Source-linked AI summary
LocUS: Head Selection and Subspace Projection for Targeted Activation Steering
Irene Tallini, Lorenzo Basile, Valentino Maiorca, Francesco Locatello, Alberto Cazzaniga
TL;DR
Contrastive steering directions can include off-target differences and may damage unrelated capabilities. LOCUS uses lexical subspaces to constrain both the heads and directions involved; across three model families and tasks, it reports stronger target-metric shifts than comparison methods while preserving general capabilities measured through MMLU.
Problem
Contrastive-data differences beyond the target property can enter steering directions and potentially damage unrelated capabilities such as factual recall or reasoning.
Source: §1 · p. 1Method
LOCUS uses lexical subspaces to constrain difference-of-means steering to selected attention heads and property-aligned per-head directions.
Source: §1 · pp. 1–2Results
Takeaways & Limitations
The lexical dictionary can be filtered to focus on chosen directions, including removing demographic-content atoms when steering for toxicity reduction.
Source: §7 · p. 7LOCUS applies only when the target property is carried by a lexical difference, and its capability evaluation does not cover open-ended reasoning.
Source: §7 · p. 8
Abstract
from arXiv · showhide
Activation steering is a powerful training-free paradigm for controlling large language models at inference time. However, standard approaches estimate a per-layer steering direction from contrastive data and apply it on the layer's entire representation space, which may couple the intervention to off-target properties present in the contrastive data and degrade unrelated capabilities. To mitigate this issue, we introduce LocUS (Localized Unembedding Steering), a method which grounds activation steering to the model's own output vocabulary subspace. By identifying a property-specific linear subspace within the unembedding matrix, LocUS enforces a geometric constraint that restricts the steering transformation to a specific subspace and at the same time localizes its application to a sparse subset of attention heads. Extensive evaluations across three model families on toxicity mitigation, sentiment redirection and sycophancy suppression show that LocUS matches or outperforms state-of-the-art baselines while intervening on under 6% of parameters and better preserving general capability.
1 Introduction
Contrastive activation steering can carry unrelated differences in its update, while fine-tuning and prompting have their own costs or calibration challenges. LOCUS uses lexical subspaces to select attention heads and constrain where steering acts, and the paper evaluates it across three models and three tasks.
1 Introduction
- Contrastive steering can encode differences beyond the target property, potentially damaging unrelated capabilities such as factual recall or reasoning.Fine-tuning requires an additional training stage and risks catastrophic forgetting, while prompting can be brittle and difficult to calibrate.Source: §1 · p. 1
- LOCUS uses lexical subspaces to determine both which attention heads to steer and which representational subspace each update can affect.The subspaces are defined by a sparse subset of unembedding-matrix columns corresponding to tokens linked to the target property.Source: §1 · p. 1
- The proposed contributions are automated head selection based on lexical alignment and per-head steering vectors projected into localized lexical subspaces.The lexical sets can be automatically generated or user curated, providing a lever for guiding the steering transformation.Source: §1 · p. 2
- The paper evaluates toxicity reduction, sentiment control, and sycophancy suppression across three models.The contribution summary identifies three evaluated models and the three target behaviors.Source: §1 · p. 2
2 Related Work
Prior work identifies property-relevant components at different model granularities and uses localized components as steering sites. The authors identify automatic property-agnostic head selection and property-aligned subspace projection as gaps in that literature.
2 Related Work
- Interpretability research identifies property-relevant components at several granularities, while steering work tests localized components as intervention sites.The cited examples span layer-level steering and less common head-level steering.Source: §2 · p. 2
- Li et al. (2023) select heads with a per-head linear probe for LLaMA truthfulness steering, while Izawa et al. (2026) select heads within a chosen layer for persona traits.Both methods evaluate a single property, and head counts and intervention strength are swept or set manually.Source: §2 · p. 2
- The authors describe automatic, property-agnostic head-wise steering and property-aligned subspace projection as missing from prior activation-steering work.They characterize the latter as entirely absent from the literature they review.Source: §2 · p. 2
3 Background
Difference-of-means steering estimates a direction from contrastive residual activations and adds it to the model during inference, but the direction can inherit off-target differences. LOCUS uses unembedding-derived lexical atoms and sparse reconstruction to localize both the heads and subspaces used for steering.
3 Background
- Difference-of-means steering estimates a direction from the class-conditional means of residual-stream activations and adds a scaled version during inference.The residual stream is updated additively by attention heads and MLP blocks, making vector addition a natural intervention primitive.Source: §3 · pp. 2–3
- Because the contrastive direction inherits every difference between the two datasets, off-target axes can also be injected during steering.LOCUS addresses this by localizing the intervention to selected attention heads and a property-aligned subspace within each.Source: §3 · p. 3
- LOCUS defines property atoms by selecting unembedding columns for concept-relevant tokens, then uses SOMP to find a shared sparse atom set that reconstructs each head’s calibration outputs.Head outputs are passed through the final RMSnorm before comparison with the unembedding atoms to address their scale mismatch.Source: §3 · p. 3
- The explained-variance ratio scores how well selected atoms capture a head’s outputs; Figure 2 shows per-head scores, selected heads, and selected atoms for top-scoring heads.Its caption identifies the selected heads using the μ + 2σ rule.Source: §3 · p. 3, Figure 2 · p. 3
4 Method
LOCUS uses vocabulary-derived property subspaces to select steering heads and constrain updates within those heads. Its variants localize interventions at either the residual-stream layer or raw-head level, with the full method combining head selection and head-level projection.
4 Method
- The head-selection procedure scores heads using SOMP on calibration examples and retains those with unusually large explained variance relative to the network.The number of retained heads is determined from the empirical mean and standard deviation of head scores.Source: §4 · p. 4
- LOCUS-s applies a shared property-subspace constraint at every residual-stream layer, while LOCUS-hs projects updates at every raw head without selecting heads.For LOCUS-s, SOMP identifies shared atoms that reconstruct calibration activations, and the resulting steering vector is applied to original activations.Source: §4 · p. 4
- At head level, the property dictionary is translated from residual-stream space into raw-head space through the model’s decoding path.The resulting directions represent raw-head contributions to property-token logits after the output projection, RMS normalization, and unembedding.Source: §4 · p. 4
- LOCUS combines data-driven head selection with projection of each selected head’s update into a sparse property-aligned subspace; unselected heads are untouched.The intervention is localized across both the selected heads and the directions used within each head.Source: §4 · p. 5
- LOCUS variants are rescaled to heuristically match the unrestricted DoM intervention magnitude, with steering strength selected on validation data.The multiplier maps each variant’s strength to the original steering coefficient; the reported coefficient is chosen on a validation split.Source: §4 · p. 5
5 Experimental Setup
The evaluation tests toxicity mitigation, sentiment redirection, and sycophancy suppression across three model families. It compares LOCUS with unsteered, DoM, and head-level baselines using target metrics and general-capability checks.
5 Experimental Setup
- The study evaluates toxicity mitigation, IMDb sentiment redirection, and sycophancy suppression on Mistral-7B, deepseek-7b, and Llama-8B.It uses instruct/chat variants for toxicity and sycophancy, and base variants for IMDb continuation.Source: §5 · pp. 5–6
- The comparisons include unsteered models, DoM, LOCUS ablations, and head-level ITI and SMH baselines.The ablations separate head selection, layer-level projection, head-level projection without selection, and the combined LOCUS method.Source: §5 · p. 6, Table 3 · p. 6
- Target outcomes are toxicity rate, IMDb positive rate, and an LLM-judged 0–100 sycophancy trait score, with lower values indicating more effective steering.MMLU and Wikipedia-opening perplexity assess unrelated capabilities and output quality.Source: §5 · p. 6
- The atom budget for head selection is 50 and the projection budget is n=20; steering strength is validation-selected under MMLU and perplexity constraints.The selected strength must keep validation perplexity at most twice the unsteered value and MMLU at least 0.99× the unsteered value.Source: §5 · p. 6
6 Experimental Results
LOCUS generally outperforms layerwise and head-level baselines, while combining head selection with subspace projection improves steering and capability retention. Its gains persist across external-corpus fitting and 67B-scale evaluation with a small intervention.
6 Experimental Results
- In most cases, head selection beats whole-layer steering, and projection within selected heads improves on head selection alone.The ablations report that head selection alone accounts for most of the gain, while adding projection further protects capabilities.Source: §6 · pp. 6–7
- LOCUS beats DoM in eight of nine cells and ITI in those same eight; SMH beats LOCUS only on TET/deepseek, while no method shifts Sycophancy/Llama-8B.The unchanged Sycophancy/Llama-8B cell is described as a failure case for difference-of-means steering generally.Source: §6 · pp. 6–7
- Within 0.005 MMLU of unsteered, Jigsaw-fitted LOCUS reduces toxicity more than same-data DoM on all three models.The cited table covers steering fitted on Jigsaw and evaluated on TET.Source: Table 4 · p. 7, §6 · p. 7
- Head selection alone beats DoM in every cell; projection without selection either loses MMLU or understeers.On IMDb/Llama-8B, LOCUS trails LOCUS-h (0.119 vs. 0.070) because PPL grows faster as the budget is concentrated, so the validation gate rejects the next strength.Source: §6 · p. 7
- About 3% of 6,080 heads are selected at 67B, where LOCUS beats DoM on all three tasks and keeps MMLU within 0.01 of unsteered.Reported target pairs are 0.000 vs. 0.020 on TET, 0.009 vs. 0.387 on IMDb, and 54.4 vs. 58.2 on Sycophancy.Source: §6 · p. 7
- 0.4%-0.8% of unprojected DoM degrees of freedom are used, with at most 5.1% of heads retained and updates confined to 16% of per-head dimensionality.The paper characterizes this as a substantially smaller, structurally and geometrically localized intervention.Source: §6 · p. 7
7 Conclusions
LOCUS localizes difference-of-means steering to selected attention heads and sparse property-aligned directions. Across three model families and tasks, it produces stronger target-metric shifts than the compared steering methods while preserving MMLU-measured capabilities, with limitations in lexical scope and capability coverage.
7 Conclusions
- Across three model families and tasks, LOCUS yields stronger target-metric shifts than layerwise difference-of-means and existing head-level methods while preserving MMLU-measured capabilities with fewer steering parameters.The authors report this pattern across toxicity, sentiment, and sycophancy tasks.Source: §7 · p. 7
- LOCUS confines difference-of-means steering to a small set of attention heads and sparse property-aligned directions selected through a user-controllable lexical dictionary.The authors describe this as two-level localization.Source: §7 · p. 7
- MMLU does not evaluate fine-grained controllability, such as reducing toxicity while preserving specific demographic content.The authors identify a dedicated benchmark as necessary to evaluate this.Source: §7 · p. 7
- LOCUS specifies intervention sites and subspaces, making it in principle compatible with any steering method; combining it with more sophisticated estimators is proposed as future work.Source: §7 · p. 8
- LOCUS is applicable only when the target property is carried by some lexical difference.Source: §7 · p. 8
- Capability evaluation uses MMLU and PPL, leaving effects on open-ended reasoning uncovered; the method also tends to degrade fluency more than factual reasoning.Source: §7 · p. 8
Ethical Considerations
The paper frames targeted behavior modification as useful for interpretability, auditing, and alignment, while warning that it can also be misused. Experiments use released Mistral, Llama, and DeepSeek checkpoints without further fine-tuning.
Ethical Considerations
- Targeted behavior modification can support interpretability, auditing, and alignment, but could also be misused to suppress, emphasize, or disguise content.Source: Ethical Considerations · p. 11
- The authors urge careful assessment of downstream uses, particularly in high-stakes or sensitive settings.Source: Ethical Considerations · p. 11
- The authors state that the models and datasets comply with their research licenses and that code will be released for non-commercial research use under compatible licensing conditions.Source: Ethical Considerations · p. 11
A.1 Models.
- Experiments use released Mistral, Llama, and DeepSeek checkpoints at their official revisions, with no further fine-tuning.Sentiment experiments use base checkpoints; toxicity and sycophancy experiments use instruction-tuned counterparts.Source: §A.1 · p. 11
A.2 Datasets and pipeline
The appendix describes task-specific fit and evaluation data, then details how the fit split supplies the steering components while validation selects strength and test data supplies reported metrics. It also specifies the lexical-dictionary and activation-capture procedures used in the method.
A.2 Datasets and pipeline
- For toxicity, 2,546 prompts are split into 1,273 test prompts and 636 fit plus 637 validation prompts; fit completions are classifier-labeled to form a contrastive set.The contrastive set uses up to 512 toxic completions and an equal number of non-toxic completions.Source: §A.2 · p. 11
- IMDb uses 512 positive and 512 negative training reviews for fitting, with 1,000 eligible test prefixes and the next 1,000 for validation; sycophancy uses 512 trait-eliciting and 512 neutral responses for fitting.Sycophancy evaluation uses five system prompts and 20 questions, scored by an LLM judge.Source: §A.2 · p. 11
- Across tasks, fit data forms the property dictionary, per-head EVR matrix and dictionaries, and difference-of-means vector; validation selects the coefficient under the capability gate, while test data is used only for reported metrics.Source: §A.2 · p. 11
A.3 Method
- The property dictionary ranks words by pointwise KL-divergence contribution in both directions, removes stop words, and retains a union of up to 70 top-scoring words per direction.The resulting vocabulary contains 139–140 words per model-task cell; some toxicity lists are manually filtered.Source: §A.3 · p. 11
- The atonce strategy captures activations for all selected heads in one calibration-set forward pass and estimates each head’s difference-of-means update, avoiding hook-order dependence but ignoring downstream effects of upstream interventions.The steering vector averages prompt positions and is applied at the last token of the generated continuation.Source: §A.3 · pp. 11–12
A.4 Evaluation
The evaluation selects steering strength on validation data subject to capability gates and fixes LOCUS’s head-level subspace budget using fit-time EVR. The accompanying figures contrast the concentration of EVR head scores with the broader distribution of ITI probe accuracy.
A.4 Evaluation
- The coefficient α1 is selected once per method-model-task cell on validation data, choosing the lowest-target-metric admissible point from method-specific sweep grids.Admissibility requires validation Wiki-PPL no greater than twice the unsteered value and MMLU at least 0.99 times the unsteered value.Source: §A.4 · p. 12
- The control metrics are Wiki-PPL and 57-subject, five-shot MMLU accuracy, with validation and test partitions used for selection and reporting, respectively.MMLU has 14,042 items split by subject; the Jigsaw and 67B tables use the full set.Source: §A.4 · p. 12
- ITI ranks heads by cross-validated linear-probe accuracy and selects as many heads as LOCUS-h.The probes use last-token per-head activations and balanced classes.Source: §A.4 · p. 12
- The fit-time budget criterion yields n⋆ values from 14 to 25 across twelve cells, with median 21, motivating n=20 for LOCUS and LOCUS-hs; LOCUS-s uses n=10 by hand.The criterion is the smallest atom budget where mean cumulative EVR over heads exceeds 0.25.Source: Table 6 · p. 12, §A.4 · p. 12
B Head selection matrices
- Figures 3 and 4 show per-head EVR scores and mark retained heads, while Figure 5 shows ITI probe accuracy, which is broadly distributed across heads and layers unlike EVR.Source: B Head selection matrices · pp. 12–13
C Strength Comparison
The validation sweep compares steering strength across task–model cells using target metrics and MMLU. In the Llama-8B sycophancy cell, no tested variant changes the target score.
C Strength Comparison
- Less than two points of sycophancy-score variation occur across the entire strength sweep for Llama-8B, leaving every method’s target unchanged.The panel spans less than two points, and no variant at any tested strength moves the score from the unsteered value.Source: C Strength Comparison · p. 13
- Figure 6 sweeps α1 from 0.25 to 4 for each task–model cell, plotting the validation target metric against MMLU for DoM and four LOCUS variants.Lower target metric and higher MMLU are preferred; points with validation wiki-PPL above twice the unsteered value are omitted, and black rings mark selected α∗ values.Source: C Strength Comparison · p. 13, Figure 6 · p. 17