Probe-Based Steering: Methods & Applications

• Probe-based steering is a control strategy that uses auxiliary signals to determine intervention directions across digital and physical domains.
• In activation engineering, probes such as linear classifiers extract latent state features to guide token generation and model behavior.
• The approach separates sensing from actuation, enabling context-dependent adjustments that improve performance in language models, LiDAR, and robotics.

Probe-based steering denotes a family of control schemes in which an auxiliary probe determines where, when, or how strongly a system is steered. In contemporary arXiv literature, the term covers at least two technically distinct traditions. In mechanistic interpretability and activation engineering, the probe is typically a linear classifier, contrastive activation statistic, or related representational readout whose direction is reused as an intervention vector in hidden-state space. In sensing and robotics, the probe is a physical channel or instrument whose measured state reveals or guides the steering target, as in heralded quantum beam steering or image-guided needle orientation. Across these settings, a recurring architectural pattern is the separation of sensing from actuation: the probe reads latent state, predicts future behavior, or reveals an otherwise hidden observation direction, and steering then acts conditionally on that information (Hsu et al., 27 Apr 2026, Zhang et al., 9 Feb 2026, Kim et al., 12 Nov 2025).

1. Scope and recurring architecture

The modern literature uses “probe-based steering” for methods that derive an intervention from an auxiliary signal rather than from direct parameter updates. In LLMs, the canonical form is residual-stream intervention,

$h'(x) = h(x) + \alpha v,$

where $v$ is probe-derived and $\alpha$ controls intervention strength; CIS makes this coefficient the continuous experimental variable for studying graded pragmatic interpretation (Cho, 8 Apr 2026). In other works, the probe is not merely a detector but also a gate, a site selector, or a controller: CLAS keeps the probe-derived direction fixed and learns a context-dependent gain, GSS separates a probe direction $u$ from a steering direction $v$, and FASB reuses probes both to select heads and to trigger online backtracking interventions (Hsu et al., 27 Apr 2026, Zhang et al., 9 Feb 2026, Cheng et al., 25 Aug 2025).

The same abstraction appears outside LLMs. In quantum LiDAR, the “probe” photon is physically steered by its randomly generated wavelength, while the heralding photon later reveals the direction through dispersive timing; the direction is therefore unknown until after measurement (Kim et al., 12 Nov 2025). In robotic biopsy and trans-esophageal echocardiography, the probe is a physical instrument whose orientation is actively guided by image registration, tracking, or remote-control interfaces rather than by static manual positioning (Lagomarsino et al., 2021, Wang et al., 2020).

Domain	Probe role	Steering target
LLM activation steering	Read out concept, behavior, or state from activations	Residual stream, heads, or token trajectory
Audio-LLMs	Contrast instruction-conditioned hidden states	Temporal attention over audio tokens
Quantum LiDAR	Heralding photon reveals probe wavelength/direction	Free-space beam angle and range association
Medical robotics	Imaging/tracking estimates target geometry	Probe tip or needle orientation

A central design choice across these domains is whether the probe and the steer are identified with the same direction. Several papers explicitly reject that identification: GSS treats $u$ as a sensor and $v$ as an actuator, CLAS uses probes only for directions and learns separate sensing vectors $c_\ell$, and response-time safety defenses place the probe in a different subspace from the refusal vector itself (Zhang et al., 9 Feb 2026, Hsu et al., 27 Apr 2026, Mitra, 28 Jun 2026).

2. Probe-derived directions in representation space

A large fraction of the literature instantiates probe-based steering as linear direction extraction from hidden activations. In AxBench, a linear probe trained with binary cross-entropy serves both as a concept detector and, after activation addition,

$\Phi_{\text{Steer}}(h_i)=h_i+\alpha \mathbf{w},$

as a steering vector. The benchmark makes the asymmetry between readout and control explicit: the probe reaches mean ROC AUC $0.940$ for concept detection, statistically tied with the best methods, yet its average steering score is only $v$0, far below prompting at $v$1 and below DiffMean at $v$2 (Wu et al., 28 Jan 2025). This directly supports a recurring conclusion in later work: decodability is not itself a guarantee of useful causal control.

Multilingual steering exhibits the same pattern. CLaS-Bench trains a linear binary classifier $v$3 on balanced target-language versus negative-language residual activations, then uses the learned weight vector $v$4 as the normalized residual-stream intervention. On Llama-3.1-8B-Instruct, probe steering attains an average steering score of $v$5, substantially below DiffMean’s $v$6, while retaining high average output relevance $v$7 but low average language forcing success $v$8; the method is therefore coherent more often than it is controlling (Gurgurov et al., 13 Jan 2026).

CIS uses the same basic intervention form but reinterprets $v$9 as a continuous probe of latent interpretive geometry rather than as a fixed control knob. Pragmatic direction is estimated from pragmatic-minus-logical representations, and the steered anchor is judged by cosine proximity to pragmatic versus logical variants. Uniform activation steering yields a global pragmatic shift but destroys item-level scalar diversity, with near-zero and non-significant Spearman correlations to baseline across LLaMA3, Qwen2, Gemma2, and OLMo. Graded steering, by contrast, preserves item-level structure, with $\alpha$0 for LLaMA3, $\alpha$1 for Qwen2, $\alpha$2 for Gemma2, and $\alpha$3 for OLMo, all significant, while Wilcoxon tests remain $\alpha$4 for the global shift (Cho, 8 Apr 2026). The result is important because it reframes probe-based steering as a measurement instrument for representational gradience, not only as a behavior-forcing tool.

Related work on functional metacognition also uses probe-derived residual directions but emphasizes that different latent states have different causal status. Six binary contrasts—Evaluation Awareness, Self-Assessed Capability, Perceived Risk, Computational Effort, Audience Expertise, and Intentionality—are linearly decoded from prompt last-token hidden states. Best-layer probe accuracy rises from average $\alpha$5 on Qwen3-0.6B to $\alpha$6 on Qwen3-14B and to approximately $\alpha$7 on Qwen3-30B-A3B and Qwen3-235B-A22B, while pairwise cosine similarity of best-layer probe directions remains near-orthogonal, with max off-diagonal $\alpha$8 and mean off-diagonal below $\alpha$9 in every model (Li et al., 9 May 2026). Yet one of these states, Audience Expertise, is described as “representationally present but read-only,” establishing that linearly separable state variables can exist without yielding strong steerability.

3. Conditional and context-dependent steering

A second major development replaces fixed-coefficient activation addition with probe-conditioned control laws. CLAS is the cleanest formulation. Standard LAS uses

$u$0

where $u$1 is a steering direction and $u$2 is a global scalar. CLAS keeps the probe-derived direction but replaces the scalar with a context-dependent term,

$u$3

where $u$4 is a learned sensing vector. The direction is extracted by an RFM probe as the principal eigenvector of the final AGOP matrix, while only the sensing vectors are trained on next-token prediction loss. Across 11 steering tasks and 4 instruction-tuned models, CLAS outperforms LAS on nearly every model-task pair, averages $u$5 on Qwen2.5-7B and $u$6 on Llama-3.1-70B over 10 tasks excluding JailbreakBench, performs best across all models on JailbreakBench, and retains strong concept-monitoring performance, with RFM average $u$7 on Qwen2.5-7B versus $u$8 for LoRA and $u$9 for ReFT (Hsu et al., 27 Apr 2026).

GSS pushes the separation between detection and correction further. The paper argues that memorization is sparse, intermittent, and token-conditioned, so a uniform intervention damages many nonmemorized tokens. Its gated update,

$v$0

and later rank-$v$1 extension explicitly use $v$2 as the probe and $v$3 as the corrective direction. The threshold is calibrated on generalization activations, typically at the $v$4th percentile of $v$5, so that the gate rarely fires on normal tokens. The method reaches $v$6 memorization on TinyMem across settings while keeping math accuracy near baseline and language perplexity stable; on Pythia-6.9B, memorization drops from $v$7 to $v$8, and on Pythia-2.8B from $v$9 to $u$0, with reported $u$1 less compute than optimization-based alternatives (Zhang et al., 9 Feb 2026).

Token-specific gain prediction appears again in PSR, which treats prompt steering as a nonuniform activation intervention and trains a one-layer ReLU probe to estimate per-token steering coefficients,

$u$2

The intervention becomes

$u$3

Empirically, PSR outperforms constant steering across Persona Vectors and AxBench and often matches or exceeds prompting when coherence is controlled; on Llama-3.1-8B, for example, A-PSR$u$4 reaches $u$5, above prompting at $u$6 (Heyman et al., 5 May 2026). The key mechanistic point is that prompting itself appears to impose highly nonuniform token- and layer-specific intervention magnitudes.

Dynamic intervention over generated text is pushed still further in FASB. The method trains probe heads on last-token attention-head activations, averages their online deviation scores during generation, gates intervention with

$u$7

and, when deviation is detected, backtracks $u$8 tokens to regenerate the offending span under steering. On TruthfulQA open-ended generation, Probe reaches True $u$9, Info $v$0, and True$v$1Info $v$2, above ITI at $v$3. Removing backtracking drops True$v$4Info to $v$5, showing that online gating without corrective rollback is substantially weaker (Cheng et al., 25 Aug 2025).

A more adversarial variant, developed for jailbreaking, combines iterative probe retraining with adaptive strength calibration from contrastive activation statistics. Steering strengths are chosen relative to probe outputs of faithful activations rather than by manual uniform tuning, all token positions are steered, and the last layer is discarded. In the reported experiments, this raises average harmfulness from about $v$6 to $v$7 on fortified models (Chen et al., 19 May 2026). The paper is attack-oriented, but methodologically it reinforces the general lesson that fixed, layer-uniform steering is usually an inadequate approximation.

4. Causality, geometry, and the limits of decodability

A recurrent controversy in the field is whether a good probe identifies a good intervention target. Several papers answer negatively, but for different reasons. GCM argues that correlational probes identify components that encode a behavior, whereas steering requires components that causally mediate the transition between behaviors. Its core quantity is an indirect effect defined by activation patching on individual heads, ranking heads by how much swapping $v$8 into $v$9 increases preference for the contrastive response over the original one. Across refusal, sycophancy reduction, and verse style transfer on three DPO instruction-tuned models, activation patching and attribution patching usually beat the linear-probe ITI baseline, and GCM variants can achieve at least $c_\ell$0 steering success when intervening on at most $c_\ell$1 of heads in many settings (Sankaranarayanan et al., 17 Feb 2026).

Dual steering makes a different critique: even if a linear probe direction is valid, directly adding it in Euclidean hidden-state space may be geometrically mismatched to the model’s softmax output geometry. The paper distinguishes Euclidean steering,

$c_\ell$2

from dual steering,

$c_\ell$3

where $c_\ell$4 is the dual coordinate induced by the log-normalizer of the softmax family. The claimed consequence is robustness: dual steering changes the target concept while minimizing KL distortion to off-target concepts, and empirically it preserves off-target distributions, rank order, and counterfactual mass better than Euclidean steering on Gemma-3-4B and MetaCLIP-2 (Park et al., 17 Feb 2026).

LAP addresses a more practical question: when should a steering vector work at all? Its training-free linear accessibility score,

$c_\ell$5

is logit-lens accuracy at layer $c_\ell$6 for the target concept family. Across 24 controlled binary concept families and five main models, peak $c_\ell$7 predicts maximum steering effect with $c_\ell$8 to $c_\ell$9 and predicts best-layer selection with $\Phi_{\text{Steer}}(h_i)=h_i+\alpha \mathbf{w},$0 to $\Phi_{\text{Steer}}(h_i)=h_i+\alpha \mathbf{w},$1. The paper therefore proposes a three-regime view: low $\Phi_{\text{Steer}}(h_i)=h_i+\alpha \mathbf{w},$2 implies no useful steering, high $\Phi_{\text{Steer}}(h_i)=h_i+\alpha \mathbf{w},$3 but low $\Phi_{\text{Steer}}(h_i)=h_i+\alpha \mathbf{w},$4 implies nonlinear methods may be needed, and high $\Phi_{\text{Steer}}(h_i)=h_i+\alpha \mathbf{w},$5 implies simple difference-of-means steering should work (Billa, 16 Apr 2026). This suggests that output alignment, not generic decodability, is the relevant precondition for causal activation addition.

Prediction-versus-detection is a third axis along which probes and steering can diverge. In large reasoning models, future-behavior probes trained on intermediate sentence-level activations predict future behavioral outcomes with $\Phi_{\text{Steer}}(h_i)=h_i+\alpha \mathbf{w},$6 binarized accuracy. FPCG then uses those probes to select among candidate next sentences rather than directly modifying hidden states. The paper reports that activation steering increases perplexity in $\Phi_{\text{Steer}}(h_i)=h_i+\alpha \mathbf{w},$7 of $\Phi_{\text{Steer}}(h_i)=h_i+\alpha \mathbf{w},$8 scenarios, whereas FPCG does so in only $\Phi_{\text{Steer}}(h_i)=h_i+\alpha \mathbf{w},$9 of $0.940$0, and that FPCG often steers where activation steering fails (Kortukov et al., 9 Jun 2026). The underlying claim is that features detecting behavior already present in text are not the natural intervention targets for chain-of-thought models; prediction features are.

A closely related safety result moves the probe in time rather than in space. “Closing the Activation-Cone Blind Spot” argues that prompt-time activation defenses are structurally blind to prefilling attacks because they examine activations that have already been made benign-looking by the attack template. A response-time linear probe over the first generated tokens reaches AUROC $0.940$1 across seven models and, when combined with a halt, reduces prefilling attack success to $0.940$2 on every model with $0.940$3 benign false positives; composing that response halt with AlphaSteer yields defense success $0.940$4 on Mistral and $0.940$5 on Llama (Mitra, 28 Jun 2026). Here again, the lesson is that probe location and temporal semantics determine causal utility.

5. Cross-modal and behavioral extensions

Probe-based steering is no longer restricted to text generation. In large audio-LLMs, instruction-based vector steering constructs a steering vector by keeping the audio fixed and contrasting hidden states under a focused versus generic instruction,

$0.940$6

Injected with norm preservation into the residual stream, this intervention redistributes temporal attention mass over audio tokens, especially in later layers. In a controlled benchmark of 500 three-event audio samples, the resulting window probe attains $0.940$7 overall overlap on Qwen2-Audio and $0.940$8 on Audio Flamingo 3, far above direct prompting at $0.940$9 and $v$00, respectively (Lin et al., 9 Jun 2026). The paper characterizes this as a training-free probe of latent temporal structure rather than merely an output-control trick.

Behavioral steering through SAE-decoded probe vectors extends the same logic to sparse latent features. On Qwen 3.5-35B-A3B, nine SAEs are trained on residual-stream activations, ridge probes are fit in latent space, and probe weights are decoded back to native residual space via

$v$01

Autonomy steering at multiplier $v$02 reaches Cohen’s $v$03 with $v$04, shifting the model from asking the user for help $v$05 of the time toward proactive code execution and web search. Yet the cross-trait analysis concludes that all five learned steering vectors primarily modulate a single dominant agency axis rather than five independent traits. Decode-only steering has zero effect, with $v$06, implying that behavioral commitment in this GatedDeltaNet/attention architecture is computed during prefill rather than during autoregressive decoding (Yap, 17 Mar 2026).

Functional metacognition adds a related dissociation between representational richness and causal accessibility. Joint steering with normalized probe directions alters verbosity, structure, hedging, and sometimes accuracy, with particularly strong effects for Computational Effort and Self-Assessed Capability; at 30B, concise steering reduces word count by $v$07 and increases accuracy from $v$08 to $v$09, while at 14B capability steering raises GSM8K accuracy from $v$10 to $v$11 (Li et al., 9 May 2026). However, the paper also identifies dimensions that are linearly decoded yet weakly steerable, which aligns with the broader literature’s distinction between readable states and actionable states.

These multimodal and behavioral extensions reinforce two nontrivial points. First, the probe need not be a classifier over labels in the ordinary supervised sense; it can be a contrast between instructions, a sparse latent regressor, or a response-time safety detector. Second, probe-based steering increasingly functions as an interpretability method for exposing latent structure—temporal localization, agency organization, or metacognitive state geometry—as much as a control method for changing outputs (Lin et al., 9 Jun 2026, Yap, 17 Mar 2026, Li et al., 9 May 2026).

6. Physical probe steering in sensing and robotics

In physical systems, probe-based steering often refers to steering an actual probe beam or medical instrument by exploiting a secondary measurement channel. The most explicit quantum example is QEP-LiDAR. A pulsed pump at $v$12 ($v$13) and $v$14 pulse width drives SpFWM in a 1-cm silicon waveguide, generating correlated probe and heralding photons satisfying

$v$15

Because pair frequencies are random from shot to shot, the probe photon’s diffraction angle after a 600-groove/mm grating is random as well. The heralding photon traverses $v$16 of SMF-28 with about $v$17 dispersion, so its arrival time reveals the probe wavelength and therefore the probe direction only after measurement. The system reports angular dispersion $v$18, target distance resolution $v$19, angular resolution $v$20, multiple-target detection in parallel, and up to a $v$21-fold signal-to-noise ratio improvement over classical LiDAR under strong-noise conditions (Kim et al., 12 Nov 2025). The paper explicitly contrasts this with deterministic raster-scanned LiDAR: no mirror angle or control signal reveals the final observation direction in advance.

Medical robotics uses the term in a more literal instrument-guidance sense. An IoT-enabled robotic trans-esophageal echocardiography probe reproduces four manual DOFs, including left-right and up-down steering, and can be controlled over LAN or a 5G hotspot-created WiFi connection. Backlash hysteresis dominates the steering problem: the left-right axis has a deadband of 1200 motor steps, equivalent to about $v$22, and the up-down axis a deadband of 640 motor steps, about $v$23. In target-reaching experiments, mean positioning error is approximately $v$24 for robotic control, maximum overshoots are around $v$25, and the button-based gamepad is faster than the joystick though both are worse than manual control (Wang et al., 2020). Here the probe is the physical TEE instrument, and “probe-based steering” concerns precise orientation under networked teleoperation.

MRI-guided breast biopsy provides a second example of human-in-the-loop probe steering. A hand-mounted motorized tool supplies two needle-orientation DOFs through a differential bevel gear mechanism, while the clinician remains responsible for insertion and tactile contact. Preoperative MRI, intraoperative stereo optical tracking, rigid tool registration, and Thin-Plate Spline deformation compensation are fused to estimate the lesion position and steer the needle toward it. In phantom validation, lesion localization error under TPS is $v$26 mean norm, the final needle-to-lesion Euclidean error is $v$27, and the suspicious lesion is targeted with a radius down to $v$28 (Lagomarsino et al., 2021). The steering is therefore “probe-based” in the physical sense that a biopsy probe is actively oriented by image-derived target estimates rather than inserted under static manual alignment.

A nearby but terminologically distinct use appears in continuous-variable quantum channels, where Gaussian steering is not the control signal but the measured quantity used to probe non-Markovianity. For a two-mode Gaussian probe state, temporary increases in Gaussian steerability witness information backflow, and the sub-Ohmic low-temperature case yields non-Markovianity about $v$29 times larger than the Ohmic case under the reported conditions (Frigerio et al., 2021). This neighboring usage clarifies an important boundary of the term: in some quantum literature, steering itself becomes the probe, whereas in LiDAR and robotics the probe is what gets steered.

Across these physical examples, the common structure remains the same as in activation engineering. A secondary observable—heralding time, optical registration, IMU feedback, or networked control state—reveals or constrains a steering variable that is not directly available at actuation time. Probe-based steering is therefore best understood not as a single algorithm, but as a design pattern for conditional control built around an auxiliary readout channel.