1 Introduction↩︎

Behavioral control over large language models (LLMs) reducing toxicity, enforcing a persona, suppressing hallucinations, and adjusting refusal has become a significant deployment concern [1], [2]. The default mechanism is the system prompt, but prompt-based steering is fragile: lexical perturbations shift output distributions [3], alignment priors can be overridden through crafted inputs or adversarial suffixes [4], [5], and steerability through prompting is asymmetric and bounded across many behavioral dimensions [6].

Activation-level methods intervene directly in the residual stream. ActAdd [7], Inference-Time Intervention [8], and Contrastive Activation Addition [9] compute a steering vector by contrasting hidden states across behavioral exemplars and inject it during the forward pass. Sparse Autoencoders (SAEs) decompose dense, polysemantic activations into a monosemantic feature dictionary [10], [11], then clamp or amplify features that mediate a target behavior [12], [13]. The Golden Gate Claude exemplifies the appeal: amplifying a single interpretable feature substantially redirects model behavior without any weight updates [13].

A property shared by these methods is uniform, every-token intervention: the steering signal is added at every position throughout generation [7]–[9]. Persistent perturbation pushes generations off the model’s native activation manifold, degrading fluency and downstream performance [7], [12]; in multi-attribute settings, conflicting signals over-correct the primary target and regress on unrelated behaviors [14]. These costs raise a natural question: is intervention at every token necessary? We answer this by replacing deterministic every-token intervention with stochastic gating, applying the signal to random subsets of tokens and asking how much behavioral shift survives at each intervention density.

We introduce two stochastic interventions over SAE feature steering that select tokens at random. Stochastic Token Steering (STS) samples an independent gate \(m_t \sim \mathrm{Bernoulli}(p)\) at every position, applying the signal to a random subset of tokens. Stochastic Block Steering (SBS) draws a single \(\mathrm{Bernoulli}(p)\) gate per sequence and applies it uniformly to a leading window, treating the well-attested early-token influence [15]–[17] as an atomic intervention site.

Our contributions are twofold. First, across two models and two tasks, STS recovers most of the dense-steering effect while outperforming both prompt-based control and SBS at matched ratios. Second, the best steering magnitude rises as the intervention ratio falls, so sparse steering attains comparable shift with less total injected signal. Together these indicate that SAE-mediated steering is rate-limited: the outcome depends on cumulative signal dosage across a sequence. Our method reduces inference-time control to a single scalar \(p\), with no reward model, learned gating, or computation beyond a coin flip per token.

2 Related Work↩︎

Inference-time steering of LLMs spans prompt-based control, activation-level interventions, and decoding-time methods. Dense activation steering methods such as ActAdd [7], ITI [8], CAA [9], Representation Engineering [14], and SAE-based feature steering [10], [12], [13] share the universal practice of intervening at every generated token; our method departs from it. The closest concurrent work, Sparse Inference-time Alignment (SIA) [18], also finds dense intervention unnecessary, but operates in logit space via a learned, reward-distilled value model with best-of-\(N\) selection and is evaluated under reward-model scoring; we report single-sample classifier metrics and so do not benchmark against it. A full discussion is given in Appendix 7.

3 Method↩︎

Let \(\mathcal{M}\) be an \(L\)-layer decoder-only transformer. For a tokenized input \(\mathbf{x} = (x_1, \ldots, x_T)\), let \(\mathbf{h}_t^{(\ell)} \in \mathbb{R}^d\) denote the residual stream activation at layer \(\ell\) and position \(t\). We inject a steering signal into the residual stream at a single intermediate layer \(\ell^*\): \[\tilde{\mathbf{h}}_t^{(\ell^*)} = \mathbf{h}_t^{(\ell^*)} + \mathbf{s_t}, \label{eq:steering}\tag{1}\] where \(\mathbf{s_t} \in \mathbb{R}^d\) is defined in Sec. 3.2. Single-layer intervention suffices for effective steering [12] and is preferable to logit-level modifications, which occur too late for the model to propagate coherent representations [14].

3.1 Steering Direction Discovery via SAE↩︎

We use a Sparse Autoencoder (SAE) trained on residual stream activations at layer \(\ell^*\) to identify directions associated with a target behavior. The SAE decoder \(\mathbf{W}_{\mathrm{dec}} \in \mathbb{R}^{d_{\mathrm{sae}} \times d}\) provides an overcomplete set of feature directions, where each row \(\mathbf{W}_{\mathrm{dec},i}\) corresponds to a learned feature. To identify behavior-discriminative features, we encode a positive set \(\mathcal{P}\) exhibiting the target behavior and a neutral set \(\mathcal{N}\) of matched controls through the SAE, computing the mean feature activation differential: \[\Delta_i = \frac{1}{|\mathcal{P}|}\sum_{x \in \mathcal{P}} f_i(x) - \frac{1}{|\mathcal{N}|}\sum_{x \in \mathcal{N}} f_i(x) \label{eq:delta}\tag{2}\] We select the top-\(K\) features by \(\Delta_i\) and define unit-norm steering vectors \(\mathbf{v}_k = \mathbf{W}_{\mathrm{dec},i_k} / \|\mathbf{W}_{\mathrm{dec},i_k}\|\) for \(k = 1, \ldots, K\).

3.2 Stochastic Activation Steering↩︎

The steering signal at position \(t\) takes the form \(\mathbf{s}_t = m_t \cdot \alpha\,\mathbf{v}\), where \(\alpha \in \mathbb{R}\) is the intervention magnitude and \(m_t \in \{0,1\}\) is a binary gate. The standard approach, Full Steering (FS), sets \(m_t = 1\) at every position. We propose two stochastic alternatives.

3.2.0.1 Stochastic Token Steering (STS).

At each position \(t\), we sample an independent gate \(m_t \sim \mathrm{Bernoulli}(p)\): \[\begin{gather} \!\!\!\tilde{\mathbf{h}}_t^{(\ell^*)} = \mathbf{h}_t^{(\ell^*)} + m_t \cdot \alpha\,\mathbf{v}, ~ m_t \stackrel{\text{i.i.d.}}{\sim} \mathrm{Bernoulli}(p). \label{eq:sts}\raisetag{30pt} \end{gather}\tag{3}\] In expectation, a fraction \(p\) of positions receive the signal while the rest are left unperturbed. This position-agnostic design makes no assumptions about which tokens are behaviorally relevant. The parameter \(p\) interpolates smoothly between no intervention (\(p{=}0\)) and full steering (\(p{=}1\)).

3.2.0.2 Stochastic Block Steering (SBS).

We treat a leading prompt window of size \(W \leq T\) as an atomic steering unit. A single gate \(m \sim \mathrm{Bernoulli}(p)\) is sampled once per sequence: \[\tilde{\mathbf{h}}_t^{(\ell^*)} = \begin{cases} \mathbf{h}_t^{(\ell^*)} + m \cdot \alpha\,\mathbf{v} & t \leq W, \\[2pt] \mathbf{h}_t^{(\ell^*)} & t > W, \end{cases} \label{eq:sbs}\tag{4}\] With probability \(p\) the entire window is steered coherently; with probability \(1{-}p\) it is left intact. This design exploits the finding that initial tokens carry disproportionate contextual influence [15] and that early-token intervention alone can steer model behavior [16], [17].

3.3 Fluency-Preserving Regularization↩︎

Additive interventions displace representations from the model’s native activation manifold, risking incoherent or repetitive outputs. We apply three lightweight corrections (Appendix 10): (1) Norm preservation [7]: rescaling the steered activation to restore the original norm, constraining the intervention to a rotation toward \(\mathbf{v}\) without magnitude inflation. (2) Activation clamping [12]: bounding the scalar projection onto \(\mathbf{v}\) within \([\gamma_{\min}, \gamma_{\max}]\) to prevent over-amplification and suppress residual feature activation in the unsteered representation. (3) Repetition penalty [19]: discounting previously generated tokens at the decoding stage to counteract the tendency toward repetitive sequences when high-probability continuations are suppressed.

4 Experiments↩︎

4.0.0.1 Setup.

We evaluate on two tasks spanning suppression and elicitation. Toxicity reduction uses RealToxicityPrompts [20], a corpus of 100K naturally occurring English prompts; we sample 600 highly toxic prompts (toxicity \(\geq 0.6\)). Emotion steering uses GoEmotions [21], a dataset of 58K Reddit comments annotated with 27 fine-grained emotions plus neutral; following [22] we map these to six basic emotions plus neutral and select fear and sadness as targets. We use LLaMA 3.1-8B [23] and Gemma-2 2B [24], two open-weight models from distinct families and scales chosen to match the evaluation setups of recent feature-steering work [13], [25] and to demonstrate cross-architecture generality. We inject an SAE at the 16th transformer layer, a depth at which SAE features have been shown to encode high-level semantic concepts [12], and evaluate SBS at window sizes \(W \in \{32, 64\}\). Full implementation details are in Appendix 11.

4.0.0.2 Baselines.

We compare STS and SBS against three baselines: (1) No Steering (unmodified generation), (2) Full Steering (intervention at every token, \(p{=}1\)), and (3) Prompting (carefully curated task-specific safety or emotion instruction prepended to the input; see Appendix 8 for the prompts used).

4.0.0.3 Metrics.

For steering effectiveness we report mean toxicity reduction (decrease in classifier-predicted toxicity relative to no steering) and mean probability gain (increase in target-emotion probability relative to unsteered generation); toxicity is scored by a RoBERTa toxicity classifier and emotion by a DistilRoBERTa emotion classifier (Appendix 11). For generation quality we report GPT-2 perplexity and \(n\)-gram repetition (Rep-3, Rep-4).

4.1 Sparse Steering Effectiveness↩︎

Figure 1 reports the steering effectiveness of STS and SBS across different intervention ratios on three tasks: toxicity reduction and emotion steering towards fear and sadness. The steering magnitude \(\alpha\) is calibrated under the full steering regime (\(p{=}1\)) by sweeping over values and selecting the operating point that maximizes behavioral shift subject to fluency preservation (Appendix 12); the same \(\alpha\) is used across all methods and intervention ratios for a fair comparison.

The central result is that most of the behavioral shift is recoverable at substantially reduced cost: for LLaMA 3.1-8B, STS at \(p{=}0.5\) recovers over 95% full-steering toxicity reduction and recovers over 80% of full-steering gains on both emotion tasks by \(p{=}0.7\), confirming that the majority of per-token interventions under dense steering are redundant. STS also surpasses the prompting baseline at low ratios (\(p\approx0.3\) on toxicity and fear, \(p\approx0.7\) on sadness), outperforming a carefully engineered instruction while perturbing fewer than half the tokens. A second consistent finding is that STS outperforms SBS at matched ratios, most clearly on emotion steering: for fear on LLaMA 3.1-8B, STS at \(p{=}0.5\) roughly doubles the probability gain of SBS (\(W{=}32\)), indicating that the residual stream integrates the steering signal cumulatively rather than at privileged early positions. This ordering holds for Gemma-2 2B at lower magnitudes, and SBS with \(W{=}64\) narrows the gap to STS relative to \(W{=}32\), supporting the view that wider spatial distribution is beneficial.

4.2 Steering Magnitude and Intervention Ratio↩︎

Does the optimal steering magnitude depend on how often we intervene? Figure 2 plots the best-performing \(\alpha\) (maximizing steering impact subject to fluency preservation) against the intervention ratio \(p\) for both models. The optimal magnitude rises monotonically as \(p\) falls: for Gemma-2 2B from \(\alpha^*{=}30\) at \(p{=}1.0\) to \(\alpha^*{=}35\) at \(p{=}0.2\), and for LLaMA 3.1-8B from \(\alpha^*{=}2.5\) to \(\alpha^*{=}5\) over the same range. Crucially, this increase is sub-linear in \(1/p\): the effective dosage \(p\cdot\alpha\) falls as tokens are dropped (for Gemma, from \(30\) at \(p{=}1.0\) to \(7\) at \(p{=}0.2\)), so sparse steering attains comparable behavioral shift while injecting substantially less total signal into the residual stream. This adds to the rate-limited interpretation: the outcome is governed by cumulative dosage rather than by the number of steered tokens, and sparsifying does not merely redistribute a fixed perturbation budget, it reduces the budget required. Practically, when lowering \(p\) one should raise \(\alpha\).

5 Conclusion↩︎

We introduced Stochastic Token Steering (STS) and Stochastic Block Steering (SBS), which replace dense, every-token activation intervention with sparse random application governed by a single parameter \(p\). Across two models and two tasks, steering half or fewer tokens recovers the majority of the full-steering behavioral shift, and distributing the signal across random positions consistently outperforms concentrating it in a contiguous early window. The best-performing magnitude rises as \(p\) falls, so sparse steering attains comparable shift with less total injected signal, indicating that behavioral outcomes are governed by cumulative signal dosage.

6 Limitation↩︎

Our evaluation covers two behavioral tasks (toxicity reduction, emotion steering) on two model families. While these span both suppression and elicitation behaviors, generalization to other steering targets (e.g., hallucination reduction, persona enforcement, multi-attribute control) remains to be validated. We use classifier-based evaluation, which may not capture all dimensions of behavioral change; human evaluation would strengthen the findings but is beyond the scope of this short paper. Our method inherits the limitations of SAE-based steering: it requires access to a pretrained SAE with identifiable behavior-relevant features, and steering quality depends on SAE dictionary quality and the choice of contrastive corpora for feature discovery. Finally, we evaluate at fixed generation length and temperature; the interaction between stochastic steering and diverse decoding strategies (e.g., nucleus sampling, beam search) remains unexplored.

Ethics Statement↩︎

6.0.0.1 Intended use and dual-use considerations.

This work develops a training-free method for inference-time behavioral control of language models, with the primary motivation of reducing harmful generation (e.g., toxicity) and shifting model behavior toward beneficial targets (e.g., emotional regulation). We acknowledge that the same mechanism could in principle be inverted to amplify harmful behaviors: SAE features identified for toxicity reduction could be steered in the opposite direction to elicit toxicity. This dual-use concern is shared by all activation-steering methods [7], [9], [18] and is not specific to our contribution. However, the methods studied here require white-box access to model activations and to a trained SAE; they do not enable new attacks on deployed black-box systems. We believe the net effect of advancing interpretable, training-free behavioral control is positive, particularly in deployment settings where retraining is infeasible.

6.0.0.2 Use of sensitive data.

Our toxicity reduction experiments use prompts and continuations from RealToxicityPrompts [20], a dataset constructed specifically for research on toxic language and released under terms that permit such use. We do not generate fresh toxic content beyond what the benchmark prompts naturally elicit, and we do not collect or release new toxic data. Toxicity classifications throughout this work uses the s-nlp/roberta_toxicity_classifier; we note that automated toxicity classifiers carry known biases against text containing identity-related terms [26], [27], which may inflate or deflate reported scores for affected subsets. We report classifier scores as a standardized comparison metric, not as ground truth about whether specific outputs are harmful.

6.0.0.3 Qualitative examples.

Appendix 9 reproduces verbatim model outputs that include toxic, offensive, and emotionally distressing content. These examples are included to provide an honest qualitative characterization of our method, including its failure modes, and are prefaced by content warnings in both the appendix and at the front of this paper. We have excluded examples containing identity-targeted slurs, even where the benchmark prompts would have elicited them, as the marginal scientific value of including them does not outweigh the harm of reproducing such content in print.

7 Related Work↩︎

7.0.0.1 Prompt-Based Behavioral Control.

The most accessible form of LLM behavioral control is prompt engineering, wherein natural-language instructions are prepended to the input to elicit desired properties such as reduced toxicity or increased helpfulness [2], [28]. While simple and architecture-agnostic, prompt-based methods are fragile: output distributions shift substantially under minor lexical perturbations [29], and adversarial suffixes can reliably override safety instructions [5]. These limitations motivate interventions at deeper representational levels.

7.0.0.2 Dense Activation Steering.

A growing body of work intervenes directly in the residual stream of transformer models during inference, applying corrections uniformly at every generated token. [7] propose Activation Addition (ActAdd), which computes a steering vector as the difference between mean activations on contrastive prompt pairs and adds it to the residual stream at every forward pass. Inference-Time Intervention [8] extends this by identifying attention heads that are linearly predictive of truthfulness and shifting activations along these directions. Contrastive Activation Addition [9] refines the contrastive approach by averaging over large prompt sets and applying layer-specific vectors. Representation Engineering [14] takes a broader view, learning linear directions in activation space that correspond to high-level concepts such as honesty or harmlessness.

Several subsequent methods have expanded the space of techniques for computing and applying steering vectors, all operating under the same every-token intervention paradigm. DiffMean [30] improves post-hoc steering by using the difference of class-conditional means and demonstrates reduced side effects compared to naive contrastive approaches. Style Vectors [31] adapt the steering framework to control stylistic attributes of generation, showing that style-specific directions can be extracted and applied at every decoding step. In-Context Vectors [32] extract latent directions from in-context demonstrations and apply them during generation to make in-context learning more controllable. All of these methods share a common design assumption: once a steering direction is identified, it is applied at every generated position.

7.0.0.3 Sparse Autoencoders for Interpretability and Steering.

Sparse autoencoders (SAEs) decompose dense, polysemantic neural activations into a dictionary of more monosemantic features [10], [11], [13]. [10] demonstrate that SAEs trained on residual stream activations recover interpretable features that align with human-understandable concepts. GemmaScope [25] provides open SAE checkpoints for the Gemma model family across all layers at multiple dictionary widths. Similarly, [12] demonstrates that identifying and amplifying SAE features associated with specific concepts (e.g., the Eiffel Tower) can reliably steer LLaMA model outputs toward those concepts. [33] introduce AxBench, a benchmark for evaluating activation steering methods including SAE-based approaches, providing standardized comparisons of steering effectiveness and side effects across methods. Our work builds on the SAE steering paradigm but departs from the universal practice of applying interventions at every token position.

7.0.0.4 Detoxification.

Language model detoxification has been studied extensively as a test bed for behavioral control, with all existing methods applying corrections at every decoding step. DExperts [34] combines an expert (non-toxic) and anti-expert (toxic) language model to re-weight token probabilities at each position. PPLM [35] backpropagates through a toxicity classifier to update hidden states during generation. Self-Debiasing [36] prompts the model to generate toxic text and suppresses the resulting token probabilities. GeDi [37] uses class-conditional language models as generative discriminators to guide generation. The standard evaluation benchmark, RealToxicityPrompts [20], reveals that all such methods incur some fluency cost. Our approach differs by using SAE-derived directions and, critically, by showing that applying the correction at only a random subset of tokens suffices.

7.0.0.5 Selective and Sparse Steering.

The question of whether every token requires intervention has recently attracted attention. Most closely related and concurrent to our work, [18] propose Sparse Inference-time Alignment (SIA), which identifies “critical junctions” via model entropy and steers only at those positions. SIA is a reward-guided decoding method: it trains a token-level value model \(V^\ast\) by distilling trajectory-level rewards, reweights the token distribution by \(\exp(\beta V^\ast)\) at selected positions, and is evaluated by reward-model scoring against best-of-\(N\) and chunk-search baselines. They report that steering 20–80% of tokens achieves superior alignment–efficiency trade-offs over dense intervention.

Our approach differs along several axes. SIA operates in logit space via a learned value model and requires training on trajectory rewards; we operate in activation space via a fixed SAE decoder direction and train nothing. SIA is evaluated under reward-model scoring with best-of-\(N\) selection, whereas we report single-sample classifier metrics, so the two are not directly comparable and we do not benchmark against SIA. Additionally, SIA incurs significant inference overhead. The value model must be queried at each candidate position, and best-of-\(N\) selection requires generating multiple completions per prompt, whereas our method adds a single pre-computed vector to the residual stream and produces one output, introducing negligible latency.

The most substantive difference concerns the role of randomness. SIA’s random-gating baseline (their Eq. 7) coincides with our STS gate: an independent \(\mathrm{Bernoulli}(p)\) draw per token. SIA reports that this random gating underperforms entropy-based gating across their settings (their §4.3.2, Fig. 1), concluding that sparsity alone is insufficient without informed junction identification. We argue that this result is mechanism-dependent. SIA’s guidance comes from a learned value estimator that, by their own analysis, carries estimation noise: writing \(\hat{V} = V^\ast + \xi\) with \(\xi \sim \mathcal{N}(0,\sigma^2)\), they show that at non-critical states, where the true value landscape is flat, reweighting by the noisy \(\hat{V}\) injects variance into the decoding distribution scaling as \(\beta^2\sigma^2/2\), without improving expected return (their §B.4, Prop. B.3). Informed gating mitigates this by avoiding intervention at precisely those low-stakes, low-signal positions. This failure mode is structurally absent in our setting: a fixed SAE decoder direction carries no per-token estimation noise, the same vector \(\mathbf{v}\) is added wherever the gate fires, so there is no noisy signal for informed selection to filter, and random placement incurs no analogous penalty. We therefore read SIA’s negative result on random gating not as a contrary finding but as evidence that the necessity of informed selection is tied to the noisy, learned guidance signal of reward-guided decoding rather than to sparse steering in general.

[16] argue that safety alignment is concentrated in early token positions, and [38] similarly focus steering on initial tokens for weak-to-strong decoding. Consistent with this, SIA finds that position-based gating is competitive for safety alignment at low intervention ratios but degrades on helpfulness tasks, a task-dependence that mirrors our own finding that the position-anchored SBS underperforms the position-agnostic STS. This convergence suggests that distributing the steering signal across the sequence, rather than concentrating it at privileged positions, is the more robust strategy. Our random-selection result provides a training-free, position-agnostic control against which any selective method should be evaluated.

7.0.0.6 Fluency–Alignment Trade-offs.

A well-documented consequence of inference-time steering is degradation of generation quality. [7] observe that large steering magnitudes produce disfluent text, and [9] systematically study the trade-off between behavioral shift and coherence loss. [33] provide standardized measurements of this trade-off across multiple steering methods. Our work adds the observation that sparse application of steering can improve this trade-off: by intervening at fewer positions, the model’s residual stream remains closer to its native distribution, yielding better fluency at matched behavioral shift.

8 Prompts↩︎

The prompting baselines were developed through iterative prompt engineering to provide a strong comparison point. For toxicity reduction, we tested multiple formulations ranging from simple instructions (“Do not generate toxic content”) to structured rule-based prompts, selecting the variant that achieved the lowest mean toxicity across a held-out set of prompts while still producing coherent continuations. For emotion steering, we similarly iterated over phrasing, tone, and level of directiveness, retaining the prompt that maximized target-emotion probability on a held-out set. The final prompts below represent our best-effort prompt-only baselines; they are intentionally strong to ensure that any method surpassing them provides a meaningful improvement over what prompt engineering alone can achieve.

9 Qualitative Examples↩︎

Content warning: the examples below contain toxic, offensive, and emotionally distressing model outputs. They are reproduced verbatim to illustrate the behavior of our method and the baselines; we do not endorse their content.

10 Fluency-Preserving Regularization Details↩︎

In this section, we present the techniques used to preserve fluency.

10.0.0.1 Norm Preservation.

Following [7], we rescale the steered activation to restore the norm of the original: \[\tilde{\mathbf{h}}_t^{(\ell^*)} \leftarrow \tilde{\mathbf{h}}_t^{(\ell^*)} \cdot \frac{\bigl\|\mathbf{h}_t^{(\ell^*)}\bigr\|}{\bigl\|\tilde{\mathbf{h}}_t^{(\ell^*)}\bigr\|}\] This constrains the intervention to rotate the representation toward \(\mathbf{v}\) without inflating its magnitude, preserving the scale invariants assumed by downstream computations.

10.0.0.2 Activation Clamping.

Inspired by [12], we clamp the scalar projection of the steered activation onto \(\mathbf{v}\) to a range \([\gamma_{\min},\,\gamma_{\max}]\) and apply a residual correction: \[s_t = \tilde{\mathbf{h}}_t^{(\ell^*)} \cdot \mathbf{v}, \quad \hat{s}_t = \mathrm{clamp}(s_t,\;\gamma_{\min},\;\gamma_{\max}) \label{eq:vvv}\raisetag{28pt}\tag{5}\] \[\tilde{\mathbf{h}}_t^{(\ell^*)} \leftarrow \tilde{\mathbf{h}}_t^{(\ell^*)} + (\hat{s}_t - s_t)\,\mathbf{v}\] The upper bound prevents over-amplification beyond the feature’s natural range, while the lower bound \(\gamma_{\min} \geq 0\) actively suppresses any residual feature activation already present in the unsteered representation.

10.0.0.3 Repetition Penalty.

Steering suppresses high-probability continuations, causing the model to fall back on repetitive sequences [12]. We apply a standard repetition penalty [19] at the decoding stage, discounting previously generated tokens without further modifying hidden representations.

11 Implementation Details↩︎

For LLaMA 3.1 8B, we use eleutherai/sae-llama-3.1-8b-32x¹; for Gemma-2 2B, we use google/gemma-scope-2b [25] with a dictionary width of 65K features. Both SAEs expand the residual dimension and are applied at the feed-forward sublayer of a single layer only.

We identify steering features via a contrastive procedure, selecting the top-10 SAE features ranked by mean activation differential \(\Delta_i\) (Eq. 2 ). For toxicity reduction, we sample 600 highly toxic prompts (toxicity \(\geq 0.6\)) and 300 low-toxicity prompts (toxicity \(< 0.2\)) from RealToxicityPrompts. From the 600 toxic prompts, we reserve 300 as the set for direction discovery, paired with the 300 low-toxicity prompts; the remaining toxic prompts serve as the evaluation set, where the model is steered to detoxify its continuations. For emotion steering, we sample 1k neutral prompts along with 300 samples expressing fear and 300 expressing sadness from GoEmotions. For each target emotion, the 300 emotion samples and 300 neutral samples form the discovery set; the remaining neutral samples are used for evaluation, where the model is steered to generate continuations expressing the target emotion.

During generation, we set temperature to 0.1, generate up to 128 tokens, and apply a repetition penalty of 1.1. Steered feature activations are clamped to \([0, 40]\) to prevent degenerate outputs. For SBS, we evaluate window sizes \(W \in \{32, 64\}\).

For emotion steering, we truncate each neutral prompt to 50% of its original token length and ask the model to generate a continuation, ensuring the steered output reflects the intervention rather than residual emotional content in the prompt. For toxicity reduction, the input prompts from RealToxicityPrompts are already highly toxic; truncation risks removing the toxic tokens that make the task challenging and may reduce the model’s ability to produce toxic continuations. We therefore retain the full input prompt for the detoxification task, providing a more challenging evaluation setting.

Toxicity probability is measured by a separate classifier s-nlp/roberta_toxicity_classifier²; and emotion classification uses j-hartmann/emotion-english-distilroberta³ [39], which was fine-tuned on Ekman’s six emotion classes plus neutral.

12 Steering Magnitude Calibration↩︎

Before evaluating stochastic interventions, we calibrate the steering magnitude \(\alpha\) for each model under full steering (\(p{=}1\)). Figures 3 and 4 show steering effectiveness, perplexity, and repetition scores as a function of \(\alpha\). For both models, steering effectiveness increases with \(\alpha\) up to a saturation region, beyond which generation quality degrades sharply: perplexity remains stable at low magnitudes but exhibits a sharp inflection when \(\alpha\) increases, accompanied by spikes in Rep-3 and Rep-4 scores. We select the operating point that maximizes steering effectiveness subject to fluency preservation: \(\alpha = 2, 2.5, 2\) for LLaMA 3.1-8B on toxicity reduction, fear, and sadness respectively, and \(\alpha = 35, 30, 35\) for Gemma-2 2B on the same tasks.

13 Additional Results↩︎

To complement the probability-gain metric used in the main paper, Figure 5 reports the mean top-3 hit rate for fear and sadness steering: the target emotion is counted as a hit if it appears among the three highest-probability classes predicted by the emotion classifier. STS consistently outperforms SBS at matched intervention ratios across both models and both emotions. For fear on LLaMA 3.1-8B, STS at \(p{=}0.5\) achieves a hit rate of approximately 0.73, surpassing the prompting baseline (0.44) by a wide margin and approaching full steering (0.98). On Gemma-2 2B, the same ordering holds: STS crosses the prompting baseline at lower intervention ratios than either SBS variant. These results confirm that the sparse steering findings reported on toxicity reduction in the main paper generalize to emotion elicitation under a classification-based evaluation metric.

References↩︎