Angular Steering: Behavior Control via Rotation in Activation Space

AI summary

Overview

Research area: Activation steering and interpretability in large language models — controlling model behavior at inference time by editing internal representations rather than retraining.

Technical level: Intermediate. The paper is written for readers comfortable with transformer internals (residual streams, normalization layers, attention/MLP blocks) and basic linear algebra (subspaces, projection, rotation matrices). The core idea is geometric and can be grasped without deep math background, but the implementation details require familiarity with hidden-state manipulation.

Scope: The paper proposes Angular Steering, a method that steers LLM behavior by rotating activations inside a fixed two-dimensional subspace, and evaluates it on refusal steering and emotion steering across Llama 3, Qwen 2.5, and Gemma 2 model families of various sizes (3B to 14B).

What This Paper Is About

Existing methods for controlling LLM behavior at inference time — adding a scaled "feature direction" to activations, or ablating that direction entirely — are confined to a two-dimensional subspace defined by the activation and the feature direction, which makes them sensitive to parameter tuning and prone to damaging unrelated model capabilities. The paper reframes steering as a geometric rotation: instead of pushing an activation along a direction or deleting a component, it rotates the activation within a fixed 2D plane toward or away from a target behavior direction, giving smooth control over how strongly a behavior such as refusal or compliance is expressed.

Key Contributions

1. Angular Steering, a rotation-based framework that provides continuous, fine-grained control over model behaviors by rotating activations within a fixed two-dimensional subspace, plus Adaptive Angular Steering, a selective variant that rotates only activations positively aligned with the target feature direction.

2. A unifying geometric account of prior methods. The paper shows that activation addition and directional ablation, when applied before normalization, can both be viewed as special cases of rotation within a 2D plane — linear combination corresponds to a partial rotation toward or away from the feature, and orthogonalization corresponds to rotating to a position 90 degrees from the feature.

3. Empirical validation across model families and sizes (Llama 3, Qwen 2.5, Gemma 2, 3B to 14B) showing strong behavior control with minimal degradation of general language modeling performance, as measured by the TinyBenchmarks suite and perplexity.

4. A statistical procedure for automatically selecting the feature direction, in contrast to prior work that selects directions manually, plus a PCA-based construction of the steering plane.

Main Findings

• Rotation produces a smooth behavioral arc. Sweeping the target angle from 0 to 360 degrees in 10-degree intervals causes models to move from refusal to compliance and back to refusal. Plots show a clear arc of strong alignment (high refusal scores, low harmful scores) and an opposing arc of weak alignment (low refusal, high harmful scores), with performance peaking near the center and diminishing outward.

• Behavior transitions pass through distinct qualitative classes. Using the reasoning model QVQ-72B-Preview to classify outputs into direct, indirect, redirect, and refusal, the paper finds that for five of six models, refusal dominates in the strong arc, followed by redirect, then direct or indirect responses as the angle shifts.

• Gemma-2-9B-IT is an outlier. It displays the weakest steering effect of the tested models, though it still follows the overall trend.

• Steering on a random plane does almost nothing. In an ablation using Adaptive Angular Steering with a random plane, there was little to no effect on controlling refusal in five out of six tested models.

• General benchmarks are largely preserved. Across the TinyBenchmarks suite (ARC, MMLU, WinoGrande, GSM8k, TruthfulQA, HellaSwag — each containing 100 examples), accuracies are maintained across the entire steering circle, and in many cases performance under intervention even surpasses the non-steered baseline.

• Qwen2.5-3B-Instruct shows a localized drop. It exhibits a performance decline along the arc from 160° to 280°, which the authors attribute to feature interference, where multiple latent features dominate within the chosen steering plane — a phenomenon smaller models are more susceptible to. The consistent accuracy drop across all benchmarks in that region suggests the model is reacting to a competing feature.

• Smaller models are more vulnerable to interference under non-adaptive steering. In non-adaptive experiments, 7B–14B models generate coherent outputs throughout the steering circle, while Llama-3.2-3B-Instruct and Qwen2.5-3B-Instruct often produce incoherent text across a wide arc. Refusal phrases still appear randomly in various languages for Llama-3.2-3B-Instruct, and mainly in Chinese for Qwen2.5-3B-Instruct, despite English prompts.

• Adaptive steering preserves coherence better. Perplexity of Adaptive Steering outputs is lower, more stable, and closer to no steering than the non-adaptive counterpart. Both 3B models show unstable perplexity under non-adaptive steering.

• Safety alignment appears to mask rather than remove harmful behavior. Perplexity stays near baseline when steering aligns with the target feature, but drops below baseline as it moves toward the "jailbroken" region. The authors read this as evidence that harmful generations (learned during pretraining) remain more probable than refusal responses (learned during safety tuning), consistent with prior work showing that safety alignment mainly affects the first few tokens.

• Format sensitivity affects GSM8k measurement. For tinyGSM8k, the flexible metric extracts the last numeric value as the final answer, whereas the strict variant assumes a predefined output format, so results are highly sensitive to formatting variations and fluctuate noticeably across steering angles.

Methodology in Plain English

The researchers start from the observation that modern LLMs use RMSNorm before every attention and MLP block, which maps activations onto a scaled sphere and then rescales them into a fixed shape. This makes direction, rather than magnitude, the meaningful representation — and it explains why coefficient-based methods are brittle, since activation norms vary and grow across layers.

To find the behavior direction, they take an 80% split of AdvBench (416 harmful instructions) and 512 random harmless examples from Alpaca, run them through the model, and record activations of the final input token at each normalization layer. There are two extraction points per transformer block (before attention and before MLP), giving a total of M candidates where M is twice the number of blocks. Each candidate direction is computed with the Difference-in-Means method: the mean harmful activation minus the mean harmless activation.

Rather than hand-picking a layer, they choose the candidate direction that is most cosine-similar to the others, since high similarity among candidates in layers where refusal is strong suggests a stable approximation of the true feature. They also note that refusal emerges progressively with depth, stabilizes, and then spikes again near the final layer — a late spike they hypothesize is a filtering step before token generation, and which they exclude from the candidate list.

For the second axis of the steering plane, they reject using the span of the activation and the feature direction (the choice implicit in prior methods) for three reasons: feature directions are thought to be layer-independent, that span might contain other dominant features, and per-step rotation is costly. Instead they run PCA over the candidate directions and take the first principal component as the second axis, producing a fixed plane that captures meaningful variation in the target feature. A plot of layer-wise feature directions projected onto this plane shows a smooth directional shift across depth.

Steering then works by projecting an activation onto this plane, rotating it to a target angle, and leaving the orthogonal complement untouched. Because the rotation is norm-preserving, the projection matrix and the rotated basis vector can be precomputed, making the operation efficient. The adaptive variant adds a mask that zeroes out the edit for activations whose projection onto the feature direction is negative, so only positively aligned activations are rotated. In inference, the steering is applied at every normalization module before each attention and MLP layer.

Evaluation uses a refusal score based on substring matching (1 if a common refusal phrase such as "I'm sorry" or "As an AI" appears, 0 otherwise), two harmful-score classifiers (LlamaGuard3 and HarmBench, each scoring 1 or 0), and the LLM-as-a-judge classification scheme. The authors note that substring matching only detects memorized refusal phrases and does not assess coherence or harmfulness, which motivates the complementary metrics.

Why This Matters

The paper's central claim is that steering should be understood geometrically as rotation rather than as addition or deletion, which subsumes prior techniques under a single framework and simplifies parameter selection. By restricting changes to two orthogonal directions and leaving the remaining basis vectors untouched, the method aims to minimize interference with unrelated features — a direct concern for deploying controllable models without degrading them.

Real-world applications implied by the work:

• Safety and refusal control in deployed assistants, where operators may want to raise or lower refusal thresholds continuously rather than in binary on/off fashion.
• Compliance tuning — for instance, making a model more willing to follow benign instructions while retaining guardrails, which the paper demonstrates with angles in the 100°–200° range.
• Emotion and style steering, which the paper reports as an additional use case in its appendix, suggesting applications in tone and persona control for user-facing products.
• Post-hoc model adaptation without retraining, allowing behavior adjustment at inference time for models that are expensive or impractical to fine-tune.

Industry relevance: The method requires no weight updates, only a fixed 2D subspace and a precomputable rotation, making it cheap to deploy as an inference-time intervention. The finding that smaller models (3B class) suffer coherence breakdown under non-adaptive steering, while the adaptive variant stays closer to baseline perplexity, is practically important for teams running smaller models in production. The paper's observation that safety alignment may mask rather than remove harmful capability also has direct implications for how organizations assess the robustness of their guardrails.

Future Directions

• Understanding and mitigating feature interference in small models. The failure mode observed in Qwen2.5-3B-Instruct and Llama-3.2-3B-Instruct — incoherent text and refusal phrases in unexpected languages — suggests that multiple features become entangled in the 2D steering subspace. The paper states it remains unclear how to choose a plane that avoids this.

• Explaining the late-layer "spike" in refusal signal. The authors hypothesize it reflects a filtering step just before token generation and exclude it from the candidate list; verifying and characterizing this stage is left open.

• Clarifying the mechanisms of safety alignment. The perplexity analysis indicates harmful continuations remain more probable than refusal responses, but the paper explicitly notes that the mechanisms behind safety alignment are still unclear.

• Extending the adaptive thresholding scheme. The paper notes that beyond the steering angle, users may vary the similarity threshold used in the mask or employ different per-layer feature directions, which suggests a broader design space for selective steering.

Target Audience

This paper is most useful to machine learning researchers working on activation steering, mechanistic interpretability, and inference-time model control; alignment and safety engineers who need practical, tunable behavior modulation without retraining; and graduate students or advanced practitioners familiar with transformer internals who want a geometric framework for reasoning about existing steering techniques. Readers looking for a fully automated performance-maximizing pipeline should note the authors' explicit statement that their goal is to study steering control rather than maximize downstream results, and that the full model list and several results (including emotion steering) live in appendices not included in the provided content.

Authors’ abstract

Controlling specific behaviors in large language models while preserving their general capabilities is a central challenge for safe and reliable artificial intelligence deployment. Current steering methods, such as vector addition and directional ablation, are constrained within a two-dimensional subspace defined by the activation and feature direction, making them sensitive to chosen parameters and potentially affecting unrelated features due to unintended interactions in activation space. We introduce Angular Steering, a novel and flexible method for behavior modulation that operates by rotating activations within a fixed two-dimensional subspace. By formulating steering as a geometric rotation toward or away from a target behavior direction, Angular Steering provides continuous, fine-grained control over behaviors such as refusal and compliance. We demonstrate this method using refusal steering emotion steering as use cases. Additionally, we propose Adaptive Angular Steering, a selective variant that rotates only activations aligned with the target feature, further enhancing stability and coherence. Angular Steering generalizes existing addition and orthogonalization techniques under a unified geometric rotation framework, simplifying parameter selection and maintaining model stability across a broader range of adjustments. Experiments across multiple model families and sizes show that Angular Steering achieves robust behavioral control while maintaining general language modeling performance, underscoring its flexibility, generalization, and robustness compared to prior approaches. Code and artifacts are available at https://github.com/lone17/angular-steering/.