PaperlayerView exact revision on arXiv

Source-linked AI summary

Activation Flow: Manufacturing Activations for Steering

Hong Kiat Tan, Linh Le, David Williams-King

arXiv:2609.32530v2cs.LGcs.AIcs.CLmath.DG

TL;DR

Sandbagging makes capability evaluations underestimate models that deliberately underperform, and existing reference grafting depends on honest activations unavailable to evaluators. ActFlow manufactures steering activations from correct labels and locked-model activations without fine-tuning. At k = 40, it brings mean ARC-Easy accuracy across six locked models to 0.85, close to 0.88 for fine-tuning.

  • Problem

    Sandbagging models deliberately underperform on capability evaluations, causing those evaluations to underestimate what the models can do.

    Source: §1 · p. 1

  • Method

    ActFlow uses correct labels and a locked model’s activations to construct target logits, then applies one shared residual-stream shift across the labeled items without fine-tuning.

    Source: §1 · p. 2, §3.2 · pp. 4–5

  • Results

    At k = 40, mean ARC-Easy accuracy across six locked models rises from 0.05 to 0.85 with ActFlow5, versus 0.88 for fine-tuning and 0.92 for honest models.

    Source: §5.1 · p. 8

  • Takeaways & Limitations

    ActFlow unlocks locked models without fine-tuning and comes close to fine-tuning in accuracy.

    Source: §7 · p. 10

    Whether ActFlow’s residual-stream path stays near a manifold of the model’s activations is untested.

    Source: §6 · p. 10

Abstract

from arXiv · show

Difference-in-means steering requires activations recorded while a model shows the desired behavior, which a sandbagging model withholds by deliberately underperforming. We introduce Activation Flow (ActFlow), which manufactures these activations from $k$ correct labels without fine-tuning. ActFlow sets target logits that rank each labeled item's correct answer first, and moves the logits toward them by adding one vector $x$ to all $k$ residual streams at one layer. ActFlow is a family of ordinary differential equations for $x$, one for each rule that maps the required logit change to the velocity of $x$. The smallest-norm rule lands exactly on the targets, while the others keep only the top singular directions of the Jacobian. We test ActFlow on three instruction-tuned models, each locked by a sandbagging prompt and by a password-locked LoRA. At $k=40$, ActFlow keeping five singular directions raises the mean held-out ARC-Easy accuracy over the six locked models from $0.05$ to $0.85$, against $0.88$ for rank-$16$ LoRA fine-tuning, which trains about $3{,}000$ times as many parameters, and $0.92$ for the honest models. Furthermore, it scores higher than the smallest-norm rule in 16 of the 18 combinations of locked model and $k$, and its steering direction is nearly orthogonal to the honest difference-in-means direction. It also unlocks two LoRA locks where the honest direction fails. Surprisingly, with one labeled item, the single-step smallest-norm rule raises the Qwen2.5-7B prompt lock from $0.04$ to $0.59$.

1 INTRODUCTION

Sandbagging can make capability evaluations underestimate what a model can do, while existing reference grafting relies on honest-condition activations unavailable to evaluators. ActFlow instead manufactures steering activations from correct labels and the locked model’s own activations, without fine-tuning.

1 INTRODUCTION

  • Capability evaluations can underestimate a sandbagging model’s capability because it deliberately underperforms, while reference grafting relies on honest-condition activations that evaluators lack.Reference grafting uses a difference of mean activations and sets the residual-stream coordinate along that direction to its honest mean.Source: §1 · p. 1
  • A reference graft is a one-vector, one-layer, rank-one residual-stream edit that leaves model weights unchanged and is more interpretable than an adapter on every layer.For Qwen2.5-7B, the graft has 3,584 parameters versus 10.1 million for the rank-16 LoRA baseline.Source: §1 · p. 1
  • ActFlow manufactures steering activations from k correct labels and the locked model’s own activations by moving logits toward correct-answer-first targets with one shared residual-stream shift.The shift is applied to all k items at one layer, without fine-tuning.Source: §1 · p. 2
  • ActFlow is tested on three instruction-tuned models, each locked by a sandbagging prompt and a password-locked LoRA, with honest accuracy and grafts reported as references.ActFlow itself uses neither the known honest condition nor honest activations.Source: §1 · p. 2
  • At k = 40, ActFlow5 raises mean ARC-Easy accuracy across six locked models from 0.05 to 0.85, versus 0.88 for fine-tuning and 0.92 for honest models.ActFlow5 scores higher than ActFlowfull in 16 of 18 locked-model and k combinations; its direction is nearly orthogonal to the harvested direction, and it unlocks two LoRA locks where the honest graft fails.Source: §1 · p. 2

2 RELATED WORK

Prior work elicits hidden capabilities through fine-tuning, inference-time grafting, or other steering approaches, while related research studies steering interpretability, activation-space geometry, and redundant Jacobian solutions.

Sandbagging and capability elicitation

  • ActFlow retains grafting but manufactures activations from the locked model and correct labels without fine-tuning.Earlier elicitation approaches include fine-tuning, noise injection, rank-one adapters, and grafting honest activations.Source: §2 · p. 2

Steering without a contrast condition

  • Other steering methods avoid a contrast condition through optimized vectors, Fisher-metric updates, reinforcement learning, or gradient-trained low-rank edits; ActFlow fits one shift shared across k items.A shift for one multiple-choice item generally does not transfer to new items.Source: §2 · p. 2

Interpreting steering directions

  • Prior work cautions that steering vectors can classify behavior poorly, move activations to unlikely points, or be non-identifiable from first-order behavior.The paper measures one instance of non-identifiability in Section 5.4.Source: §2 · p. 3

Neural geometry

  • Neural-geometry work models concepts as curved activation-space manifolds, whereas ActFlow uses locked-model logit-map fibres and crosses them using Jacobians and correct labels.A sandbagging model provides no honest activations with which to fit the manifold approach described.Source: §2 · p. 3

Redundancy resolution

  • ActFlow’s possible velocities form an affine space of dimension d − qk, and its rule selects a velocity using the Jacobian pseudo-inverse or truncated SVD.This parallels resolved motion-rate control, which uses a Jacobian pseudo-inverse to choose among redundant joint velocities.Source: §2 · p. 3

3 ACTIVATION FLOW

ActFlow finds shared residual-stream shifts whose logits follow a prescribed path toward targets that rank each labeled item’s correct answer first. Different rules choose among the many shifts that produce the required logit changes, with spectral rules selectively retaining Jacobian directions.

3.1 SETUP

  • ActFlow adds one shared shift to all k labeled items’ residual streams, targeting logits that rank each correct answer first.The target keeps wrong-answer logits and sets the correct-answer logit 5 above the largest wrong-answer logit.Source: §3.2 · p. 4, §3.1 · p. 4

3.2 HOW ACTFLOW WORKS

  • The logit path leaves many possible residual-stream curves, so a rule selects a unique velocity at each point and integration yields the steering shift.The smallest-Euclidean-norm choice uses the Jacobian’s Moore–Penrose pseudoinverse.Source: §3.2 · p. 4

3.3 THE SPECTRAL PICTURE

  • Spectral rules map each Jacobian left singular direction to its paired right singular direction with a weight determined by its singular value.The smallest-norm lift reaches the target logits; partial lifts omit selected directions and can incur landing error.Source: §3.3 · pp. 5–6

3.4 DISCRETIZATIONS

  • The flow can be discretized with Euler steps or corrected steps, while gradient descent on squared logit error provides a comparison method.The corrected scheme adds a Gauss–Newton-style correction to the Euler step.Source: §3.4 · pp. 6–7

3.5 WHEN THE FLOW IS DEFINED

  • The flow assumes a full-row-rank Jacobian; for the tested models, analyticity implies this condition holds away from a closed measure-zero set if it holds at the start.The lift reaches the end of the path only if its smallest singular value stays bounded away from zero; partial lifts require a corresponding singular-value gap.Source: §3.5 · p. 7

4 EXPERIMENTS

The experiments evaluate ActFlow and comparison methods on three instruction-tuned models locked by prompts or password-locked LoRAs. They use labeled ARC-Easy items, held-out ARC-Easy and OpenBookQA tests, and graft-based steering interventions.

4 EXPERIMENTS

  • Three instruction-tuned models are each tested with a prompt lock and a password-locked LoRA, yielding six locked models.The prompt lock instructs the model to answer incorrectly; the LoRA lock answers incorrectly unless given a password.Source: §4 · p. 7
  • For k values of 1, 4, 10, and 40, labeled items come from 80 ARC-Easy validation questions, with held-out tests on ARC-Easy and OpenBookQA.No OpenBookQA items are used for training, so its accuracy measures transfer to a second dataset; test scores average across disjoint draws.Source: §4 · p. 7
  • ActFlow replaces the honest residual streams in a reference graft with manufactured activations, while the honest graft uses honest activations from the same labeled items.The graft direction is the unit direction from the mean locked residual stream to the mean honest one, and the best layer is chosen using labeled-item accuracy.Source: §4 · pp. 7–8
  • The comparison includes ActFlow variants, gradient descent, LoRA fine-tuning on the labeled items, and an honest graft; only the honest graft reads honest-model activations.Default ActFlow settings use Gauss–Newton correction, 40 steps, and a linear logit path.Source: §4 · p. 8

5 RESULTS

ActFlow substantially improves held-out accuracy on locked models, with performance depending on the flow rule and fitting setup. The results also show that shared shifts transfer better than per-item shifts, while manufactured and honest grafting directions can be nearly orthogonal.

5.1 ACTFLOW UNLOCKS THE MODELS AND COMES CLOSE TO FINE-TUNING

  • At k = 40, ActFlow5 reaches mean ARC-Easy accuracy 0.85 across six locked models, versus 0.05 for locked models, 0.88 for FT, and 0.92 for honest models.ActFlow5 is within 0.05 of FT on every lock except the Mistral prompt lock, where it scores 0.69 against FT's 0.88.Source: §5.1 · p. 8, Figure 3 · p. 9
  • ActFlow5 reaches 0.68 on OpenBookQA, versus 0.73 for FT and 0.79 for honest models, and comes within 0.07 of the honest graft on five locked models.GD took 6.2 times as long as one ActFlow rule across four Llama and Mistral locks; ActFlowPR closely matches ActFlow5 except on the Qwen LoRA lock.Source: §5.1 · p. 9

5.2 EXACT LANDING ON THE k ITEMS DOES NOT GIVE THE HIGHEST TEST ACCURACY

  • At k = 40, ActFlowfull averages 0.92 labeled-item accuracy but 0.61 test accuracy, while ActFlow5 averages 0.84 and 0.85, respectively.ActFlowfull brings all q logits within 0.5 of target in 179 of 180 draws with k ≥ 4; ActFlow5 scores higher on ARC-Easy in 16 of 18 rows.Source: §5.2 · p. 9

5.3 A SHIFT SHARED BY THE k ITEMS TRANSFERS BETTER THAN PER-ITEM SHIFTS

  • At k = 40, a shared ActFlow5 shift reaches at least 0.93 on both Qwen locks, versus at most 0.27 for per-item shifts.On the Qwen LoRA lock, a one-item shift answers 65 of 100 test items with the labeled item's letter.Source: §5.3 · p. 9

5.4 MANUFACTURED AND HARVESTED GRAFTING DIRECTIONS ARE NEARLY ORTHOGONAL

  • Across 540 draws with k ≥ 4, the median absolute cosine between manufactured and honest directions is 0.05, versus 0.01 for a random direction.The directions are stable across draws; ActFlow5 reaches 0.72 and 0.82 on two locks where the honest graft scores at most 0.03 at every layer.Source: §5.4 · pp. 9–10

5.5 GENERAL PROPERTIES OF THE FLOW

  • More steps and Gauss–Newton corrections raise ActFlow5 and ActFlowPR accuracy across both Qwen locks at k = 4, 10, and 40.At k = 10 on the LoRA lock, ActFlow5 reaches 0.61 with N = 40 versus 0.01 with N = 1; the path choice has no consistent effect. With one item, ActFlowfull scores 0.59 at N = 1 versus 0.42 at N = 40. At the last layer, ActFlowfull lands no items for k ≥ 4, and the 32 selected grafts score 0.00–0.25.Source: §5.5 · p. 10

6 DISCUSSION

Manufactured and harvested shifts can achieve similar accuracy despite being nearly orthogonal. The discussion relates this to the many shifts that fit the labeled logits and identifies open questions about the activation-space path and alternative flow rules.

6 DISCUSSION

  • The labeled items constrain only qk logits, leaving a fibre of shared shifts with dimension d − qk > 0, so shifts that fit the same items can be nearly orthogonal.Source: §6 · p. 10
  • The residual-stream shift does not follow the line between locked and honest centroids, and whether it stays near the model's activation manifold is untested.Source: §6 · p. 10
  • Rules R(J) = J+ + M(J) with JM(J) = 0 also land on target logits, but whether some transfer better than ActFlow5 remains future work.Source: §6 · p. 10

7 CONCLUSION

The paper concludes that ActFlow builds a steering direction from correct labels and the locked model's activations, without honest activations or fine-tuning. It reports results on public multiple-choice science tasks and describes the authors' use and review of generative AI tools.

7 CONCLUSION

  • ActFlow builds a shared residual-stream shift from k correct labels and the locked model's own activations, and grafting it unlocks the tested models without fine-tuning.Source: §7 · p. 10
  • Generative AI tools helped write and run code, refine the mathematical framework, draft proofs, and propose initial hypotheses and experiments; authors reviewed the work and take responsibility for its final content.Source: AI USE STATEMENT · pp. 10–11
  • The experiments use public multiple-choice science questions, with known keys and public open-weight models, and do not test refusal or harmful-content tasks.The study involves no human subjects or personal data.Source: ETHICS STATEMENT · p. 11

A PROOFS

The appendix outlines proofs for the paper's main mathematical results, including conditions for the flow to continue and bounds on truncated-flow landing error. It also treats the rank constraint at the last layer.

A PROOFS

  • The appendix roadmap covers the proof of Lemma 1, flow existence, truncated-flow landing error, and the special case of the last layer.Source: A PROOFS · p. 15
  • The flow has a unique solution for rules defined at x = 0; the lift reaches t = 1 when σ_qk stays bounded away from zero, while ActFlowm requires a bounded-away-from-zero singular-value gap.Source: A PROOFS · p. 15
  • At the last layer, the rank is at most q + k.The appendix notation identifies F and J, defines the singular values and norms, and states continuity facts used in the proofs.Source: A PROOFS · p. 15

A.1 PROOF OF LEMMA 1

The proof uses an analytic rank test: rank deficiency is the zero set of a real-analytic function. Unless that function vanishes identically, the deficient points form a closed set of measure zero.

A.1 PROOF OF LEMMA 1

  • The rank-deficient points are exactly the zeros of the real-analytic function g.The entries of DG are real-analytic, and g is a polynomial in those entries.Source: §A.1 · p. 15
  • If g is identically zero, every point in R^d is rank-deficient.Source: §A.1 · p. 15
  • Otherwise, the rank-deficient set is closed and has Lebesgue measure zero.It is the zero set of a non-identically-zero real-analytic function.Source: §A.1 · p. 15

A.2 EXISTENCE OF THE FLOW

This section characterizes existence and endpoint attainment for ActFlow flows and lifts, including uniqueness while solutions remain in the rule’s domain. It identifies singular-value failure, rank loss, and escape to infinity as conditions under which a lift may stop early.

A.2 EXISTENCE OF THE FLOW

  • The lift fails to reach t = 1 exactly when its smallest singular value is not bounded away from zero along the flow.The scalar example shows this can happen even when the Jacobian has full rank everywhere; there, the smallest singular value tends to zero as the solution diverges.Source: §A.2 · p. 16
  • Every locally spectral rule is C∞ in J and independent of the chosen SVD, even where singular values meet.Locally, the rule is given by a real-analytic weight function that assigns zero weight near singular value zero.Source: §A.2 · p. 17
  • Every locally spectral rule yields a unique solution of flow (6) in U on a maximal interval.The rule is required to be locally spectral on D, with 0 in U = {x : J(x) ∈ D}.Source: §A.2 · p. 21
  • The flow starts uniquely and can stop before t = 1 only by leaving every compact subset of the rule’s domain; its speed is bounded by the largest spectral weight times the logit-path speed.For rules that recompute m, the result applies only where m is locally constant; the rule is discontinuous where m changes.Source: §A.2 · pp. 21, 23
  • The lift reaches t = 1 exactly when its smallest singular value stays bounded away from zero along the flow.It follows the logit path exactly for as long as it exists; full rank at every point alone is insufficient.Source: §A.2 · p. 22
  • ActFlowm reaches t = 1 exactly when the gap between its m-th and (m + 1)-th singular values stays bounded away from zero.The flow has a unique solution while it remains in the domain where that gap is positive.Source: §A.2 · pp. 22–23

A.3 WHY THE LIFT CAN STOP EARLY

  • A lift can stop before t = 1 if the smallest singular value approaches zero, or if the trajectory escapes to infinity despite full rank throughout.The section’s example shows that a submersion need not define a fibre bundle; its orthogonal lift can leave the domain at t = 1/2.Source: §A.3 · p. 24

A.4 LANDING ERROR OF ACTFLOWm

ActFlowm’s partial lift has a bounded landing error determined by the share of logit change it retains, while its last-layer rank limits can prevent exact landing. The appendices also document variation across LoRA seeds, experimental settings, and baseline details.

A.4 LANDING ERROR OF ACTFLOWm

  • ActFlowm’s landing error is between (1 − θ)||∆γ|| and √(1 − θ)||∆γ||, where θ is the average share of squared logit change retained.Exact landing occurs only when ∆γ lies in the top m directions at every point along the flow.Source: §A.4 · p. 24

A.5 THE LAST LAYER

  • At the last layer, ActFlowfull lands no item for k ≥ 2 in four-choice tasks, whereas with k = 1 it lands all 80 items on both Qwen locks.For k = 4, 10, and 40, measured ranks equal q + k; with k = 1 the measured rank is qk = 4.Source: §A.5 · p. 25

B.1 LOCKED MODELS

  • The experiments use three instruction-tuned models with prompt and password-locked LoRA variants; all ten locked models pass the stated lock checks.The prompt locks have locked accuracies of 0.04 to 0.14, and the LoRA locks have honest-to-locked accuracy gaps of 0.87 to 0.97.Source: §B.1 · pp. 26–27

B.2 ACTFLOW

  • Most runs use ActFlow5 with five singular directions, 40 steps, a linear logit path, and a Gauss–Newton correction; the target puts the correct letter five logits above the others.The m = 5 setting was fixed before the runs and not tuned.Source: §B.2 · p. 27

B.3 BASELINES

  • Fine-tuning uses a rank-16 LoRA adapter and 1,024 examples per draw, and answers every labeled item correctly at all three checkpoints.The three checkpoint mean accuracies differ by at most 0.015 on ARC-Easy and 0.02 on OpenBookQA.Source: §B.3 · p. 28, Table 7 · p. 28

B.4 QWEN LORA SEEDS

  • At k = 4, ActFlow5 ranges from 0.32 to 0.87 across five Qwen LoRA seeds, while at k = 40 it ranges from 0.82 to 0.96.At k = 4, ActFlowPR trails ActFlow5 by 0.10 to 0.30 on every seed.Source: §B.4 · p. 28

B.5 COMPUTE

The compute appendix compares ActFlow and gradient descent (GD) on four Llama and Mistral locks. ActFlow uses less GPU time in the reported runs.

B.5 COMPUTE

  • GD took 6.2 times as long as one ActFlow rule in the four Llama and Mistral locks at k ∈ {4, 10, 40}.Across individual locked-model and k pairs, the ratio ranged from 2.9 to 8.7.Source: §B.5 · p. 29
  • With N = 40, one ActFlow rule makes 41 Jacobian evaluations, while GD makes up to 1001 gradient evaluations.The final evaluation records the ActFlow endpoint; GD’s last evaluation checks stopping after step 1000.Source: §B.5 · p. 29
  • The reported experiments used 130 GPU-hours in total, excluding model downloads and idle time.Table 9 covers each experiment stage and sums wall-clock job time across jobs.Source: §B.5 · p. 29

B.6 ONE LABELED ITEM

The one-item appendix compares ActFlow variants on the two Qwen locks. A single step performs best on the prompt lock, while the LoRA-lock results remain below chance.

B.6 ONE LABELED ITEM

  • On the Qwen prompt lock, one step scores 0.59 ARC-Easy test accuracy, versus 0.41 to 0.45 for N = 8, N = 40, and GD.For the LoRA lock every method scores below chance.Source: §B.6 · p. 29
  • On the prompt lock, one-step median landing error below the last layer is 7.8 to 11.7 logits, compared with at most 0.02 for N = 40.The one-step accuracy ranges from 0.01 to 0.94 across the 80 labeled items, with median 0.66.Source: §B.6 · p. 29
  • For k = 1, ActFlow5 equals ActFlowfull because the Jacobian has q = 4 rows.Table 10 reports ARC-Easy test accuracy and label share, the share of test answers matching the labeled item’s correct letter.Source: §B.6 · p. 29, Table 10 · p. 30

B.7 FULL RESULTS

The full-results appendix catalogs accuracy, fit, layer-selection, and balance measures across methods and settings. It reports that the last layer generally fails to land items at their targets and gives counts for selected layers within a prior study’s window.

B.7 FULL RESULTS

  • At every k ≥ 4, no method brings any item within 0.5 of its target at the last layer, except GD for one item on the Qwen prompt lock at k = 4.At those k values, the starting Jacobian rank at the last layer is q + k in every draw.Source: §B.7 · p. 30
  • For eight locked models with a comparison window, selected layers fall inside it in 103 ActFlow5, 88 ActFlowPR, 112 ActFlowfull, and 114 GD draws out of 240.The honest graft falls inside the window in 224 draws.Source: §B.7 · p. 30
  • The appendix tables report test accuracy, labeled-item fit, landing error, chosen layers, balanced accuracy, top-answer share, and ActFlow0.1 results.The last-layer table reports ActFlowfull landing errors; the chosen-layer table compares selected layers with Tan et al. (2026)’s window.Source: §B.7 · p. 30, Table 12 · p. 31, Table 14 · p. 33
Loading 2609.32530v2…