited picture of how steering methods perform in the real world. We therefore introduce RealControlBench, a comprehensive benchmark for evaluating fine-grained steering of LLMs and LLM agents across diverse behavioral targets and interaction settings. RealControlBench extends steering evaluation beyond isolated generations to complex, execution-grounded, multi-turn agent interactions, covering five complementary dimensions: instruction-following control, agentic tool-use decision control, reasoning-performance steering, reasoning-length control, and trajectory-conditioned safety awareness. Rather than measuring steering success alone, the benchmark jointly evaluates target controllability and capability preservation, including instruction following, reasoning performance, and downstream agent utility and safety. It further examines whether steering effects remain specific and robust across prompt variations, domains, and model architectures. Our evaluation shows that existing steering methods remain unreliable across realistic control objectives: they often fail to consistently induce the intended behavior and can substantially degrade the model's underlying task performance. These results suggest that strong steering effects in controlled settings do not necessarily translate into reliable control in more realistic evaluations. By providing a unified, model-agnostic steering evaluation framework, RealControlBench aims to support the development of steering methods that are not only effective but also precise, robust, and useful in realistic AI deployments.

Figures & tables

Benchmark	Setting	Target	Tool Use	CoT Len.	Reason. Perf.	Instr. Follow.	Safety	Traj. Level	Model- Agn.
AxBench ( Wu et al., 2025 )	LLM	Concept steering and concept detection	\xmark	\xmark	\xmark	\xmark	$\triangle$	\xmark	$\triangle$
TruthGen ( Fulay et al., 2024 )	LLM	Truthfulness steering via factual/false statements	\xmark	\xmark	\xmark	\xmark	$\triangle$	\xmark	$\triangle$
TwinViews-13k ( Fulay et al., 2024 )	LLM	Political viewpoint steering via matched left/right statements	\xmark	\xmark	\xmark	\xmark	$\triangle$	\xmark	$\triangle$
CLaS-Bench ( Gurgurov et al., 2026 )	LLM	Cross-lingual alignment and target-language steering	\xmark	\xmark	\xmark	$\triangle$	\xmark	\xmark	\cmark
STEER-BENCH ( Chen et al., 2025a )	LLM	Community norm and viewpoint steering	\xmark	\xmark	\xmark	$\triangle$	$\triangle$	\xmark	\cmark
MAS ( Luo et al., 2026 )	Multi-turn Agent	Runtime safety detection and mitigation	$\triangle$	\xmark	$\triangle$	$\triangle$	\cmark	\cmark	\xmark

Table 1: Coverage of existing LLM and agent steering benchmarks. \cmark denotes explicit coverage,

\triangle

partial or indirect coverage, and \xmark no coverage.

Panel of Table 2 — Table 2: Five instruction-following constraint types.

Panel of Table 3 — Table 3: Three possible tool-use decisions and their follow-up checks.

Panel of Figure 1 — Figure 1: Shared steering-vector extraction and application across the two tool-use tracks.

Panel of Figure 2 — Figure 2: Safety-awareness examples extracted from pre-execution snapshots of agent trajectories.

Task	Metrics
Instruction following	Average accuracy
Single-turn tool use	Decision success rate; follow-up success rate
Multi-turn tool use	Joint accuracy (BFCL and applicable decision checks)
Reasoning	Answer accuracy
Long2Short	Relative length change (Comp); Answer accuracy (Acc)
Safety awareness	Classification accuracy; unsafe F1

Table 4: Evaluation metrics by task.

Baseline	Mechanism	Train free
No Steering	Unmodified model	\cmark
Prompted	Behavior instruction	\cmark
CAA	Mean activation difference	\cmark
PCA	Leading activation component	\cmark
LAT	PCA of paired differences	\cmark
Linear Probe	Classifier weight direction	\xmark

Table 5: Steering baselines.

	Method	IF	Tool Use			Reasoning			Long2Short		Safety
		AvgAcc.	Decision.	FollowUp.	Acc.	MATH500.	AMC’23.	AIME’24.	Comp	Acc.	Acc.	F1
			$\underbrace{\hskip 41.6822pt}_{\text{\scriptsize{\color[rgb]{0.3398,0.3828,0.418}Single Turn}}}$		$\underbrace{\hskip 12.12573pt}_{\text{\scriptsize{\color[rgb]{0.3398,0.3828,0.418}Multi Turn}}}$	$\underbrace{\hskip 18.94646pt}_{\text{\scriptsize{\color[rgb]{0.3398,0.3828,0.418}ID}}}$	$\underbrace{\hskip 43.95578pt}_{\text{\scriptsize{\color[rgb]{0.3398,0.3828,0.418}OOD}}}$
Qwen3-8B	No Steering	3.20%	32.00%	13.00%	8.33%	81.43%	60.00%	10.00%	0.00%	80.60%	37.15%	52.74%
	Prompted	95.60%	40.50%	24.50%	9.50%	79.29%	57.50%	20.00%	-41.50%	77.00%	46.88%	56.90%
	CAA	38.00%	41.33%	18.25%	10.00%	83.93%	60.00%	10.00%	-3.20%	81.80%	41.32%	54.45%
	PCA	38.20%	42.00%	16.25%	9.50%	83.93%	60.00%	23.33%	-2.00%	80.60%	47.57%	57.22%

Table 6: Main results across five RealControlBench domains and three models.

Figure 3: Multi-turn accuracy (%), ranked within each model.

Figure 4: Instruction-following accuracy (%) by task and model. Tasks run from R1 (lowercase) to R5 (fixed ending) from left to right.

Figure 5: ITI validation probing accuracy across all 1,152 attention heads of Qwen3-8B for five instruction-following tasks, evaluated on 40 examples per task. The original top 48 heads are highlighted. Every task has a median accuracy of 100%, with 643–745 heads achieving perfect accuracy, leaving a large tie at the head-selection cutoff.

Data split	Call	Clarify	Abstain	Total
A. Steering extraction (pairs)
Extraction set	2,700	2,700	2,700	8,100
B. Single-turn evaluation (examples)
Full evaluation pool	1,226	873	1,010	3,109
Evaluated subset	200	200	200	600
With follow-up (included)	0	200	200	400

Table 7: Tool-use data sizes by target and evaluation track. Extraction pairs are shared by both tracks. The 400 follow-up examples are included in the 600 single-turn examples. Rows are not additive; repeated model generations are not counted.

	Negative response category
Positive target	Call	Clarify	Abstain	Direct	Total pairs
Call	—	900	900	900	2,700
Clarify	900	—	900	900	2,700
Abstain	900	900	—	900	2,700
Total	1,800	1,800	1,800	2,700	8,100

Table 8: Contrastive pairs by positive target and negative response category. Same-category pairs are excluded (—).

Figure 7: Qwen3-8B tool-use responses without steering and with clarification steering (PCA, layer 18, strength 0.5), including the follow-up call.

Panel of Figure 8 — Figure 8: Multi-turn steering: vector extraction, application with frozen model weights, and episode evaluation. Responses and calls illustrate expected behavior, not recorded model outputs.

Data split	Source	Count
A. Performance
Steering extraction (pairs)	MATH500	160
Development (problems)	MATH500	60
In-distribution test (problems)	MATH500	280
Excluded/unused (problems)	MATH500	0
Transfer test (problems)	AMC 2023	40

Table 9: Reasoning extraction and evaluation data. Performance and Long2Short use different extraction sources and different MATH500 evaluation sets.

			Benign-source task		Harmful-source task
Source model	Split	Task groups	Safe	Unsafe	Safe	Unsafe	Total
Qwen3-8B	Extraction	151	318	0	433	403	1,154
Qwen3-8B	Eval	37	76	2	111	99	288
Gemma-2-9B-it	Extraction	123	318	0	135	78	531
Gemma-2-9B-it	Eval	30	80	0	34	19	133
Llama-3.1-8B-Instruct	Extraction	127	945	0	634	519	2,098

Table 10: Label distribution by task-source group and action label.

	Qwen3-8B					Llama-3.1-8B-Instruct					Gemma-2-9B-it
Method	Lower case	One sentence	No comma	Question ending	Fixed ending	Lower case	One sentence	No comma	Question ending	Fixed ending	Lower case	One sentence	No comma	Question ending	Fixed ending
No Steering	0	0	0	16	0	0	0	2.5	0	0	0	0	1.5	1	0
Prompted	97.5	94	95	94	97.5	90	93	91	89	91.5	88.5	86	92.5	89	93.5
CAA	85	67	29	9	0	80.5	28	20	3.5	0	89	13	59	6	0
PCA	86	66	29.5	9.5	0	82.5	26	18	3.5	0	88.5	12.5	59.5	5	0
LAT	82	66	31	11	0	79	29	18.5	3	0	89	13	63.5	4.5	0

Table 11: Instruction-following success rates (%). Darker blue indicates higher success rates. Compare methods within each model–target column.

		Qwen3-8B					Llama-3.1-8B-Instruct					Gemma-2-9B-it
Method		Lower case	One sentence	No comma	Question ending	Fixed ending	Lower case	One sentence	No comma	Question ending	Fixed ending	Lower case	One sentence	No comma	Question ending	Fixed ending
CAA	Layer	27	18	18	9	—	24	16	24	8	—	32	21	21	21	—
	$\alpha$	0.5	0.5	1	0.5	—	0.5	1	1	0.5	—	0.5	1.5	1	0.5	—
PCA	Layer	27	18	18	9	—	24	16	16	8 ∗	—	32	21	21	21	—
	$\alpha$	0.5	1	1	0.5	—	0.5	1	1	0.5	—	0.5	1	1	0.5	—
LAT	Layer	27	18	18	9	—	24	16	16	8	—	32	21	21	21	—

Table 12: Selected intervention configurations corresponding to Table 11 . Each method has separate layer (or head) and strength rows.

		Benign		Harmful		Overall
Source model	Method	Acc.	F1	Acc.	F1	Acc.	F1
Qwen3-8B	No Steering	10.26	5.41	47.14	64.08	37.15	52.74
	Prompted	46.15	8.70	47.14	64.08	46.88	56.90
	CAA	25.64	6.45	47.14	64.08	41.32	54.45
	PCA	48.72	9.09	47.14	64.08	47.57	57.22
	LAT	51.28	9.52	47.14	64.08	48.26	57.55

Table 13: Safety classification on Eval by task-source group (%). F1 treats unsafe as the positive class. Compare methods within a model and column.

Language Model Steering

Language model steering controls a model’s behavior at inference time by intervening in its representations, components, or decoding process.

See all 279 papers

Mar 18, 2026

FaithSteer-BENCH: A Deployment-Aligned Stress-Testing Benchmark for Inference-Time Steering

Inference-time steering is widely regarded as a lightweight and parameter-free mechanism for controlling large language model (LLM) behavior, and prior work has often suggested that simple activation-level interventions can reliably induce targeted behavioral changes. However, such conclusions are typically drawn under relatively relaxed evaluation settings that overlook deployment constraints, capability trade-offs, and real-world robustness. We therefore introduce FaithSteer-BENCH, a stress-testing benchmark that evaluates steering methods at a fixed deployment-style operating point through three gate-wise criteria: controllability, utility preservation, and robustness. Across multiple models and representative steering approaches, we uncover several systematic failure modes that are largely obscured under standard evaluation, including illusory controllability, measurable cognitive tax on unrelated capabilities, and substantial brittleness under mild instruction-level perturbations, role prompts, encoding transformations, and data scarcity. Gate-wise benchmark results show that existing methods do not necessarily provide reliable controllability in deployment-oriented practical settings. In addition, mechanism-level diagnostics indicate that many steering methods induce prompt-conditional alignment rather than stable latent directional shifts, further explaining their fragility under stress. FaithSteer-BENCH therefore provides a unified benchmark and a clearer analytical lens for future method design, reliability evaluation, and deployment-oriented research in steering.

Zikang Ding, Qiying Hu, Yi Zhang +4

University of Electronic Science and Technology of China · Mohamed bin Zayed University of Artificial Intelligence · South China University of Technology

Language Model Steering Language Model Robustness

Ask PDF

Mar 3, 2026

How Controllable Are Large Language Models? A Unified Evaluation across Behavioral Granularities

Large Language Models (LLMs) are increasingly deployed in socially sensitive domains, yet their unpredictable behaviors, ranging from misaligned intent to inconsistent personality, pose significant risks. We introduce SteerEval, a hierarchical benchmark for evaluating LLM controllability across three domains: language features, sentiment, and personality. Each domain is structured into three specification levels: L1 (what to express), L2 (how to express), and L3 (how to instantiate), connecting high-level behavioral intent to concrete textual output. Using SteerEval, we systematically evaluate contemporary steering methods, revealing that control often degrades at finer-grained levels. Our benchmark offers a principled and interpretable framework for safe and controllable LLM behavior, serving as a foundation for future research.

Ziwen Xu, Kewei Xu, Haoming Xu +8

Zhejiang University · Alibaba Group

LLM Evaluation Language Model Steering

Ask PDF

Oct 6, 2026

Does Steering Break Your Model? A Multi-Dimensional Evaluation Suite for LLM Steering Methods

Activation steering provides a lightweight and flexible way to control large language model (LLM) behavior. However, effective steering requires more than inducing the intended behavior: it should also limit unintended changes and remain robust across inputs and training data. Existing evaluations cover these dimensions only in fragments. As a result, the trade-offs between efficacy and side effects have not been systematically characterized. We introduce SteerScope, a two-axis, multi-dimensional evaluation suite that jointly characterizes steering outcomes and method properties through 15 metrics. We score target efficacy and side effects on language quality, task capabilities, and safety and reliability, and further assess generalization and data dependence through steering-specific metrics for sample efficiency and sample sensitivity. Rather than comparing methods at a single operating point, we characterize the trade-offs between efficacy and side effects. Under matched models, tasks, and evaluation protocols, we benchmark 23 methods spanning 4 families, including prompting, LoRA, and SFT as baseline methods, and release the suite as an extensible codebase. We find that current activation steering methods do not yet surpass the Prompt Steering baseline in their overall balance between steering efficacy and side effects: across both model scales, no evaluated activation steering method achieves higher efficacy without incurring greater composite side effects. We further uncover a consistent coupling between steering efficacy and side effects. Under OOD prompts, target efficacy is often preserved, whereas side effects tend to become more pronounced, particularly through declines in instruction relevance and fluency. Methods also exhibit sharply different sample-efficiency profiles.

Haotian Yang, Huikang Jiang, Yucheng Wu +4

State Key Laboratory of Multimedia Information Processing, Peking University · School of Computer Science, Peking University · Columbia University +2

LLM Evaluation Language Model Steering Language Model Safety Evaluation Activation Steering

Ask PDF

Abstract

Language Model Steering

Explore similar work

FaithSteer-BENCH: A Deployment-Aligned Stress-Testing Benchmark for Inference-Time Steering

How Controllable Are Large Language Models? A Unified Evaluation across Behavioral Granularities

Does Steering Break Your Model? A Multi-Dimensional Evaluation Suite for LLM Steering Methods