Activation Steering: Changing Personality by Nudging Directions Inside the Model

Why It Was Needed: The Gap Between Prompting and Fine-Tuning

There are two common ways to change the behavior of a large language model (LLM). One is to instruct it through a prompt, such as "Answer honestly." The other is fine-tuning, which retrains the weights themselves. Prompts are cheap and fast, but it is hard to guarantee how closely the model will follow the instruction; fine-tuning works reliably but costs data and compute, and is cumbersome to undo.

Activation Steering targets the space in between. It leaves the model's weights unchanged and shifts behavior by adding a small vector to internal computed values (activations) during inference. The OPIUM study paper describes it as "a lightweight mechanism for controlling LLMs at inference time," and the SYNC study paper explains that it "aligns models at inference time without touching the weights."

This approach draws particular attention in safety and alignment. It lets researchers experiment with and adjust, without training, how altruistically a model behaves in strategy games, how well it upholds organizational values, and how much its hallucinations can be reduced. At the same time, it shows which directions inside the model connect to which behaviors, which also makes it a tool for interpretability research.

Core Idea: 'Directions' in the Space of Thought

A transformer carries information about each token through its layers by continually adding to a single long vector of numbers. This flow is called the Residual Stream. Several studies hold that this space contains interpretable directions. The First-Order Steering study paper defines Activation Steering as "manipulating model behavior at inference time using interpretable directions in the Residual Stream."

Here is an analogy. Think of the model's thinking as a point on a large map. If an 'optimistic tone' neighborhood and a 'dark tone' neighborhood sit on different sides of the map, the arrow connecting their centers is the steering vector. Adding this arrow to the current position during inference pushes the thinking in that direction, and making the arrow longer (increasing the strength) pushes it farther.

This design is appealing for three reasons. First, it requires no training, or very little. Second, removing the vector or setting the strength to 0 immediately restores the original model. Third, a single model can stay as is while a different vector is plugged in for each request. On the other hand, there is no guarantee that the arrow captures only the intended concept. This trade-off is the root of the side-effect problems discussed later.

How It Works: CAA Step by Step

The most widely used starting point is CAA (Contrastive Activation Addition). As the input-dependent steering study paper explains, CAA adds a single fixed direction, obtained from the difference between two group means, to every input. Step by step:

1) Collect paired examples of the target behavior (e.g., altruistic answers) and the opposite (selfish answers). 2) Feed both sets into the model and record the activations at a specific layer. 3) Compute the difference in mean activations between the two sets and save it as the steering vector. 4) During actual inference, multiply this vector by a strength coefficient and add it to the activations at the same layer.

A study that applied this method to game theory experiments paper used CAA to build persona vectors representing altruism, forgiveness and expectations of others, and showed that steering systematically shifts both numerical strategy choices in the games and the natural-language explanations. The Creative Collision study paper also built persona vectors for two film directors using mean differences on a corpus based on their scripts; both personas appeared most strongly at layer 28 of a 40-layer decoder model. This means that the choice of layer strongly affects the result.

In short, there are three knobs a person has to set: which contrastive data to extract the direction from, which layer to inject it into, and how strongly to inject it. Most later studies are ways of choosing one of these three more intelligently.

How It Developed: From a Single Vector to Combinations, Context and Side Effects

The first trend is 'changing the vector according to context.' Dynamic Multimodal Activation Steering paper, which addresses hallucination in vision-language models (VLMs), found that truthfulness steering vectors vary greatly with semantic context. It built a database of vectors by meaning, selected the vector most similar to the input, and injected it only into the most influential attention heads. TRACESTEER paper, which deals with diffusion language models, argues that a preset vector and uniform strength do not fit states that change at each denoising step, and uses the previous step's prediction as feedback to adjust direction and strength at every step.

The second trend is 'mixing multiple vectors.' Creative Collision paper mixed two persona vectors with opposite tendencies and observed direction dominance, where one (Spielberg) suppressed the other across almost the entire range. SYNC paper points out that when eliciting several personas at once, fixing the layers and combination method in advance makes offline search expensive, and that the optimal strength varies across decoding steps. It therefore estimates per-layer sensitivity from trends in cosine similarity and picks, for each persona, the layer to inject into at every step; it came out ahead in 21 of 28 settings (15 of them significant). First-Order Steering paper took a different path. Building on the observation from model merging that weight changes combine well, it defines a steering vector as a first-order approximation of a weight update and proposes HeRD-Merging, a merging procedure that reduces the approximation error.

The third trend is 'cleaning up side effects.' OPIUM paper took issue with 'externalities,' where a helpfulness vector weakens safety behavior and a refusal vector makes the model refuse even harmless questions. It optimizes a new vector to match safer reference behavior on questions where the original vector fails, improving the safety-helpfulness balance without training.

Where It Is Heading Now

Recent research asks less "how much can we change?" and more "how much change is acceptable?" The Behavior-Capability Frontier study paper took 4 instruction-tuned models and 7 behaviors, capped capability loss at 1, 3 and 5 percentage points, and chose the strength that maximized behavior change within each cap. Effects selected on validation data carried over well to new data (ρ=0.945), but the rate at which both behavior and capability survived was 37.5% at a 1% budget and 72.7% at 3%, with little further gain at 5%. The study also reported that capabilities that were not tested can still degrade even when the protected benchmarks pass.

The second direction is input-specific editing. The input-dependent steering study paper argues that when the target point varies even within the same category, fixed-direction CAA leaves differences it cannot express, and uses a retrieval-based rule that takes as its target the mean of the k stored states closest to the question. When targets varied within a category, this approach outperformed a fixed direction; word-level edits worked best in the first 10% of the network, while clause-level edits worked best with the category mean at any depth.

The third is the problem of upholding several criteria at once, such as organizational values. VIAS paper found that simply contrasting answers that uphold all values with answers that violate them yields nearly the same 'general compliance signal' vector for every value. So it isolated each value by comparing against prompts with only that one value removed. Overlap between vectors decreased, but it did not reach the point of controlling each value independently; when combined with prompts, the share of responses that upheld all applicable values was 69.6% for Qwen2.5-7B and 75.2% for Mistral-7B.

Limitations and Open Issues: When to Use It and When to Avoid It

First, it is hard to be sure what a vector contains. As in the VIAS paper case, a vector built for a 'specific value' may actually be a more general signal. The game study paper also observed cases where, under steering, the model's words (explanations) and its actual strategy diverged. A change in tone should not be taken to mean that behavior has changed too.

Second, side effects are the default. The weakened safety and over-refusal shown by OPIUM paper and the degradation of untested capabilities shown by the Frontier study paper can grow as strength increases. Mixing multiple vectors can also cause one to override the other paper. Conversely, the Creative Collision study reported that at high strength, mixing two vectors roughly halfway actually improved sentence coherence over a single vector, showing that the effects of combinations are hard to predict in advance.

As practical criteria: it is worth using when you cannot change the weights or need to experiment quickly, and prompts alone do not change behavior well. On the other hand, it cannot be used with API models that, unlike open-weight models, do not give access to internal activations, and it does not yet work as well as hoped when several criteria must be controlled precisely and independently. Common mistakes are setting the strength by looking only at the target behavior score, fixing one layer and one strength for all inputs, and not checking whether the contrastive data also captures differences other than the target concept (length, format, etc.).

Further Reading

If you are new to the topic, start with the game theory study paper, which applied CAA in practice. In a single paper, you can see how persona vectors are built, their effects, and the limitation that words and strategy can diverge. Reading the Behavior-Capability Frontier study paper next will give you a sense of what else needs to be measured when choosing the strength.

If you are interested in mixing multiple behaviors, look at the phenomenon in Creative Collision paper, then compare two directions of solutions with SYNC paper and First-Order Steering paper (layer selection during inference, and the link to weight merging). From a safety perspective, OPIUM paper and VIAS paper directly address side effects and value separation.

For applications such as hallucination mitigation, Dynamic Multimodal Activation Steering paper on VLMs and TRACESTEER paper on diffusion language models illustrate the shift 'from fixed vectors to context-adaptive vectors,' and the input-dependent steering study paper puts that shift on a theoretical footing.