Inference-Time Activation Steering

• Inference-time activation steering is a method that adjusts a frozen model’s hidden activations during decoding to promote desired behaviors such as truthfulness and safety.
• It employs strategies like additive modifications, norm-preserving rotations, and context-dependent token interventions to steer internal representations.
• Recent studies demonstrate improvements in calibration, reasoning efficiency, and refusal control by dynamically modulating activation vectors based on contrastive signals.

Searching arXiv for papers on inference-time activation steering and related methods. Inference-time activation steering refers to modifying a LLM’s hidden activations during decoding—without changing any weights—to push the model toward desired behaviors such as truthfulness, safety, style, calibration, or task-specific control (You et al., 9 Feb 2026). In its canonical form, a frozen model with hidden state $h^{(l)}$ at layer $l$ is steered by adding a direction $v$ with strength $\alpha$, yielding $h^{(l)\prime} = h^{(l)} + \alpha v$; subsequent work generalizes this basic primitive to layer-wise weighting, feature-level edits, norm-preserving rotations, context-dependent vector fields, and multi-step flows (Hegazy et al., 22 May 2025). The literature represented here treats activation steering not as a single algorithm but as a family of inference-time interventions defined by three coupled choices: how the steering signal is estimated, how it is applied inside the network, and how its attribute–utility trade-off is controlled.

1. Core formalism and representational assumptions

The standard formalism assumes a decoder-only transformer with residual-stream or hidden-state activations $h^{(l)} \in \mathbb{R}^d$ at layer $l$. A steering intervention modifies these activations during generation while keeping the base parameters frozen, usually by an additive update $h^{(l)\prime} = h^{(l)} + \lambda \mu$ or $h'_{l,t} = h_{l,t} + \alpha \cdot d_{\text{steer}}$, where $\mu$ or $l$0 encodes a target concept and the scalar coefficient controls intervention strength (You et al., 9 Feb 2026). This additive template underlies linear steering, contrastive activation addition, and many contrastive residual-stream methods, and it is also the point of departure for later geometry-aware and adaptive variants.

Although the simplest description uses a single global vector, the intervention site varies substantially across the literature. Some methods act on residual-stream activations at selected layers, some operate on attention-head outputs, and some use internal activations only as a lens for downstream corrections rather than directly editing the residual stream (Zhan et al., 10 Jun 2025). Instruction-following work computes instruction-specific vectors from residual activations at the last input token and then adds them at a chosen layer for all token positions, explicitly treating the residual stream as a carrier of a reusable instruction representation (Stolfo et al., 2024).

A recurrent assumption in early steering work is that a target behavior can be approximated by a relatively linear direction in representation space. Several later papers problematize this assumption. Spherical Steering argues that modern LMs rely on RMSNorm or LayerNorm and therefore encode useful information primarily in directions rather than norms, while SVF and FLAS argue that the locally effective steering direction can vary with the current activation, token, and generation stage (Li et al., 2 Feb 2026). This suggests that inference-time steering is best understood as a spectrum ranging from fixed global shifts to explicitly state-dependent transport operators.

2. Estimating steering signals

A large fraction of the literature estimates steering directions contrastively. One common recipe is to compute layer-wise means of positive and negative activations and take their difference, as in the prototype direction $l$1 with $l$2 for truthful versus hallucinated answers (You et al., 9 Feb 2026). Instruction-following work uses a closely related construction, but the contrast is “query with instruction” versus “query without instruction,” producing an instruction-specific difference-in-means vector at each layer (Stolfo et al., 2024). Activation-steered compression applies the same logic to reasoning style, averaging the difference between concise and verbose chain-of-thought end states to obtain a “concise-minus-verbose” steering vector (Azizi et al., 7 Jul 2025).

Other work replaces activation-space contrast with alternative sources of semantic signal. Weighted Activation Steering constructs a refusal direction directly from token embeddings: if $l$3 and $l$4 are average embeddings of refusal and answer token sets, then

$l$5

yielding a fixed output-embedding-level refusal direction that is later modulated by a controller (Hegazy et al., 22 May 2025). LF-Steering instead maps a selected layer into a sparse, overcomplete feature space with a TopK sparse autoencoder and then identifies inconsistency-related latent features by averaging absolute differences between correct and incorrect paraphrase pairs, thereby moving the estimation problem from component-level activations to sparse latent features (Yang et al., 19 Jan 2025).

Recent work also emphasizes the data distribution under which steering vectors are estimated. ROAST argues that many prior methods estimate directions under teacher forcing and apply them under autoregressive rollouts, then replaces this with rollout-based on-distribution contrastive pairs generated from the model’s own sampled continuations (Su et al., 15 Feb 2026). GrAInS uses a different route to specificity: it defines a preference objective $l$6, computes Integrated Gradients over token embeddings, selects the top-$l$7 most positive and most negative tokens, and derives layer-wise steering vectors from the activation changes induced by masking those tokens and aggregating the resulting deltas with PCA (Nguyen et al., 24 Jul 2025). This shifts the estimation problem from “which average activation difference matters” to “which causally influential tokens generate a stable directional signal.”

3. Intervention operators and geometric primitives

The dominant primitive remains additive activation steering, but the intervention geometry has diversified sharply. Weighted Activation Steering augments the additive template with prompt-conditioned magnitude and layer allocation: $l$8 where a lightweight MLP controller predicts a scalar $l$9 and layer weights $v$0, producing a discriminative, adaptive, layer-aware patch applied across all layers of a frozen model (Hegazy et al., 22 May 2025).

Spherical Steering replaces addition with norm-preserving geodesic rotation. Given a normalized activation direction $v$1, a target prototype $v$2, and angle $v$3, it uses spherical linear interpolation

$v$4

and then restores the original norm, so $v$5 by construction (You et al., 9 Feb 2026). The explicit goal is to avoid the uncontrolled norm changes induced by addition and thereby maintain open-ended generation quality.

SVF generalizes the steering vector itself from a constant to a vector field. It learns a differentiable concept scorer $v$6 in a shared low-dimensional concept space and defines the steering direction at each hidden state by

$v$7

so the intervention depends explicitly on the current activation and can be coordinated across multiple layers through a shared projection and layer-conditioned calibration (Li et al., 2 Feb 2026). FLAS pushes this further by treating steering as integrating a concept-conditioned velocity field: $v$8 implemented with forward Euler steps and a FlowBlock that uses time embeddings, cross-attention to the concept text, and causal self-attention over tokens (Jin et al., 7 May 2026). In this formulation, earlier one-shot steering vectors are a special case with a constant velocity field and $v$9.

Not all intervention operators are additive or rotational. In masked diffusion LLMs, steering can be implemented as directional ablation: for a unit steering vector $\alpha$0, the steered activation removes the component along that direction,

$\alpha$1

and applies this at selected layers and token sets during every reverse-diffusion step (Shnaidman et al., 30 Dec 2025). This formulation shows that inference-time activation steering is not restricted to autoregressive addition and can instead be framed as subtraction, rotation, or continuous transport depending on the representational hypothesis.

4. Adaptive, selective, and structured control

A major theme in recent work is that uniform interventions are often too crude. Weighted Activation Steering is prompt-level adaptive: it records activations from selected layers at the last prompt token, predicts a continuous steering score $\alpha$2 together with layer-wise weights $\alpha$3, and is trained discriminatively so that harmful prompts map to $\alpha$4 and benign prompts to $\alpha$5 (Hegazy et al., 22 May 2025). Spherical Steering adds a vMF-based confidence gate: it computes directional evidence for truthful versus hallucinated prototypes, maps the resulting score through a thresholded function to a strength $\alpha$6, and only rotates activations that appear sufficiently hallucination-like (You et al., 9 Feb 2026).

Selectivity can also be imposed at the level of representation granularity. LF-Steering identifies a top-1 transformer layer via a consistency classifier, learns a sparse autoencoder on that layer, selects top-$\alpha$7 inconsistency-related latent features, and only modifies those features when they are active for the current prompt (Yang et al., 19 Jan 2025). DEAL performs a different granularity reduction: for each attention head it trains a VQ-AE, quantizes head activations into code sequences, scores heads by the AUC-ROC with which a learned prior distinguishes behavior-aligned and behavior-violating codes, and then uses those scores both for head selection and for weighting head-level steering contributions (Zhan et al., 10 Jun 2025). GrAInS enforces selectivity upstream, at the token level, by identifying the top-$\alpha$8 positively and negatively attributed tokens and constructing steering vectors from the activation shifts caused by removing them (Nguyen et al., 24 Jul 2025).

Several papers further organize steering into higher-level structures. Steer2Adapt assumes that tasks within a domain share a small set of underlying concept dimensions, constructs a reusable low-dimensional semantic prior subspace from basis steering vectors, and then adapts to a new task by searching for a linear combination $\alpha$9 using only a small calibration set and a risk-averse objective that heavily penalizes regressions on already-correct examples (Han et al., 7 Feb 2026). CORAL sits adjacent to direct activation editing: it probes a middle residual-stream layer with a regularized MLP trained on residual correctness $h^{(l)\prime} = h^{(l)} + \alpha v$0, then uses the probe output to redistribute per-option probability mass in MCQA, thereby turning internal activations into a calibration-aware steering signal rather than a residual-stream patch (Miao et al., 5 Feb 2026). This suggests that “activation steering” has broadened from literal vector addition to a wider family of inference-time control schemes that read hidden states and then decide where and how to intervene.

5. Empirical regimes and applications

Safety and refusal control remain a central application. Weighted Activation Steering reports that on Llama-3.1-8B, refusal rates rise from 32.0% to 93.0% on ToxicChat, from 12.2% to 78.9% on In-The-Wild Jailbreak Prompts, and from 91.5% to 98.8% on AdvBench, while AlpacaEval win rates against the base model remain statistically indistinguishable from 50% and MMLU/HellaSwag drops are small to modest (Hegazy et al., 22 May 2025). In masked diffusion LLMs, prompt+response steering can drive keyword-based refusal from 87.56% to 0.03% while reducing LLaMA Guard safety from 96.88% to 29.70%, whereas response-only steering also suppresses refusal phrases to 0.03% but leaves safety at 95.31%; this separation makes explicit that surface refusal behavior and content safety need not move together (Shnaidman et al., 30 Dec 2025).

Truthfulness and hallucination control motivate many of the newer geometric formulations. On LLaMA-3.1-8B-Instruct, Spherical Steering raises TruthfulQA MC average from 38.16 to 53.17 and TRUE×INFO from 48.24 to 54.63, and on a broader average over TruthfulQA MC1, COPA, StoryCloze, MMLU, WinoGrande, and BoolQ it reaches 71.96% versus a 63.90% baseline (You et al., 9 Feb 2026). GrAInS reports a 13.22% accuracy gain on TruthfulQA with Llama-3.1-8B, reduces hallucination rate on MMHal-Bench from 0.624 to 0.514 with LLaVA-1.6-7B, and improves alignment win rates on SPA-VL by 8.11%, while keeping MMLU and MMMU nearly unchanged relative to the base model (Nguyen et al., 24 Jul 2025). FLAS addresses the stronger zero-shot control setting of AxBench and is reported as the first learned method to consistently outperform prompting, reaching held-out harmonic means of 1.015 on Gemma-2-2B-IT and 1.113 on Gemma-2-9B-IT without per-concept tuning (Jin et al., 7 May 2026).

Inference-time steering has also been used for correctness, calibration, reasoning efficiency, semantic consistency, and instruction following. CORAL improves accuracy by 10% and expected calibration error by 50% on average across three 7B models, and transfers without retraining to held-out benchmarks with 14% accuracy improvements and 49% ECE improvements (Miao et al., 5 Feb 2026). Activation-Steered Compression shortens chain-of-thought traces by up to 67.43% on MATH500 and GSM8K while maintaining accuracy across 7B, 8B, and 32B models, and on MATH500 reports an average 2.73x speedup in end-to-end reasoning wall-clock time on an 8B model (Azizi et al., 7 Jul 2025). LF-Steering improves semantic consistency on paraphrase-robust NLU and NLG tasks, including a rise on RobustBOOLQ from $h^{(l)\prime} = h^{(l)} + \alpha v$1 to $h^{(l)\prime} = h^{(l)} + \alpha v$2, while preserving out-of-domain performance on AG News, IMDB, CNN/Daily Mail, and XSum within small margins (Yang et al., 19 Jan 2025). Instruction-specific activation vectors can improve adherence to format, length, and word inclusion constraints, can be composed across multiple instructions, and can transfer from instruction-tuned Gemma models to their base counterparts (Stolfo et al., 2024). Steer2Adapt, which searches over low-dimensional combinations of basis vectors, reports an average improvement of 8.2% across 9 tasks and 3 models in reasoning and safety domains (Han et al., 7 Feb 2026).

A parallel empirical line asks when steering succeeds at all. ASTEER introduces 1.4M steered generations over 150 concepts and shows that early hidden states encode enough structure to predict whether a run will under-steer, succeed, or over-steer; a GBDT classifier trained on early geometry and decoding-dynamics features reaches around 0.7 macro-F1 score on unseen concepts, and when used to guide strength search it achieves near-optimal steering with a small fraction of decoding cost (Fan et al., 10 Jun 2026). This suggests that steerability itself is a measurable property of the activation trajectory rather than a purely post hoc outcome.

6. Limitations, diagnostics, and neighboring directions

The literature is unusually explicit about failure modes. Weighted Activation Steering notes dependence on steering-vector quality, sensitivity to $h^{(l)\prime} = h^{(l)} + \alpha v$3, possible false positives on benign but unusual prompts, and the possibility that sophisticated attackers induce activations resembling benign prompts (Hegazy et al., 22 May 2025). Spherical Steering highlights over-steering at high $h^{(l)\prime} = h^{(l)} + \alpha v$4, degradation when too many layers are rotated, and dependence on the quality of the contrastive prototype direction (You et al., 9 Feb 2026). ROAST argues that teacher-forced steering directions are intrinsically brittle under rollout shift and that hard sparsification discards too much activation energy, motivating on-distribution contrast and continuous normalization instead (Su et al., 15 Feb 2026). FLAS, despite its strong AxBench results, incurs per-token overhead, is trained separately for each backbone, and has so far been evaluated primarily in the concept-control setting (Jin et al., 7 May 2026).

A broader conceptual tension concerns where behavioral information resides. DEAL shows that head-wise behavioral relevance scores derived from VQ-AE encodings can identify small sets of heads whose weighted steering materially improves truthfulness, including on grouped-query-attention models where ITI fails (Zhan et al., 10 Jun 2025). CORAL, by contrast, finds that correctness and calibration signals are distributed across many neurons and heads, with single SAE features and single attention heads having negligible causal effect in MCQA (Miao et al., 5 Feb 2026). This suggests that localization is behavior-dependent: some attributes admit sparse head-level handles, whereas others appear to require dense residual probes or multi-layer aggregation. A related tension appears between fixed-vector and context-dependent geometries. SVF argues that anti-steerable behavior and multi-attribute brittleness arise because a single global vector is misaligned with the locally effective direction, while FLAS reports curved, multi-step, token-varying trajectories that challenge the hypothesis that a concept is adequately represented by a single global displacement (Li et al., 2 Feb 2026).

Finally, the boundary between inference-time steering and model editing has become porous. Steer2Edit converts steering vectors into component-level rank-1 weight updates and reports more favorable attribute–utility trade-offs than direct activation injection, improving safety by up to 17.2%, increasing truthfulness by 9.8%, and reducing reasoning length by 12.2% on average at matched downstream performance (Sun et al., 10 Feb 2026). This does not replace inference-time activation steering as a concept; rather, it shows that steering directions can serve both as online intervention signals and as diagnostic signals for offline component-level editing. A plausible implication is that future work will treat activation steering less as a single mechanism and more as an interface layer between representation discovery, runtime control, and structured model modification.