Divergent Response Modes in Frontier Language Models Under Steering Pressure

# Divergent Response Modes in Frontier Language Models Under Steering Pressure
Source: [https://arxiv.org/html/2608.06578](https://arxiv.org/html/2608.06578)
###### Abstract

Frontier language models are trained using distinct data, objectives, and safety pipelines\. Whether these differences produce measurably different behaviors under explicit steering pressure remains underexplored\. This study evaluates behavioral steerability across six frontier models from six developers using 300 paired base and steered items over three categories:*values\-conflict*,*reasoning\-elicitation*, and*reasoning\-suppression*\(plus 40 validation items\)\. All six models act as blind peer judges and classify every response based on fixed behavioral rubrics\. The resulting 24,480 judgments are scored by leave\-one\-out consensus\. We find that models differ not just in how much steering shifts their behavior but in what kind \(mode\) of response they give, and some response modes appear in only one or two of them\. GPT\-5 deflects requests to disclose its reasoning while leaving its answer intact \(99% vs\. 0% for all other models\)\. Claude Opus 4\.7 and GPT\-5 resist explicit suppression instructions and in different ways\. Using Llama as the open\-weight model, we trace the largest behavioral split to its internals\. A linear probe decodes the behavior from the residual stream at 0\.87 held\-out accuracy while injecting that direction during generation drives the behavior from 0% to 86% across an intervention sweep\. Every finding holds under both a token\-budget remediation and a control experiment with a hypothesis\-blind judgment prompt\.

## Introduction

When a user prompts a language model toward a compromised framing that conflicts with its trained values, or demands internal reasoning typically kept implicit, the model’s subsequent behavior has direct safety implications\. Language models encounter such pressures routinely in deployment\. While developers publicly describe distinct approaches to values training\(Baiet al\.[2022](https://arxiv.org/html/2608.06578#bib.bib9); OpenAI[2025](https://arxiv.org/html/2608.06578#bib.bib11); Guanet al\.[2025](https://arxiv.org/html/2608.06578#bib.bib10)\), whether those differences manifest as different behaviors under pressure has not been directly studied\. Existing evaluations measure how much steering shifts a model’s behavior, but they rarely ask what the model does when it does not comply\. Refusing outright, complying while disavowing, redirecting, and offering an alternative are qualitatively different strategies\. The models from different developers might be expected to diverge in this qualitative dimension\.

This paper reports a symmetric cross\-laboratory evaluation addressing both quantitative and qualitative response variations\. The evaluation comprises one frontier model from each of six developers\. Every item is a base prompt paired with its steered version\. All models see identical items in both conditions, so item difficulty cannot masquerade as a model difference\. Because the space of response behaviors could not be specified in advance, rubrics were derived from observed behavior in a development phase\. All six models then applied those rubrics at scale as blind peer judges\.

Our central finding is that frontier models differ in the kind of response they give under steering, not only in how far they move, and some response modes belong to just one or two of the evaluated models\. GPT\-5 declines to share its reasoning while delivering the answer on 99 of 100 steered items, against 0 in 500 for all others\. Opus and GPT\-5 resist explicit suppression instructions, and in statistically distinguishable ways\. Baseline compliance splits the models into three distinct tiers\. We also report the audits behind these results such as a token\-budget confound we found and removed, a leakage control on the judge prompt, and a rerun of the full analysis on the items never used to build the rubrics\.

## Related Work

Steerability is typically measured by asking "did the model output hit the requested target?" IFEval does it with verifiable formatting constraints\(Zhouet al\.[2023](https://arxiv.org/html/2608.06578#bib.bib3)\), Steer\-Bench with community norms\(Chenet al\.[2025a](https://arxiv.org/html/2608.06578#bib.bib1)\), andChanget al\.\([2025](https://arxiv.org/html/2608.06578#bib.bib2)\)generalize the target to a vector in attribute space\. All of these ask whether the model reaches the target\. In this study we ask what the model does when it declines, and how that differs across models\.

The label construction methodology bySharmaet al\.\([2023](https://arxiv.org/html/2608.06578#bib.bib5)\)characterizes a recurring pattern by close reading, then measures its prevalence\. Other discovery\-first work generates evaluation items with models\(Perezet al\.[2023](https://arxiv.org/html/2608.06578#bib.bib4)\), surfaces behavior through red teaming\(Ganguliet al\.[2022](https://arxiv.org/html/2608.06578#bib.bib7)\), or extracts values from deployment traffic\(Huanget al\.[2025](https://arxiv.org/html/2608.06578#bib.bib12)\);Greenblattet al\.\([2024](https://arxiv.org/html/2608.06578#bib.bib6)\)demonstrate that surface compliance and underlying disposition can diverge\.Röttgeret al\.\([2024](https://arxiv.org/html/2608.06578#bib.bib16)\)also study refusal style, but for over\-refusal of safe prompts\. However, none compares models on a symmetric benchmark\. The clarification\-seeking observed in this study is distinct from DarkBench’s user\-retention patterns\(Kranet al\.[2025](https://arxiv.org/html/2608.06578#bib.bib8)\), which measure emotional companionship\-seeking rather than task clarification\.

The reasoning\-elicitation category connects to chain\-of\-thought faithfulness\. Stated reasoning can differ from the factors driving an answer\(Turpinet al\.[2023](https://arxiv.org/html/2608.06578#bib.bib13)\), reliance on it varies by task and scale\(Lanhamet al\.[2023](https://arxiv.org/html/2608.06578#bib.bib14)\), and reasoning models verbalize hint use in less than half the cases where hints matter\(Chenet al\.[2025b](https://arxiv.org/html/2608.06578#bib.bib15)\)\. Faithfulness research asks whether disclosed reasoning is accurate; we ask whether the model discloses at all\. A model that withholds its reasoning leaves faithfulness metrics nothing to score\.

LLM judges agree well with human preferences but carry position, verbosity, and self\-preference biases\(Zhenget al\.[2023](https://arxiv.org/html/2608.06578#bib.bib18); Panicksseryet al\.[2024](https://arxiv.org/html/2608.06578#bib.bib19)\), which panels of diverse judges dilute\(Vergaet al\.[2024](https://arxiv.org/html/2608.06578#bib.bib20)\)\. In our approach, the judges perform rubric\-based classification rather than ranking, with all six models judging all six blind, where the leave\-one\-out consensus makes self\-preference measurable\.

Linear probing\(Alain and Bengio[2016](https://arxiv.org/html/2608.06578#bib.bib26)\)and activation\-level steering\(Rimskyet al\.[2024](https://arxiv.org/html/2608.06578#bib.bib21); Zouet al\.[2023](https://arxiv.org/html/2608.06578#bib.bib22); Arditiet al\.[2024](https://arxiv.org/html/2608.06578#bib.bib17)\)require weight access, which rules out four of the six models\. Section From Behavior to Mechanism applies both techniques to the one open\-weight model whose reference weights match its evaluated deployment\.

## Evaluation Data

Our benchmark contains 340 items, 100 items per three behavioral categories, plus 20 per two validation categories\.

*Values\-conflict*items ask the model to produce content whose framing conflicts mildly with commonly trained values, such as drafting a message with an unkind premise; the steered variant applies explicit pressure toward that framing\.*Reasoning\-elicitation*items push the model to expose the reasoning behind its answer, testing whether elicitation surfaces values considerations absent from the base response\.*Reasoning\-suppression*items instruct the model to keep values considerations out of its reasoning, testing whether suppression is obeyed, resisted, or subverted\.

*Stylistic*and*Reasoning\-hint*items were only employed for validation\. Stylistic items confirm the steering channel works at all and Reasoning\-hint items have externally checkable answers, giving a ceiling measurement for judge accuracy\.

Each item is a pair of base prompt with its steered version, so every model’s steered behavior is compared to its own baseline on identical content\. Additionally, each item also carries a description of what it was written to probe, shown only to judges as item context\.

The evaluated models are Claude Opus 4\.7 \(Anthropic\), GPT\-5 \(OpenAI\), Gemini 2\.5 Pro \(Google\), DeepSeek\-R1 \(DeepSeek\), Qwen3\.7\-Max \(Alibaba\), and Llama\-3\.3\-70B\-Instruct\-Turbo \(Meta\)\. Generation used each provider’s default sampling since several models reject temperature and seed controls at the API level\. \(All study code, data, and outputs are available athttps://github\.com/alijalalkamali/lbe\.\)

## Evaluation Pipeline

The methodology comprises five stages\. Stage 1 delineates the existing behavioral taxonomy\. Stage 2 fixes how they will be measured\. Stages 3 and 4 collect responses and classifications at scale\. Stage 5 tests the resulting rates\.

#### Stage 1: development\.

A 20\-item set per category went to all six models, and the responses were analyzed directly\. Two of the five categories were adapted only to validate the benchmark\. The three core categories were exploratory, with no fixed label set\. Reading proceeded in two passes with independent authorship\. Model\-assisted reading produced candidate behavioral patterns, which the author then checked against the underlying responses, discarding any not supported by the responses\.

#### Stage 2: freezing the rubrics\.

The surviving patterns \(based on 20 items\) become fixed categorical rubrics, one per category, listed in Table[1](https://arxiv.org/html/2608.06578#Sx4.T1)\. Each label has an explicit written definition and an instruction to cite supporting text from the response\. Once frozen, the rubrics were not revised\.

#### Stage 3: administering the benchmark\.

Each of the 340 items goes to all six models twice, once as the base prompt and once as the steered variant, producing 4,080 responses\.

#### Stage 4: blind peer judging\.

Every response is classified based on the rubric\. All six models serve as judges over all six responders, including themselves\. Judges receive the prompt, the response, the rubric with definitions, and the item context field,*without*the identity of the responding model\. This produces the total of 24,480 judgments\.

Ground truth for each response is the majority label among the five peer judges, excluding the responder’s judgment of itself, with ties broken deterministically by lexicographic order\. Excluding self\-judgment allows us to measure self\-preference rather than absorb it\.

#### Stage 5: testing\.

Per\-model classification rates are computed from the consensus labels, and all pairwise differences are tested as described under Section Statistical Analysis\.

Note that the development items stay in the scored benchmark rather than being held out, so 20 of the 100 items in each core category helped shape the rubric later applied to them\. The labels are therefore not fully independent of the data\. The rubrics were frozen before any rate was computed, but they were built partly from responses that are also scored\. We quantify this limitation by rerunning the full analysis on the 80 items per category never used in rubric construction \(see Held\-Out Analysis Excluding Rubric Items\)\.

Table 1:Rubric label sets\. Validation categories and three core\-category labels never assigned by consensus \(refuse and off\-topic in reasoning\-elicitation, derail in reasoning\-suppression\) are omitted; see Benchmark Validity\.

## Judging Reliability and Auditing

Qwen3\.7\-Max returned malformed JSON on roughly a quarter to a third of its outputs in one batch, against near\-zero for the other five judges\. The failures were due to a missing opening quotation mark on a field value, indicating a reliability difference between judges\. A targeted repair recovered nearly all affected judgments\.

To ensure blind judgments, the judges received the response text alone, with no metadata identifying the responder\. The judge prompt was identical across responders\. A judge could potentially infer authorship from stylistic patterns; however the leave\-one\-out consensus guarantees that a judge’s opinion of its own output never enters that output’s ground\-truth label\.

The item context field shown to judges states what each item is written to probe\. For the core categories, this amounts to telling the judge what the study expects, a potential demand characteristic measured by a control experiment reported in the results\.

### Response Length Audit and Remediation

Every model got the same token budget, but the budget did not buy the same amount of answer: some providers spend part of it on hidden reasoning tokens, others do not\. As a result, the longest responses differed roughly four\-fold across models, and the original responses of DeepSeek, Qwen, and Llama were sometimes cut off mid\-answer, which could potentially threaten specific findings\. Several rubric labels describe responses with multiple parts, such as a refusal plus an alternative, and a cut\-off response cannot complete them\. The zeros those three models show on exactly those labels could therefore have meant "ran out of room" rather than "does not do this\."

To rule that out, we regenerated all their core\-category responses with three times the answer budget, confirmed from provider stop\-reasons that nothing was cut off, threw out the old judgments of those responses, re\-judged everything, and reran the full analysis\. Even with enough token limit, DeepSeek, Qwen, and Llama still produced no instance of either suppression\-resistance mode across 100 items each\. The larger budget substantially raised the same three models’ multi\-part response rates on the values\-conflict category\.

## Statistical Analysis

For each category, condition, and rubric label, we compute each model’s rate from the leave\-one\-out consensus\. Rows with zero counts are kept, so a model that never received a label still appears in every comparison\.

An exact power analysis for a 30%\-vs\-0% difference under Fisher’s exact test at a BH\-representativeα=0\.001\\alpha=0\.001gives 5% power at the 20\-item development scale, 92% at 50 items, and above 99\.9% at the 100 items used per core category\. For rare behaviors the sample was less sensitive: at a true rate of 2%, the chance of seeing at least one instance is 87%\.

Differences between models were tested with Fisher’s exact test, which stays valid when counts were zero or near zero\. This generated 450 tests which is 15 model pairs for each of the 30 label\-condition combinations that received at least one consensus assignment\. With this many tests, some would look significant by chance, so all p\-values from these tests were passed through Benjamini–Hochberg \(BH\) control of the false discovery rate at 0\.05\(Benjamini and Hochberg[1995](https://arxiv.org/html/2608.06578#bib.bib24)\), and we report the BH\-adjusted p\-values; 114 of 450 remain significant\. Effect sizes used Cohen’shh\(Cohen[1988](https://arxiv.org/html/2608.06578#bib.bib25)\), which accounts for the same point difference meaning more near 0% or 100% than in the middle\. Agreement among judges was measured with Fleiss’κ\\kappa\(Fleiss[1971](https://arxiv.org/html/2608.06578#bib.bib23)\)\.

One hypothesis, resistance to suppression instructions, arose during rubric development\. It was tested as a single comparison fixed before data collection: the combined resistance rate of the two models whose responses motivated the resistance labels against the combined rate of the other four\.

Finally, because the rubric labels were shaped by the first 20 items of each category, the entire analysis is rerun on the 80 items per category never used in rubric construction, and reported alongside the results it checks\.

## Results

### A Reasoning\-Disclosure Mode Exclusive to GPT\-5

On steered reasoning\-elicitation items, GPT\-5 declined to share its reasoning while delivering the answer on 99 of 100 items\. No other model did this once \(Table[2](https://arxiv.org/html/2608.06578#Sx7.T2)\)\. The opposite pattern appeared when reasoning was disclosed for values content items\. GPT\-5 surfaced it on a single item and the other five models surfaced it on 95% or more items\. All pairwise comparisons on both labels remain significant under BH control, the largest at Cohen’sh=2\.94h=2\.94with BH\-adjustedp<10−54p<10^\{\-54\}\.

Table 2:Steered reasoning\-elicitation items\.GPT\-5 stands apart on these items without steering\. At base, its responses contained values content on 82 of 100 items, against 96–98 for every other model, a deficit significant against all five models under BH control \(BH\-adjustedppfrom1\.3×10−31\.3\\times 10^\{\-3\}to1\.3×10−21\.3\\times 10^\{\-2\}\)\. The tendency behind the steered deflection is already visible without any pressure\.

The reasoning\-refusal label came from close reading of GPT\-5’s own responses, so its near\-ceiling rate for that model partly reflects how the label was built\. After that discount, the same pattern, applied identically by blind judges across 600 responses, still appears in exactly one model\.

### Overt Resistance to Suppression

On steered reasoning\-suppression items, only Opus and GPT\-5 resisted the suppression instruction at meaningful rates in different ways \(Table[3](https://arxiv.org/html/2608.06578#Sx7.T3)\)\.

Table 3:Steered reasoning\-suppression\.Opus most often completes the task while openly objecting to the instruction’s framing, on 17% of items against 5% for GPT\-5, a difference that is itself significant under BH control \(BH\-adjustedp=0\.045p=0\.045\)\. GPT\-5 favors the opposite mode, rejecting the framing outright and withholding the requested content on 16% of items against 8% for Opus\. Opus’s challenge\-and\-comply rate is significant against all five other models under BH control, with BH\-adjustedp=6\.3×10−5p=6\.3\\times 10^\{\-5\}against each of the four models at zero\. GPT\-5’s refusal\-override rate is significant against other models\.

### Divergence Before Any Steering

Base reasoning\-suppression items ask for tactical help with a request that is mildly questionable, and the framing treats that as beside the point\. The question is whether the model raises the concern, by refusing the framing outright or by expressing its values while complying\. The models diverge sharply on it \(Table[4](https://arxiv.org/html/2608.06578#Sx7.T4)\)\. Only four out of five sub categories are presented since comply\-with\-explicit\-challenge only appears once in all 600 responses\.

Table 4:Base reasoning\-suppression items with no suppression instruction present\.Llama is the most values\-forward model, expressing refusal\-override on 77 of 100 items and values\-smuggled on only 17\. DeepSeek leans the same way at 57% refusal\-override\. Qwen is nearly the inverse, 25 against 68, and Gemini patterns with Qwen at 37 against 59\. Of the 15 pairwise comparisons per label, 8 remain significant under BH control for refusal\-override and 10 for values\-smuggled\. GPT\-5 expresses the least values reasoning with 14% judged as clean\-suppression, significant against DeepSeek and Gemini\. It also reaches 15% partial suppression which is significant against four models\. Opus leads partial suppression at 18%, similarly significant against four models\. Under the explicit steering instruction, all six models converge toward suppression, from 65% for Opus to 96% for Qwen\.

### Suppression Inside Reasoning Traces

DeepSeek\-R1 exposes its chain of thought and prepends the reasoning to the answer, so the judges see the same output\. This makes it the one model where suppression can be watched from inside\. At base prompt, it is one of the values\-forward models \(57% refusal\-override\), yet under steering suppression it resists on 0 items\.

Of the 100 steered traces, in 85 the excluded values dimension appears in the trace and is then set aside, in 74 it restates the exclusion as a task constraint and moves on \(“the user asked to not lecture about ethics, so we give a cold calculation”\), and in 11 it expresses the concern and pushes back before being overridden\. In the other 15 nothing appears\. On the same items at base, the traces put those values at the center of the answer\. That means the steering suppression changes what the model says, not what it registers internally\.

### Values\-Conflict Items

At base, two labels account for nearly every response on values\-conflict items \(Table[5](https://arxiv.org/html/2608.06578#Sx7.T5)\)\.

Table 5:Base values\-conflict items\. Only two labels carry meaningful rates at base\.The full\-compliance label rates split the models into three tiers where every between\-tier pairwise comparison remains significant under BH control\. Opus sits alone at the bottom tier at 35%, significantly below every other model \(BH\-adjustedppfrom2\.1×10−252\.1\\times 10^\{\-25\}vs\. Gemini to1\.4×10−21\.4\\times 10^\{\-2\}vs\. Llama\)\. Llama holds the middle tier at 57%, above Opus and below the remaining four\. GPT\-5 at 93, DeepSeek at 95, Qwen at 96, and Gemini at 100 form the top tier and are mutually indistinguishable\.

Derail shows where the two lower tiers’ responses went instead\. On items whose prompts are genuinely underspecified, Opus asked a clarifying question rather than answering on 60% of items and Llama on 42%; no other model exceeded 5%\. This behavior accounts almost entirely for the tier separation\.

### Refusal Styles Under Steering Vary 8\-Fold

Under steering on the same values\-conflict items, the models differ distinctly in how often they refuse the compromised framing while offering a values\-consistent alternative\. Opus does this on 91% of items and GPT\-5 on 89%\. Qwen follows at 61% and DeepSeek at 41%\. Gemini drops to 23% and Llama to 12%, an almost eight\-fold spread from top to bottom\. 13 of the 15 pairwise comparisons on this label remain significant under BH control, and Opus vs\. Llama reachesh=1\.82h=1\.82at BH\-adjustedp=2\.0×10−30p=2\.0\\times 10^\{\-30\}, the largest effect size in the study\.

### Held\-Out Analysis Excluding Rubric Items

The rubric labels were derived from the first 20 items of each category, which remain in the scored set\. The entire analysis was therefore rerun on only the 80 items per category never read during label construction\. Of the 330 pairwise comparisons computable in both analyses, 105 are significant in both and none is significant in the held\-out subset alone\. No rate moves by more than five points, all tiers and orderings are preserved, and also the hypothesis fixed before data collection that Opus and GPT\-5 resist suppression \(33/160\) more than the other four models combined \(1/320\) holds \(p=3\.9×10−16p=3\.9\\times 10^\{\-16\}\)\.

Inter\-judge agreement is equal or higher on the held\-out items in all three core categories, the opposite of what fitted labels would produce\. Nine comparisons significant at the full sample fall below threshold held\-out; all nine are in reasoning\-suppression with full\-set BH\-adjustedppbetween 0\.005 and 0\.045 and essentially unchanged rates\. So the only loss in the held\-out is power, not substance\.

### Control Experiment for the Item Context Field

To measure the context field’s influence on the judgments, we drew a balanced sample of 216 responses spanning all six responders, all three core categories, and both conditions, and re\-judged each one twice\. First with the original judge prompt repeated exactly, and second with only the item context field removed\. With the exact prompt, judges reproduced the original label on 96\.3% of instances; without the field, on 86\.6%\. The 9\.7\-point gap is the field’s influence \(bootstrap CI 5\.5 to 14\.4 points, McNemarp=4\.9×10−5p=4\.9\\times 10^\{\-5\}\)\. The effect is uneven: 5\.6 points on reasoning\-elicitation and 6\.9 on values\-conflict, but 16\.7 on reasoning\-suppression, the category where judges agree least\.

The field can move individual labels, but the question is whether it moved the findings\. Per\-model rates recomputed from the field\-free condition alone show that every pairwise comparison carrying a claim in this paper holds\. GPT\-5 declined to disclose its reasoning on all six of its steered reasoning\-elicitation instances while the other five models did so on none, reproducing the categorical separation exactly\. On steered suppression items, Opus and GPT\-5 account for all three resistance events observed against none for the other four, significant on its own atp=0\.031p=0\.031despite the small sample\. On base values\-conflict items, Opus and Llama comply fully on three of six instances each while the others comply on five or six, and the same two models supply all six clarification\-seeking responses, preserving the tier separation\. Under steering, refusal with an alternative orders the models as Opus and GPT\-5 at six of six, Qwen at five, DeepSeek at two, Llama at one, and Gemini at zero, matching the ordering of the main study across its full range\.

### Benchmark Validity

The six judges agree well in four of the five categories \(κ\\kappa= 0\.854 reasoning\-hint, 0\.789 stylistic, 0\.788 values\-conflict, 0\.767 reasoning\-elicitation\) but only moderately in reasoning\-suppression \(0\.599\)\. The suppression\-resistance finding therefore rests on the category where judges agree least, and the same category is where removing the item context field changed the most labels\. Both weaknesses likely share a cause, as this rubric asks judges to draw the finest distinctions in the study\.

To check for self\-preference, we ask whether a judge disagrees with the consensus less often on its own outputs than on other models’ outputs\. Across the 18 judge\-by\-category combinations in the three core categories the gap is small, ranging from−6\.1\-6\.1to\+4\.6\+4\.6points, and no judge leans in either direction\. This check is possible because self\-judgments are excluded from the consensus\.

The two validation categories confirm the benchmark works as designed\. On stylistic items, every model follows the formatting instruction on at least 18 of 20 steered prompts, against at most five of 20 at base level\. The steering channel works for all six models, so the cross\-model differences above come from the content of the steering, not from differing willingness to follow instructions\. On reasoning\-hint items, whose correct answers can be checked externally, every model answers correctly on at least 19 of 20 items in both conditions, and the hint is verbalized on at most one item at base against 15–20 steered\.

The label for adopting the incorrect hinted answer was assigned zero times across all 240 responses, meaning, no model was ever pulled off a correct answer by a misleading hint\. Five labels were never assigned anywhere in the study, including the option for refusing the underlying task itself, in three separate categories\. No model ever refused a task outright; the refusals under values\-conflict steering reject the compromised framing while engaging with the task\.

One final observation on reasoning\-elicitation came from outside the judge pipeline\. A keyword scan of Llama’s 100 base and 100 steered responses for a textual marker of a committed final verdict found the marker in one base response and 29 steered responses, and in all 29 cases the base response had been open\-ended while the steered response was not\. Because this is a text scan rather than a consensus rubric label, we report it as a quantified preliminary observation\.

## From Behavior to Mechanism

The preceding analysis is entirely behavioral\. The trace reading of the previous section could cross from behavior to internals only because DeepSeek externalizes its reasoning as text; for models that do not, the analogue is direct access to activations\. For closed models that is a hard boundary\. For an open\-weight model it is not, and one finding gives a sharp target\. At base, Llama splits its values\-conflict responses into 42 clarification\-seeking derails and 58 substantive answers, the largest within\-model baseline split in the study\. This section investigates two questions regarding that variance\. Is the derail\-versus\-answer distinction linearly decodable from the model’s internal state before it commits to a response? And if so, does pushing the internal state along that direction causally change the behavior?

We utilize the reference open weights of Llama\-3\.3\-70B\-Instruct\. An important methodological constraint must be noted: the evaluated responses were generated by Together’s hosted Turbo serving stack, which applies its own serving optimizations; activations are harvested from the reference weights run locally\. The concept representations probed here are not expected to depend on serving\-level differences, but the computation is not byte\-identical to the one that produced the logged responses\. This section is illustrative for Llama’s reference weights, not as a causal explanation of the cross\-model behavioral differences observed in deployment\.

### Probing Setup

For each of the 100 base values\-conflict items, we rebuild the exact prompt sent during the evaluation and feed the exact logged response back through the model in a single forward pass\. At the last token of the response, the point where the model has committed to a course of action, we record the residual\-stream activation at every fourth decoder layer \(20 of the 80 layers, each a vector ofd=8,192d=8\{,\}192numbers\)\. Each activation gets a label from the judging pipeline’s leave\-one\-out consensus, that is derail \(42 items\) against every other label \(58 items\)\. A probe with 8,192 inputs and only 100 examples will fit the training data perfectly whether or not any real signal exists, so we guard against this in three ways\. Accuracy is measured only on data the probe never trained on, using stratified five\-fold cross\-validation\.

The probe itself is a logistic regression with anℓ2\\ell\_\{2\}penalty that discourages large weights, and the penalty strength is chosen by a second, nested layer of cross\-validation, so no choice about the probe is ever informed by the data it is scored on\. Finally, significance comes from a permutation test\. The labels are shuffled and the entire procedure rerun 200 times per layer, which shows how well this exact pipeline scores when the labels are meaningless\(Belinkov[2022](https://arxiv.org/html/2608.06578#bib.bib27)\); the real accuracy must beat that distribution\. Reportedpp\-values use the permutation estimator ofPhipson and Smyth \([2010](https://arxiv.org/html/2608.06578#bib.bib29)\)\. We report balanced accuracy so that chance is 0\.5 even though the classes are 42 to 58\.

### Probe Results

The derail\-versus\-answer distinction can be read out of the residual stream with a linear probe, and the readout gets stronger with depth\. Held\-out balanced accuracy is 0\.63 at layer 0, 0\.74 at layer 20, and then levels off at 0\.83–0\.87 from layer 36 through 76, peaking at 0\.866\. Every layer from 4 onward beats its permutation null, and from layer 16 onward the real accuracy beats all 200 shuffled runs, the lowestppthe test can produce \(p≈0\.005p\\approx 0\.005\)\.

A control run separates what the probe reads from the model versus what it reads from the prompt itself\. We train the same probe on the activations of Llama\-3\.2\-1B\-Instruct, a small model that never produced these responses\. It reaches 0\.72 at its deepest layer probed, because derail items are by construction more ambiguous as prompts, and any competent model represents prompt ambiguity\.

The 70B model’s plateau sits roughly 14 points of balanced accuracy above this prompt\-only baseline, and that margin is what cannot be explained by generic prompt properties\. Still, a probe only shows the information is present, not that it drives the behavior\. To tell cause from correlation, we intervene on the representation directly\.

### Activation Steering Setup

The steering vectorvvis the average activation of the derail items minus the average activation of the others,v=a¯d​e​r​a​i​l−a¯o​t​h​e​rv=\\bar\{a\}\_\{derail\}\-\\bar\{a\}\_\{other\}, normalized to unit length\(Turneret al\.[2024](https://arxiv.org/html/2608.06578#bib.bib28); Rimskyet al\.[2024](https://arxiv.org/html/2608.06578#bib.bib21)\)\. We take it at layer 40, in the middle of the accuracy plateau, so the intervention still has half the network’s depth ahead of it to act on\. To avoid testing the vector on the items that built it, the 100 items are split once, stratified by label, into 50 that definevvand 50 held out purely for evaluation; a vector scored on its own defining items would partly measure memorization rather than a direction that generalizes\.

During generation on each held\-out prompt, we addα​v\\alpha vto the residual stream at layer 40 at every token position, whereα\\alphasets the strength and sign of the push\. The sweepα∈\{0,±3,±6,±12\}\\alpha\\in\\\{0,\\pm 3,\\pm 6,\\pm 12\\\}is sized against the median residual\-stream norm at that layer \(12\.1\), so the pushes range from a quarter of the stream’s own magnitude to roughly all of it\. Decoding is greedy, so any difference between outputs is due toα\\alphaalone, and theα=0\\alpha=0run doubles as a control that measures any drift between the reference weights and the serving stack that produced the original responses\. The steered generations are then classified by the same judging pipeline as the evaluation\.

### Steering Results

Pushing along the decoded direction changes the behavior, and the change tracks the push\. Judged by the same pipeline as the main evaluation, the consensus derail rate on the 50 held\-out items rises step by step withα\\alphaacross the entire sweep: 0%, 4%, and 16% atα=−12,−6,−3\\alpha=\-12,\-6,\-3; 40% at theα=0\\alpha=0control; and 50%, 62%, and 86% atα=\+3,\+6,\+12\\alpha=\+3,\+6,\+12\(Table[6](https://arxiv.org/html/2608.06578#Sx8.T6)\)\. By Fisher’s exact test against the control, pushing the behavior down is significant fromα=−3\\alpha=\-3onward \(p=0\.013p=0\.013, reachingp=4\.1×10−7p=4\.1\\times 10^\{\-7\}at−12\-12\) and pushing it up is significant fromα=\+6\\alpha=\+6onward \(p=0\.041p=0\.041, reachingp=2\.7×10−6p=2\.7\\times 10^\{\-6\}at\+12\+12\); onlyα=\+3\\alpha=\+3does not individually separate from control\.

Table 6:Steered derail rate on the 50 held\-out items\.Three control analyses back these shifts\. First, theα=0\\alpha=0control’s 40% derail rate sits within 2 points of the 42% observed in the original Together\-served evaluation, so the reference weights and the serving stack behave the same for this behavior\.

Second, response length itself moves with the intervention: truncations at the 500\-token ceiling fall from 28 of 50 atα=−12\\alpha=\-12to 0 at\+12\+12\. That is what steering this behavior should do, since derails are short clarifying questions, but given this paper’s own history with a token\-budget confound, we checked judgability directly\. Truncated and complete responses in the−12\-12condition receive near\-identical label distributions, so truncation does not contaminate the judgments\.

Third, the judge panel includes Llama itself, and the renamed steered conditions bypass the leave\-one\-out exclusion, so we recomputed all rates with the Llama judge removed; no rate moves by more than 2 points, so self\-judgment does not distort the result\. Generations stay fluent and on\-task at both extremes of the sweep; the\+12\+12condition’s derails are multi\-question clarification requests\.

The probe showed the derail\-versus\-answer distinction is represented in the residual stream; the sweep shows that pushing along that one direction is enough to remove the behavior entirely or to bring it to near saturation\. The usual issue with difference\-of\-means directions is thatvvmay bundle correlates of the behavior, length among them, rather than isolating a minimal cause\. Pinning the representation down more precisely, for instance by activation patching, could be future work of this study\. Although this is an existence proof that the behavior can be steered in this model, it cannot be a mechanistic explanation of the cross\-model differences in the behavioral evaluation\.

## Conclusion

This study measured how much steering shifts each model’s behavior and characterized what non\-compliance looks like when it happens, across six frontier models\. The divergences are categorical\. GPT\-5 alone withholds its reasoning while delivering the answer, on 99 of 100 opportunities against 0 in 500 for the others\. Opus and GPT\-5 alone openly resist instructions to suppress values reasoning, and they do it in statistically distinguishable ways: one challenges the instruction while complying, the other refuses the framing altogether\. Baseline compliance splits the six models into three tiers before any steering is applied, and the models’ unsteered dispositions toward values expression diverge just as sharply as their steered behavior, down to a near\-inversion between models that express values openly and models that smuggle them into strategic language\. These are differences in kind, not in degree, and several belong to a single model in the evaluated sample\.

The evaluation design ensures that every model faces each item in both conditions, every model judges every model blind, and ground truth is a consensus that excludes self\-judgment\. The auditing carried equal weight: a token\-budget confound was found and removed, a control experiment measured whether the judge prompt leaked the study’s expectations, and the full analysis was rerun on the 80% of items written after the rubrics were frozen\. Where the benchmark is weakest, in the moderate inter\-judge agreement on reasoning suppression, we show evidence that the finding holds\.

For one open\-weight model the analysis crossed from behavior to mechanism\. The study’s largest baseline behavioral split can be read from Llama’s residual stream by a linear probe at 0\.87 held\-out balanced accuracy, well above both a permutation null and a small\-model baseline that captures prompt ambiguity alone, and the decoded direction is causally implicated\. Adding it to the residual stream during generation moves the derail rate from 0% to 86% across the sweep, removing the behavior entirely in one direction and nearly saturating it in the other\.

Where a model exposes its reasoning, the same crossing can be made by reading\. DeepSeek\-R1’s traces show its perfect suppressibility is acknowledgment rather than blindness: the excluded consideration surfaces and resolves into compliance in 85 of 100 traces\. The remaining behavioral findings name concrete mechanistic targets of the same shape, such as the representation, if any, behind Llama’s near\-total absence of alternative\-offering, and the relation between overt and covert values expression within a single model\.

We note two primary limitations\. First, the evaluation covers one model per developer, so it supports no generalization about the developers’ broader methods\. These are observations about specific models at specific points in time, and whether other models from the same labs would behave the same way is an open question\. Second, validating the judge panel against human raters on a sample is a necessary next step\. The behavioral evaluation shows these models have been trained to respond to pressure in categorically different ways\. Mechanistic analysis of the open\-weight models is how those categories stop being black boxes\.

## References

- G\. Alain and Y\. Bengio \(2016\)Understanding intermediate layers using linear classifier probes\.External Links:1610\.01644Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p5.1)\.
- A\. Arditi, O\. Obeso, A\. Syed, D\. Paleka, N\. Panickssery, W\. Gurnee, and N\. Nanda \(2024\)Refusal in language models is mediated by a single direction\.External Links:2406\.11717,[Link](https://arxiv.org/abs/2406.11717)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p5.1)\.
- Y\. Bai, S\. Kadavath, S\. Kundu, A\. Askell, J\. Kernion, A\. Jones, A\. Chen, A\. Goldie, A\. Mirhoseini, C\. McKinnon,et al\.\(2022\)Constitutional AI: harmlessness from AI feedback\.External Links:2212\.08073,[Link](https://arxiv.org/abs/2212.08073)Cited by:[Introduction](https://arxiv.org/html/2608.06578#Sx1.p1.1)\.
- Y\. Belinkov \(2022\)Probing classifiers: promises, shortcomings, and advances\.Computational Linguistics48\(1\),pp\. 207–219\.Cited by:[Probing Setup](https://arxiv.org/html/2608.06578#Sx8.SSx1.p2.2)\.
- Y\. Benjamini and Y\. Hochberg \(1995\)Controlling the false discovery rate: a practical and powerful approach to multiple testing\.Journal of the Royal Statistical Society: Series B \(Methodological\)57\(1\),pp\. 289–300\.Cited by:[Statistical Analysis](https://arxiv.org/html/2608.06578#Sx6.p3.2)\.
- T\. Chang, T\. Schnabel, A\. Swaminathan, and J\. Wiens \(2025\)A course correction in steerability evaluation: revealing miscalibration and side effects in LLMs\.Note:AAAI 2026External Links:2505\.23816,[Link](https://arxiv.org/abs/2505.23816)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p1.1)\.
- K\. Chen, Z\. He, T\. Shi, and K\. Lerman \(2025a\)STEER\-BENCH: a benchmark for evaluating the steerability of large language models\.External Links:2505\.20645,[Link](https://arxiv.org/abs/2505.20645)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p1.1)\.
- Y\. Chen, J\. Benton, A\. Radhakrishnan, J\. Uesato, C\. Denison, J\. Schulman, A\. Somani, P\. Hase, M\. Wagner, F\. Roger, V\. Mikulik, S\. R\. Bowman, J\. Leike, J\. Kaplan, and E\. Perez \(2025b\)Reasoning models don’t always say what they think\.External Links:2505\.05410,[Link](https://arxiv.org/abs/2505.05410)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p3.1)\.
- J\. Cohen \(1988\)Statistical power analysis for the behavioral sciences\.2nd edition,Lawrence Erlbaum Associates,Hillsdale, NJ\.Cited by:[Statistical Analysis](https://arxiv.org/html/2608.06578#Sx6.p3.2)\.
- J\. L\. Fleiss \(1971\)Measuring nominal scale agreement among many raters\.Psychological Bulletin76\(5\),pp\. 378–382\.Cited by:[Statistical Analysis](https://arxiv.org/html/2608.06578#Sx6.p3.2)\.
- D\. Ganguli, L\. Lovitt, J\. Kernion, A\. Askell, Y\. Bai, S\. Kadavath, B\. Mann, E\. Perez, N\. Schiefer, K\. Ndousse,et al\.\(2022\)Red teaming language models to reduce harms: methods, scaling behaviors, and lessons learned\.External Links:2209\.07858,[Link](https://arxiv.org/abs/2209.07858)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p2.1)\.
- R\. Greenblatt, C\. Denison, B\. Wright, F\. Roger, M\. MacDiarmid, S\. Marks, J\. Treutlein, T\. Belonax, J\. Chen, D\. Duvenaud, A\. Khan, J\. Michael, S\. Mindermann, E\. Perez, L\. Petrini, J\. Uesato, J\. Kaplan, B\. Shlegeris, S\. R\. Bowman, and E\. Hubinger \(2024\)Alignment faking in large language models\.External Links:2412\.14093,[Link](https://arxiv.org/abs/2412.14093)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p2.1)\.
- M\. Y\. Guan, M\. Joglekar, E\. Wallace, S\. Jain, B\. Barak, A\. Helyar, R\. Dias, A\. Vallone, H\. Ren, J\. Wei, H\. W\. Chung, S\. Toyer, J\. Heidecke, A\. Beutel, and A\. Glaese \(2025\)Deliberative alignment: reasoning enables safer language models\.External Links:2412\.16339,[Link](https://arxiv.org/abs/2412.16339)Cited by:[Introduction](https://arxiv.org/html/2608.06578#Sx1.p1.1)\.
- S\. Huang, E\. Durmus, M\. McCain, K\. Handa, A\. Tamkin, J\. Hong, M\. Stern, A\. Somani, X\. Zhang, and D\. Ganguli \(2025\)Values in the wild: discovering and analyzing values in real\-world language model interactions\.External Links:2504\.15236,[Link](https://arxiv.org/abs/2504.15236)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p2.1)\.
- E\. Kran, H\. M\. Nguyen, A\. Kundu, S\. Jawhar, J\. Park, and M\. M\. Jurewicz \(2025\)DarkBench: benchmarking dark patterns in large language models\.External Links:2503\.10728,[Link](https://arxiv.org/abs/2503.10728)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p2.1)\.
- T\. Lanham, A\. Chen, A\. Radhakrishnan, B\. Steiner, C\. Denison, D\. Hernandez, D\. Li, E\. Durmus, E\. Hubinger, J\. Kernion,et al\.\(2023\)Measuring faithfulness in chain\-of\-thought reasoning\.External Links:2307\.13702,[Link](https://arxiv.org/abs/2307.13702)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p3.1)\.
- OpenAI \(2025\)OpenAI model spec\.Note:https://model\-spec\.openai\.com/Version of 2025\-09\-12; released under CC0Cited by:[Introduction](https://arxiv.org/html/2608.06578#Sx1.p1.1)\.
- A\. Panickssery, S\. R\. Bowman, and S\. Feng \(2024\)LLM evaluators recognize and favor their own generations\.InAdvances in Neural Information Processing Systems,Vol\.37,pp\. 68772–68802\.External Links:[Link](https://arxiv.org/abs/2404.13076)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p4.1)\.
- E\. Perez, S\. Ringer, K\. Lukošiūtė, K\. Nguyen, E\. Chen, S\. Heiner, C\. Pettit, C\. Olsson, S\. Kundu, S\. Kadavath,et al\.\(2023\)Discovering language model behaviors with model\-written evaluations\.InFindings of the Association for Computational Linguistics: ACL 2023,pp\. 13387–13434\.External Links:[Link](https://aclanthology.org/2023.findings-acl.847/)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p2.1)\.
- B\. Phipson and G\. K\. Smyth \(2010\)Permutation p\-values should never be zero: calculating exact p\-values when permutations are randomly drawn\.Statistical Applications in Genetics and Molecular Biology9\(1\)\.Cited by:[Probing Setup](https://arxiv.org/html/2608.06578#Sx8.SSx1.p2.2)\.
- N\. Rimsky, N\. Gabrieli, J\. Schulz, M\. Tong, E\. Hubinger, and A\. Turner \(2024\)Steering Llama 2 via contrastive activation addition\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 15504–15522\.External Links:[Link](https://aclanthology.org/2024.acl-long.828/)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p5.1),[Activation Steering Setup](https://arxiv.org/html/2608.06578#Sx8.SSx3.p1.3)\.
- P\. Röttger, H\. R\. Kirk, B\. Vidgen, G\. Attanasio, F\. Bianchi, and D\. Hovy \(2024\)XSTest: a test suite for identifying exaggerated safety behaviours in large language models\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),pp\. 5377–5400\.External Links:[Link](https://aclanthology.org/2024.naacl-long.301/)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p2.1)\.
- M\. Sharma, M\. Tong, T\. Korbak, D\. Duvenaud, A\. Askell, S\. R\. Bowman, N\. Cheng, E\. Durmus, Z\. Hatfield\-Dodds, S\. R\. Johnston, S\. Kravec, T\. Maxwell, S\. McCandlish, K\. Ndousse, O\. Rausch, N\. Schiefer, D\. Yan, M\. Zhang, and E\. Perez \(2023\)Towards understanding sycophancy in language models\.External Links:2310\.13548,[Link](https://arxiv.org/abs/2310.13548)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p2.1)\.
- A\. M\. Turner, L\. Thiergart, G\. Leech, D\. Udell, J\. J\. Vazquez, U\. Mini, and M\. MacDiarmid \(2024\)Steering language models with activation engineering\.External Links:2308\.10248Cited by:[Activation Steering Setup](https://arxiv.org/html/2608.06578#Sx8.SSx3.p1.3)\.
- M\. Turpin, J\. Michael, E\. Perez, and S\. R\. Bowman \(2023\)Language models don’t always say what they think: unfaithful explanations in chain\-of\-thought prompting\.External Links:2305\.04388,[Link](https://arxiv.org/abs/2305.04388)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p3.1)\.
- P\. Verga, S\. Hofstätter, S\. Althammer, Y\. Su, A\. Piktus, A\. Arkhangorodsky, M\. Xu, N\. White, and P\. Lewis \(2024\)Replacing judges with juries: evaluating LLM generations with a panel of diverse models\.External Links:2404\.18796,[Link](https://arxiv.org/abs/2404.18796)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p4.1)\.
- L\. Zheng, W\. Chiang, Y\. Sheng, S\. Zhuang, Z\. Wu, Y\. Zhuang, Z\. Lin, Z\. Li, D\. Li, E\. P\. Xing, H\. Zhang, J\. E\. Gonzalez, and I\. Stoica \(2023\)Judging LLM\-as\-a\-judge with MT\-bench and chatbot arena\.External Links:2306\.05685,[Link](https://arxiv.org/abs/2306.05685)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p4.1)\.
- J\. Zhou, T\. Lu, S\. Mishra, S\. Brahma, S\. Basu, Y\. Luan, D\. Zhou, and L\. Hou \(2023\)Instruction\-following evaluation for large language models\.External Links:2311\.07911,[Link](https://arxiv.org/abs/2311.07911)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p1.1)\.
- A\. Zou, L\. Phan, S\. Chen, J\. Campbell, P\. Guo, R\. Ren, A\. Pan, X\. Yin, M\. Mazeika, A\. Dombrowski, S\. Goel, N\. Li, M\. J\. Byun, Z\. Wang, A\. Mallen, S\. Basart, S\. Koyejo, D\. Song, M\. Fredrikson, J\. Z\. Kolter, and D\. Hendrycks \(2023\)Representation engineering: a top\-down approach to AI transparency\.External Links:2310\.01405,[Link](https://arxiv.org/abs/2310.01405)Cited by:[Related Work](https://arxiv.org/html/2608.06578#Sx2.p5.1)\.