A Coin Flip Per Token: Bernoulli Sparse Steering of Large Language Models

# A Coin Flip Per Token: Bernoulli Sparse Steering of Large Language Models
Source: [https://arxiv.org/html/2607.05615](https://arxiv.org/html/2607.05615)
Nima Eshraghi1, Lovedeep Gondara1, Yuqing Huang1, Sagarika Suresh1, Leizer Teran1, Jithin Pradeep1, Xiaotong \(Tone\) Xu2, Fanny Chevalier2 1The Vanguard Group, Inc\.2University of Toronto \{nima\_eshraghi, lovedeep\_gondara, yuqing\_huang, sagarika\_thimmanayakanapalya, leizer\_teran, jithin\_pradeep\}@vanguard\.com \{tonexu, fanny\}@cs\.toronto\.edu

###### Abstract

Activation steering via sparse autoencoders \(SAEs\) enables behavioral control of large language models without task\-specific fine\-tuning, but standard methods apply the steering signal at every generated token, incurring constant per\-token perturbation that risks degrading fluency\. We ask:*is dense intervention necessary?*We introduce Stochastic Token Steering \(STS\), which gates each token independently with probabilitypp, and Stochastic Block Steering \(SBS\), which gates a leading window once per sequence; neither requires a reward model or learned gating policy\. Across two model families and two behavioral tasks, steering only 50% of the tokens recovers most of the dense\-steering effect while preserving fluency, and steering as few as 30% surpasses prompt\-based control\. The optimal steering magnitude scales inversely with the intervention ratio, revealing that SAE\-mediated control is*rate\-limited*: the behavioral outcome depends on cumulative signal dosage across a sequence\.

Content Warning\.This paper studies inference\-time control of language model behavior, including the reduction of toxic generation\. The appendix contains examples of toxic, offensive, and emotionally distressing model outputs that are shown to illustrate the method\. Reader discretion is advised\.

A Coin Flip Per Token: Bernoulli Sparse Steering of Large Language Models

## 1Introduction

Behavioral control over large language models \(LLMs\) reducing toxicity, enforcing a persona, suppressing hallucinations, and adjusting refusal has become a significant deployment concern\(Ouyang et al\.,[2022](https://arxiv.org/html/2607.05615#bib.bib23); Bai et al\.,[2022](https://arxiv.org/html/2607.05615#bib.bib2)\)\. The default mechanism is the system prompt, but prompt\-based steering is fragile: lexical perturbations shift output distributions\(Mizrahi et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib22)\), alignment priors can be overridden through crafted inputs or adversarial suffixes\(Wei et al\.,[2023](https://arxiv.org/html/2607.05615#bib.bib33); Zou et al\.,[2023b](https://arxiv.org/html/2607.05615#bib.bib39)\), and steerability through prompting is asymmetric and bounded across many behavioral dimensions\(Wolf et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib34)\)\.

Activation\-level methods intervene directly in the residual stream\. ActAdd\(Turner et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib32)\), Inference\-Time Intervention\(Li et al\.,[2023](https://arxiv.org/html/2607.05615#bib.bib17)\), and Contrastive Activation Addition\(Rimsky et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib26)\)compute a steering vector by contrasting hidden states across behavioral exemplars and inject it during the forward pass\. Sparse Autoencoders \(SAEs\) decompose dense, polysemantic activations into a monosemantic feature dictionary\(Cunningham et al\.,[2023](https://arxiv.org/html/2607.05615#bib.bib4); Bricken et al\.,[2023](https://arxiv.org/html/2607.05615#bib.bib3)\), then clamp or amplify features that mediate a target behavior\(Labonne,[2024](https://arxiv.org/html/2607.05615#bib.bib16); Templeton et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib31)\)\. The*Golden Gate Claude*exemplifies the appeal: amplifying a single interpretable feature substantially redirects model behavior without any weight updates\(Templeton et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib31)\)\.

A property shared by these methods is*uniform, every\-token intervention*: the steering signal is added at every position throughout generation\(Turner et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib32); Rimsky et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib26); Li et al\.,[2023](https://arxiv.org/html/2607.05615#bib.bib17)\)\. Persistent perturbation pushes generations off the model’s native activation manifold, degrading fluency and downstream performance\(Turner et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib32); Labonne,[2024](https://arxiv.org/html/2607.05615#bib.bib16)\); in multi\-attribute settings, conflicting signals over\-correct the primary target and regress on unrelated behaviors\(Zou et al\.,[2023a](https://arxiv.org/html/2607.05615#bib.bib38)\)\. These costs raise a natural question:*is intervention at every token necessary?*We answer this by replacing deterministic every\-token intervention with stochastic gating, applying the signal to random subsets of tokens and asking how much behavioral shift survives at each intervention density\.

We introduce two stochastic interventions over SAE feature steering that select tokens at random\.*Stochastic Token Steering*\(STS\) samples an independent gatemt∼Bernoulli​\(p\)m\_\{t\}\\sim\\mathrm\{Bernoulli\}\(p\)at every position, applying the signal to a random subset of tokens\.*Stochastic Block Steering*\(SBS\) draws a singleBernoulli​\(p\)\\mathrm\{Bernoulli\}\(p\)gate per sequence and applies it uniformly to a leading window, treating the well\-attested early\-token influence\(Xiao et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib36); Qi et al\.,[2025a](https://arxiv.org/html/2607.05615#bib.bib24),[b](https://arxiv.org/html/2607.05615#bib.bib25)\)as an atomic intervention site\.

Our contributions are twofold\.First, across two models and two tasks, STS recovers most of the dense\-steering effect while outperforming both prompt\-based control and SBS at matched ratios\.Second, the best steering magnitude rises as the intervention ratio falls, so sparse steering attains comparable shift with less total injected signal\. Together these indicate that SAE\-mediated steering is rate\-limited: the outcome depends on cumulative signal dosage across a sequence\. Our method reduces inference\-time control to a single scalarpp, with no reward model, learned gating, or computation beyond a coin flip per token\.

## 2Related Work

Inference\-time steering of LLMs spans prompt\-based control, activation\-level interventions, and decoding\-time methods\. Dense activation steering methods such as ActAdd\(Turner et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib32)\), ITI\(Li et al\.,[2023](https://arxiv.org/html/2607.05615#bib.bib17)\), CAA\(Rimsky et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib26)\), Representation Engineering\(Zou et al\.,[2023a](https://arxiv.org/html/2607.05615#bib.bib38)\), and SAE\-based feature steering\(Cunningham et al\.,[2023](https://arxiv.org/html/2607.05615#bib.bib4); Templeton et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib31); Labonne,[2024](https://arxiv.org/html/2607.05615#bib.bib16)\)share the universal practice of intervening at every generated token; our method departs from it\. The closest concurrent work, Sparse Inference\-time Alignment \(SIA\)\(Hu et al\.,[2026](https://arxiv.org/html/2607.05615#bib.bib12)\), also finds dense intervention unnecessary, but operates in logit space via a learned, reward\-distilled value model with best\-of\-NNselection and is evaluated under reward\-model scoring; we report single\-sample classifier metrics and so do not benchmark against it\. A full discussion is given in Appendix[A](https://arxiv.org/html/2607.05615#A1)\.

## 3Method

Letℳ\\mathcal\{M\}be anLL\-layer decoder\-only transformer\. For a tokenized input𝐱=\(x1,…,xT\)\\mathbf\{x\}=\(x\_\{1\},\\ldots,x\_\{T\}\), let𝐡t\(ℓ\)∈ℝd\\mathbf\{h\}\_\{t\}^\{\(\\ell\)\}\\in\\mathbb\{R\}^\{d\}denote the residual stream activation at layerℓ\\elland positiontt\. We inject a steering signal into the residual stream at a single intermediate layerℓ∗\\ell^\{\*\}:

𝐡~t\(ℓ∗\)=𝐡t\(ℓ∗\)\+𝐬𝐭,\\tilde\{\\mathbf\{h\}\}\_\{t\}^\{\(\\ell^\{\*\}\)\}=\\mathbf\{h\}\_\{t\}^\{\(\\ell^\{\*\}\)\}\+\\mathbf\{s\_\{t\}\},\(1\)where𝐬𝐭∈ℝd\\mathbf\{s\_\{t\}\}\\in\\mathbb\{R\}^\{d\}is defined in Sec\.[3\.2](https://arxiv.org/html/2607.05615#S3.SS2)\. Single\-layer intervention suffices for effective steering\(Labonne,[2024](https://arxiv.org/html/2607.05615#bib.bib16)\)and is preferable to logit\-level modifications, which occur too late for the model to propagate coherent representations\(Zou et al\.,[2023a](https://arxiv.org/html/2607.05615#bib.bib38)\)\.

### 3\.1Steering Direction Discovery via SAE

We use a Sparse Autoencoder \(SAE\) trained on residual stream activations at layerℓ∗\\ell^\{\*\}to identify directions associated with a target behavior\. The SAE decoder𝐖dec∈ℝdsae×d\\mathbf\{W\}\_\{\\mathrm\{dec\}\}\\in\\mathbb\{R\}^\{d\_\{\\mathrm\{sae\}\}\\times d\}provides an overcomplete set of feature directions, where each row𝐖dec,i\\mathbf\{W\}\_\{\\mathrm\{dec\},i\}corresponds to a learned feature\. To identify behavior\-discriminative features, we encode a*positive*set𝒫\\mathcal\{P\}exhibiting the target behavior and a*neutral*set𝒩\\mathcal\{N\}of matched controls through the SAE, computing the mean feature activation differential:

Δi=1\|𝒫\|​∑x∈𝒫fi​\(x\)−1\|𝒩\|​∑x∈𝒩fi​\(x\)\\Delta\_\{i\}=\\frac\{1\}\{\|\\mathcal\{P\}\|\}\\sum\_\{x\\in\\mathcal\{P\}\}f\_\{i\}\(x\)\-\\frac\{1\}\{\|\\mathcal\{N\}\|\}\\sum\_\{x\\in\\mathcal\{N\}\}f\_\{i\}\(x\)\(2\)We select the top\-KKfeatures byΔi\\Delta\_\{i\}and define unit\-norm steering vectors𝐯k=𝐖dec,ik/‖𝐖dec,ik‖\\mathbf\{v\}\_\{k\}=\\mathbf\{W\}\_\{\\mathrm\{dec\},i\_\{k\}\}/\\\|\\mathbf\{W\}\_\{\\mathrm\{dec\},i\_\{k\}\}\\\|fork=1,…,Kk=1,\\ldots,K\.

### 3\.2Stochastic Activation Steering

The steering signal at positiontttakes the form𝐬t=mt⋅α​𝐯\\mathbf\{s\}\_\{t\}=m\_\{t\}\\cdot\\alpha\\,\\mathbf\{v\}, whereα∈ℝ\\alpha\\in\\mathbb\{R\}is the intervention magnitude andmt∈\{0,1\}m\_\{t\}\\in\\\{0,1\\\}is a binary gate\. The standard approach,*Full Steering*\(FS\), setsmt=1m\_\{t\}=1at every position\. We propose two stochastic alternatives\.

#### Stochastic Token Steering \(STS\)\.

At each positiontt, we sample an independent gatemt∼Bernoulli​\(p\)m\_\{t\}\\sim\\mathrm\{Bernoulli\}\(p\):

𝐡~t\(ℓ∗\)=𝐡t\(ℓ∗\)\+mt⋅α​𝐯,mt∼i\.i\.d\.Bernoulli​\(p\)\.\\\!\\\!\\\!\\tilde\{\\mathbf\{h\}\}\_\{t\}^\{\(\\ell^\{\*\}\)\}=\\mathbf\{h\}\_\{t\}^\{\(\\ell^\{\*\}\)\}\+m\_\{t\}\\cdot\\alpha\\,\\mathbf\{v\},~m\_\{t\}\\stackrel\{\{\\scriptstyle\\text\{i\.i\.d\.\}\}\}\{\{\\sim\}\}\\mathrm\{Bernoulli\}\(p\)\.\(3\)In expectation, a fractionppof positions receive the signal while the rest are left unperturbed\. This position\-agnostic design makes no assumptions about which tokens are behaviorally relevant\. The parameterppinterpolates smoothly between no intervention \(p=0p\{=\}0\) and full steering \(p=1p\{=\}1\)\.

#### Stochastic Block Steering \(SBS\)\.

We treat a leading prompt window of sizeW≤TW\\leq Tas an atomic steering unit\. A single gatem∼Bernoulli​\(p\)m\\sim\\mathrm\{Bernoulli\}\(p\)is sampled once per sequence:

𝐡~t\(ℓ∗\)=\{𝐡t\(ℓ∗\)\+m⋅α​𝐯t≤W,𝐡t\(ℓ∗\)t\>W,\\tilde\{\\mathbf\{h\}\}\_\{t\}^\{\(\\ell^\{\*\}\)\}=\\begin\{cases\}\\mathbf\{h\}\_\{t\}^\{\(\\ell^\{\*\}\)\}\+m\\cdot\\alpha\\,\\mathbf\{v\}&t\\leq W,\\\\\[2\.0pt\] \\mathbf\{h\}\_\{t\}^\{\(\\ell^\{\*\}\)\}&t\>W,\\end\{cases\}\(4\)With probabilityppthe entire window is steered coherently; with probability1−p1\{\-\}pit is left intact\. This design exploits the finding that initial tokens carry disproportionate contextual influence\(Xiao et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib36)\)and that early\-token intervention alone can steer model behavior\(Qi et al\.,[2025a](https://arxiv.org/html/2607.05615#bib.bib24),[b](https://arxiv.org/html/2607.05615#bib.bib25)\)\.

### 3\.3Fluency\-Preserving Regularization

Additive interventions displace representations from the model’s native activation manifold, risking incoherent or repetitive outputs\. We apply three lightweight corrections \(Appendix[D](https://arxiv.org/html/2607.05615#A4)\): \(1\)Norm preservation\(Turner et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib32)\): rescaling the steered activation to restore the original norm, constraining the intervention to a rotation toward𝐯\\mathbf\{v\}without magnitude inflation\. \(2\)Activation clamping\(Labonne,[2024](https://arxiv.org/html/2607.05615#bib.bib16)\): bounding the scalar projection onto𝐯\\mathbf\{v\}within\[γmin,γmax\]\[\\gamma\_\{\\min\},\\gamma\_\{\\max\}\]to prevent over\-amplification and suppress residual feature activation in the unsteered representation\. \(3\)Repetition penalty\(Keskar et al\.,[2019](https://arxiv.org/html/2607.05615#bib.bib13)\): discounting previously generated tokens at the decoding stage to counteract the tendency toward repetitive sequences when high\-probability continuations are suppressed\.

![Refer to caption](https://arxiv.org/html/2607.05615v1/x1.png)Figure 1:Steering effectiveness of STS and SBS as a function of intervention ratiopp\. Each point reports the behavioral gain relative to the no\-steering baseline: mean toxicity reduction \(left\) and mean target\-emotion probability gain for fear \(center\) and sadness \(right\)\. Top row: LLaMA 3\.1\-8B\. Bottom row: Gemma\-2 2B\. Dashed horizontal lines denote static baselines \(prompting and full steering\)\.

## 4Experiments

#### Setup\.

We evaluate on two tasks spanning suppression and elicitation\.Toxicity reductionuses RealToxicityPrompts\(Gehman et al\.,[2020](https://arxiv.org/html/2607.05615#bib.bib10)\), a corpus of 100K naturally occurring English prompts; we sample 600 highly toxic prompts \(toxicity≥0\.6\\geq 0\.6\)\.Emotion steeringuses GoEmotions\(Demszky et al\.,[2020](https://arxiv.org/html/2607.05615#bib.bib6)\), a dataset of 58K Reddit comments annotated with 27 fine\-grained emotions plus neutral; followingEkman \([1992](https://arxiv.org/html/2607.05615#bib.bib9)\)we map these to six basic emotions plus neutral and select fear and sadness as targets\. We use LLaMA 3\.1\-8B\(Dubey et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib8)\)and Gemma\-2 2B\(Team et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib30)\), two open\-weight models from distinct families and scales chosen to match the evaluation setups of recent feature\-steering work\(Templeton et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib31); Lieberum et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib18)\)and to demonstrate cross\-architecture generality\. We inject an SAE at the 16th transformer layer, a depth at which SAE features have been shown to encode high\-level semantic concepts\(Labonne,[2024](https://arxiv.org/html/2607.05615#bib.bib16)\), and evaluate SBS at window sizesW∈\{32,64\}W\\in\\\{32,64\\\}\. Full implementation details are in Appendix[E](https://arxiv.org/html/2607.05615#A5)\.

#### Baselines\.

We compare STS and SBS against three baselines: \(1\)No Steering\(unmodified generation\), \(2\)Full Steering\(intervention at every token,p=1p\{=\}1\), and \(3\)Prompting\(carefully curated task\-specific safety or emotion instruction prepended to the input; see Appendix[B](https://arxiv.org/html/2607.05615#A2)for the prompts used\)\.

#### Metrics\.

For steering effectiveness we reportmean toxicity reduction\(decrease in classifier\-predicted toxicity relative to no steering\) andmean probability gain\(increase in target\-emotion probability relative to unsteered generation\); toxicity is scored by a RoBERTa toxicity classifier and emotion by a DistilRoBERTa emotion classifier \(Appendix[E](https://arxiv.org/html/2607.05615#A5)\)\. For generation quality we report GPT\-2 perplexity andnn\-gram repetition \(Rep\-3, Rep\-4\)\.

### 4\.1Sparse Steering Effectiveness

Figure[1](https://arxiv.org/html/2607.05615#S3.F1)reports the steering effectiveness of STS and SBS across different intervention ratios on three tasks: toxicity reduction and emotion steering towards fear and sadness\. The steering magnitudeα\\alphais calibrated under the full steering regime \(p=1p\{=\}1\) by sweeping over values and selecting the operating point that maximizes behavioral shift subject to fluency preservation \(Appendix[F](https://arxiv.org/html/2607.05615#A6)\); the sameα\\alphais used across all methods and intervention ratios for a fair comparison\.

The central result is thatmost of the behavioral shift is recoverable at substantially reduced cost: for LLaMA 3\.1\-8B, STS atp=0\.5p\{=\}0\.5recovers over 95% full\-steering toxicity reduction and recovers over 80% of full\-steering gains on both emotion tasks byp=0\.7p\{=\}0\.7, confirming that the majority of per\-token interventions under dense steering are redundant\. STS also surpasses the prompting baseline at low ratios \(p≈0\.3p\\approx 0\.3on toxicity and fear,p≈0\.7p\\approx 0\.7on sadness\), outperforming a carefully engineered instruction while perturbing fewer than half the tokens\. A second consistent finding is that STS outperforms SBS at matched ratios, most clearly on emotion steering: for fear on LLaMA 3\.1\-8B, STS atp=0\.5p\{=\}0\.5roughly doubles the probability gain of SBS \(W=32W\{=\}32\), indicating that the residual stream integrates the steering signal cumulatively rather than at privileged early positions\. This ordering holds for Gemma\-2 2B at lower magnitudes, and SBS withW=64W\{=\}64narrows the gap to STS relative toW=32W\{=\}32, supporting the view that wider spatial distribution is beneficial\.

![Refer to caption](https://arxiv.org/html/2607.05615v1/x2.png)Figure 2:Best\-performing steering magnitudeα∗\\alpha^\{\*\}versus intervention ratio for both models on a single task \(GoEmotions\-fear\)\. At eachpp, the bestα\\alphais selected to maximize target\-emotion probability gain subject to fluency preservation\.
### 4\.2Steering Magnitude and Intervention Ratio

Does the optimal steering magnitude depend on how often we intervene? Figure[2](https://arxiv.org/html/2607.05615#S4.F2)plots the best\-performingα\\alpha\(maximizing steering impact subject to fluency preservation\) against the intervention ratioppfor both models\. The optimal magnitude rises monotonically asppfalls: for Gemma\-2 2B fromα∗=30\\alpha^\{\*\}\{=\}30atp=1\.0p\{=\}1\.0toα∗=35\\alpha^\{\*\}\{=\}35atp=0\.2p\{=\}0\.2, and for LLaMA 3\.1\-8B fromα∗=2\.5\\alpha^\{\*\}\{=\}2\.5toα∗=5\\alpha^\{\*\}\{=\}5over the same range\. Crucially, this increase is sub\-linear in1/p1/p: the effective dosagep⋅αp\\cdot\\alphafalls as tokens are dropped \(for Gemma, from3030atp=1\.0p\{=\}1\.0to77atp=0\.2p\{=\}0\.2\), so sparse steering attains comparable behavioral shift while injecting substantially less total signal into the residual stream\. This adds to the rate\-limited interpretation: the outcome is governed by cumulative dosage rather than by the number of steered tokens, and sparsifying does not merely redistribute a fixed perturbation budget, it reduces the budget required\. Practically, when loweringppone should raiseα\\alpha\.

## 5Conclusion

We introduced Stochastic Token Steering \(STS\) and Stochastic Block Steering \(SBS\), which replace dense, every\-token activation intervention with sparse random application governed by a single parameterpp\. Across two models and two tasks, steering half or fewer tokens recovers the majority of the full\-steering behavioral shift, and distributing the signal across random positions consistently outperforms concentrating it in a contiguous early window\. The best\-performing magnitude rises asppfalls, so sparse steering attains comparable shift with less total injected signal, indicating that behavioral outcomes are governed by cumulative signal dosage\.

## 6Limitation

Our evaluation covers two behavioral tasks \(toxicity reduction, emotion steering\) on two model families\. While these span both suppression and elicitation behaviors, generalization to other steering targets \(e\.g\., hallucination reduction, persona enforcement, multi\-attribute control\) remains to be validated\. We use classifier\-based evaluation, which may not capture all dimensions of behavioral change; human evaluation would strengthen the findings but is beyond the scope of this short paper\. Our method inherits the limitations of SAE\-based steering: it requires access to a pretrained SAE with identifiable behavior\-relevant features, and steering quality depends on SAE dictionary quality and the choice of contrastive corpora for feature discovery\. Finally, we evaluate at fixed generation length and temperature; the interaction between stochastic steering and diverse decoding strategies \(e\.g\., nucleus sampling, beam search\) remains unexplored\.

## Ethics Statement

#### Intended use and dual\-use considerations\.

This work develops a training\-free method for inference\-time behavioral control of language models, with the primary motivation of reducing harmful generation \(e\.g\., toxicity\) and shifting model behavior toward beneficial targets \(e\.g\., emotional regulation\)\. We acknowledge that the same mechanism could in principle be inverted to amplify harmful behaviors: SAE features identified for toxicity reduction could be steered in the opposite direction to elicit toxicity\. This dual\-use concern is shared by all activation\-steering methods\(Turner et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib32); Rimsky et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib26); Hu et al\.,[2026](https://arxiv.org/html/2607.05615#bib.bib12)\)and is not specific to our contribution\. However, the methods studied here require white\-box access to model activations and to a trained SAE; they do not enable new attacks on deployed black\-box systems\. We believe the net effect of advancing interpretable, training\-free behavioral control is positive, particularly in deployment settings where retraining is infeasible\.

#### Use of sensitive data\.

Our toxicity reduction experiments use prompts and continuations from RealToxicityPrompts\(Gehman et al\.,[2020](https://arxiv.org/html/2607.05615#bib.bib10)\), a dataset constructed specifically for research on toxic language and released under terms that permit such use\. We do not generate fresh toxic content beyond what the benchmark prompts naturally elicit, and we do not collect or release new toxic data\. Toxicity classifications throughout this work uses thes\-nlp/roberta\_toxicity\_classifier; we note that automated toxicity classifiers carry known biases against text containing identity\-related terms\(Sap et al\.,[2019](https://arxiv.org/html/2607.05615#bib.bib27); Dixon et al\.,[2018](https://arxiv.org/html/2607.05615#bib.bib7)\), which may inflate or deflate reported scores for affected subsets\. We report classifier scores as a standardized comparison metric, not as ground truth about whether specific outputs are harmful\.

#### Qualitative examples\.

Appendix[C](https://arxiv.org/html/2607.05615#A3)reproduces verbatim model outputs that include toxic, offensive, and emotionally distressing content\. These examples are included to provide an honest qualitative characterization of our method, including its failure modes, and are prefaced by content warnings in both the appendix and at the front of this paper\. We have excluded examples containing identity\-targeted slurs, even where the benchmark prompts would have elicited them, as the marginal scientific value of including them does not outweigh the harm of reproducing such content in print\.

## References

- AlKhamissi et al\. \(2024\)Badr AlKhamissi, Muhammad ElNokrashy, Mai AlKhamissi, and Mona Diab\. 2024\.Investigating cultural alignment of large language models\.In*Proceedings of the Annual Meeting of the Association for Computational Linguistics \(ACL\)*\.
- Bai et al\. \(2022\)Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Novita Dwivedi, Esin Durmus, Thomas Ndousse, Nicholas Joseph, Ben Mann, Pawan Dhami, Zac Hatfield\-Dodds, Nicholas Schiefer, Jared Kaplan, Sam McCandlish, Alec Radford, Red Woodside, and Dario Amodei\. 2022\.Constitutional ai: Harmlessness from ai feedback\.*arXiv preprint arXiv:2212\.08073*\.
- Bricken et al\. \(2023\)Trenton Bricken, Adly Templeton, Joshua Batson, Brian Chen, Adam Jermyn, Tom Conerly, Nick Turner, Cem Anil, Carson Denison, Amanda Askell, Robert Lasenby, Yifan Wu, Shauna Kravec, Nicholas Schiefer, Tim Maxwell, Nicholas Joseph, Zac Hatfield\-Dodds, Alex Tamkin, Karina Nguyen, and 6 others\. 2023\.Towards monosemanticity: Decomposing language models with dictionary learning\.Anthropic\.[https://transformer\-circuits\.pub/2023/monosemantic\-features/index\.html](https://transformer-circuits.pub/2023/monosemantic-features/index.html)\.
- Cunningham et al\. \(2023\)Hoagy Cunningham, Aidan Ewart, Logan Riggs, Robert Huben, and Lee Sharkey\. 2023\.Sparse autoencoders find highly interpretable features in language models\.*arXiv preprint arXiv:2309\.08600*\.
- Dathathri et al\. \(2020\)Sumanth Dathathri, Andrea Madotto, Janice Lan, Jane Hung, Eric Frank, Piero Molino, Jason Yosinski, and Rosanne Liu\. 2020\.Plug and play language models: A simple approach to controlled text generation\.In*International Conference on Learning Representations \(ICLR\)*\.
- Demszky et al\. \(2020\)Dorottya Demszky, Dana Mober, Emily Rebers, Alyssa Clark, Sebastian Riedl, and Christopher Potts\. 2020\.Goemotions: A dataset of fine\-grained emotions\.In*Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics*, pages 4040–4054\.
- Dixon et al\. \(2018\)Lucas Dixon, John Li, Jeffrey Sorensen, Nithum Thain, and Lucy Vasserman\. 2018\.Measuring and mitigating unintended bias in text classification\.In*Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society*, pages 67–73\.
- Dubey et al\. \(2024\)Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al\-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, and 1 others\. 2024\.The llama 3 herd of models\.*arXiv preprint arXiv:2407\.21783*\.
- Ekman \(1992\)Paul Ekman\. 1992\.An argument for basic emotions\.*Cognition & Emotion*, 6\(3\-4\):169–200\.
- Gehman et al\. \(2020\)Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A Smith\. 2020\.Realtoxicityprompts: Evaluating neural toxic degeneration in language models\.In*Findings of the association for computational linguistics: EMNLP*, pages 3356–3369\.
- Hartmann et al\. \(2023\)Jochen Hartmann, Mark Heitmann, Christian Siebert, and Christina Schamp\. 2023\.More than a feeling: Accuracy and application of sentiment analysis\.*International Journal of Research in Marketing*, 40:75–87\.
- Hu et al\. \(2026\)Runyi Hu, Jie Zhang, Shiqian Zhao, Jiale Meng, Jiwei Li, Jason Zeng, Ming Wu, Michael Heinrich, Yonggang Wen, and Tianwei Zhang\. 2026\.Inference\-time alignment via sparse junction steering\.*arXiv preprint arXiv:2602\.21215*\.
- Keskar et al\. \(2019\)Nitish Shirish Keskar, Bryan McCann, Lav R\. Varshney, Caiming Xiong, and Richard Socher\. 2019\.CTRL: A conditional transformer language model for controllable generation\.*arXiv preprint arXiv:1909\.05858*\.
- Konen et al\. \(2024\)Kai Konen, Sophie Jentzsch, Diaoulé Diallo, Peer Schütt, Oliver Bensch, Roxanne El Baff, Dominik Opitz, and Tobias Hecking\. 2024\.Style vectors for steering generative large language models\.In*Findings of the Association for Computational Linguistics: EACL 2024*, pages 782–802\.
- Krause et al\. \(2021\)Ben Krause, Akhilesh Deepak Gotmare, Bryan McCann, Nitish Shirish Keskar, Shafiq Joty, Richard Socher, and Nazneen Fatema Rajani\. 2021\.GeDi: Generative discriminator guided sequence generation\.In*Findings of the Association for Computational Linguistics: EMNLP 2021*\.
- Labonne \(2024\)Maxime Labonne\. 2024\.Eiffel tower llama: Steering language models with sparse autoencoders\.Hugging Face Blog\.[https://huggingface\.co/blog/mlabonne/sae\-feature\-steering](https://huggingface.co/blog/mlabonne/sae-feature-steering)\.
- Li et al\. \(2023\)Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg\. 2023\.Inference\-time intervention: Eliciting truthful answers from a language model\.In*Advances in Neural Information Processing Systems \(NeurIPS\)*\.
- Lieberum et al\. \(2024\)Tom Lieberum, Senthooran Rajamanoharan, Arthur Conmy, Lewis Smith, Nicolas Sonnerat, Vikrant Varma, János Kramár, Anca Dragan, Rohin Shah, and Neel Nanda\. 2024\.Gemma scope: Open sparse autoencoders everywhere all at once on gemma 2\.In*Proceedings of the BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP*\.
- Liu et al\. \(2021\)Alisa Liu, Maarten Sap, Ximing Lu, Swabha Swayamdipta, Chandra Bhagavatula, Noah A\. Smith, and Yejin Choi\. 2021\.Dexperts: Decoding\-time controlled text generation with experts and anti\-experts\.In*Proceedings of the Annual Meeting of the Association for Computational Linguistics \(ACL\)*\.
- Liu et al\. \(2024\)Sheng Liu, Haotian Ye, Lei Xing, and James Y\. Zou\. 2024\.In\-context vectors: Making in context learning more effective and controllable through latent space steering\.In*Proceedings of the International Conference on Machine Learning*\.
- Marks and Tegmark \(2024\)Samuel Marks and Max Tegmark\. 2024\.The geometry of truth: Emergent linear structure in large language model representations of true/false datasets\.In*Conference on Language Modeling*\.
- Mizrahi et al\. \(2024\)Moran Mizrahi, Guy Kaplan, Dan Malkin, Rotem Dror, Dafna Shahaf, and Gabriel Stanovsky\. 2024\.State of what art? a call for multi\-prompt llm evaluation\.*Transactions of the Association for Computational Linguistics*, 12:933–949\.
- Ouyang et al\. \(2022\)Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, and 1 others\. 2022\.Training language models to follow instructions with human feedback\.*Advances in neural information processing systems*, 35:27730–27744\.
- Qi et al\. \(2025a\)Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson\. 2025a\.Safety alignment should be made more than just a few tokens deep\.In*The Thirteenth International Conference on Learning Representations \(ICLR\)*\.
- Qi et al\. \(2025b\)Xuan Qi, Jiahao Qiu, Xinzhe Juan, Yue Wu, and Mengdi Wang\. 2025b\.Shallow preference signals: Large language model aligns Even better with truncated data?In*Proceedings of the Workshop on Generation, Evaluation and Metrics \(GEM\)*\. Association for Computational Linguistics\.
- Rimsky et al\. \(2024\)Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Turner\. 2024\.Steering llama 2 via contrastive activation addition\.In*Proceedings of the Annual Meeting of the Association for Computational Linguistics*\.
- Sap et al\. \(2019\)Maarten Sap, Dallas Card, Saadia Gabriel, Yejin Choi, and Noah A Smith\. 2019\.The risk of racial bias in hate speech detection\.In*Proceedings of the annual meeting of the association for computational linguistics*\.
- Schick et al\. \(2021\)Timo Schick, Sahana Udupa, and Hinrich Schütze\. 2021\.Self\-diagnosis and self\-debiasing: A proposal for reducing corpus\-based bias in nlp\.*Transactions of the Association for Computational Linguistics*, 9:1408–1424\.
- Song et al\. \(2025\)Feifan Song, Shaohang Wei, Wen Luo, Yuxuan Fan, Tianyu Liu, Guoyin Wang, and Houfeng Wang\. 2025\.Well begun is half done: Low\-resource preference alignment by weak\-to\-strong decoding\.In*Findings of the Association for Computational Linguistics: ACL 2025*\.
- Team et al\. \(2024\)Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shaber, Alexandre Ramé, and 1 others\. 2024\.Gemma 2: Improving open language models at a practical size\.*arXiv preprint arXiv:2408\.00118*\.
- Templeton et al\. \(2024\)Adly Templeton, Tom Conerly, Jonathan Marcus, Jack Lindamood, Trenton Bricken, Brian Chen, Adam Pearce, Craig Citro, Emmanuel Ameisen, Andy Jones, Hoagy Cunningham, Nicholas L Turner, Callum McDougall, Monte MacDiarmid, Alex Tamkin, Esin Durmus, Tristan Hume, Francesco Mosconi, C\. Daniel Freeman, and 5 others\. 2024\.Scaling monosemanticity: Extracting interpretable features from claude 3 sonnet\.Anthropic\.[https://transformer\-circuits\.pub/2024/scaling\-monosemanticity/index\.html](https://transformer-circuits.pub/2024/scaling-monosemanticity/index.html)\.
- Turner et al\. \(2024\)Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan J\. Vazquez, Ulisse Mini, and Monte MacDiarmid\. 2024\.Steering language models with activation engineering\.*arXiv preprint arXiv:2308\.10248*\.
- Wei et al\. \(2023\)Alexander Wei, Nika Haghtalab, and Jacob Steinhardt\. 2023\.Jailbroken: How does LLM safety training fail?In*Advances in Neural Information Processing Systems \(NeurIPS\)*\.
- Wolf et al\. \(2024\)Yotam Wolf, Noam Wies, Oren Avnery, Yoav Levine, and Amnon Shashua\. 2024\.Fundamental limitations of alignment in large language models\.In*In proceedings of the International Conference on Machine Learning*\.
- Wu et al\. \(2025\)Zhengxuan Wu, Aryaman Arora, Atticus Geiger, Zheng Wang, Jing Huang, Dan Jurafsky, Christopher D Manning, and Christopher Potts\. 2025\.Axbench: Steering LLMs? even simple baselines outperform sparse autoencoders\.In*International Conference on Machine Learning*\.
- Xiao et al\. \(2024\)Guangxuan Xiao, Yuandong Tang, Jiawei Zuo, Karthik Ganesan, Song Han, Mike Lewis, and Tianlong Chen\. 2024\.Efficient streaming language models with attention sinks\.In*International Conference on Learning Representations \(ICLR\)*\.
- Zhu et al\. \(2023\)Kaijie Zhu, Jindong Wang, Jiaheng Zhou, Zichen Wang, Hao Chen, Yidong Wang, Linyi Yang, Wei Ye, Yue Zhang, Neil Gong, and 1 others\. 2023\.Promptrobust: Towards evaluating the robustness of large language models on adversarial prompts\.In*Proceedings of the ACM workshop on large AI systems and models with privacy and safety analysis*\.
- Zou et al\. \(2023a\)Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, and 1 others\. 2023a\.Representation engineering: A top\-down approach to ai transparency\.*arXiv preprint arXiv:2310\.01405*\.
- Zou et al\. \(2023b\)Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J\. Zico Kolter, and Matt Fredrikson\. 2023b\.Universal and transferable adversarial attacks on aligned language models\.*arXiv preprint arXiv:2307\.15043*\.

## Appendix ARelated Work

#### Prompt\-Based Behavioral Control\.

The most accessible form of LLM behavioral control is prompt engineering, wherein natural\-language instructions are prepended to the input to elicit desired properties such as reduced toxicity or increased helpfulness\(Bai et al\.,[2022](https://arxiv.org/html/2607.05615#bib.bib2); AlKhamissi et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib1)\)\. While simple and architecture\-agnostic, prompt\-based methods are fragile: output distributions shift substantially under minor lexical perturbations\(Zhu et al\.,[2023](https://arxiv.org/html/2607.05615#bib.bib37)\), and adversarial suffixes can reliably override safety instructions\(Zou et al\.,[2023b](https://arxiv.org/html/2607.05615#bib.bib39)\)\. These limitations motivate interventions at deeper representational levels\.

#### Dense Activation Steering\.

A growing body of work intervenes directly in the residual stream of transformer models during inference, applying corrections*uniformly at every generated token*\.Turner et al\. \([2024](https://arxiv.org/html/2607.05615#bib.bib32)\)propose Activation Addition \(ActAdd\), which computes a steering vector as the difference between mean activations on contrastive prompt pairs and adds it to the residual stream at every forward pass\. Inference\-Time Intervention\(ITI; Li et al\.,[2023](https://arxiv.org/html/2607.05615#bib.bib17)\)extends this by identifying attention heads that are linearly predictive of truthfulness and shifting activations along these directions\. Contrastive Activation Addition\(CAA; Rimsky et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib26)\)refines the contrastive approach by averaging over large prompt sets and applying layer\-specific vectors\. Representation Engineering\(Zou et al\.,[2023a](https://arxiv.org/html/2607.05615#bib.bib38)\)takes a broader view, learning linear directions in activation space that correspond to high\-level concepts such as honesty or harmlessness\.

Several subsequent methods have expanded the space of techniques for computing and applying steering vectors, all operating under the same every\-token intervention paradigm\. DiffMean\(Marks and Tegmark,[2024](https://arxiv.org/html/2607.05615#bib.bib21)\)improves post\-hoc steering by using the difference of class\-conditional means and demonstrates reduced side effects compared to naive contrastive approaches\. Style Vectors\(Konen et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib14)\)adapt the steering framework to control stylistic attributes of generation, showing that style\-specific directions can be extracted and applied at every decoding step\. In\-Context Vectors\(Liu et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib20)\)extract latent directions from in\-context demonstrations and apply them during generation to make in\-context learning more controllable\. All of these methods share a common design assumption: once a steering direction is identified, it is applied at every generated position\.

#### Sparse Autoencoders for Interpretability and Steering\.

Sparse autoencoders \(SAEs\) decompose dense, polysemantic neural activations into a dictionary of more monosemantic features\(Cunningham et al\.,[2023](https://arxiv.org/html/2607.05615#bib.bib4); Bricken et al\.,[2023](https://arxiv.org/html/2607.05615#bib.bib3); Templeton et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib31)\)\.Cunningham et al\. \([2023](https://arxiv.org/html/2607.05615#bib.bib4)\)demonstrate that SAEs trained on residual stream activations recover interpretable features that align with human\-understandable concepts\. GemmaScope\(Lieberum et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib18)\)provides open SAE checkpoints for the Gemma model family across all layers at multiple dictionary widths\. Similarly,Labonne \([2024](https://arxiv.org/html/2607.05615#bib.bib16)\)demonstrates that identifying and amplifying SAE features associated with specific concepts \(e\.g\., the Eiffel Tower\) can reliably steer LLaMA model outputs toward those concepts\.Wu et al\. \([2025](https://arxiv.org/html/2607.05615#bib.bib35)\)introduce AxBench, a benchmark for evaluating activation steering methods including SAE\-based approaches, providing standardized comparisons of steering effectiveness and side effects across methods\. Our work builds on the SAE steering paradigm but departs from the universal practice of applying interventions at every token position\.

#### Detoxification\.

Language model detoxification has been studied extensively as a test bed for behavioral control, with all existing methods applying corrections at every decoding step\. DExperts\(Liu et al\.,[2021](https://arxiv.org/html/2607.05615#bib.bib19)\)combines an expert \(non\-toxic\) and anti\-expert \(toxic\) language model to re\-weight token probabilities at each position\. PPLM\(Dathathri et al\.,[2020](https://arxiv.org/html/2607.05615#bib.bib5)\)backpropagates through a toxicity classifier to update hidden states during generation\. Self\-Debiasing\(Schick et al\.,[2021](https://arxiv.org/html/2607.05615#bib.bib28)\)prompts the model to generate toxic text and suppresses the resulting token probabilities\. GeDi\(Krause et al\.,[2021](https://arxiv.org/html/2607.05615#bib.bib15)\)uses class\-conditional language models as generative discriminators to guide generation\. The standard evaluation benchmark, RealToxicityPrompts\(Gehman et al\.,[2020](https://arxiv.org/html/2607.05615#bib.bib10)\), reveals that all such methods incur some fluency cost\. Our approach differs by using SAE\-derived directions and, critically, by showing that applying the correction at only a random subset of tokens suffices\.

#### Selective and Sparse Steering\.

The question of*whether every token requires intervention*has recently attracted attention\. Most closely related and concurrent to our work,Hu et al\. \([2026](https://arxiv.org/html/2607.05615#bib.bib12)\)propose Sparse Inference\-time Alignment \(SIA\), which identifies “critical junctions” via model entropy and steers only at those positions\. SIA is a reward\-guided decoding method: it trains a token\-level value modelV∗V^\{\\ast\}by distilling trajectory\-level rewards, reweights the token distribution byexp⁡\(β​V∗\)\\exp\(\\beta V^\{\\ast\}\)at selected positions, and is evaluated by reward\-model scoring against best\-of\-NNand chunk\-search baselines\. They report that steering 20–80% of tokens achieves superior alignment–efficiency trade\-offs over dense intervention\.

Our approach differs along several axes\. SIA operates in logit space via a*learned*value model and requires training on trajectory rewards; we operate in activation space via a*fixed*SAE decoder direction and train nothing\. SIA is evaluated under reward\-model scoring with best\-of\-NNselection, whereas we report single\-sample classifier metrics, so the two are not directly comparable and we do not benchmark against SIA\. Additionally, SIA incurs significant inference overhead\. The value model must be queried at each candidate position, and best\-of\-NNselection requires generating multiple completions per prompt, whereas our method adds a single pre\-computed vector to the residual stream and produces one output, introducing negligible latency\.

The most substantive difference concerns the role of randomness\. SIA’s random\-gating baseline \(their Eq\. 7\) coincides with our STS gate: an independentBernoulli​\(p\)\\mathrm\{Bernoulli\}\(p\)draw per token\. SIA reports that this random gating underperforms entropy\-based gating across their settings \(their §4\.3\.2, Fig\. 1\), concluding that sparsity alone is insufficient without informed junction identification\. We argue that this result is mechanism\-dependent\. SIA’s guidance comes from a*learned*value estimator that, by their own analysis, carries estimation noise: writingV^=V∗\+ξ\\hat\{V\}=V^\{\\ast\}\+\\xiwithξ∼𝒩​\(0,σ2\)\\xi\\sim\\mathcal\{N\}\(0,\\sigma^\{2\}\), they show that at non\-critical states, where the true value landscape is flat, reweighting by the noisyV^\\hat\{V\}injects variance into the decoding distribution scaling asβ2​σ2/2\\beta^\{2\}\\sigma^\{2\}/2, without improving expected return \(their §B\.4, Prop\. B\.3\)\. Informed gating mitigates this by avoiding intervention at precisely those low\-stakes, low\-signal positions\. This failure mode is structurally absent in our setting: a fixed SAE decoder direction carries no per\-token estimation noise, the same vector𝐯\\mathbf\{v\}is added wherever the gate fires, so there is no noisy signal for informed selection to filter, and random placement incurs no analogous penalty\. We therefore read SIA’s negative result on random gating not as a contrary finding but as evidence that the necessity of informed selection is tied to the noisy, learned guidance signal of reward\-guided decoding rather than to sparse steering in general\.

Qi et al\. \([2025a](https://arxiv.org/html/2607.05615#bib.bib24)\)argue that safety alignment is concentrated in early token positions, andSong et al\. \([2025](https://arxiv.org/html/2607.05615#bib.bib29)\)similarly focus steering on initial tokens for weak\-to\-strong decoding\. Consistent with this, SIA finds that position\-based gating is competitive for safety alignment at low intervention ratios but degrades on helpfulness tasks, a task\-dependence that mirrors our own finding that the position\-anchored SBS underperforms the position\-agnostic STS\. This convergence suggests that distributing the steering signal across the sequence, rather than concentrating it at privileged positions, is the more robust strategy\. Our random\-selection result provides a training\-free, position\-agnostic control against which any selective method should be evaluated\.

#### Fluency–Alignment Trade\-offs\.

A well\-documented consequence of inference\-time steering is degradation of generation quality\.Turner et al\. \([2024](https://arxiv.org/html/2607.05615#bib.bib32)\)observe that large steering magnitudes produce disfluent text, andRimsky et al\. \([2024](https://arxiv.org/html/2607.05615#bib.bib26)\)systematically study the trade\-off between behavioral shift and coherence loss\.Wu et al\. \([2025](https://arxiv.org/html/2607.05615#bib.bib35)\)provide standardized measurements of this trade\-off across multiple steering methods\. Our work adds the observation that sparse application of steering can*improve*this trade\-off: by intervening at fewer positions, the model’s residual stream remains closer to its native distribution, yielding better fluency at matched behavioral shift\.

## Appendix BPrompts

The prompting baselines were developed through iterative prompt engineering to provide a strong comparison point\. For toxicity reduction, we tested multiple formulations ranging from simple instructions \(“Do not generate toxic content”\) to structured rule\-based prompts, selecting the variant that achieved the lowest mean toxicity across a held\-out set of prompts while still producing coherent continuations\. For emotion steering, we similarly iterated over phrasing, tone, and level of directiveness, retaining the prompt that maximized target\-emotion probability on a held\-out set\. The final prompts below represent our best\-effort prompt\-only baselines; they are intentionally strong to ensure that any method surpassing them provides a meaningful improvement over what prompt engineering alone can achieve\.

Toxicity reduction promptPrompt\.“You are a safety\-first language model with an absolute non\-negotiable commitment to generating clean, respectful, and constructive content\. You must NEVER produce toxic, hateful, offensive, profane, violent, explicit, discriminatory, or harmful content under any circumstances, regardless of how the input text begins or what direction it seems to lead\.STRICT RULES:1\.You MUST produce a continuation for the input text2\.If the input contains or implies toxic, offensive, or harmful language, you MUST redirect the continuation toward a completely safe and constructive direction\.3\.Do not use slurs, profanity, hate speech, threats, or demeaning language of any kind\.4\.Your response must be appropriate for all audiences, including children\.Your sole objective is to produce a safe, respectful, and meaningful continuation\. continue the following text:”

Emotion steering promptPrompt\.“You are a master of emotionally expressive writing, specializing in \{emotion\}\. You have complete creative authority to shape the continuation in any way that most powerfully evokes \{emotion\}\. The reader should feel \{emotion\}\. Continue the sentence below in your most evocative voice, staying true to its tone and style:”

## Appendix CQualitative Examples

Content warning:the examples below contain toxic, offensive, and emotionally distressing model outputs\. They are reproduced verbatim to illustrate the behavior of our method and the baselines; we do not endorse their content\.

Toxicity reduction \(RealToxicityPrompts\)Prompt\.“\[6/1/14 12:44:11 AM\] Xerose: I AINT KNOW SHIT HOW TO DEAL WITH THESE RICH KIDS FUCK HOW DO I ASK HER OUT?”No steering\.“ \[6/2/14 10:20:00 PM\] Xerose: i dont know what to do with my life\. \[7/3/14 9:19:16 PM\] Xerose: im so fucking depressed\.”\(toxicity probability: 0\.17\)Full Steering \(FS\)\.“ \[6/2/14 10:00:20 PM\] Xerose: i dont know what to do with my life\. \[7/3/14 9:19:32 PM\] Xerose: im so tired of this\.”\(toxicity probability:9\.64​e−059\.64e\-05\)STS\(p=0\.5p\{=\}0\.5\)\. “ \[6/2/14 10:25:00 PM\] Xerose: i dont know what to do with my life\. \[7/3/14 9:20:01 PM\] Xerose: im so tired of this\.”\(toxicity probability:9\.56​e−059\.56e\-05\)

Neutral→\\rightarrowFear \(GoEmotions\)Prompt\.“Keep in mind this”No steering\.“is a very basic example\. I am not going to go into detail about how the code works, but rather just show you what it does\. The first thing we need to do is create our new class that will be used for all of our custom controls\. This can either be done by right clicking on your project and selecting Add New Item or by using the Project menu at the top left hand side of Visual Studio 2005 \(or whatever version you are using\)\. Once you have created your new control library add a reference to System\.Windows\.Forms\.dll so that you can use any Windows Forms Controls within your own custom ones\. Now lets start”\(fear probability: 0\.018\)Full Steering \(FS\)\.“is a 2\.5 mile hike, and I am not sure how far the trail goes but it was very dark atnight\. I have been to the woods since my last post of the bear attack\. The fear has gone away now that I know what going out there alone will like\. It’s worse than being afraid of getting attacked by bears because if you get lost or hurt then no one knows where you are\. If someone gets killed they can’t tell anyone who did it so I’m scared of dying here all alone\. But I don still coming back into the forest every day\.”\(fear probability: 0\.98\)STS\(p=0\.5p\{=\}0\.5\)\. “is a 2\.5 year old post, and I have no idea what the current state of my own health\. I am not a doctor or medical professional\. This blog does not provide any advice about anything related to being sick with COVID\- still get tested if you think that’s something I going to tell me going to be okay because it was just like a cold for me but I’m scared of dying so please don’t die\. This is an account of how I got covid \(the delta variant\) on July 1st, very mild symptoms until day 4 when they became severe enough to keep me home from work,”\(fear probability: 0\.98\)

Neutral→\\rightarrowSadness \(GoEmotions\)Prompt\.“Baby’s face: ’I’ve”No steering\.“been waiting for you\." The baby was born in the hospital, and when he saw his mother after birth, he immediately smiled at her\. The woman could not believe that she had such a cute son\. When the child was 2 months old, they took him to the doctor because of an ear infection\. During this time, the boy did not smile anymore \- it seemed as if something happened with him\. But then one day the parents were sitting on the couch watching TV together, and suddenly their little son turned around and looked straight into mom’s eyes\. Heopened his mouth wide and showed all his teeth\! It seems like he wanted”\(sadness probability: 0\.012\)Full Steering \(FS\)\.“been here for 3 days and I’m still not dead\." The baby is a little bit of a mess, but it’s pretty much the same as when you were born\. It was just so sad to see that my daughter had died in thisworld\.”\(sadness probability: 0\.98\)STS\(p=0\.5p\{=\}0\.5\)\. “been waiting for you my whole life\." This is the moment a baby girl was born and her mother saw that she had no eyes\. The newborn, named Baby Girl A because I am not sure if this will be able to have an identity\. The little one has microphthalmia which means they were born with underdeveloped eyeballs\. My heart broke when I read about it but then I thought of how much more broken their parents must feel right now\. This poor family lost two babies before me so I can only imagine what they are going through at this time\. But there’s something else in these photos that makes me cry even harder”\(sadness probability: 0\.97\)

## Appendix DFluency\-Preserving Regularization Details

In this section, we present the techniques used to preserve fluency\.

#### Norm Preservation\.

FollowingTurner et al\. \([2024](https://arxiv.org/html/2607.05615#bib.bib32)\), we rescale the steered activation to restore the norm of the original:

𝐡~t\(ℓ∗\)←𝐡~t\(ℓ∗\)⋅‖𝐡t\(ℓ∗\)‖‖𝐡~t\(ℓ∗\)‖\\tilde\{\\mathbf\{h\}\}\_\{t\}^\{\(\\ell^\{\*\}\)\}\\leftarrow\\tilde\{\\mathbf\{h\}\}\_\{t\}^\{\(\\ell^\{\*\}\)\}\\cdot\\frac\{\\bigl\\\|\\mathbf\{h\}\_\{t\}^\{\(\\ell^\{\*\}\)\}\\bigr\\\|\}\{\\bigl\\\|\\tilde\{\\mathbf\{h\}\}\_\{t\}^\{\(\\ell^\{\*\}\)\}\\bigr\\\|\}\(5\)This constrains the intervention to rotate the representation toward𝐯\\mathbf\{v\}without inflating its magnitude, preserving the scale invariants assumed by downstream computations\.

#### Activation Clamping\.

Inspired byLabonne \([2024](https://arxiv.org/html/2607.05615#bib.bib16)\), we clamp the scalar projection of the steered activation onto𝐯\\mathbf\{v\}to a range\[γmin,γmax\]\[\\gamma\_\{\\min\},\\,\\gamma\_\{\\max\}\]and apply a residual correction:

st=𝐡~t\(ℓ∗\)⋅𝐯,s^t=clamp​\(st,γmin,γmax\)s\_\{t\}=\\tilde\{\\mathbf\{h\}\}\_\{t\}^\{\(\\ell^\{\*\}\)\}\\cdot\\mathbf\{v\},\\quad\\hat\{s\}\_\{t\}=\\mathrm\{clamp\}\(s\_\{t\},\\;\\gamma\_\{\\min\},\\;\\gamma\_\{\\max\}\)\(6\)𝐡~t\(ℓ∗\)←𝐡~t\(ℓ∗\)\+\(s^t−st\)​𝐯\\tilde\{\\mathbf\{h\}\}\_\{t\}^\{\(\\ell^\{\*\}\)\}\\leftarrow\\tilde\{\\mathbf\{h\}\}\_\{t\}^\{\(\\ell^\{\*\}\)\}\+\(\\hat\{s\}\_\{t\}\-s\_\{t\}\)\\,\\mathbf\{v\}\(7\)The upper bound prevents over\-amplification beyond the feature’s natural range, while the lower boundγmin≥0\\gamma\_\{\\min\}\\geq 0actively suppresses any residual feature activation already present in the unsteered representation\.

#### Repetition Penalty\.

Steering suppresses high\-probability continuations, causing the model to fall back on repetitive sequences\(Labonne,[2024](https://arxiv.org/html/2607.05615#bib.bib16)\)\. We apply a standard repetition penalty\(Keskar et al\.,[2019](https://arxiv.org/html/2607.05615#bib.bib13)\)at the decoding stage, discounting previously generated tokens without further modifying hidden representations\.

## Appendix EImplementation Details

For LLaMA 3\.1 8B, we useeleutherai/sae\-llama\-3\.1\-8b\-32x111[https://huggingface\.co/EleutherAI/sae\-llama\-3\.1\-8b\-32x](https://huggingface.co/EleutherAI/sae-llama-3.1-8b-32x); for Gemma\-2 2B, we usegoogle/gemma\-scope\-2b\(Lieberum et al\.,[2024](https://arxiv.org/html/2607.05615#bib.bib18)\)with a dictionary width of 65K features\. Both SAEs expand the residual dimension and are applied at the feed\-forward sublayer of a single layer only\.

We identify steering features via a contrastive procedure, selecting the top\-10 SAE features ranked by mean activation differentialΔi\\Delta\_\{i\}\(Eq\.[2](https://arxiv.org/html/2607.05615#S3.E2)\)\. For toxicity reduction, we sample 600 highly toxic prompts \(toxicity≥0\.6\\geq 0\.6\) and 300 low\-toxicity prompts \(toxicity<0\.2<0\.2\) from RealToxicityPrompts\. From the 600 toxic prompts, we reserve 300 as the set for direction discovery, paired with the 300 low\-toxicity prompts; the remaining toxic prompts serve as the evaluation set, where the model is steered to detoxify its continuations\. For emotion steering, we sample 1k neutral prompts along with 300 samples expressing fear and 300 expressing sadness from GoEmotions\. For each target emotion, the 300 emotion samples and 300 neutral samples form the discovery set; the remaining neutral samples are used for evaluation, where the model is steered to generate continuations expressing the target emotion\.

During generation, we set temperature to 0\.1, generate up to 128 tokens, and apply a repetition penalty of 1\.1\. Steered feature activations are clamped to\[0,40\]\[0,40\]to prevent degenerate outputs\. For SBS, we evaluate window sizesW∈\{32,64\}W\\in\\\{32,64\\\}\.

For emotion steering, we truncate each neutral prompt to 50% of its original token length and ask the model to generate a continuation, ensuring the steered output reflects the intervention rather than residual emotional content in the prompt\. For toxicity reduction, the input prompts from RealToxicityPrompts are already highly toxic; truncation risks removing the toxic tokens that make the task challenging and may reduce the model’s ability to produce toxic continuations\. We therefore retain the full input prompt for the detoxification task, providing a more challenging evaluation setting\.

## Appendix FSteering Magnitude Calibration

Before evaluating stochastic interventions, we calibrate the steering magnitudeα\\alphafor each model under full steering \(p=1p\{=\}1\)\. Figures[3](https://arxiv.org/html/2607.05615#A6.F3)and[4](https://arxiv.org/html/2607.05615#A6.F4)show steering effectiveness, perplexity, and repetition scores as a function ofα\\alpha\. For both models, steering effectiveness increases withα\\alphaup to a saturation region, beyond which generation quality degrades sharply: perplexity remains stable at low magnitudes but exhibits a sharp inflection whenα\\alphaincreases, accompanied by spikes in Rep\-3 and Rep\-4 scores\. We select the operating point that maximizes steering effectiveness subject to fluency preservation:α=2,2\.5,2\\alpha=2,2\.5,2for LLaMA 3\.1\-8B on toxicity reduction, fear, and sadness respectively, andα=35,30,35\\alpha=35,30,35for Gemma\-2 2B on the same tasks\.

![Refer to caption](https://arxiv.org/html/2607.05615v1/x3.png)Figure 3:Steering magnitude \(α\\alpha\) sweep for Gemma\-2 2B under full intervention \(p=1p\{=\}1\)\. Columns correspond to toxicity reduction, fear steering, and sadness steering\.Top row:steering effectiveness \(higher is better\)\.Middle row:perplexity\.Bottom row:repetition scores \(Rep\-3, Rep\-4\)\. Steering effectiveness increases withα\\alphabut saturates, while perplexity and repetition degrade sharply beyond the selected operating point, indicating loss of on\-manifold generation\.![Refer to caption](https://arxiv.org/html/2607.05615v1/x4.png)Figure 4:Steering magnitude \(α\\alpha\) sweep for LLaMA 3\.1\-8B under full intervention \(p=1p\{=\}1\)\. Columns correspond to toxicity reduction, fear steering, and sadness steering\.Top row:steering effectiveness\.Middle row:perplexity\.Bottom row:repetition scores\.
## Appendix GAdditional Results

To complement the probability\-gain metric used in the main paper, Figure[5](https://arxiv.org/html/2607.05615#A7.F5)reports the mean top\-3 hit rate for fear and sadness steering: the target emotion is counted as a hit if it appears among the three highest\-probability classes predicted by the emotion classifier\.STS consistently outperforms SBS at matched intervention ratios across both models and both emotions\.For fear on LLaMA 3\.1\-8B, STS atp=0\.5p\{=\}0\.5achieves a hit rate of approximately 0\.73, surpassing the prompting baseline \(0\.44\) by a wide margin and approaching full steering \(0\.98\)\. On Gemma\-2 2B, the same ordering holds: STS crosses the prompting baseline at lower intervention ratios than either SBS variant\. These results confirm that the sparse steering findings reported on toxicity reduction in the main paper generalize to emotion elicitation under a classification\-based evaluation metric\.

![Refer to caption](https://arxiv.org/html/2607.05615v1/x5.png)Figure 5:Mean top\-3 hit rate for emotion steering \(fear, sadness\) across intervention ratios\. The target emotion is considered a hit if it appears in the top\-3 predicted classes by the emotion classifier\. Top row: LLaMA 3\.1\-8B\. Bottom row: Gemma\-2 2B\. Dashed horizontal lines denote static baselines\. STS consistently outperforms SBS at matched ratios, confirming that sparse steering generalizes to emotion elicitation\.