PaperlayerView exact revision on arXiv

Source-linked AI summary

Kernelized Activation Steering

Laziz U. Abdullaev, Minh-Hieu Pham, Bach Do, Khoat Than, Tan M. Nguyen

arXiv:2610.01062v1cs.LG

TL;DR

Fixed Difference-in-Means steering applies one input-independent direction despite nonlinear structure in activation spaces. KAS formulates steering through kernel evaluations to produce locally adaptive updates, and performs better than or on par with existing methods across the reported activation-steering tasks.

  • Problem

    Difference-in-Means applies a single input-independent steering direction, although transformer representations can contain polysemantic and curved structure that global linear directions do not capture.

    Source: §1 · p. 1

  • Method

    KAS optimizes an implicit steering score expressed through kernel evaluations, producing activation-dependent updates and recovering DiM exactly with a linear kernel.

    Source: §1 · p. 2

  • Results

    KAS improves jailbreak attack success over ActAdd on Gemma and Qwen while matching it on Llama, has the strongest effects on four CAA behaviors with non-null responses, and improves style induction over Mean-AcT across most tested strengths while preserving prompt alignment.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The KAS score is an empirical maximum mean discrepancy witness function, connecting activation steering to kernel two-sample testing and characteristic-kernel detection of distributional differences linear mean steering misses.

    Source: §1 · p. 2

    Curveball comparisons are restricted to evaluated configurations; on Gemma and Qwen it attains high attack success only beyond the validation perplexity cap.

    Source: §5.1 · p. 7

Abstract

from arXiv · show

Activation steering provides a simple, training-free mechanism for controlling attributes of generative models such as sentiment, style, and helpfulness. However, standard approaches such as Difference-in-Means apply a single input-independent steering vector across all activations, limiting expressivity and ignoring the local geometry of the activation space. We propose Kernelized Activation Steering (KAS), a unifying framework that lifts activation steering into a reproducing kernel Hilbert space. KAS formulates steering as an optimization problem expressed purely via kernel evaluations, yielding an implicit, activation-dependent steering score without constructing explicit feature maps. Unlike DiM, KAS induces locally adaptive steering: each activation is modified according to its relative position with respect to source and target reference sets, producing a nonlinear steering field over the representation space. Importantly, DiM is recovered as a special case under a linear kernel, while richer kernels enable geometry-aware interventions. Across standard activation steering tasks, including jailbreaking LLMs and image style control, KAS outperforms or is on par with the existing methods.

1 Introduction

Activation steering offers inference-time control without parameter updates, but fixed linear directions do not capture nonlinear structure in activation space. Kernelized Activation Steering (KAS) makes steering locally adaptive, connects it to kernel two-sample testing, and performs strongly across language-model and image-control tasks.

1 Introduction

  • Difference-in-Means (DiM) relies on linear directions [36] [14], while transformer representations can have polysemantic and curved structure [15] [14] that a single global translation cannot faithfully capture.DiM-style interventions may be ineffective on out-of-distribution activations or destructive of unrelated capabilities when steering strength is increased.Source: §1 · pp. 1–2
  • KAS optimizes an implicit steering score using kernel evaluations, with kernel gradients making updates locally adaptive to each activation and its relation to source and target references.A proximal regularizer bounds deviation from the original activation, and a linear kernel recovers DiM exactly.Source: §1 · p. 2
  • KAS’s score is the empirical witness function for maximum mean discrepancy, linking activation steering to kernel two-sample testing and characteristic-kernel detection of distributional differences missed by linear mean steering.Source: §1 · p. 2
  • The Gaussian RBF instantiation yields a closed-form, activation-dependent gradient update.Source: §1 · p. 2
  • KAS improves jailbreak attack success over ActAdd on Gemma and Qwen while matching it on Llama, achieves the strongest effects on four CAA behaviors with non-null responses, and improves style induction over Mean-AcT across most tested strengths while preserving prompt alignment.The evaluation covers three instruction-tuned LLMs, CAA-style behavioral steering, and text-to-image style control.Source: §1 · p. 2

2 Preliminaries

The preliminaries define the activation notation and contrast the global DiM update with kernel methods. The kernel trick permits operations in an RKHS through kernel evaluations rather than explicit feature maps.

2 Preliminaries

  • For a decoder-only transformer, x(ℓ) denotes the residual-stream activation at layer ℓ, and [n] denotes {1, . . . , n} for positive integer n.Source: §2 · p. 3
  • DiM [54] [3] [56] forms a steering direction by subtracting mean source activations from mean target activations, then applies the same input-independent translation to every activation.The intervention layer is typically selected on a held-out validation set [3].Source: §2 · p. 3
  • A positive semi-definite kernel defines an RKHS, and the kernel trick implements algorithms based on feature-space inner products using kernel evaluations without materializing the feature map.The passage gives a cost of O(n) kernel evaluations per query.Source: §2 · p. 3

3 Related Work

Prior activation-level interventions include fixed-direction methods, nonlinear feature-based approaches, and transport-based steering. KAS instead derives activation-dependent interventions from a kernel-based objective and recovers DiM under a linear kernel.

3 Related Work

  • Activation-level interventions include activation addition [54], representation engineering [59], contrastive activation addition, and inference-time intervention [24], while most methods use fixed directions from DiM, linear probing, or PCA.Source: §3 · p. 3
  • Input-dependent alternatives include K-steer’s trained nonlinear attribute classifier [35], SAS’s pretrained sparse autoencoders [6], and Optimal Transport approaches with affine [46] and nonlinear [1] steering.Source: §3 · p. 3
  • KAS derives an activation-dependent intervention from an interpretable kernel-based optimization objective, recovers DiM under a linear kernel, and connects steering to hypothesis-testing techniques [33].Related approaches include Curveball steering using kernel PCA [40] and kernel methods for distribution matching, variational inference, and diffusion-based image restoration [25] [27] [20].Source: §3 · p. 3

4 Kernelized Activation Steering

KAS generalizes DiM by lifting activation steering into an RKHS and optimizing a kernel-based score, so updates can reflect local activation geometry. With a linear kernel it recovers DiM; with an RBF kernel it produces locally adaptive updates and has sufficient conditions for one-step objective improvement.

4 Kernelized Activation Steering

  • KAS addresses DiM’s disregard for local activation structure by deriving steering as a principled operation that also covers nonlinear decision boundaries.DiM is effective when the source and target activations are well separated by a linear hyperplane.Source: §4 · p. 4

4.1 Lifting Difference-in-Means into an RKHS

  • KAS lifts the DiM direction into an RKHS, where expressive kernels can capture contrastive features without explicitly materializing the feature-space vector.The ideal update increases the alignment between the lifted activation change and the lifted DiM direction.Source: §4.1 · p. 4

4.2 Steering as an Optimization Problem

  • The proximal objective optionally limits drift from the original activation, while gradient ascent yields an input-dependent update; most experiments use one step with λ = 0.Under a linear kernel and no proximal term, the update recovers DiM.Source: §4.2 · pp. 4–5
  • The implicit steering score uses kernel evaluations against source and target references, and is the empirical MMD witness that Algorithm 2 ascends.The population score is the MMD witness; characteristic kernels can detect distributional differences beyond mean differences.Source: §4.2 · p. 5

4.3 RBF Kernelized Activation Steering

  • With the RBF kernel, reference points exert similarity-weighted forces that attract activations toward target examples and repel them from source examples.Similarity decays with Euclidean distance, so reference points act within an effective radius of approximately σ.Source: §4.3 · p. 6
  • A normalized-gradient update strictly improves the objective under sufficient step-size conditions, but those bounds can be conservative in practice.The authors tune the step size; the normalized direction is undefined when the gradient is zero, at which point the algorithm terminates.Source: §4.3 · p. 6

5 Experiments

Experiments assess steering across jailbreaks, multiple-choice behaviors, and image style control, then test kernel approximation and one-pair data efficiency. Results vary by task, with gains in jailbreak ASR, targeted behaviors, or style induction alongside utility and content-preservation checks.

5.1 Jailbreaking LLMs

  • KAS exceeds ActAdd by 10 and 5 percentage points on Gemma and Qwen, respectively, and matches ActAdd at 94% ASR on Llama with higher perplexity.These jailbreak comparisons use validation-selected settings across three instruction-tuned models.Source: Table 1 · p. 7, §5.1 · p. 7

5 Experiments

  • Jailbreak experiments evaluate three instruction-tuned LLMs at validation-selected settings, with Alpaca validation perplexity capped at 1.05 times the unsteered value.Final evaluation uses separate jailbreak, Alpaca, and TinyBenchmarks test sets.Source: §5.1 · p. 7

5.2 CAA-style Contrastive Steering on Multiple-choice Question Answering

  • KAS exceeds linear contrastive addition by 9.63, 11.04, and 8.92 percentage points on Corrigibility, Hallucination, and Myopic Reward, and leads four behaviors.Survival Instinct and Sycophancy remain near-null; activations are collected at the answer-token position.Source: §5.2 · pp. 7–8, Table 2 · p. 8

5.3 Image Generation Style Control

  • KAS achieves higher style-classification scores than Mean-AcT across most intervention strengths and maintains high CLIPSCORE near λ = 1.The CLIPSCORE comparison uses the original prompt to measure content preservation.Source: Figure 3 · p. 8, §5.3 · p. 8

5.4 Ablation: Kernel Approximation

  • Nyström approximation lowers jailbreak ASR on all three models, while CAA outcomes split between AI Coordination and Corrigibility versus Hallucination and Myopic Reward.It also yields slightly lower Alpaca perplexity; exact KAS has higher probabilities on Hallucination and Myopic Reward.Source: Table 3 · p. 9, Table 4 · p. 9, §5.4 · p. 9

5.5 Ablation: Jailbreaking from a Single Contrastive Pair

  • With one contrastive pair, KAS remains competitive in ASR while reducing perplexity, although ActAdd obtains the highest ASR on Llama.The comparison samples ten random harmful–harmless prompt pairs.Source: Figure 5 · p. 10, §5.5 · p. 10

6 Conclusion

KAS creates a locally adaptive, geometry-aware steering field while recovering Difference-in-Means under a linear kernel. The conclusion identifies uniform per-token gradient steps and task-specific kernel choice as open limitations.

6 Conclusion

  • KAS recasts activation steering in an RKHS, producing an implicit, activation-dependent field while recovering Difference-in-Means exactly under a linear kernel.The paper frames this as a step toward geometry-aware inference-time control.Source: §6 · p. 10
  • Uniform gradient-ascent steps for every token can waste computation on tokens near the target manifold and may be insufficient for harder tokens.The conclusion suggests token-adaptive compute scheduling as a potential improvement to efficiency and stability.Source: §6 · p. 10
  • A principled way to select a kernel for a particular steering task or requirement remains an open direction.RBF is described as a reliable default, not as a universally optimal choice.Source: §6 · p. 10

A.1 Proofs

The appendix supplies proof fragments, kernel-specific steering gradients, matrix-form RBF updates, and a Nyström approximation, followed by a pointer to supplementary experimental details.

A.1 Proofs

  • Strict ascent is guaranteed when 0 < η < ∥∇F(xt)∥/(H + λ/2), under the stated smoothness bound.The proof derives this sufficient step-size condition using L = 2H + λ.Source: §A.1 · p. 17

A.2 Steering Gradients for Different Kernels

  • Polynomial steering combines second-moment and mean differences; with c = 0 it can steer distributions with identical means, while Laplacian updates pull coordinate-wise toward targets and away from sources.RBF contributions are attractive for target references and repulsive for source references, weighted by similarity to the current activation.Source: §A.2 · pp. 18–19

A.3 Matrix Form of RBF-Kernel Steering

  • The RBF matrix formulation expresses the joint gradient and update for N token activations using pairwise kernel matrices and kernel-weighted reference means.The update includes a step size η and regularization λ.Source: §A.3 · p. 20

A.4 Nyström Approximation

  • The Nyström approximation uses a fixed set of landmarks to define an approximate kernel, while retaining contributions from all reference activations.Its gradient and normalized update hold the landmarks and precomputed coefficients fixed.Source: §A.4 · pp. 20–21

B Additional Experimental Details

  • The appendix states that it provides additional implementation details, hyperparameters, dataset construction procedures, and supplementary experimental results.Source: B Additional Experimental Details · p. 21

B.1 Common Implementation Details

Common settings specify where and how KAS interventions are applied; the jailbreak details describe the contrastive prompts, evaluation, and matched intervention layers used across methods.

B.1 Common Implementation Details

  • Interventions generally target the residual stream at the final prompt-token position, using an RBF bandwidth selected by the median heuristic and one inference-time gradient step.The regularizer is set to λ = 0; multi-step results are identified explicitly when used.Source: §B.1 · p. 21
  • Table 5 is identified as covering common implementation details, while Table 6 lists Curveball hyperparameters for jailbreak experiments.Source: Table 5 · p. 22, Table 6 · p. 22

B.2 Jailbreak Steering Details

  • Jailbreak steering uses 128 harmful and 128 harmless prompts for contrastive references, evaluates attack success on JAILBREAKBENCH with LLAMA-GUARD-3-8B, and measures general utility on TINYBENCHMARKS.ActAdd, Curveball, and KAS are applied at the same intervention layer for each model.Source: §B.2 · p. 22

B.3 CAA-style Multiple-choice Steering Details

The appendix details CAA-style multiple-choice evaluations under varied prompt and dataset conditions, then describes a separate image style-control evaluation.

B.3 CAA-style Multiple-choice Steering Details

  • CAA-style pairs share a multiple-choice question and differ only in the appended behavior-consistent or opposite answer; evaluation averages the target-option probability over 50 held-out questions per behavior.Activations are extracted at the answer-token position.Source: §B.3 · p. 22
  • The behavioral datasets cover six alignment-relevant attributes, and evaluation tests neutral, target-aligned, and target-opposed system prompts.Except for Hallucination, datasets primarily come from Anthropic’s Advanced AI Risk human-written evaluations; Hallucination uses GPT-4-generated contrastive questions.Source: §B.3 · p. 22

B.4 Image Style-control Details

  • Image style control uses original and style-augmented COCO prompts with FLUX.1-SCHNELL, assessing style induction by zero-shot CLIP classification and content preservation by CLIPScore.Source: §B.4 · p. 23

C.1 Additional CAA-style Multiple-choice Results

KAS provides robust CAA-style concept control across neutral, supportive, and opposing system-prompt contexts, performing best for nearly all tested behaviors and matching the strongest baseline in saturated cases.

C.1 Additional CAA-style Multiple-choice Results

  • The main paper reports CAA-style results under a negative system prompt that discourages the target behavior.Experiments use GEMMA-2-9B-IT, answer-token activations, and average token probability for the behavior-consistent answer.Source: §C.1 · p. 23
  • Tables 10–11 add no-system-prompt and positive-prompt results alongside the negative-prompt condition.The reported conditions follow the same setup and measure average token probability assigned to the behavior-consistent answer.Source: §C.1 · p. 23
  • Across all system-prompt conditions, KAS attains the best probability for nearly all behaviors and matches the strongest baseline in remaining saturated cases.The results support robust concept control across neutral, supportive, and opposing prompt contexts.Source: §C.1 · p. 23

C.2 Additional Ablation Results

The additional ablations show that KAS outcomes depend on kernel choice and reference-set size, while the reported cost analysis finds minimal execution-time overhead relative to ActAdd and no steering.

C.2 Additional Ablation Results

  • Polynomial kernel performance keeps up with RBF, while Laplacian kernel lowers benchmark performance, indicating KAS performance depends on kernel choice.The ablation compares Laplacian, polynomial, and RBF kernels.Source: §C.2 · p. 23
  • KAS achieves notable ASR with as few as two contrastive pairs, and performance can improve with more pairs.The ablation tests pair counts from 1 to 128.Source: §C.2 · p. 23
  • Tables 9 and 10 report average behavior-consistent answer probability under negative and no-system-prompt conditions, respectively.They compare no steering with the best ActAdd and KAS results and report selected step size and intervention layer.Source: Table 9 · p. 24, Table 10 · p. 24

C.3 Results on Cost Analysis

  • KAS adds minimal execution-time overhead compared with ActAdd and no steering.The cost analysis uses one-step steering on 50 Myopic Reward CAA samples on a single NVIDIA H100 GPU.Source: §C.3 · p. 24

C.4 Additional Image Style-control Qualitative Results

This appendix covers additional qualitative image-style examples alongside broader-impact considerations, existing assets, and reproducibility information. The supplied passages contain no image-style qualitative findings and note that the research does not involve human-subject research or use LLMs as a core methodological component.

C.4 Additional Image Style-control Qualitative Results

  • Additional qualitative examples show KAS controlling cyberpunk and impressionism styles across more prompts and intervention strengths λ from 0.2 to 1.0.The main paper reports cyberpunk style induction measured by 0-shot classification and content preservation measured by CLIPSCORE; Figures 6 and 7 show the additional examples.Source: §C.4 · p. 24, Figure 6 · p. 26, Figure 7 · p. 27

D Broader Impacts

  • KAS is presented as useful for controllability and safety evaluation but dual-use, since steering can also elicit harmful behavior or bypass refusals.The authors say jailbreak experiments measure controllability and expose alignment weaknesses, not encourage misuse; they call for safeguards, intended-use documentation, accountability, and downstream safety evaluations.Source: D Broader Impacts · p. 28

E Use of Existing Assets

NeurIPS Paper Checklist

  • The checklist reports complete theorem proofs and specifies experimental models, datasets, baselines, metrics, steering settings, hyperparameter procedures, and summary statistics.It also reports compute-resource information and open access to data and code, with further experimental details in the appendix.Source: NeurIPS Paper Checklist · pp. 30–32

10. Broader impacts

  • The checklist says societal impacts are discussed in Appendix D and release safeguards are not applicable because the paper releases no data, pretrained models, image generators, or scraped datasets.Source: §10 · pp. 32–33
  • The paper reports no crowdsourcing or human-subject research, so participant risks and IRB approval are not applicable.Source: §10 · p. 34
  • LLM use is marked N/A because LLMs are not an important, original, or non-standard part of the core methodology.Source: §10 · p. 35

Related papers

Loading 2610.01062v1…