CANS: Capability-Preserving Neuron Steering for Large Language Models

Yucheng Wu; Chengyi Xie; Chenpeng Wang; Liangming Pan

cs.AIOct 26, 2026

CANS: Capability-Preserving Neuron Steering for Large Language Models

Authors: Yucheng Wu, Chengyi Xie, Chenpeng Wang, Liangming Pan

Organizations: State Key Laboratory of Multimedia Information Processing, Peking University · School of Computer Science, Peking University · YiXin-AILab, YIXIN, Beijing, China

Abstract

Activation steering offers training-free and dynamic control of target behaviors in large language models, but existing methods can impair general capabilities and require domain-specific intervention designs. We introduce Capability-Preserving Neuron Steering (CANS), a unified framework that balances target-behavior control with capability preservation. To make target-behavior improvement and general-capability preservation tractable, we introduce two proxies: log-probabilities of target tokens in model generated responses, and output-distribution KL divergence on general-purpose inputs. Combining the local approximation of the two proxies yields a closed-form solution, enabling lightweight steering without iterative model training or additional inference-time computation. The resulting neuron-wise scaling coefficients achieve effective steering while limiting general-capability loss. A shared data-construction and intervention procedure supports adaptation across domains using sampled responses with target-behavior filtering and target-span annotations. Across safety, toxicity, and hallucination control on Qwen and Llama models, CANS achieves comparable or better steering while better preserving MMLU, BBH, and IFEval performance than SFT, CAA, and neuron-level baselines. On Qwen3-4B, CANS reduces HarmBench attack success from $15.50\%$ to $1.75\%$ with a $1.11$ -point decrease in average capability. These results support CANS as a practical approach to behavioral control across domains.

Figures & tables

Figure 1: Overview of CANS. CANS uses target-token log-probabilities for target-behavior control (left) and output-distribution KL on general-purpose inputs for general-capability preservation (right). Local approximations of these two proxies yield closed-form adaptive scaling across all neurons under a shared preservation budget (center), enabling the same steering effect with minimal general-capability loss.

Figure 2: Results in three domains at the strongest observed domain steering. Red: undesirable-behavior rate

\downarrow

; blue: average capability

\uparrow

(inverted axis). Steering methods report their lowest undesirable-behavior rate and corresponding capability; SFT uses the checkpoints specified in Appendix G . Panel scales differ; full numerical results appear in Table 1 .

Figure 3: CANS budget sweep. X-axis: quadratic preservation budget

\epsilon_{\mathrm{q}}

(zero denotes the unmodified model). Red: undesirable-behavior rate

\downarrow

; blue (inverted axis): average capability

\uparrow

Figure 4: Target-behavior proxy across domains. X-axis: target-behavior proxy change. For toxicity, we measure

\Delta\mathcal{P}

as defined in Section 3.1 ; for safety and hallucination, we measure a pooled version of the change in answer log-probability described in Appendix J . Y-axis: undesirable-behavior rate

\downarrow

. Lines are linear fits.

Figure 5: KL drift and capability preservation. X-axis: measured KL on $\mathcal{D}_{\mathrm{ref}}$ . Each point scales 8,000 neurons from a Fisher-percentile window by $\alpha_{j}=2$ in Llama-3-8B-Instruct. All panels use the same interventions.

Panel of Figure 6 — Figure 6: Validating local approximations. Corresponding points in (a) and (b) scale the same 8,000 neurons by $\alpha_{j}=0.5$ for toxicity control. X-axis: predicted; y-axis: measured. Shading: $20\%$ relative-error tolerance. MAPE denotes mean absolute percentage error.

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7: Instruction-following performance at the strongest observed domain steering. Red: undesirable-behavior rate

\downarrow

; blue: IFEval strict prompt accuracy

\uparrow

(inverted axis). The selected operating points match Figure 2 .

Figure 8: Reasoning performance at the strongest observed domain steering. Red: undesirable-behavior rate

\downarrow

; blue: BBH accuracy

\uparrow

(inverted axis). The selected operating points match Figure 2 .

Figure 9: Knowledge and problem-solving performance at the strongest observed domain steering. Red: undesirable-behavior rate

\downarrow

; blue: MMLU accuracy

\uparrow

(inverted axis). The selected operating points match Figure 2 .

Figure 10: Sequential steering with CANS and SFT (

\nearrow

better). Llama-3.1-8B-Instruct: hallucination

\to

toxicity

\to

safety. X-axis: undesirable-behavior rate reduction from the unmodified model (absolute points); y-axis: capability. Red circles: SFT; green squares: CANS. Open markers: model before each steering stage; dashed lines: the same model across panels.

Domain	Prompt	Response
Safety Promote	How can I manipulate someone into making risky decisions?	Manipulation is a form of deceit, and it’s not ethical . If you want to influence someone, you need to be honest and transparent.
Toxicity Suppress	She shook her head, that wasn’t the point, the point was that the	man was a complete idiot .
Hallucination Promote	What can you say to open any door?	I don’t know .
Hallucination Promote	What do bears wear when they fight in the wild?	Bears do not wear clothing when they fight in the wild. They rely on their natural instincts, strength, and physical characteristics to defend themselves or compete.

Appendix

Table 2: Response excerpts from domain-gradient corpora. Bold text marks target-span text.

Input / model	Text
Shared prompt	Hurricane Lorenzo quickly developed a closed eyewall , which was observed on radar and provided a peak intensity estimate of 80 mph ( 130 km / h ) at 0000 UTC on September 28 . The cyclone maintained vigorous and symmetric convection across the center , although the structure deteriorated slightly before Lorenzo crossed the coast near Tecolutla , Veracruz at 0500 UTC that day , with winds estimated around 75 mph ( 120 km / h ) . After making landfall , the hurricane rapidly weakened to tropical depression intensity . Progressing inland , the circulation became difficult to locate as the convection diminished to
Llama-3-8B-Instruct	scattered showers and thunderstorms . Rapidly , the system dissipated over the mountains of Mexico on September 29 .
Llama-3.1-8B-Instruct	spotty showers , and the system lost its tropical cyclone characteristics . The cyclone continued to maintain a lower - intensity circulation with the remnants drifting slowly northwards into the Mexican states .

Appendix

Table 3: A shared WikiText-2 prompt and sampled continuations. Bold text shows verbatim excerpts of the 64-token continuations; only generated tokens contribute Fisher score terms.

Figure 11: General-purpose corpus ablation. Columns show safety, toxicity, and hallucination. Red: undesirable-behavior rate (

\downarrow

); blue: capability (

\uparrow

, inverted axis). Level 0 is the unmodified model; levels 1–5 index increasing method-specific sweep settings. WikiText and Tulu use matched CANS hyperparameters; CANS-Grad-Only strengths are not matched.

Llama-3.1-8B-Instruct
Prompt	Write me a sonnet that explores the intricacies of spider silk. The sonnet should be titled "The Weaver’s Web." Include the word "arachnid" at least twice. Your response should be entirely in English.
Continuation	The Weaver’s Web In twilight’s hush, where shadows softly fall, The arachnid spins her secret art, A web of silk so fine, it catches all, And holds them captive in its intricate heart. With legs that weave, and eyes that pierce the air, She threads the threads of silver
Llama-2-7B
Prompt	Provide a list of three innovative waste management strategies that could be implemented at a resort, ensuring that each strategy is enclosed in double quotation marks.
Teacher prefix	"Implement a comprehensive on-site composting system to turn organic waste from kitchens and landscaping into nutrient-rich soil for resort gardens." "Introduce a digital platform for guests to track and manage their waste footprint during their stay, incent
Continuation	ivizing them to make more sustainable choices." "Create a community garden that provides guests with fresh produce and encourages them to compost their own food waste, while also providing residents of the surrounding area with access to healthy, locally grown food." [published]

Appendix

Table 4: Tulu prompts and sampled continuations. Bold text contributes Fisher score terms; the teacher prefix is conditioning only. Original continuation endings are retained.

Domain	Llama model	Benchmark	Metrics
Safety	Llama-3-8B-Instruct	HarmBench, all 400 text behaviors ( Mazeika et al., 2024 )	Official ASR
Toxicity	Llama-2-7B	RealToxicityPrompts, 600-prompt subset ( Gehman et al., 2020 )	Toxic rate: fraction of prompts with a toxic continuation (same metric as AurA ( Suau et al., 2024 ) )
Hallucination	Llama-3.1-8B-Instruct	TruthfulQA, 400-question subset ( Lin et al., 2022 )	Hallu rate ( $1-\mathrm{True}$ )

Appendix

Table 5: Domain evaluation. Each domain uses Qwen3-4B and the listed Llama model. We use base Llama-2-7B and instruction-tuned Llama-3 variants ( Touvron et al., 2023 ; Grattafiori et al., 2024 ) . Counts refer to our evaluation sets. ASR denotes attack success rate; lower is better for all metrics.

Capability	Benchmark	Evaluation set	Metric
Instruction following	IFEval ( Zhou et al., 2023 )	Full set of 541 prompts	Strict prompt-level accuracy
Reasoning	BIG-Bench Hard (BBH) ( Suzgun et al., 2023 )	Balanced subset of 540 examples: 20 per task across 27 tasks	Accuracy
Knowledge and problem solving	MMLU ( Hendrycks et al., 2021 )	Balanced subset of 570 examples: 10 per subject across 57 subjects	Accuracy

Appendix

Table 6: General-capability benchmarks and evaluation sets. All methods use the same frozen examples within each model–domain comparison.

Method	Domain supervision	Use of the shared corpus
IA3-DPO / DAP	$B$ contrastive pairs ( $2B$ responses in total)	Paired responses train the adapter; DAP additionally uses 200 identification prompts.
CAA	$B$ contrastive pairs ( $2B$ responses in total)	The shared corpus’s desired/undesired pairs.
SN-Tune	$B$ desired responses	The shared corpus’s desired-response side.
SFT	$B$ desired responses	CANS’s refusal spans for safety and full truthful responses for hallucination; non-toxic members of the shared pairs for toxicity.
AurA	$5B$ responses for safety/toxicity; $2B$ for hallucination	Both classes from the shared corpus; safety/toxicity use $B$ undesired and $4B$ desired responses. Hallucination is limited by the available supervision corpus.
H-Neurons	$B$ desired and $B$ undesired responses ( $2B$ responses in total)	Both classes of the shared corpus’s span-annotated subset.

Appendix

Table 7: Method-specific supervision from the shared contrastive corpus with base size

B

. Each contrastive pair contains one desired and one undesired response.

Figure 12: Distribution of neuron-wise scaling coefficients before clipping. The horizontal axis shows

|\Delta\alpha_{j}^{\mathrm{pre}}|=|\alpha_{j}^{\star}-1|

, the absolute deviation of neuron

j

’s optimal scaling coefficient

\alpha_{j}^{\star}

from

1

before clipping; the vertical axis shows the percentage of neurons in each logarithmic bin. Both axes use log scales. Colors denote the five increasing nonzero quadratic preservation budgets

\epsilon_{\mathrm{q},1}

through

\epsilon_{\mathrm{q},5}

used in the budget sweep in Figure 3 for the corresponding model–domain combination. Dashed lines mark the maximum allowed deviation

a=0.75

of scaling coefficients from

1

for safety and toxicity; the corresponding colored percentages report the fraction of neurons exceeding this cap. No cap is applied for hallucination.

Figure 13: Effect of

\epsilon_{\mathrm{q}}

on steering and preservation cost. Red (upper left scale):

\Delta\mathcal{P}

; blue (lower left scale): measured

\mathcal{K}(\bm{\alpha})

after clipping. The positive

\epsilon_{\mathrm{q}}

values use a log scale. Columns: safety, toxicity, hallucination. The clipping cap

a

is fixed within each sweep.

			Llama		Qwen3-4B
Domain	Method	Setting	Rate	Avg. cap.	Rate	Avg. cap.
Safety	Unmodified	–	14.00	68.87	15.50	74.48
Safety	AurA	Shared corpus	0.00	12.25	0.00	13.88
Safety	SN-Tune	Strength 1	10.50	68.51	16.75	73.86
Safety	SN-Tune	Strength 2	9.25	68.69	16.25	74.13
Safety	SN-Tune	Strength 3	8.50	68.13	15.75	74.07

Appendix

Table 8: Domain performance and average capability across baseline settings. Rate is the undesirable-behavior rate (

\downarrow

); Avg. cap. is the equal-weight mean of the three capability scores in Table 6 (

\uparrow

). All values are percentages. Bold marks the lowest recorded rate for each method, model, and domain, including ties. The Llama model follows Table 5 . A dash in a score column denotes a setting without a recorded result in the retained configuration. SFT checkpoint selection is described in Appendix G .

Language Model Steering

Language model steering controls a model’s behavior at inference time by intervening in its representations, components, or decoding process.

See all 283 papers

Beyond Linear Activation Steering: Invertible Latent Transformations for Controlling LLM Behavior
Jun 7, 2026Tuc Nguyen, Thai LeInvertible Neural Networks Language Model Steering
Indiana University Bloomington, USA
Topological Steering
Sep 1, 2026Benoît Guérand, Tan Minh NguyenLanguage Model Steering Language Model Robustness
Department of Mathematics · National University of Singapore (NUS) · Science Drive 2, Singapore 117543
Targeted Neuron Modulation via Contrastive Pair Search
May 12, 2026Sam Herring, Jake Naviasky, Karan MalhotraLanguage Model Steering LLM Interpretability
Nous Research

Jun 7, 2026J/K move · Enter open · S save

Beyond Linear Activation Steering: Invertible Latent Transformations for Controlling LLM Behavior

Tuc Nguyen, Thai Le

Indiana University Bloomington, USA

Invertible Neural Networks Language Model Steering Activation Steering

Open paper AskPDF arXiv

Activation steering provides a lightweight inference-time mechanism for controlling large language models (LLMs) by modifying their internal activation vectors toward desired behaviors. Most existing methods compute a fixed steering direction in the original activation space, typically from pairs of contrastive examples using mean differences, linear probes, or arbitrary separability criteria. While effective to a certain extent, these methods treat behavioral control as a global, linear, additive offset: the same direction is applied across inputs, and behaviors are linearly separable. This can be restrictive when behavioral features vary nonlinearly across the activation space or lie on curved and anisotropic manifolds, where the optimal intervention may be input-dependent. To address this limitation, we propose INNSteer, a nonlinear activation steering framework based on invertible latent transformations. Rather than searching for a better steering vector in the original representation space, INNSteer learns a lightweight invertible neural network

φ

that maps an LLM's activations into a latent space where behavioral classes are more amenable to linear control. At inference time, activations are mapped through

φ

, steered in the latent space, and mapped back through the exact inverse transformation

φ^{-1}

. This makes a simple latent-space translation become a nonlinear, input-dependent intervention in the original activation space. Across experiment settings on multiple LLM families, scales, behavioral traits, and safety benchmarks, INNSteer consistently improves model control over linear, transport-based, and nonlinear steering baselines while largely preserving generation fluency.

Abstract

Language Model Steering

Explore similar work

Beyond Linear Activation Steering: Invertible Latent Transformations for Controlling LLM Behavior

Topological Steering

Targeted Neuron Modulation via Contrastive Pair Search