Present but Rescaled: Chat-to-Agent Transfer of Additive Activation Steering

Abstract: Additive activation steering (injecting a scaled residual-stream direction during generation) is calibrated almost entirely in single-turn chat, yet the models it targets are increasingly deployed as tool-using ReAct agents. We present the first systematic chat-to-agent transfer study of additive steering, coupling behavioral measurement with a representation read-out in a matched-information design: the same items rendered as plain chat or as a ReAct tool-use episode, with matched-norm random-direction controls and the transcript re-encoded every turn to exclude KV-cache contamination. Transfer is real but rescaled, and the right description is a dissociation: the injected direction reaches the late layers at near-full strength in every setting and model tested (install-site agent-over-chat ratios 0.83-1.16 across three families), while the behavioral coupling is reset per model and context. On Qwen2.5-7B a refusal bypass vector amplifies in the agent (T = 1.45, CI [1.20, 1.78], N = 300); across a powered uniform-protocol distribution the coupling spans amplification (Gemma-2-9B T = 2.00) to attenuation (Yi-1.5-9B T = 0.43, CI [0.29, 0.60]), with no universal constant and a single clean attenuator against a universal sign. Directional ablation of the same axis does not amplify (T = 0.93, CI including 1) while additive injection amplifies (T = 1.50), a 20.1-point gain difference (CI [13.4, 26.8]) that identifies an additive-specific mechanism. Two pre-registered instruments converge to localize the rescaling to the ReAct format scaffold, before any tool observation, rather than to the observation boundary where a dilution account would predict it. The safety implication is immediate and unpredictable: agentic deployment amplifies steering-based refusal bypass by up to 2.00x on some models while others attenuate, so a deployment cannot assume a given model is safe under additive steering.

• The paper demonstrates that additive activation steering’s injected directions persist robustly in agents, even as their behavioral coupling is rescaled per deployment.
• It introduces a five-rung matched-information ladder (C0–C4) to quantify directional effects, showing varied amplification and attenuation across major LLMs.
• It shows that the ReAct format drives agentic amplification of steering, emphasizing that continuous additive injection—not ablation—underpins safety vulnerabilities.

Chat-to-Agent Transfer of Additive Activation Steering: Mechanism, Rescaling, and Safety Implications

Introduction

This paper provides a systematic investigation into the transfer properties of additive activation steering when moving from single-turn chat to multi-turn, tool-augmented agentic deployments based on the ReAct format. Additive activation steering, which involves injecting a trait-extracted direction into the model's residual stream, has become a key inference-time control method for modifying LLM behavior in a targeted, interpretable manner. Despite the popularity of this approach for safety and alignment interventions, prior work has almost exclusively focused on single-turn chat settings. Given that actual LLM deployments increasingly instantiate models as tool-using agents, it is critical to understand if and how activation steering generalizes across these modes of use.

Experimental Protocol and Matched-Information Design

The study introduces a five-rung matched-information ladder (C0–C4), ranging from byte-identical harmful instructions in single-turn chat (C0) through progressively more agentic wrappers, culminating in a ReAct agent with a deterministic real tool (C3). The protocol explicitly rules out KV-cache contamination, employs tightly matched-norm random control directions, and provides both a representation-level (residual projection) and behavioral (judge-scored compliance/refusal rate) readout for every matched input. All behavioral results are direction-gated against the strongest random control, ensuring strict direction-specificity.

Figure 1: Setup schematic illustrating additive steering direction injection and matched read/write protocol across chat and agent settings.

Survival of Representation and Rescaling of Behavioral Coupling

A core contribution is the dissociation between representation and behavior in chat-to-agent transfer. The injected steering direction survives into the agent's late residual stream at near-full or sometimes amplified strength (agent-over-chat install-site ratios 0.83–1.16 across Qwen2.5-7B, Llama-3.1-8B, Gemma-2-9B-IT). However, the degree to which this activation drives behavior is not conserved; behavioral coupling is rescaled per model and deployment context.

On Qwen2.5-7B, refusal bypass is amplified in the agent ($T = 1.45$, 95% CI [1.20, 1.78], $N = 300$), while induction of refusal (on harmless prompts) is saturated ($T \geq 3.68$). In contrast, Llama-3.1-8B exhibits no agentic amplification of behavioral steering (bypass and induce arms include the null within their CIs). Gemma-2-9B shows even stronger amplification ($T = 2.00$), and Yi-1.5-9B demonstrates clear attenuation ($T = 0.43$). Across eight families, there is no universal constant nor sign for the chat-to-agent steering effect; the distribution is two-sided, spanning amplification to attenuation.

Figure 2: Per-model coupling distribution $T_{\text{family}}$ illustrating the diversity of rescaling across major LLMs; no universal transfer constant or sign.

Mechanistic Dissection: Additive vs. Ablation and Frame Priming Localization

Mechanistically, amplification in behavioral coupling is specific to the additive injection mechanism. Directional ablation—removing the refusal direction via rank-1 updates—does not amplify in agents ($T = 0.93$), while additive injection does ($T = 1.50$), with a 20.1-point gain (CI [13.4, 26.8]), replicated in sign on Llama-3.1-8B.

Through two pre-registered, convergent localization instruments, the study demonstrates that coupling rescaling is set by the adoption of the ReAct format scaffold, not by tool observation or multi-turn context accumulation. Nested input-frame ablations show all agentic amplification is committed by the ReAct scaffolding step (104% of endpoint gain), while incremental additions (role header, tool schemas, observation processing) and post-observation blocks contribute statistically zero.

Figure 3: Frame-priming localization showing (left) gain attribution to the ReAct format addition, (right) phase-restricted coupling indicating rescaling occurs pre-observation.

Post-observation injection—i.e., after reading tool outputs—has zero effect; only pre-observation injection drives behavior. No effect "locks in" via prefill-state overwriting; continuous injection per-token is required, emphasizing the fundamental difference from ablation.

Theoretical and Practical Implications

The output-level baseline-shift and belief dynamics models—predicting additivity and universal transfer—are decisively falsified. Sycophancy, as a control axis, does not amplify in agents, and the sign of behavioral rescale is behavior- and context-dependent, with no single mechanistic law.

The safety implications are immediate and bidirectional:

• Amplification: Some agent deployments (Qwen2.5-7B, Gemma-2-9B) become more vulnerable to steering-based jailbreaks—additive injection makes safety bypasses up to $2.00\times$ more effective than in chat, on top of any context-driven baseline erosion.
• Attenuation: Models like Yi-1.5-9B reduce behavioral coupling, potentially muting steering attacks.
• No transferability guarantee: A model's safety margin in chat under steering does not predict its agentic vulnerability; every deployment must be evaluated in its operational context.

Meanwhile, activation-level safety monitoring transfers robustly—a chat-trained probe remains predictive inside the agent. However, control must always be recalibrated per deployment; chat-side coupling is not informative for the agent.

Limitations and Future Directions

Most mechanistic dissection is performed on Qwen2.5-7B, though trends hold on Llama and Gemma. The study does not benchmark external agent frameworks (e.g., tau2-bench) or evaluate SHADE-Arena comparative safety. Only one family (Yi) is a clean attenuator, so claims about universal attenuation are not supported; practical "no universal sign" statements rest on this single case. The search for a closed-form law predicting coupling sign remains open and behavior-specific.

Further work should expand the coupling distribution with more diverse architectures, cover more deployment wrappers, and develop mechanistic accounts translating format-specific context features into activation–behavior transfer.

Conclusion

Additive activation steering's representation survives near fully in agent deployments, but behavioral efficacy is idiosyncratically rescaled by agentic format adoption. The behavioral transfer ratio spans clean amplification to attenuation with no universal law, and the mechanism depends on continuous additive injection at the frame-priming step. The safety-critical takeaway is that steering vulnerability in chat cannot be extrapolated to agents; every deployment must be empirically characterized for both monitoring and control.

(2607.09156)