Where Steering Signals Come From: Activation Source Selection in Activation Steering

Abstract: Activation steering controls LLMs by adding vectors or features to hidden states at inference time, but the upstream source of these steering signals is often treated as a secondary detail. We study this source choice as activation source selection: the combination of source context and activation readout policy used to collect the hidden states from which a steering signal is built. Holding the downstream intervention fixed, we show across three instruction-tuned models and four steering task families that changing only the source activations substantially changes steering success. We further find that effective steering is not explained simply by whether the desired behavior appears in the source text. Instead, strong signals come from execution-boundary states, where the model is about to produce or continue the target behavior. This pre-/post-realization distinction explains why answer-based sources sometimes work: their useful component aligns with execution-boundary directions rather than target appearance alone. Building on this view, we introduce tail subtraction, which removes shared prompt and continuation semantics from boundary states and yields cleaner, more stable steering signals. Overall, our results suggest that steering depends on representations of what the model is about to do, not merely on what has already appeared.

• The paper demonstrates that the effectiveness of activation steering in language models is significantly influenced by the selection of activation sources, with pre-target production states outperforming post-target states, as it consistently improves steering success. It finds that prompt-only states show a 47.6% success rate compared to 19.8% for answer-only states, and that tail subtraction increases success by up to 26.2 percentage points.
• "Hybrid + last", combining instructions and demonstrations, performs best with up to 65.1% success, indicating that demonstration format influences steering effectiveness.
• Beyond average performance, the authors clarify the difference between execution-boundary states, crucial for steering, and post-realization target traces

Activation steering is typically presented as an intervention problem: a vector is constructed from hidden states and added to the residual stream during generation. “Where Steering Signals Come From: Activation Source Selection in Activation Steering” (2607.25270) argues that this framing omits a consequential upstream variable. The source context used to elicit activations, together with the policy used to read those activations, can substantially determine whether the resulting vector steers behavior successfully. The paper therefore treats activation source selection as an explicit design dimension, distinct from vector construction and intervention.

Problem formulation and methodological scope

Let a source-selection condition specify both a context-construction function and a readout policy. The context may contain only an instruction and user query, an instruction followed by a target-bearing answer, or the answer without its prompt. The readout may select the final token state or average hidden states across the sequence. These choices define the source activations from which standard steering vectors are estimated.

The study deliberately holds the downstream procedure fixed. It evaluates additive activation steering, with vectors constructed using Mean, Diff-Mean, PCA, Diff-PCA, and SAE-consensus methods. Source layers, intervention layers, and steering strengths are selected through a common search protocol. This design isolates the effect of source activations rather than conflating it with improvements to vector estimation or injection. The setting is consequently narrower than the full space of representation interventions studied in work such as “Representation Engineering: A Top-Down Approach to AI Transparency” (Zou et al., 2023), “Steering Llama 2 via Contrastive Activation Addition” (Turner et al., 2023), and feature-level SAE methods (He et al., 17 Feb 2025).

Experiments use Gemma-2-9B-IT, Qwen2.5-7B-Instruct, and Llama-3.1-8B-Instruct. The behavioral evaluation covers 20 targets in four families: 11 entities, seven persona or style attributes, refusal, and nonsense generation. The evaluation contains 1,950 target–question instances per model. A generation is counted as successful only if it expresses the target behavior and remains readable, thereby excluding degenerate outputs based on token repetition, flooding, or severe corruption. Relation-completion experiments provide a complementary exact-match evaluation over 16 tasks and 958 input–output pairs.

The central comparison distinguishes three coarse source contexts. Prompt-only contains the target instruction and query but no response. Prompt-and-answer adds a response exhibiting the target. Answer-only contains only the target-bearing response. Each is paired with either last-token or sequence-mean readout.

Source activations have a large effect

Changing only the source activations produces large changes in steering success. Across the three models and vector-construction methods, prompt-only with last-token readout is strongest on average, whereas answer-only sources are consistently weak despite visibly containing the target behavior.

Source condition	Llama	Qwen	Gemma	Mean
Prompt-only + last token	33.6%	50.6%	58.6%	47.6%
Prompt-only + sequence mean	16.4%	40.0%	43.5%	33.3%
Prompt-and-answer + last token	6.0%	21.0%	47.3%	24.8%
Prompt-and-answer + sequence mean	23.1%	52.7%	52.1%	42.6%
Answer-only + last token	7.8%	24.1%	33.0%	21.6%
Answer-only + sequence mean	11.9%	19.3%	28.1%	19.8%

The best and worst aggregate conditions differ by more than twofold: prompt-only plus last-token readout reaches 47.6%, while answer-only plus sequence mean reaches 19.8%. The result challenges the common assumption that activations collected from text already exhibiting the desired behavior are automatically suitable steering sources. Target visibility is not equivalent to causal usefulness for reproducing the target elsewhere.

The stronger performance of prompt-only final-token states is consistent with an execution-oriented interpretation. The target instruction has been integrated into the model’s current context, but the target response has not yet appeared. The final state therefore reflects a model poised to begin generation under the target condition rather than a state encoding text that has already been produced.

Figure 1: Source context and activation readout substantially alter steering behavior; pre-realization boundary states outperform post-realization target traces under a fixed intervention pipeline.

The authors’ aggregation protocol reports the best score over layer and strength grids, so the values measure steering potential under the shared diagnostic protocol rather than performance at a single deployment configuration. A held-out selection experiment nonetheless supports the source effect: relative to answer-only plus mean, prompt-only plus last yields gains of 0.198, 0.287, and 0.281 for Llama, Qwen, and Gemma, respectively; hybrid plus last yields gains of 0.253, 0.414, and 0.320. All reported uncertainty intervals exclude zero.

Execution-boundary states versus target-appearance states

The paper formalizes two phases of computation. Given an open context $p$ and a target-bearing continuation $a$, the execution-boundary state is the hidden state immediately before the continuation begins. A post-realization trace state is read after some prefix of the target continuation has already appeared. The distinction is functional rather than merely positional: the former represents preparation to execute a behavior, whereas the latter records a state after some realization of that behavior.

To test the distinction, the authors construct three boundary sources:

• Instruction + last: a target instruction followed by an open question and an incomplete assistant prefix.
• ICL + last: target-bearing demonstrations followed by the same type of open boundary.
• Hybrid + last: both the instruction and demonstrations followed by the open boundary.

The final hidden state is always read before the target continuation is generated. The hybrid construction performs best across all three models, with success rates of 38.9% for Llama, 64.0% for Qwen, and 62.5% for Gemma. Instruction + last reaches 33.8%, 55.5%, and 55.7%, respectively. ICL + last is substantially weaker at 16.0%, 20.1%, and 28.1%, indicating that demonstrations alone do not reliably establish the intended execution boundary. The result is compatible with known sensitivity of in-context learning to demonstration format and task structure (Subramani et al., 2022).

The comparison is particularly strong in relation completion, where target appearance is naturally separated from execution. The model must infer and execute a mapping before producing the answer; once the answer is present, the local computation is largely complete.

Source condition	Llama	Qwen	Gemma
Instruction + last	60.8%	56.7%	64.9%
ICL + last	55.0%	34.6%	55.5%
Hybrid + last	64.2%	63.1%	65.1%
Post-realization + mean	12.8%	12.3%	11.4%

The gap is decisive: hybrid boundary sources achieve 63.1–65.1%, whereas post-realization mean sources achieve only 11.4–12.8%. Because the answer appears in the latter condition but the relevant relation has already been executed, the result provides direct evidence against target appearance as a sufficient explanation. The residual nonzero performance of post-realization sources leaves open a weaker contribution from answer content itself, but that contribution is far smaller than the pre-generation execution signal.

Why answer-bearing sources sometimes work

The paper does not claim that answer-based sources are entirely useless. Prompt-and-answer plus sequence mean reaches 42.6% on average in the coarse comparison and is substantially stronger than answer-only plus mean. The proposed explanation is that answer-bearing averages produce mixed states. Some positions encode post-realization content, while later positions also encode continuation or maintenance of the target behavior. This is especially plausible for style and persona attributes, where a generated answer must sustain a tone across multiple tokens.

A mean over an answer can consequently contain an execution-continuation component even though the target is already visible. Boundary readout accesses this component more directly and with less contamination from post-realization traces. Relation completion provides an unentangled test because the answer does not normally continue the same behavior after it appears.

The authors further test the mixed-state account by removing the component of answer-based vectors aligned with a Diff-PCA direction derived from boundary states. Projection ablation consistently reduces steering:

Source	Model	Before	After	Drop
Answer-only + mean	Gemma	28.1%	20.8%	7.3 points
Answer-only + mean	Llama	11.9%	8.7%	3.2 points
Answer-only + mean	Qwen	19.3%	12.3%	7.0 points
Prompt-and-answer + mean	Gemma	52.1%	30.5%	21.6 points
Prompt-and-answer + mean	Llama	23.1%	14.9%	8.2 points
Prompt-and-answer + mean	Qwen	52.7%	33.4%	19.3 points

The larger degradation for prompt-and-answer sources is important. Their useful signal is not explained solely by the presence of target-bearing text; removing the boundary-derived execution component eliminates 8.2–21.6 percentage points of success. The weaker effect for answer-only sources is consistent with their already limited execution-relevant content.

Tail subtraction as phase-aware source construction

Boundary states are more steerable, but they contain nuisance semantics. A full boundary context includes the target instruction or demonstrations as well as the final question, chat-format tokens, assistant prefix, and generic continuation cues. The paper therefore introduces tail subtraction.

For each target-conditioned boundary context, a matched tail-only context retains the local user question and assistant prefix while removing target conditioning. The source activation is the residual between the full and tail-only final states. This operation aims to remove shared local continuation semantics while retaining target-conditioned execution information.

The cosine diagnostic supports the need for this subtraction. Full and tail-only states have cosine similarities of 0.7715 for Gemma, 0.5548 for Llama, and 0.8241 for Qwen. The full-minus-tail residual is much less aligned with the full state for Gemma and Qwen, at 0.2404 and 0.2281, respectively. Thus, much of the boundary representation in those models is shared local continuation structure rather than target-specific information. Llama exhibits a weaker tail component, with full–tail similarity of 0.5548 and residual–full similarity of 0.5205.

Tail subtraction improves both simple mean and PCA constructions:

Model	Mean positive-only	Mean negative-subtracted	Mean tail-subtracted	PCA positive-only	PCA negative-subtracted	PCA tail-subtracted
Gemma	28.8%	60.1%	86.3%	61.3%	76.9%	86.2%
Llama	16.8%	34.8%	54.6%	22.6%	47.5%	59.0%
Qwen	40.6%	58.4%	72.5%	51.7%	65.0%	77.0%

The improvement is systematic rather than confined to one vector estimator. For Gemma, tail subtraction raises mean steering from 60.1% with negative subtraction to 86.3%, a gain of 26.2 percentage points. For Qwen, PCA improves from 65.0% to 77.0%. Llama gains are smaller but remain positive for both mean and PCA. The correspondence between large tail similarity and large gains supports the interpretation that matched residualization removes a substantial source of representational variance.

This construction should nevertheless be understood as a diagnostic source estimator, not as a universally optimal intervention. It assumes that the tail-only context preserves nuisance continuation semantics while excluding the target-conditioned computation. That assumption may fail when target behavior changes the local syntax, assistant prefix, or discourse state itself.

Limitations and open questions

The empirical claims are restricted to additive activation steering and do not establish that execution-boundary source selection governs projection-based interventions, dynamic steering, layer-dependent injection, neuron-level edits, subspace methods, or SAE feature interventions. Although SAE-consensus vectors are included for some models, the study does not evaluate the full interaction between source selection and structured or nonlinear estimators.

The model scope is also limited to three instruction-tuned models in the 7B–9B range. Base models, larger models, multilingual and multimodal models, long-context settings, and multi-turn conversations are not tested. Consequently, the cross-model consistency shown here does not determine whether the execution-boundary effect is scale-invariant or architecture-independent.

Behavioral results rely primarily on an automatic judge. Agreement with independent validation labels is 87.0% overall, ranging from 82.0% for refusal to 92.0% for entity steering. Rescoring with Gemma-3-27B preserves the source-condition ordering, but automatic evaluation can still miss subtle quality and safety failures. In addition, best-over-grid reporting can overstate performance relative to a fixed, preselected layer and steering strength.

Finally, tail subtraction is only one residualization strategy. The paper leaves open whether nuisance components should be removed using learned subspaces, tokenwise causal mediation, task-specific probes, or nonlinear conditional estimators. It also does not establish whether the identified boundary directions correspond to a single interpretable representation or to a distributed mixture whose composition varies across layers and behaviors.

Conclusion

The paper establishes activation source selection as a first-class variable in activation steering. Across heterogeneous behavioral tasks, relation completion, three instruction-tuned models, and multiple vector-construction methods, states read immediately before target production are generally more effective than states extracted after target appearance. Answer-based sources work when they contain mixed execution-continuation information, not merely because the target text is visible. Tail subtraction operationalizes this account and produces substantial gains, reaching up to 86.3% macro success in the reported experiments. The principal unresolved issue is how broadly execution-boundary semantics and phase-aware residualization extend beyond additive steering and the model-task regimes evaluated here.