PaperlayerView exact revision on arXiv

Source-linked AI summary

Representational Control over Self-Report & Behavior Coherence in LLM Risk-Taking

Rafal Kocielnik, Peiyang Song, Pengrui Han, Myrl G. Marmarelis, Ramit Debnath, Dean Mobbs, R. Michael Alvarez

arXiv:2610.04125v1cs.CLcs.AIcs.CYcs.LG

TL;DR

Self-report is used to infer and control LLM dispositions, but prior black-box prompting studies leave unresolved whether its selective agreement with behavior reflects internal representations or elicitation. Using activation steering to study risk-taking, this paper finds supervision-specific channel reach, largely separate steering directions, and compositions that can align or oppose reported and enacted risk.

  • Problem

    Prior prompting studies find selective agreement between LLM self-reports and behavior, but cannot distinguish representational separation from different readout pathways or elicitation confounds.

    Source: §1 · p. 1

  • Method

    The study applies activation steering to risk-taking, comparing directions from task instructions, model choices, and trait descriptions across self-report and behavioral outputs.

    Source: §1 · p. 2

  • Results

    Task-instruction directions retain only 32% of behavioral effect after shortcut removal, while anti-aligned compositions induce anti-coherence in 69–89% of cases across models.

    Source: §1 · pp. 2–3

  • Takeaways & Limitations

    Self-report is at best a weak, tamper-prone signal of behavior, motivating mechanistically informed auditing of whether reports track behavior-governing processes.

    Source: §1 · p. 3, §5 · p. 9

    The study examines only risk-taking, uses mid-size open-weight models requiring activation access, and measures behavior through single decisions rather than multi-step agentic trajectories.

    Source: §5 · p. 9

Abstract

from arXiv · show

Self-report is an appealing low-cost probe of an LLM's dispositions, but recent work finds only selective agreement between what models report and how they behave. Prior accounts establish these patterns by prompting black-box LLMs, leaving open whether the gap is a prompting artefact or a fact about how the underlying constructs are represented internally. We investigate risk-taking, a consequential dimension of agentic decision-making, using activation steering to measure self-report and behavior under the same internal intervention. We survey nine steering-vector extraction methods spanning task-specific directives, the model's own task behavior, and dispositional descriptions at two granularities, evaluated on two behavioral tasks and two psychometric instruments across four open-weight LLMs. We find that (1) a shared internal intervention does not ensure shared responsiveness: directions built from trait descriptions move self-report but leave behavior at chance, directions built from the model's own task choices do the reverse, and only task-specific directives reach both, weakly. (2) Diagnosis dissolves that exception: removing surface confounders leaves the directives only 32% of their behavioral effect. The two channels are otherwise steered by near-orthogonal directions, each channel reachable by several independent constructions. (3) An intervention composing one behavior-moving and one self-report-moving direction moves both together; flipping one sign sets them in opposition, with reported and enacted risk pointing in opposite directions on 69-89% of flipped compositions in all models. These findings move the self-report-behavior relationship from a black-box observation to a representational one that can be inspected and controlled, motivating representational checks alongside behavioral evaluation.

1 INTRODUCTION

Self-report is used both to audit behavior and as a reusable control interface, but prior prompting studies find selective agreement and leave the source of the gap unresolved. This paper applies internal steering to risk-taking and finds that supervision source determines which channel moves, while composing directions can align or oppose the channels.

1 INTRODUCTION

  • Prior accounts compare questionnaire self-descriptions with task behavior from outside the model, leaving distinct internal representations, separate readout pathways, and elicitation confounds unresolved.The same input-output dissociation is consistent with all three explanations.Source: §1 · pp. 1–2
  • The paper uses activation steering to apply the same internal direction at the same dose across questionnaire and task contexts, then compares directions built from task instructions, model choices, and trait descriptions.The trait descriptions vary in specificity, from risk-specific clauses to broad Big-Five profiles.Source: §1 · p. 2
  • Representationally, the channel a direction reaches depends largely on its supervision source; fine-grained task-specific directives are an exception, moving both channels, though their behavioral effect is mostly a lexical shortcut.After orthogonalization against surface controls, they retain only 32% [95% CI: 18, 47] of their behavioral effect.Source: §1 · p. 2
  • Anti-aligned compositions induce opposite reported and enacted risk in 69–89% of cases across all four models.Composing directions can also impose coherence, showing that the channels can be controlled together or in opposition.Source: §1 · p. 3

2 RQ1 (REPRESENTATIONAL COHERENCE): DOES REPRESENTATIONAL STEERING REPLICATE DISSOCIATION PATTERNS?

The study tests whether activation steering reproduces self-report–behavior dissociation across four open-weight models, two behavioral tasks, and two self-report instruments. Which channel moves depends on supervision source: dispositional directions move self-report, own-choice directions move behavior, and task instructions reach both.

2.1 EXPERIMENTAL SETUP

  • The study applies matched internal interventions across separate questionnaire and task contexts, comparing nine extraction methods across four supervision families.It evaluates four open-weight chat models, the CCT and BART, and BFI-44 and DOSPERT outcomes; effects are assessed against matched random-direction controls.Source: §2 · p. 3, §2.1 · pp. 4–5

2.2 RESULTS

  • Risk-disposition and Big-Five directions clear the control in none of 40 behavioral cells but in 31 of 40 self-report cells.Their behavioral medians are 0.7 [0.3, 1.1] and 0.4 [0.3, 0.8] control SDs; self-report medians are 6.6 [5.6, 10.0] and 8.9 [6.2, 11.4].Source: §2.2 · p. 5
  • Own choices clear the control in all 16 behavioral cells, with a median swing of 42.1 [27.7, 59.6] control SDs, while self-report effects remain weak and inconsistent.Their behavioral effects retain only 7% [3, 13] on the other task.Source: §2.2 · p. 5
  • Task instructions clear the control in 11 of 16 behavioral cells, with a median swing of 6.2 [3.4, 9.7] control SDs, and in 24 of 32 self-report cells.Self-report medians are 33.4 [12.1, 56.9] on DOSPERT and 6.9 [3.3, 9.0] on BFI.Source: §2.2 · p. 5
  • Dispositional directions move self-report but not behavior, own-choice directions move behavior but weakly affect self-report, and task instructions reach both channels.Task-instruction effects are stronger on DOSPERT than BFI; increasing dose does not make additional families reliable movers of both channels.Source: §2.2 · p. 5

3 RQ2 (DIAGNOSING DISSOCIATION): HOW ARE SELF-REPORT AND BEHAVIOR ENCODED?

The section tests whether dissociation reflects separate steering geometry, shortcut cues, or shared downstream computation. It finds largely distinct directions across channels, substantial quantity-cue dependence for task-instruction behavior effects, and downstream dependence within both channels.

3.1 EXPERIMENTAL SETUP

  • The analysis distinguishes geometric overlap by removing components from steering vectors from downstream dependence by removing components from hidden states throughout computation.It compares both interventions with matched-rank random subspaces and defines retention as the fraction of the original effect remaining.Source: §3.1 · p. 6

3.2 RESULTS

  • Directions moving the same channel are more aligned than those moving different channels, and removing other-channel families preserves most behavior and self-report effects.Cross-channel removal retains 97% [90, 104] and 92% [85, 99] of task-instruction and own-choice behavioral effects, and 102% [96, 108] of the task-instruction self-report effect.Source: §3.2 · p. 7
  • Shortcut removal retains 32% [18, 47] of task-instruction behavioral effect versus 74% [69, 80] for own choices; purified task-instruction effects never clear control across tested doses.Most task-instruction loss comes from removing quantity cues, including cues in TASK-COMMAND’s extraction text.Source: §3.2 · p. 7
  • Self-report families retain 64–66% after shortcut removal, while joint removal of the other self-report families leaves 7% [−11, 25] for risk dispositions and 33% [24, 42] for Big-Five profiles.Individual family removals preserve more, showing that effects can depend on the combined span of other families.Source: §3.2 · p. 7
  • Removing shared computation routes causes larger losses than removing direction components, with retention falling to 40% for own-choice behavior and 32% for Big-Five self-report.Shortcut ablation during self-report evaluation largely abolishes steering, but also shifts unsteered readouts, leaving its interpretation uncertain.Source: §3.2 · p. 7

4 RQ3 (JOINT CONTROL): CAN THE TWO CHANNELS BE DRIVEN INTO EXPLICITLY COHERENT AND ANTI-COHERENT STATES?

The paper composes behavior-moving and self-report-moving directions to test whether the channels can be aligned or driven into opposition. Aligned compositions often induce coherence, while anti-aligned compositions induce anti-coherence across all four models despite model-dependent resistance.

4.1 EXPERIMENTAL SETUP

  • The intervention mixes behavior- and self-report-moving directions with a self-report weight and either aligned or anti-aligned signs, then evaluates joint responses across models, tasks, and instruments.Coherence means matching behavioral and self-report swing signs; anti-coherence means opposite signs.Source: §4.1 · pp. 7–8

4.2 RESULTS

  • Anti-aligned compositions induce anti-coherence in 69–89% of cases across all four models, while aligned compositions induce coherence in 91%.Reversing the self-report component raises anti-coherence from 8.5% to 77.4%, a 69 p.p. difference significant in every model.Source: §4.2 · p. 8
  • Resistance to anti-coherence varies by model, and each additional control SD of behavior-direction self-report spillover is associated with a 3.8 p.p. lower anti-coherence rate.Increasing self-report weight from β = 0.3 to 0.7 raises anti-coherence from 66% to 87% but weakens behavioral steering.Source: §4.2 · p. 8
  • Greater self-report spillover from the behavior direction predicts more resistance to anti-coherence, while removing endpoint overlap before composition leaves coherence and anti-coherence rates largely unchanged.The spillover relationship is an association; each additional control SD corresponds to a 3.8 p.p. lower anti-coherence rate.Source: §4.2 · p. 8

5 DISCUSSION

For risk-taking, self-report and behavior are moved by largely separate directions, and apparent dual reach from task instructions depends heavily on wording cues. Composing directions can produce coherent or anti-coherent outputs, with implications for interpreting self-report and auditing behavior.

5 DISCUSSION

  • Self-report- and behavior-moving directions are largely separate, while task-instruction directions’ dual reach depends heavily on shortcut cues.The apparent exception therefore does not establish a shared disposition underlying both channels.Source: §5 · p. 9
  • Compositions drive coherent states on 91% of pushes and anti-coherent states on 69–89%, with resistance varying by model.Some resistance is explained by how much the behavior direction alone moves self-report toward coherence.Source: §5 · p. 9
  • Because self-report can be steered toward caution while behavior remains risky, output agreement alone is weak evidence of a shared disposition.With weights available, overlap between channel-moving directions and survival against surface controls offer two additional checks.Source: §5 · p. 9
  • Task instructions can move dispositional questionnaires beyond wording, whereas trait descriptions reach self-report but almost never behavior.The pattern suggests that coherence in one pairing may not generalize to another; the authors note that the task-level versus trait-level hierarchy pattern does not clearly extend to behavior.Source: §5 · p. 9
  • The study covers only risk-taking in mid-size open-weight models, single behavioral decisions, and necessarily incomplete surface controls.Missed shortcuts would inflate the retained effect, so the authors say the reported dissociation may be understated.Source: §5 · p. 9

6 CONCLUSION

For risk-taking, self-report and behavior are moved by largely separate directions determined by supervision source. Only narrow task-specific instructions reach both, mostly through wording cues; composing directions can induce coherent and anti-coherent states.

6 CONCLUSION

  • For risk-taking, self-report and behavior are moved by largely separate directions, and only narrow task-specific instructions reach both, mostly through wording cues.Composing directions induces coherent and anti-coherent states with little resistance, making output agreement weak evidence of a shared internal mechanism.Source: §6 · p. 10

ETHICS STATEMENT

The authors identify dual use in compositions that can make reported values contradict behavior, while describing the work as diagnosis and coherence restoration rather than concealment.

ETHICS STATEMENT

  • Anti-aligned compositions can make a model’s report contradict its behavior, including underclaiming that could mislead self-report-based evaluation.The authors report population rates under controlled intervention, requiring white-box activation access, and frame released materials toward diagnosis and coherence restoration.Source: ETHICS STATEMENT · p. 10

REPRODUCIBILITY STATEMENT

The paper documents its experimental procedures and situates its contribution among work on LLM self-report, activation steering, representations, and causal interventions. It focuses on risk-taking, where links between self-report and behavior have been weak in both LLMs and human studies.

REPRODUCIBILITY STATEMENT

  • The reproducibility statement specifies model variants, deterministic readouts, extraction and injection procedures, tasks, instruments, controls, analyses, and planned public materials.It points to appendices and tables for implementation details and says code, vectors, and per-condition readouts will be made publicly available.Source: REPRODUCIBILITY STATEMENT · p. 10

A RELATED WORK

  • Prior LLM personality work largely measures self-report or generated text, while activation-steering research generally targets one behavioral axis with one recipe.This paper instead compares supervision sources and scores each steering method on behavioral and self-report channels.Source: A RELATED WORK · p. 17
  • The related work frames the study through linear and multidimensional representations, geometric comparisons, causal mediation, and concept erasure.The paper combines orthogonalization and representation erasure to examine whether the channels are causally separable, not only geometrically distinct.Source: A RELATED WORK · pp. 17–18

A.1 WHY RISK-TAKING.

  • Risk-taking is a consequential case because prior LLM studies find weak links between self-report and behavior, and human measures also show weak correlations across behavioral tasks and with self-report.Unlike human correlation studies, LLM internal directions can be isolated and manipulated directly.Source: §A.1 · p. 18

A.2 DETAILS OF BEHAVIORAL TASKS

The section operationalizes risk-taking through two behavioral tasks and two distinct self-report instruments, then applies a shared steering protocol whose extraction signal varies by method.

A.2 DETAILS OF BEHAVIORAL TASKS

  • CCT measures advance card-turn commitments against known losses, while BART measures advance pump choices as balloon risk grows; both use risk-taking log-odds readouts.For CCT, higher log-odds indicate choosing more than half the deck; BART uses the corresponding threshold of half the available pumps.Source: §A.2 · pp. 18–19

A.3 DETAILS OF SELF-REPORT INSTRUMENTS

  • BFI is broad and task-agnostic, scored through a Nicholson risk profile, whereas DOSPERT rates risky activities across five domains, with gambling closest in content to the tasks.BFI combines its five subscales using the Nicholson risk-taking profile; DOSPERT averages gambling and investment into a financial domain before averaging across domains.Source: §A.3 · pp. 19–20

B RQ1: EXTRACTION, INJECTION AND PERTURBATION DETAILS

B.1 SHARED EXTRACTION AND INJECTION

  • Directions are formed from positive-versus-negative residual-state means, normalized per layer, then injected at both signs with dose scaled by task-specific activation variation.Scaling by σ makes α a relative dose; σ is recomputed per task because questionnaire and decision-token residual geometry differs.Source: §B.1 · p. 20

B.2 PER-METHOD EXTRACTION SIGNALS AND READ SITES

This section describes how steering signals are extracted and read, and how their effects are tested across a 20-condition perturbation grid, including the grid’s scope and readout limitations. It also summarizes how own-choice and task-instruction directions affect self-report and behavior across instruments and tasks.

B.2 PER-METHOD EXTRACTION SIGNALS AND READ SITES

  • Read sites vary by extraction family, but do not alone produce dissociation: purified directives lose behavioral effects, while prompt delivery preserves method ordering by channel.Task-referencing anchors are read at the task decision token, descriptions over neutral text, and RISK-PERSONA over the model’s own generated responses; task-native counterparts are built for instructions and own-choice methods, but not trait descriptions.Source: §B.2 · p. 20

B.3 FULL ANCHOR SETS

  • OCEAN-PROFILE uses 15 phrases per pole without risk vocabulary, while OCEAN-COMPOSED sums five separately extracted, signed trait vectors.For OCEAN-PROFILE, the risk-seeking pole is high on openness and extraversion and low on the other three traits; OCEAN-COMPOSED’s adjective names contain no risk terms.Source: §B.3 · pp. 23–24

B.4 READOUTS

  • Readouts use answer-token likelihoods in one deterministic forward pass, with log-odds contrasting scale endpoints and dropping neutral responses.At α = 1, admissible answers receive median probability 0.999 for BFI, 1.00 for DOSPERT, 0.98 for CCT, and 0.04 for BART; BART log-odds are renormalized over about 4% of the distribution. Log-odds have no upper limit, although behavioral answers are bounded.Source: §B.4 · p. 24

B.5 PERTURBATION GRID

  • Intervals resample complete construct scores across conditions, rather than questionnaire items, to estimate reliability of steering effects instead of subscale internal consistency.The vector is held fixed while conditions are resampled, with items aggregated within each condition.Source: §B.5 · pp. 24–25

C RQ1: THE PERTURBATION GRID IN FULL

  • The tested grid was an additive union of 20 conditions: 12 base-phrasing combinations across four personas and three bands, plus 8 alternative-phrasing combinations at the full band; a 36-condition crossing was not run.Source: C RQ1: THE PERTURBATION GRID IN FULL · p. 25

C.1 AXIS 1: PERSONA CONTEXT

  • Persona context is the perturbation axis because it changes a deterministic forward pass, whereas temperature and seed do not change the likelihood-based readout.The grid uses the first four of ten persona strings, selected by greedy max-min TF-IDF ordering to maximize dissimilarity.Source: §C.1 · p. 25

C.2 AXIS 2: INJECTION BAND

  • Band contraction reduces total injected norm because every layer receives the same α-scaled vector and α is not rescaled by band width.Observed swing ratios are 0.85 for narrow and 0.61 for core, versus layer-count ratios of 0.75–0.78 and 0.44–0.56, respectively; dose change is treated as part of the design variation.Source: §C.2 · p. 25

B.6 FULL RESULT SET

  • Figure 5 presents all RQ1 outcomes in raw units with pooled 20-condition intervals, organized by recipe and model across behavioral tasks and self-report measures.Transfer cells are shaded, matched-instrument cells are marked as manipulation checks, and the shaded band denotes the null control.Source: §B.6 · p. 25, Figure 5 · p. 26

C.2 AXIS 2: INJECTION BAND

  • Qwen's injection band spans fractional depth 0.29–0.86, compared with 0.25–0.75 for the other three models, so bands are not at matched relative depth.Per-layer σ-normalisation means this difference does not confound dose.Source: Table 4 · p. 27

C.3 AXIS 3: CONSTRUCTION

  • Each method varies along its natural construction axis while risk content stays fixed, and v1 vectors match those used in the main-text experiments.The axes are verbal for four methods and non-verbal for three.Source: §C.3 · p. 27, Table 5 · p. 27

C.3.1 VERBAL AXES

  • Verbal axes vary persona framing, anchor wording, instruction verbosity, or item phrasing, with some variants holding clause content, task structure, or anchor counts fixed.RISK-DOMAINS and THRILL-SEEKING also have a v4 variant that preserves a persona frame while removing the instruction to adopt it.Source: §C.3.1 · p. 27, §C.3 · p. 27

C.3.2 NON-VERBAL AXES

  • Non-verbal axes vary the split threshold for own-choice contrasts, the subset of pooled persona templates, or the normalization used to combine OCEAN trait vectors.The OCEAN composition variants require no additional model inference.Source: §C.3.2 · p. 29

C.4 CONTROL FAMILIES AND THE SIGNIFICANCE CRITERION

  • An effect counts only when its mean swing lies outside the same-model, same-readout, same-dose control-direction band, which is ±3.5 control SDs around the control mean swing.The criterion compares against the control band rather than zero; wrong-direction effects occur only on DOSPERT in one self-report cell per family and do not count.Source: §C.4 · p. 29

C.5.1 SELF-REPORT EFFECTS OF THE OWN-CHOICE FAMILY

  • The BART-extracted CHOICE-CONTRAST B was 0.9 [0.8, 2.5] on BFI, as were both probes (CCT 0.9 [0.1, 1.6]; BART 0.9 [0.0, 3.3]); on DOSPERT, all four members were at or near control (1.3–5.5).Source: §C.5.1 · p. 30

C.5.2 SELF-REPORT EFFECTS OF THE TASK-INSTRUCTION FAMILY

  • Task instructions moved self-report by 6.9 [3.3, 9.0] control SDs on BFI versus 33.4 [12.1, 56.9] on DOSPERT, driven mainly by TASK-INTENT.TASK-INTENT cleared controls in all four models for both extraction versions; TASK-COMMAND cleared controls in five of eight cells and was smaller and less consistent.Source: §C.5.2 · p. 30

C.5.3 TRANSFER BETWEEN BEHAVIORAL TASKS

  • Own-choice vectors retained 7% [3, 13] of their native behavioral effect on the other task and were near-inert on that task and on self-report.For example, CHOICE-CONTRAST B moved BART by 1.63 log-odds and CCT by 0.03; its CCT-extracted counterpart moved CCT by 0.85 and BART by 0.12.Source: §C.5.3 · p. 30

C.5.4 DOSE ESCALATION

Dose escalation tests whether steering effects grow consistently and compares steering with prompts carrying the same anchor text. The results preserve the channel dissociation while showing that prompting shifts effects toward behavior.

C.5.4 DOSE ESCALATION

  • Task instructions and own choices grow stronger at higher doses, while dispositional families do not; own choices’ changing behavioral magnitude reflects task bounds, not a change in channel.The share of cells clearing control does not change with dose for any family; the dispositional-family tests show no evidence of change, not proof of invariance.Source: §C.5.4 · p. 31
  • At higher doses, own-choice effects encounter an instrument ceiling, while task-instruction effects show no flattening within the tested range.Across α = 4→8, own choices’ elasticity is 0.04 and 50% of conditions are at task bounds; task instructions’ elasticity is 0.64 with no external sign of flattening.Source: §C.5.4 · pp. 31–32
  • After removing lexical and task-shortcut components, directives retain only 7–17% (TASK-COMMAND) and 25–44% (TASK-INTENT) of behavioral effects, versus 52–69% and 52–77% of self-report effects, respectively.CHOICE-CONTRAST retains 63–76% of behavioral and 84–91% of self-report effects.Source: §C.5.4 · p. 32

C.5.5 PROMPTING BASELINE

  • Prompted anchor texts rank methods similarly to steering (Spearman ρ = 0.62 [0.33, 0.80], p = 0.012), while prompting raises behavioral share in 21 of 28 cells.The median increase is 0.12; the pooled shift is significant, but within-model rank agreement does not reach significance on its own.Source: §C.5.5 · p. 33, Table 12 · p. 33
  • The prompt comparison tests channel balance as well as magnitude: prompting shifts families toward behavior, whereas negative behavioral shares occur only under steering.All four negative steering shares occur on Qwen; the anchor-text prompt has no faithful form for own-choice vectors.Source: §C.5.5 · pp. 32–33
  • Prompting yields a median 11× larger raw log-odds effect than steering at α = 1, but steering can exceed prompts at higher doses for selected directive outcomes.TASK-INTENT exceeds its prompt on self-report from α = 2 and, when built from CCT, on behavior from α = 4; the prompt’s median behavioral share is 0.15.Source: §C.5.5 · pp. 33–34, Table 13 · p. 33

C.5.6 ROBUSTNESS OF THE DISSOCIATION

The reported dissociation persists across alternative scales and robustness checks, while control-SD normalization reduces between-model spread on three readouts but not DOSPERT. RQ2 compares direction removal with hidden-state removal and finds that steering directions rotate across depth, making within-layer comparisons important.

C.5.6 ROBUSTNESS OF THE DISSOCIATION

  • Behavior-to-self-report ratios remain on opposite sides of unity across raw log-odds and control-SD scales: 13.5 versus 0.06, and 24.8 versus 0.05–0.11, respectively.Construction is the widest perturbation axis on CCT, BART, and DOSPERT but the narrowest on BFI; stripping the shared persona stem moves the two instruments together where content is held fixed.Source: §C.5.6 · p. 34

C.6 WHY EFFECTS ARE EXPRESSED IN CONTROL-SD UNITS

  • Control spread tracks method spread on CCT, BART, and BFI, and normalization reduces between-model spread from 9.8× to 1.9×, 7.1× to 2.9×, and 3.7× to 1.6×, respectively.Figure 6 plots method-spread against control-spread; Figure 7 shows the reductions after normalization, while residual model heterogeneity remains.Source: §C.6 · p. 34, Figure 6 · p. 35, Figure 7 · p. 36
  • On DOSPERT, method spread and control spread are weakly related (log correlation +0.20), and normalization increases between-model spread from 4.2× to 5.7×.The authors retain the same units for cross-readout comparability but caution that pooled DOSPERT effects are the weakest in the set.Source: §C.6 · p. 35

D.1 THE TWO REMOVAL OPERATIONS

  • RQ2 uses two removal operations: shared-direction removal edits an injected steering vector, whereas shared-route removal subtracts the subspace from hidden states during the forward pass.The former tests what a direction shares with a subspace; the latter tests information’s role in producing an output.Source: D RQ2: GEOMETRY, REMOVAL AND CONTROLS · p. 35, §D.1 · p. 36

D.2 DEPTH: THE FRAME ROTATES, THE RELATIONAL STRUCTURE DOES NOT

  • Steering directions generally rotate across layers: their cosine with a nearby-layer version falls from about 0.5 at two layers to near the random floor at eight, unlike RISK-PERSONA.RISK-PERSONA remains around 0.4–0.5 across 14–16 layers; comparing directions within each layer preserves relationships that averaging across layers can destroy, with conventions differing by roughly 8×.Source: §D.2 · p. 36

D.3 WHAT ORGANISES THE PAIRWISE GEOMETRY

Pairwise steering geometry is organized mainly by extraction-family pairing, not measurement depth or model identity. The permutation tests are sharply limited by the small number of possible label assignments, so their effect sizes and consistency matter more than their p-values.

D.3 WHAT ORGANISES THE PAIRWISE GEOMETRY

  • 0.600 incremental R2 is attributed to family block, versus 0.045 to relative depth and 0.006 to model; pair within block contributes 0.186.The ordering remains when model enters first and on the raw scale, supporting the conclusion that block structure is not an averaging artifact.Source: §D.3 · p. 37
  • Between-channel alignment stays flat across injection depth, while within-family alignment rises and then plateaus, so depth changes family cohesion rather than channel separation.Within-family rows deepen by relative depth ≈0.5 and then hold; between-family rows remain pale across the span.Source: §D.3 · pp. 37, 39, Figure 8 · p. 38

D.4 IS THE BLOCK STRUCTURE OF EXTRACTION FAMILIES REAL? A PERMUTATION TEST

  • The permutation test compares within-set with between-set alignment while permuting direction labels, excluding Task instructions from channel labels because it moves both channels.The statistic is the alignment gap, with effect size expressed in standard deviations of pairwise values.Source: §D.4 · p. 39
  • With seven directions split 2-to-5, only 21 assignments are possible; the positive control has three partitions, so p-values hit their floors and cannot establish significance.The tests provide effect size and consistency, not significance.Source: §D.4 · p. 39

D.5 THE LEXICAL CONTROLS

Lexical controls reveal that some apparent steering effects track surface instructions or questionnaire form rather than risk content alone. Removal and overlap analyses further distinguish what directions carry from the routes and measurement conditions on which their effects depend.

D.5 THE LEXICAL CONTROLS

  • Quantity controls without risk vocabulary steer behavior more than task-specific risk directives, while controls that hold the relevant surface property fixed remain inside the control band.On CCT, CARDS moves 2.9 versus TASK-COMMAND’s 1.9; on BART, PUMPS moves 1.5 versus 0.55. NOUNS and NUMERALS-CCT are inside the control band on all four readouts.Source: §D.5 · pp. 39–41, Table 14 · p. 40

D.6 REMOVING THE SHORTCUT SUBSPACE FROM THE MODEL / D.7 REMOVING THE SHORTCUT COMPONENT ACROSS DOSE

  • Removing the shortcut subspace from the model abolishes self-report steering, while purified task-instruction behavior effects fail across doses and own-choice behavior effects retain about 70%.Random-direction removal preserves self-report steering (median retention 0.99); the task-instruction behavioral effect is about one-eighth of raw and includes zero at every tested dose.Source: §D.6 · p. 41, §D.7 · p. 42

D.8 ANCHOR/ITEM OVERLAP

  • ITEMS-DOSPERT has greater overlap with risk-domain anchors than the risk directions themselves, yet is nearly orthogonal to them in activation space; OCEAN-PROFILE is a BFI-overlap exception.OCEAN-PROFILE reaches 0.400 lexical / 0.717 semantic overlap against BFI, essentially matching the ITEMS-BFI ceiling, and extraction form may confound low content-overlap readings.Source: §D.8 · pp. 42–43

D.9 PER-FAMILY DECOMPOSITION OF THE THREE TESTS

  • Lexical loss for task instructions is quantity-specific, cross-channel direction removal costs little, and joint removal can cost more than separate removals.The two dispositional families are not interchangeable: each can contribute to the other’s self-report steering effect.Source: §D.9 · p. 43

D.10 MEASUREMENT AND SCORING

  • Steering effects are paired differences between positive and negative injection, while retention compares the post-removal swing with the same direction injected alone.Survival additionally requires that the post-removal swing clear the readout’s random-injection control band with the same sign.Source: §D.10 · p. 44

D.11 GROUNDING THE FUNCTIONAL BARS

  • Rank-matched random removal controls generic capacity loss, and checks find no flagged readout pinned at a response-scale rail.Small norm loss does not imply a weak intervention: removing 5% of a directive’s norm costs 59% of its effect.Source: §D.11 · p. 44

D.12 ESTIMATOR SENSITIVITY

  • An unweighted bootstrap and the weighted pool disagree in sign for Risk dispositions because some THRILL-SEEKING ratios have near-zero denominators.The extreme ratios are −3.88, −8.85, and −12.54; an unweighted mean cannot down-weight them.Source: §D.12 · p. 45

E.1 MODELING DETAILS

  • Composition analyses normalize endpoints so mixture weights compare directions rather than raw vector norms, and gate cells where the self-report component fails to push its instrument.The gated design uses matched pairs differing only in the self-report-component sign; reweighting all cells yields per-model rates within 0.03 of gated values for c ≥ 2.Source: §E.1 · pp. 45–46

E.2 ROBUSTNESS

Robustness checks show that aligned and anti-aligned compositions displace the channels in opposite directions from a chance-level unsteered baseline. Anti-coherence occurs across all four models, but interpretation of the residual analysis is bounded by the span of the extracted self-report directions.

E.2 ROBUSTNESS

  • 39.6% of gated unsteered cells are anti-coherent, not significantly different from chance; aligned steering lowers the rate to 0.085.The result is 43.8% across all 64 cells without gating.Source: §E.2 · p. 46

E.3 WHERE COMPOSITIONS LAND

  • Anti-aligned compositions are anti-coherent at rates of 0.89, 0.69, 0.83, and 0.70 for Qwen, OLMo, Llama, and Ministral, respectively.Aligned rates range from 0.01 to 0.25 across those models.Source: §E.3 · pp. 46–47

E.4 WHICH ANTI-COHERENT STATE

  • Overclaiming and underclaiming are induced at nearly even rates, within 5 percentage points on every model; only Ministral shows a corrected difference, leaning 3 points toward overclaiming.Underclaiming makes a self-report evaluation actively misleading, while overclaiming is conservative-direction miscalibration.Source: §E.4 · p. 47

E.5 THE SELF-REPORT RESIDUAL

  • The purified compositions remain indistinguishable from raw ones, but projection removes only five extracted self-report directions and cannot rule out coupling outside their span.The authors state that distinguishing a remaining coupling from this span limitation requires a basis that provably spans the channel.Source: §E.5 · pp. 47–48

E.6 THE BLEND WEIGHT

As blend weight rises, anti-aligned compositions increasingly invert self-report while reducing behavioral effects. The appendix also details a fixed-prompt risk-persona vector construction and its generated outputs.

E.6 THE BLEND WEIGHT

  • Quantity controls exceed the directive family they control for on both behavioral tasks, while self-report surface controls and count-fixed NOUNS remain at control.Removing Task instructions’ shortcut component takes almost all of its behavioral effect at every dose but little of its self-report effect.Source: Figure 11 · p. 50, Figure 13 · p. 51
  • Removing the shortcut subspace abolishes self-report steering, whereas removing a same-rank random subspace does not.The accompanying diagnostic also tests shortcut removal from the model and reports retention for directions whose standalone swing exceeds 0.1.Source: Figure 12 · p. 50
  • Self-report inversion thresholds vary by task–instrument cell: some cells cross at β = 0.3, others at 0.6–0.7, and two OLMo/DOSPERT cells never cross in range.The never-crossing cells lack an opposing push because their self-report endpoints move DOSPERT by at most about 4 control SDs in the wrong direction.Source: §E.6 · p. 48, Figure 20 · p. 56
  • Anti-coherence rises from 66% to 87% as β increases from 0.3 to 0.7, while behavioral effects fall from 42.4 to 8.8 control SDs on CCT and 71.0 to 9.0 on BART.Each 0.1 increase in β multiplies the odds of anti-coherence by 1.40 [1.24, 1.58].Source: §E.6 · p. 48, Figure 21 · p. 57
  • Observed composition paths often enter anti-coherent quadrants, unlike the simulated shared-direction reference, which reverses both channels together without entering them.The comparison assumes both channels are moved by one shared direction.Source: §E.6 · p. 48, Figure 21 · p. 57

F ADAPTATION OF THE PERSONA-VECTOR METHOD

  • The fixed-prompt Risk-PERSONA adaptation averages residual-stream states over response tokens from five templates and twelve questions, using one temperature-0, 160-token response per pair.It is a fixed-prompt variant rather than a reproduction of Chen et al. (2025); 120 generations per model are slated for release with the code.Source: F ADAPTATION OF THE PERSONA-VECTOR… · p. 58

F.1 WHAT THE MODEL IS GIVEN

  • Risk-PERSONA uses five system-prompt templates and twelve open-ended user questions, reads only assistant continuations, and supplies no task framing or risk instruction beyond the pole description.For models that reject a system role, the system text is prepended to the user turn.Source: §F.1 · p. 58

F.2 RISK POLE (QWEN2.5-7B)

  • Qwen’s risk-seeking pole generates adventurous, uncertainty-oriented responses, while its risk-averse pole describes cautious, structured choices across prompts about free time, changing plans, and deadlines.The examples include seeking adrenaline or new possibilities versus minimizing risk and organizing work methodically.Source: §F.2 · p. 59

F.3 CROSS-MODEL CONSISTENCY

The risk-pole contrast appears in generated examples across models despite differences in surface style. The section also identifies construct entanglement in the fixed-prompt variant and describes the self-report instruments.

F.3 CROSS-MODEL CONSISTENCY

  • Across the remaining models, the same risk-pole contrast appears in free-afternoon responses despite variation in surface style.The examples include adventurous or adrenaline-oriented positive poles and cautious or structured negative poles.Source: §F.3 · p. 60
  • The fixed-prompt variant reuses Big-Five questions for a risk trait, entangling risk with planning and conscientiousness vocabulary.The resulting direction raises self-reported Conscientiousness alongside every other subscale, with a broad endorsement lift dominated by Openness.Source: §F.3 · p. 60

G SELF-REPORT INSTRUMENTS

  • The BFI-44 is administered one item per forward pass, with agreement log-odds scored from rating-token probabilities after reverse-keying relevant items and dropping the midpoint.The item stem and full scale are repeated for each item.Source: Table 18 · p. 61
  • DOSPERT-RT uses 30 items across six domains, with gambling and investment reported separately; CCT and BART occupy the gambling subscale.Scores use rating-token probabilities rather than sampled answers, and all seven response points are labelled.Source: Table 19 · p. 62

Related papers

Loading 2610.04125v1…