Steering LLMs Without Touching the Weights

Activation steering modifies language model behavior at inference time by adding direction vectors to the residual stream. It is cheaper than fine-tuning, avoids catastrophic forgetting, and works on black-box models. But the practical problem is that someone has to decide where to intervene, which attention heads to target, and how strongly to push. This manual process does not scale across architectures or tasks. Frank Bobe III and colleagues at the Naval Surface Warfare Center Panama City Division introduce Deep Noir, a framework that automates the entire search. Using Logit Lens convergence to identify where a model resolves a semantic concept, and causal head-level attribution to identify which heads encode it, the engine discovers optimal steering parameters without human input. Across three model scales and four architectures, it achieves +16.7 percentage points on spam classification at 1B parameters and +21 to 42 points at 7 to 9B, with +13.1 points on sentiment analysis using zero code changes between tasks.

The Problem with Manual Steering

Existing activation steering methods, including Representation Engineering (RepE) and Contrastive Activation Addition (CAA), require manual selection of the intervention layer, the subset of attention heads, and the steering magnitude. RepE computes a contrastive direction between positive and negative examples and applies it at a fixed mid-layer with no head masking. This works when the target concept is concentrated in that layer, but fails when the concept resolves elsewhere. On sentiment analysis, RepE achieves zero improvement over baseline across all 15 folds tested, scoring exactly the same as no intervention at all.

The deeper issue is that different tasks resolve at different layers in different architectures. Spam classification resolves early to mid layers in Llama but deep layers in Gemma. Sentiment resolves later and more diffusely. A fixed heuristic like "steer at the middle layer" cannot adapt to this variation. Deep Noir replaces heuristics with diagnostics: measure where the concept actually resolves, find which heads carry the signal, and calibrate the magnitude to the specific layer and head configuration.

Architectural Chronometry: When Does a Model Decide?

The core idea is Architectural Chronometry: measuring when a model resolves a semantic concept from uncertainty to commitment by tracking token probabilities through the Logit Lens. At each layer, the hidden states are projected through the unembedding matrix to obtain next-token probabilities. The differentiation score measures the gap between the target token probability and the counter token probability at each layer. A large gap indicates that the model has committed to a decision at that layer.

But differentiation alone is insufficient. Some layers differentiate cleanly but do so through heads that are antagonistic to the target direction, meaning they actively push against the classification. The engine combines the Logit Lens score with an antagonist head strength score, computed as the negative dot product between each head's output projection and the target direction in unembedding space. The combined score uses a 0.4 to 0.6 weighting, but an ablation over seven weight ratios shows the ranking is fully invariant to the choice: all ratios select the same top layer.

Five Phases of Autonomous Discovery

The engine proceeds in five phases. Phase 1 ranks all layers using the combined score and selects the top five. Phase 2 isolates the relevant heads within each candidate layer by computing gradients of the classification loss with respect to each head's output, voting across 10 randomly sampled probes to select the top-K heads (K in {1, 2, 4}). A binary mask zeros out all dimensions except those corresponding to the selected heads. Phase 3 computes the contrastive direction from mean hidden states at layer l+1, the representation space immediately downstream of the intervention point, ensuring the direction is expressed in the same space that the hook will modify. Phase 4 calibrates the magnitude using golden-section search over M in [0.01, 20.0] with a coarse grid pre-scan. Phase 5 selects the configuration maximizing accuracy, preferring fewer heads and lower magnitude at equal performance.

The steering intervention is a scaled, masked direction vector added as a forward hook at the selected layer. The base scale factor of 450 is chosen so that the product of scale, magnitude, and mask norm falls within the residual stream's L2 norm range of approximately 200 to 800 at 1B parameters. The perturbation modifies only the selected heads' dimensions; for example, on Gemma-3-1B, K=1 modifies 256 out of 1152 dimensions, leaving 77% of the residual stream untouched.

Recursive Correction and the LayerNorm Problem

The engine extends single-shot discovery to an iterative loop. After the initial correction, it identifies remaining misclassified samples, re-runs discovery with probe weights biased 2x toward errors and the previously selected layer excluded, applies the new correction as an additional hook, and evaluates on the full probe set. If accuracy drops, the correction is rolled back. This repeats until convergence or a maximum of 5 iterations.

On Llama-3.2-1B with Enron, the recursive process discovers three complementary layers and reaches 88%, up from 56% baseline. The initial single-layer correction reaches 74%; subsequent iterations find complementary layers that push to 88%. Across 33 iterative runs, rollback triggers in 40% of attempts, preventing an average of 12 points of accuracy loss per rolled-back step. Multi-layer steering adds 4 points on average when single-layer is insufficient.

The paper also documents a failed experiment that reveals an important limitation of weight-space interventions. The authors attempted closed-form weight corrections via SVD, computing the desired activation delta and deriving a rank-r update to the output projection. This produced zero accuracy improvement across all configurations. The root cause: LayerNorm normalizes activations after the residual addition, attenuating small weight perturbations by approximately 1000x. The SVD corrections produced weight deltas of 0.01 to 0.1% of the output projection norm, corresponding to less than 0.001 logit shifts after LayerNorm, three to four orders of magnitude below the 2 to 4 logit shifts required to flip decisions. Activation-space hooks bypass this bottleneck because they inject perturbations after the attention output but before LayerNorm normalization at the next layer.

Results Across Scales and Architectures

The evaluation spans four architectures (Llama, OLMo, Gemma, Mistral) across three scales (1B, 2 to 3B, 7 to 9B). On spam classification at 1B, the engine achieves +16.7 points overall (from 60.1% to 76.7%), with +20.9 for Llama, +15.8 for Gemma, and +13.2 for OLMo. At 2 to 3B, gains increase to +25.6 to +30.4 points. At 7 to 9B, gains reach +21 to +42 points: Gemma-9B achieves +42.4 (52.0% to 94.4%), Llama-8B +29.2, Mistral-7B +22.0, and OLMo-7B +21.2.

On SST-2 sentiment analysis, the engine achieves +13.1 points overall with 100% success rate (15/15 folds improved). Critically, RepE fails entirely on sentiment, achieving exactly baseline accuracy on all 15 folds. The mechanistic explanation is that sentiment representations are distributed across layers rather than concentrated at the mid-layer where RepE applies its direction. Deep Noir's layer ranking identifies where each task's decision occurs: Llama uses layers 12 to 15, OLMo layers 12 to 14, Gemma layers 18 to 19 for sentiment, versus layers 2 to 14, 9 to 15, and 9 to 24 respectively for spam.

Each architecture exhibits a distinct correction topology that is stable across seeds (4/5 select the same layer) but varies across architectures. Llama favors early to mid layers, OLMo late layers, Gemma deep layers. The relative ordering is consistent across tasks, but absolute layer ranges shift per task, indicating that steering parameters are determined by the model's topology and the task's representational structure.

Why Components Are Individually Necessary

Ablation studies show that every component of Deep Noir is essential. Removing head masking drops accuracy below baseline on Llama (-5%) and Gemma (-1%), confirming that global steering introduces destructive interference. Removing magnitude calibration yields -11% on Llama. Using the middle layer instead of ranked selection achieves only +9% versus +21% with ranking. Random search over (layer, heads, magnitude) with the same contrastive direction underperforms by +14% (Llama), +20% (OLMo), and +33% (Gemma), confirming that mechanistic grounding provides signal that random search cannot match.

The cross-task transfer works precisely because each phase adapts to the task's representational structure rather than relying on a fixed heuristic. RepE without head masking fails on sentiment because it cannot identify which heads carry the task-specific signal; global steering introduces destructive interference that cancels the benefit. Deep Noir's head attribution identifies the specific heads, and masking them isolates the task-relevant signal from noise.

Steering Creates an Attack Surface

The paper characterizes a security risk that accompanies steering interventions. Steering creates a predictable prompt injection attack surface whose vulnerability scales monotonically with steering magnitude. On spam classification, baseline injection success rates of 13.7% to 21.2% increase to 16.9% to 35.6% under steering. The vulnerability function V(M) is monotonically non-decreasing in M for all architectures tested. OLMo rises from V(0) = 0.34 to V(4M*) = 1.0; Gemma follows a similar curve from 0.25 to 0.99.

The effect is architecture-dependent and task-dependent. On sentiment, the effect reverses for two of three models: Llama (-14.7%) and Gemma (-18.0%) become harder to inject under steering, while OLMo (+38.7%) becomes far more vulnerable. The critical factor is alignment between the steering direction and the attacker's goal. At 7B, steering reduces injection vulnerability from 97.5% to 61.1% (-36.4 points), suggesting the injection attack surface is primarily a small-model phenomenon that diminishes with scale.

For agent systems deploying steered classifiers, the implications are concrete: vulnerability is predictable from the steering configuration, enabling targeted threat modeling before deployment. The magnitude-vulnerability curve enables principled magnitude selection that balances accuracy against injection risk. Activation-norm monitoring at the steering layer provides a detection signal on some architectures (Gemma shows significant norm differences, p less than 0.001). Defenses should operate before the steered layer.

Limitations and the Path Forward

Deep Noir is strongest on binary classification. Reasoning steering is limited by near-random baselines at 1B to 9B scales (22 to 31% on 4 to 5 choice), leaving insufficient contrastive signal for the direction computation to exploit. The framework requires that the model partially encodes the target distinction; when the model cannot distinguish correct from incorrect reasoning steps, steering has nothing to amplify.

The linear direction assumption may miss non-linear decision boundaries. Per-fold variance is higher than RepE (plus or minus 10 to 11 versus plus or minus 5 to 7), a cost of per-fold optimization. Discovery takes 4 to 31 minutes depending on architecture, 50 to 80x slower than RepE's grid search, though this is a one-time setup cost reused across all subsequent inferences.

The paper compares against supervised baselines: a logistic regression probe trained on mid-layer hidden states achieves 90 to 93% on held-out folds, higher than Deep Noir's 70 to 80% at 1B. But the probe requires gradient-based training, provides no mechanistic insight, does not transfer cross-task, and cannot be analyzed for injection vulnerability or containment. Deep Noir does not aim to outperform supervised classifiers; it enables interpretable, training-free diagnosis and control of model internals.

What It Means in Practice

For teams deploying steered classifiers in production, the magnitude-vulnerability curve is immediately useful. Selecting magnitude is no longer a guess about "how strong is strong enough." The Pareto frontier between accuracy and injection risk enables principled deployment decisions. The finding that larger models are more robust to injection under steering suggests that steering at 7B and above may be safer for security-critical applications than steering at 1B.

The recursive correction mechanism is practically valuable for tasks where single-layer steering is insufficient. The rollback mechanism prevents accuracy degradation, and the error-weighted re-discovery focuses computation on the samples that matter most. The 40% rollback rate indicates that multi-layer correction is not always beneficial, and the engine correctly identifies when to stop.

The architectural determinism finding has implications for transfer learning of steering configurations. If a configuration discovered on Llama for spam transfers reasonably to Llama for sentiment (with layer range adjustment), practitioners may be able to amortize discovery cost across related tasks within the same architecture family. The paper's held-out generalization results (8% gain on fold-1 from fold-0 discovery) support this possibility, though more work is needed to quantify the transfer ceiling.

The paper's disclosure of the injection vulnerability is the most important contribution for the deployment community. Any system that steers an LLM classifier for access control, content moderation, or decision-making should account for the fact that the steering intervention itself creates an attack surface. The monotonic relationship between magnitude and vulnerability means that stronger steering, while more accurate, is also more exploitable. This is a fundamental tradeoff, not an implementation bug, and the paper provides the quantitative framework to navigate it.

Read the paper on arXiv