Activation Steering for Aligned Open-ended Generation without Sacrificing Coherence
2026-04-09 • Artificial Intelligence
Artificial Intelligence
AI summaryⓘ
The authors explain that large language models (LLMs) can sometimes act in unintended or unsafe ways, even after careful training. They explore ways to fix this by adjusting the model's internal activations during text generation, a technique called activation steering. They test three methods, including two new approaches that decide when to step in based on the model's internal signals. Their experiments show these methods help the models stay honest and kind without losing their ability to answer questions or hold conversations well.
Large Language ModelsAlignmentActivation SteeringMisalignmentAdversarial PromptsLogistic RegressionModel Activation SpaceFine-tuningMultitask Language UnderstandingModel Safety
Authors
Niklas Herbster, Martin Zborowski, Alberto Tosato, Gauthier Gidel, Tommaso Tosato
Abstract
Alignment in LLMs is more brittle than commonly assumed: misalignment can be triggered by adversarial prompts, benign fine-tuning, emergent misalignment, and goal misgeneralization. Recent evidence suggests that some misalignment behaviors are encoded as linear structure in activation space, making it tractable via steering, while safety alignment has been shown to govern the first few output tokens primarily, leaving subsequent generation unguarded. These findings motivate activation steering as a lightweight runtime defense that continuously corrects misaligned activations throughout generation. We evaluate three methods: Steer-With-Fixed-Coeff (SwFC), which applies uniform additive steering, and two novel projection-aware methods, Steer-to-Target-Projection (StTP) and Steer-to-Mirror-Projection (StMP), that use a logistic regression decision boundary to selectively intervene only on tokens whose activations fall below distributional thresholds. Using malicious system prompts as a controlled proxy for misalignment, we evaluate under two threat models (dishonesty and dismissiveness) and two architectures (Llama-3.3-70B-Instruct, Qwen3-32B). All methods substantially recover target traits (honesty and compassion) while preserving coherence. StTP and StMP better maintain general capabilities (MMLU, MT-Bench, AlpacaEval) and produce less repetition in multi-turn conversations.