Controlling Tool Use with Heading-Specific Activation Steering

# Controlling Tool Use with Heading-Specific Activation Steering
Source: [https://arxiv.org/html/2607.05790](https://arxiv.org/html/2607.05790)
###### Abstract

Tool\-augmented large language models extend their capabilities beyond parametric knowledge through external tools, but tend to invoke them unnecessarily\. We investigate whether tool\-use decisions have any stable internal representation that can be extracted and manipulated, a question that is non\-trivial given that tools exist entirely in context at inference time and have no direct encoding in model weights\. We show that steering vectors extracted from heading\-anchors positions exert bidirectional causal control over tool\-invocation behavior across five open\-source models and three domains, suppressing unnecessary tool use most effectively in domains where parametric reasoning suffices\. However, geometric analysis reveals that this causal effectiveness does not correspond to clean linear structure: tool\-invocation steps exhibit diffuse, bimodal alignment with the suppression vector rather than the consistent negative alignment a linear encoding account would predict, and different tool types recruit largely distinct internal signatures with low cross\-tool feature overlap\. We hypothesize these geometric properties are indicative of the non\-parametric nature of tools, and distinguish tool\-use steering vectors from those extracted for parametrically grounded concepts\. The relationship between this geometric irregularity and the observed causal effectiveness remains an open question\.

Activation Steering, Tool Use, Large Language Models, Representation Engineering, ICML

## 1Introduction

Tool\-augmented LLMs have become a dominant paradigm for complex reasoning and real\-world tasks\(Yaoet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib189); Levyet al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib218); Schicket al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib187)\)\. External tools such as web search, code execution, and user\-interaction modules extend model capabilities beyond parametric knowledge, improving performance on tasks requiring up\-to\-date information, precise computation, or clarification of underspecified intent\(Schicket al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib187); Schneider,[2025](https://arxiv.org/html/2607.05790#bib.bib192)\)\.

However, tool augmentation also introduces a persistent failure mode:*tool overuse*\. Models may invoke tools even when internal reasoning would suffice, repeat calls without meaningful progress, or rely on tools in ways that increase latency and cost while providing limited benefit\(Qianet al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib509); Shenet al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib511)\)\. Unnecessary tool calls can expose the system to noisy retrieval, execution failures, and avoidable error propagation\(Wanget al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib513)\)\. Existing mitigations either require expensive retraining\(Qianet al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib509); Shenet al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib511)\)or operate at the output interface rather than on the internal activations underlying tool selection\(Wanget al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib513)\), leaving the latent decision to invoke a tool unaddressed\.

We ask whether tool\-use decisions have any stable internal representation that can be extracted and manipulated\. This is non\-obvious: unlike concepts such as sentiment or factuality that are encoded in model weights through training, tools exist entirely in context at inference time, and standard assumptions from the linear representation hypothesis\(Parket al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib64)\)and representation engineering\(Zouet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib66)\)do not straightforwardly apply to concepts with no parametric grounding\. Prior steering work has targeted concepts with clear parametric grounding \(sentiment, refusal, truthfulness\)\(Panicksseryet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib106); Siuet al\.,[2025a](https://arxiv.org/html/2607.05790#bib.bib512)\); we are among the first to apply it to a behavior that is explicitly non\-parametric by construction\. Following contrastive activation addition\(Turneret al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib103); Panicksseryet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib106)\), we extract hidden states at structured tool\-heading positions in reasoning trajectories to build tool\-specific steering vectors, and evaluate their causal and geometric properties across five open\-source instruction\-tuned models and three domains\.

![Refer to caption](https://arxiv.org/html/2607.05790v1/figures/model_type_bar_chart.png)Figure 1:Average tool calls per query across five models under three conditions\. Base Model Tool Prompt is the prompt\-only baseline without hidden\-state intervention\. Activation Addition subtracts the steering vector from the residual stream, suppressing tool use below the baseline\. Orthogonalization projects hidden states to be orthogonal to the steering vector, removing the suppressive component and amplifying tool use above the baseline\. The opposing directions of the two interventions confirm that the extracted vector encodes a causally effective, bidirectional tool\-use direction in the residual stream\.Applying these vectors via activation addition suppresses tool use substantially below baseline, while orthogonalizing hidden states with respect to them amplifies tool use above it\. This bidirectional behavioral control, shown in Figure[1](https://arxiv.org/html/2607.05790#S1.F1), confirms that the extracted vectors are causally relevant to tool\-use decisions despite the absence of any stable parametric encoding of tools in model weights\. Suppression is most effective in domains where parametric reasoning suffices, and degrades where external retrieval or user clarification is genuinely required, with larger models showing greater resistance across all domains\.

However, geometric analysis reveals that causal effectiveness does not correspond to clean linear structure\. Tool\-invocation steps exhibit a diffuse bimodal cosine similarity distribution with respect to the suppression vector rather than the consistent negative alignment a linear encoding account would predict, and different tool types recruit largely distinct internal feature dimensions with low cross\-tool overlap\. These properties are consistent with the non\-parametric nature of tools and distinguish tool\-use steering vectors from those extracted for parametrically grounded concepts\. The relationship between this geometric irregularity and the observed causal effectiveness remains an open question, and we discuss it in the context of the multi\-turn dependency structure of tool\-augmented trajectories that limits direct reconciliation with the probing analysis\.

## 2Related Work

#### Representation Theory\.

The linear representation hypothesis\(Parket al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib64)\)predicts that concepts encoded in model weights should be linearly decodable from activations, with supporting evidence from word vector arithmetic\(Mikolovet al\.,[2013](https://arxiv.org/html/2607.05790#bib.bib112)\)and superposition theory\(Elhageet al\.,[2022](https://arxiv.org/html/2607.05790#bib.bib127)\)\. Empirical work on refusal\(Arditiet al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib65)\)and truthfulness\(Burnset al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib145)\)has found steering vectors with clean geometric properties consistent with this account\. More recent work has complicated the picture: concept directions can span multi\-dimensional subspaces rather than single directions\(Wollschlägeret al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib162); Siuet al\.,[2025c](https://arxiv.org/html/2607.05790#bib.bib86)\), and their geometry can exhibit complex dependencies on context and layer depth\. Our work extends this line of inquiry to a setting where linear representability is not expected to hold by construction: because tools are injected through context rather than encoded in weights, the geometric irregularity we observe is a predicted consequence of the non\-parametric nature of tools rather than an anomaly, and it distinguishes tool\-use steering vectors from those studied in prior representation theory work\.

#### Activation Steering\.

Steering methods identify directions in activation space corresponding to target behaviors and modulate them via vector addition or orthogonalization\(Zouet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib66); Arditiet al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib65); Turneret al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib103); Panicksseryet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib106); Siuet al\.,[2025a](https://arxiv.org/html/2607.05790#bib.bib512)\)\. Directions are commonly extracted from contrastive data pairs\(Burnset al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib145); Arditiet al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib65); Zouet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib66)\)and have been used for both behavior elicitation and concept removal\(Ravfogelet al\.,[2020](https://arxiv.org/html/2607.05790#bib.bib142); Siuet al\.,[2025b](https://arxiv.org/html/2607.05790#bib.bib87)\)\. Inference\-time steering uses probes or classifiers\(Liet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib51); Leeet al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib113)\)to conditionally apply interventions during forward passes\. Prior steering work has largely assumed that the concept being steered has stable parametric grounding; our work applies these methods to a concept that explicitly lacks it, and examines the consequences for both causal effectiveness and geometric structure\.

LLM Tool Use\.Tool\-use methods extend language models with external functions, APIs, and environments, enabling access to up\-to\-date information, specialized computation, and domain\-specific expertise beyond parametric memory\(Schicket al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib187); Yaoet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib189); Qinet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib10); Quet al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib9); Shen,[2024](https://arxiv.org/html/2607.05790#bib.bib8)\)\. Prior work studies how models decide*when*to call tools,*which*tools to select, and*how*to incorporate tool outputs into subsequent reasoning\(Qianet al\.,[2024d](https://arxiv.org/html/2607.05790#bib.bib6)\)\. Recent work further improves tool\-use robustness through tool creation, external module integration, and alignment for more efficient tool calling under uncertainty or knowledge\-boundary awareness\(Qianet al\.,[2024a](https://arxiv.org/html/2607.05790#bib.bib7); Liuet al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib5); Qianet al\.,[2024c](https://arxiv.org/html/2607.05790#bib.bib4); Xuet al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib3)\)\. At the same time, dedicated evaluations show that models still struggle with unnecessary or incorrect tool calls, motivating benchmarks for deciding whether tools are needed and which tools should be used\(Huanget al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib2); Ninget al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib1)\)\. Closely related to these efforts, recent work studies tool overuse and adaptive tool calling based on model uncertainty or self\-awareness\(Wanget al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib513); Shenet al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib511); Qianet al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib509)\)\. In contrast to methods that explicitly optimize external tool interaction policies, our work focuses on inducing the desired behavior through inference\-time manipulation of internal representations\.

## 3Methodology

We study inference\-time suppression of tool calls in structured tool\-augmented generation\. In our setting, the model emits intermediate reasoning using explicit section Heading\-Anchors such as\#\#\# Reasoning,\#\#\# Search,\#\#\# Code,\#\#\# AskUser, and\#\#\# Final Response\. Rather than steering the model globally throughout generation, we intervene locally at heading\-formation steps, where the decoder is about to select the next section label\. This yields a lightweight test\-time intervention that requires no parameter updates\.

During one inference run, we fix a target steering payload and a predefined intervention layerl⋆l^\{\\star\}\. The method then has three parts: \(i\) construct heading\-anchored steering vectors from complete trajectories, \(ii\) detect imminent Heading\-Anchors formation\#\#\#, and \(iii\) rerun only the triggered decoding step with a local hook\-based suppression at layerl⋆l^\{\\star\}\.

### 3\.1Heading\-Anchored Steering Vectors

For each tool typek∈\{Code,Search,AskUser\}k\\in\\\{\\texttt\{Code\},\\texttt\{Search\},\\texttt\{AskUser\}\\\}, we collect a set of complete labeled multi\-turn trajectories with Heading\-Anchors:

𝒟k=\{\(xi,yi\)\}i=1Nk,\\mathcal\{D\}\_\{k\}=\\\{\(x\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{N\_\{k\}\},wherexix\_\{i\}is the prompt andyiy\_\{i\}is the full structured response containing Heading\-Anchors, tool calls and the corresponding tool outputs\. We run the model on the full prompt\-response sequence and extract the hidden states from layerl⋆l^\{\\star\}\. As a result, each Heading\-Anchor representation is computed in the full left\-to\-right context induced by the preceding reasoning and tool interactions\.

We represent each heading occurrence by the hidden state at the token corresponding to its leading\#\#\#anchor marker\. LetRiR\_\{i\}denote the set of anchor positions for all occurrences of\#\#\# Reasoningin trajectoryyiy\_\{i\}, and letTikT\_\{i\}^\{k\}denote the set of anchor positions for all occurrences of the target headingkk\. For each layerll, we first average Heading\-Anchor states within each trajectory:

h¯R,i\(l\)=1\|Ri\|​∑t∈Rihi,t\(l\),h¯k,i\(l\)=1\|Tik\|​∑t∈Tikhi,t\(l\)\\bar\{h\}\_\{R,i\}^\{\(l\)\}=\\frac\{1\}\{\|R\_\{i\}\|\}\\sum\_\{t\\in R\_\{i\}\}h\_\{i,t\}^\{\(l\)\},\\qquad\\bar\{h\}\_\{k,i\}^\{\(l\)\}=\\frac\{1\}\{\|T\_\{i\}^\{k\}\|\}\\sum\_\{t\\in T\_\{i\}^\{k\}\}h\_\{i,t\}^\{\(l\)\}\(1\)We then form a sample\-level steering delta

Δk,i\(l\)=h¯R,i\(l\)−h¯k,i\(l\),\\Delta\_\{k,i\}^\{\(l\)\}=\\bar\{h\}\_\{R,i\}^\{\(l\)\}\-\\bar\{h\}\_\{k,i\}^\{\(l\)\},\(2\)And average these deltas across multiple trajectories:

vk\(l\)=1Nk​∑i=1NkΔk,i\(l\)\.v\_\{k\}^\{\(l\)\}=\\frac\{1\}\{N\_\{k\}\}\\sum\_\{i=1\}^\{N\_\{k\}\}\\Delta\_\{k,i\}^\{\(l\)\}\.\(3\)Under this definition,vk\(l\)v\_\{k\}^\{\(l\)\}points from the\#\#\# Reasoningstate to the corresponding target tool\-heading state\. Addingvk\(l⋆\)v\_\{k\}^\{\(l^\{\\star\}\)\}therefore acts as a suppressive intervention, shifting the hidden state away from the tool\-heading representation\.

This construction is intentionally performed at the sample level rather than by pooling all heading occurrences across the dataset before taking a single global difference of means\. We do so because trajectories can contain different numbers of\#\#\# Reasoningand tool Heading\-Anchors\. A pooled estimator would therefore overweight trajectories with many anchor occurrences, whereas our formulation gives each trajectory a more comparable contribution to the final steering vector\.

### 3\.2Activation Addition and Orthogonalization

We then utilize the obtained steering vectorvk\(l\)v\_\{k\}^\{\(l\)\}in two different ways\. At a specific layerl∗l\*on the Heading\-Anchor tokens\#\#\#, we perform activation addition\(Turneret al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib103); Panicksseryet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib106); Siuet al\.,[2025a](https://arxiv.org/html/2607.05790#bib.bib512)\), altering the layer inputht\(l⋆\)h\_\{t\}^\{\(l^\{\\star\}\)\}as following to suppress tool use with steering coefficientα\\alpha\. In our experiments we setα=1\\alpha=1\.

h~t\(l⋆\)=ht\(l⋆\)\+α​vk\(l⋆\)\.\\tilde\{h\}\_\{t\}^\{\(l^\{\\star\}\)\}=h\_\{t\}^\{\(l^\{\\star\}\)\}\+\\alpha v\_\{k\}^\{\(l^\{\\star\}\)\}\.\(4\)
We also test orthogonalizing the hidden states to the vector\(Arditiet al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib65); Siuet al\.,[2025b](https://arxiv.org/html/2607.05790#bib.bib87)\)on this Heading\-Anchor tokens, to study steering to encourage tool use by removing the suppression vector\.

h~t\(l⋆\)=ht\(l⋆\)−projvk\(l⋆\)⁡\(ht\(l⋆\)\),projv⁡\(h\)=⟨h,v⟩‖v‖22​v\\tilde\{h\}\_\{t\}^\{\(l^\{\\star\}\)\}=h\_\{t\}^\{\(l^\{\\star\}\)\}\-\\operatorname\{proj\}\_\{v\_\{k\}^\{\(l^\{\\star\}\)\}\}\\\!\\left\(h\_\{t\}^\{\(l^\{\\star\}\)\}\\right\),\\quad\\operatorname\{proj\}\_\{v\}\(h\)=\\frac\{\\langle h,v\\rangle\}\{\\\|v\\\|\_\{2\}^\{2\}\}v\(5\)

## 4Experimental Setup

Tasks and Domains\.We evaluate on the Math, Time, and Intention tasks from the SMART benchmark\(Qianet al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib509)\)\. These three domains expose complementary tool\-use regimes: Math contains many cases where parametric reasoning suffices without external computation, Time requires access to up\-to\-date information unavailable in model weights, and Intention requires recovering missing user\-specific details through clarification\. Together they test whether a suppressive intervention can reduce unnecessary tool calls without blocking those that are genuinely required\.

Models and Baselines\.We evaluate five open\-source instruction\-tuned models: Mistral\-7B, Llama\-3\.1\-8B, Mistral\-Nemo \(12B\), Mistral\-Small \(24B\), and Llama\-3\.1\-70B\(Jianget al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib517); Grattafioriet al\.,[2024](https://arxiv.org/html/2607.05790#bib.bib94)\)\. We compare against the base model with tool prompt fromQianet al\.\([2025](https://arxiv.org/html/2607.05790#bib.bib509)\), which provides the model with all available tools and their descriptions and allows it to decide independently whether and when to invoke them, following an iterative reasoning\-then\-execution loop until a final answer is produced\.

MethodModelMathTimeIntentionACCToolAvgUseACCToolAvgUseMissing DetailsRecoverySummarizedIntentionToolAvgUseBase ModelTool PromptMistral\-7B13\.33\.9049\.01\.6748\.84 / 21\.7063\.03\.80Llama\-3\.1\-8B51\.01\.9356\.02\.0554\.76 / 25\.9070\.23\.77Mistral\-Nemo\(12B\)46\.02\.3559\.01\.1931\.35 / 5\.8259\.31\.80Mistral\-Small\(24B\)76\.01\.5562\.01\.7345\.74 / 33\.6278\.22\.52Llama\-3\.1\-70B67\.53\.5363\.02\.0845\.74 / 35\.9661\.72\.71OrthogonalizationMistral\-7B11\.84\.8240\.02\.9213\.92 / 3\.1858\.04\.82Llama\-3\.1\-8B48\.82\.2544\.03\.8715\.48 / 3\.5559\.34\.20Mistral\-Nemo\(12B\)39\.82\.6645\.01\.8724\.86 / 5\.1256\.13\.05Mistral\-Small\(24B\)71\.02\.2151\.03\.2028\.94 / 5\.6366\.23\.62Llama\-3\.1\-70B60\.54\.3148\.02\.9931\.42 / 6\.2156\.03\.59ActivationAdditionMistral\-7B11\.80\.5639\.01\.1214\.3 / 4\.6757\.62\.34Llama\-3\.1\-8B48\.30\.3545\.01\.5016\.28 / 6\.3855\.21\.32Mistral\-Nemo\(12B\)43\.50\.5247\.01\.2027\.36 / 5\.5860\.81\.64Mistral\-Small\(24B\)65\.40\.1349\.01\.4831\.05 / 5\.9469\.41\.81Llama\-3\.1\-70B63\.20\.8249\.01\.9033\.21 / 7\.6855\.92\.47

Table 1:Performance comparison across three methods and three domains:Math,Time, andIntention\. ForMathandTime, we report task accuracy \(ACC\) and average tool usage \(ToolAvgUse\)\. ForIntention, we report Missing Details Recovery, Summarized Intention, and average tool usage\. Results are grouped by model to enable fair comparison across methods\. The best value is marked inbold\.Prompts\.Since the method described inMethodrelies on heading\-anchors, we use different prompts compared toQianet al\.\([2025](https://arxiv.org/html/2607.05790#bib.bib509)\)\. For each domain, we use the prompt templates as shown in[A\.1](https://arxiv.org/html/2607.05790#A1.SS1)\. Specifically,we instruct the model to format each turn with an explicit heading anchor, such that every response must begin with\#\#\#followed by one of the predefined action types:Reasoning, Code, Search, AskUser, Final Response\. In this form, it standardizes the intermediate structure of model outputs across domains, making the interaction trace easier to parse and analyze\.

Steering Vector Construction\.To construct steering vectors, we sample data from the training split of SMART benchmark\(Qianet al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib509)\)\. Specifically, we select 20 examples for each of the three domains used in our experiments:Math,Time, andIntention, yielding 60 examples in total\. These examples are used only to generate structured trajectories for steering\-vector extraction\. Using the prompts above, we generate structured responses for the selected SMART training examples withGPT\-4o\(OpenAI,[2023](https://arxiv.org/html/2607.05790#bib.bib241)\)\. These generated trajectories serve as the data for computing steering vectors described in Section[3\.1](https://arxiv.org/html/2607.05790#S3.SS1)\. In particular, the explicit heading structure enables us to identify the hidden states corresponding to\#\#\# Reasoningand the target tool heading\-anchors, from which we compute domain\-relevant steering directions\.

Steering Configuration\.As described in Section[3\.1](https://arxiv.org/html/2607.05790#S3.SS1), we construct a separate steering vector for each tool type\. In the main experiments, we restrict steering to the primary tool associated with each domain:CodeforMath,SearchforTime, andAskUserforIntention\.

Evaluation Metrics\.Following\(Qianet al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib509)\), for Math and Time we report task accuracy \(ACC\) and average tool calls per example \(ToolAvgUse\)\. For Intention we additionally reportMissing Details RecoveryandSummarized Intentionfrom the IN3 dataset\(Qianet al\.,[2024b](https://arxiv.org/html/2607.05790#bib.bib514)\), alongside the overall task score andToolAvgUse\.

![Refer to caption](https://arxiv.org/html/2607.05790v1/figures/five_models_tool_usage_vs_normalized_layer.png)Figure 2:Average tool calls per query as a function of normalized steering layer depth across five models\. Tool usage drops sharply as the steering layer moves into the middle of the network before plateauing, forming a clear elbow\. Annotated points mark the selected elbow layer for each model; despite differing in absolute depth, all five fall within normalized depths 0\.45–0\.60, suggesting that tool\-use representations stabilize at a surprisingly consistent relative depth across architectures\.
## 5Steering Results

Steering Layer SelectionWe sweep the steering vector across all layers, performing activation addition at each layer with coefficientα=1\\alpha=1to minimize tool usage, and select the elbow of the resulting tool\-usage curve \(Figure[2](https://arxiv.org/html/2607.05790#S4.F2)\)\. Mistral\-7B uses layer 18 with 0\.95 average tool calls per prompt, Llama\-3\.1\-8B uses layer 16 with 0\.70, Mistral\-Nemo uses layer 23 with 0\.82, Mistral\-Small uses layer 19 with 0\.63, and Llama\-3\.1\-70B uses layer 45 with 1\.28\. Despite differing in absolute depth, all five elbow points fall between normalized depths0\.450\.45–0\.600\.60, suggesting that tool\-use representations stabilize at a consistent relative depth across tested models\. The steering layer is calibrated once per model and held fixed for all subsequent experiments\.

Tool Use Steering ResultsTable[1](https://arxiv.org/html/2607.05790#S4.T1)presents the main experimental results across the three domains, while Figure[1](https://arxiv.org/html/2607.05790#S1.F1)visualizes the corresponding changes in average tool usage\. The central pattern is consistent across all five models: activation addition strongly suppresses tool invocation, whereas orthogonalization increases it above the base\-model level\. This bidirectional effect is itself non\-trivial: tool use is not a clean parametrically encoded skill in model weights, with limited theoretical underpinnings on linear representability\. The fact that addition and orthogonalization move behavior in opposite directions suggests that the extracted vector captures a relevant component of the model’s tool\-use decision\.

Table[1](https://arxiv.org/html/2607.05790#S4.T1)also shows that reduced tool use does not translate into uniform task outcomes across domains\. InMath, activation addition drives tool usage close to zero for all models \(e\.g\., from 3\.90 to 0\.56 for Mistral\-7B, from 1\.93 to 0\.35 for Llama\-3\.1\-8B, and from 1\.55 to 0\.13 for Mistral\-Small\), while accuracy drops only modestly relative to the base model in most cases\. This suggests that many tool calls in Math are indeed redundant, and that parametric reasoning can often replace external computation\. By contrast, inTimeandIntention, suppressing tool use is consistently accompanied by larger performance degradation\. For example, on Time, Llama\-3\.1\-8B drops from 56\.0 to 45\.0 ACC as tool usage falls from 2\.05 to 1\.50, and Mistral\-Small drops from 62\.0 to 49\.0 as tool usage falls from 1\.73 to 1\.48\. On Intention, activation addition substantially reduces Missing Details Recovery and Summarized Intention scores across all models, indicating that many of these tool calls are not redundant but necessary for recovering underspecified user information\. This finding is relatively intuitive: the questions in Time and Intention are by construction unanswerable from parametric knowledge alone, so suppressing tool calls intuitively leads to larger performance drops\.

![Refer to caption](https://arxiv.org/html/2607.05790v1/figures/orthogonalization_bar_chart.png)Figure 3:Average tool calls per query under orthogonalization and the base model prompt across five models and three domains\. Orthogonalization projects hidden states to be orthogonal to the suppression vector at tool\-heading positions, removing its suppressive component\. Tool usage increases above the base model level in all cases, suggesting that the suppression vector is active in the unsteered baseline and that its removal releases tool\-invocation behavior\.Figure[1](https://arxiv.org/html/2607.05790#S1.F1)makes this pattern visually clear: activation addition suppresses tool use across all models and domains, while orthogonalization shifts behavior in the opposite direction\. This domain asymmetry is strongest in Math, where tool calls are nearly eliminated, suggesting that many invocations are redundant\. By contrast, Time and Intention remain more resistant to suppression, consistent with these domains relying more heavily on retrieval or clarification that cannot be replaced by parametric knowledge alone\.

Orthogonalization provides the complementary intervention\. As shown in Table[1](https://arxiv.org/html/2607.05790#S4.T1)and Figure[3](https://arxiv.org/html/2607.05790#S5.F3), projecting hidden states to be orthogonal to the suppression direction increases tool usage above the base model across all models and domains\. However, this additional tool use does not improve overall task performance; in most settings it instead lowers accuracy or intention quality relative to the base model\. This indicates that the base model is not simply under\-using tools\. Rather, it already reflects a partial internal balance between tool invocation and direct answering, and removing the suppressive component pushes the model toward overuse\. This suggests that steering tool use may entangle with parametric knowledge due to the non\-parametric nature of tools, a phenomenon also observed in prior representation\-steering work\(Siuet al\.,[2025a](https://arxiv.org/html/2607.05790#bib.bib512)\)\. Taken together, the results suggest that the extracted direction primarily controls*whether*the model invokes tools, but the utility of suppressing that behavior depends strongly on domain: it is comparatively safe in Math, but much more harmful in Time and Intention, where tool access is often genuinely required\.

Robustness Beyond the Literal Heading Token\.Because the intervention is anchored on the formatted heading\#\#\# Code, a natural concern is whether it controls tool invocation or merely suppresses the literal surface string\. We probe this with two controls on Llama\-3\.1\-8B in the Math domain \(full results in Appendix[A\.2](https://arxiv.org/html/2607.05790#A1.SS2)\)\. First, under*cross\-format transfer*, we extract theCodevector under the Markdown heading schema but evaluate it under a JSON action schema \(e\.g\.\{"action": "code", …\}\) in which the literal\#\#\# Codeheading never appears; the Markdown\-extracted vector still removes63\.9%63\.9\\%of tool calls with accuracy essentially unchanged \(0\.330→0\.3250\.330\\to 0\.325\)\. Second, under*heading rename*, we keep the vector extracted from\#\#\# Codebut evaluate with renamed tool headings of the same semantics; suppression persists even when the active heading contains no occurrence of the wordCode\(e\.g\.70\.3%70\.3\\%relative suppression under\#\#\# Action\_B\)\. Both controls indicate that the effect is not solely the suppression of the literal heading token\. It is nonetheless schema\-sensitive: reverse transfer \(JSON→\\toMarkdown\) is much weaker \(15\.5%15\.5\\%\), and JSON→\\toJSON reduces tool use but collapses accuracy through malformed generations\. We therefore characterize the extracted direction as a schema\- and anchor\-sensitive tool\-use control direction with partial transfer beyond literal heading tokens, rather than a fully format\-independent representation\. We note these are preliminary single\-model, single\-domain controls\.

![Refer to caption](https://arxiv.org/html/2607.05790v1/figures/five_model_similarity_distributions_horizontal.png)Figure 4:Cosine similarity between the steering vector and hidden states at reasoning steps \(blue\) and tool\-invocation steps \(red\) on unsteered prompts, across five models\. Reasoning steps concentrate sharply at zero, indicating near\-orthogonality to the steering vector\. Tool steps exhibit a diffuse bimodal distribution with mass on both the acute and oblique sides, inconsistent with the steering vector acting as a simple linear encoding of tool\-use intent\. This pattern is consistent across all five tested models\. However, we note that due to the multi\-turn nature of the evaluation, these similarities do not describe the responses intervened on in Section[5](https://arxiv.org/html/2607.05790#S5), since steering shifts the trajectory of each interaction\.
## 6Geometric Analysis of the Steering Vector

![Refer to caption](https://arxiv.org/html/2607.05790v1/figures/five_model_steering_cosine_heatmaps.png)Figure 5:Pairwise cosine similarity between steering vectors extracted for code, search, and askuser tool types across five models\. Code and search vectors are consistently more similar to each other than either is to the askuser vector, suggesting that clarification\-seeking recruits distinct internal structure relative to external computation and retrieval\.Table 2:Jaccard similarity of the top 10% feature\-dimension indices selected by absolute steering\-vector magnitude for theCode,Search, andAskUsersteering vectors across models\. Each value reports the mean overlap across vectors; the last column shows the three\-way Jaccard overlap among all three vectors\.ModelCode&SearchCode&AskUserSearch&AskUserThree\-wayMistral\-7B0\.1980\.1430\.1790\.0671Llama\-3\.1\-8B0\.1810\.1170\.1270\.0416Mistral\-Nemo\(12B\)0\.2260\.1440\.1650\.0639Mistral\-Small\(24B\)0\.2280\.1490\.1700\.0675Llama\-3\.1\-70B0\.1780\.1080\.1400\.0421### 6\.1Probing Expression of the Steering Vectors

To understand what the steering vector captures geometrically, we measure the cosine similarity between the extracted vector and the hidden states of unsteered prompts at both reasoning steps and tool\-invocation steps\. If the vector encoded a stable tool\-suppression direction, tool\-step hidden states should align negatively with it while reasoning\-step hidden states should not\. Importantly, these distributions are characterized on unsteered multi\-turn trajectories, where each step is conditioned on prior tool interactions; the geometric relationship between the suppression vector and the hidden state distribution under orthogonalization in Figure[3](https://arxiv.org/html/2607.05790#S5.F3)is therefore not directly comparable, as orthogonalization intervenes on a sequential process in which each modified step conditions all subsequent ones\.

Figure[4](https://arxiv.org/html/2607.05790#S5.F4)plots these distributions across all five models\. Reasoning steps concentrate sharply at zero, indicating near\-orthogonality to the steering vector across all architectures\. Tool steps exhibit a generally negative alignment, but their distributions are often diffuse and bimodal, with substantial mass in both acute and oblique alignment with the steering vector\. This is seemingly consistent with the non\-parametric nature of tools: because tool definitions exist only in context at inference time and have no direct encoding in model weights, tool\-step activations have no a priori reason to cluster along a consistent direction in the residual stream\. The extracted vector therefore does not correspond to a stable concept direction in the sense assumed by prior representation engineering work\(Zouet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib66); Panicksseryet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib106)\), but rather captures something about the conditions under which the model defers to context\. We hypothesize that steering effectiveness persists despite this geometric irregularity because the heading\-anchor format concentrates the tool\-invocation decision into a single token: intervening at this structural bottleneck may be sufficient for behavioral control even when the underlying concept has no consistent direction in the residual stream\.

In Llama\-3\.1\-70B this geometric irregularity is most pronounced: the tool\-step hidden states approach near\-orthogonality to the mean\-difference steering vector, making them difficult to distinguish from reasoning\-step states under this vector alone\. A key question is whether this reflects an*absence*of any linearly encoded heading\-type information at scale, or merely a limitation of the mean\-difference estimator\. To disentangle the two, we compare the mean\-difference direction against alternative extractors on Llama\-3\.1\-70B—a supervised linear probe, a diagonally whitened mean difference, and norm\-matched random and shuffled\-label controls—each scored for both linear separability and causal steering effect \(Appendix[A\.3](https://arxiv.org/html/2607.05790#A1.SS3), Table[5](https://arxiv.org/html/2607.05790#A1.T5)\)\. The results show that heading\-type information*is*linearly decodable at 70B: a linear probe separatesCodefromReasoningheading states almost perfectly \(validation AUROC1\.0001\.000\), so we do not claim that the model lacks a linearly readable encoding of heading type\. Crucially, however, this most\-decodable direction is*not*the most causally effective one\. The mean\-difference vector suppresses tool use far more strongly than the probe direction \(held\-out Math ToolAvgUse0\.2350\.235vs\.1\.2351\.235\), the whitened estimator does not improve over it, and the random and shuffled controls are substantially weaker on both axes\(Wuet al\.,[2025](https://arxiv.org/html/2607.05790#bib.bib80); Panicksseryet al\.,[2023](https://arxiv.org/html/2607.05790#bib.bib106)\)\. We therefore revise the interpretation accordingly: rather than reading the 70B geometry as evidence of linear*inseparability*or of a failed estimator, we conclude that probing separability and causal controllability*diverge*at this scale\. The heading\-type concept is linearly readable, yet the direction that most effectively*controls*tool invocation remains geometrically near\-orthogonal to the tool\-step states it acts on\. This dissociation is itself consistent with the non\-parametric account: causal leverage at the heading\-anchor bottleneck does not require the steering direction to coincide with the cleanest decoding direction, and the cosine analysis on unsteered multi\-turn trajectories does not by itself explain the orthogonalization behavior\.

### 6\.2Cross\-Tool Steering Vector Similarity

The steering vectors extracted for each tool type encode which feature dimensions of the residual stream are most strongly implicated in the decision to invoke that tool\. To assess whether different tools draw on similar internal representations, we examine both the pairwise cosine similarity between steering vectors \(Figure[5](https://arxiv.org/html/2607.05790#S6.F5)\) and the Jaccard similarity of their top 10% of feature dimensions by absolute magnitude \(Table[2](https://arxiv.org/html/2607.05790#S6.T2)\)\. High overlap under either measure would indicate that different tool invocations recruit similar regions of the model’s feature space; low overlap would indicate largely distinct internal signatures\.

Both measures are consistent\. Cosine similarities between steering vectors range from0\.3240\.324to0\.6430\.643, with code\-search similarity the highest pairwise value across all five models and askuser the most dissimilar from both\. Jaccard overlaps follow the same pattern: pairwise overlaps range from0\.1080\.108to0\.2280\.228, with three\-way overlap substantially lower at0\.0420\.042–0\.0680\.068\. The higher code\-search similarity is consistent with both involving external computation over well\-defined inputs, whereas askuser involves a fundamentally different pragmatic action directed at the user rather than an external system\. The low three\-way overlap confirms that tool\-type specificity is the dominant structure, with little shared substrate across all three vectors\.

## 7Conclusion

This paper investigates tool\-use decisions in language models as an activation steering problem: tools are non\-parametric, existing entirely in context at inference time with no direct encoding in model weights\. Despite this, heading\-anchored steering vectors exert bidirectional causal control over tool\-invocation behavior across five models and three domains, suppressing tool use via activation addition and amplifying it via orthogonalization\. Suppression is most effective in domains where parametric reasoning suffices, and degrades where external retrieval or clarification is genuinely required\.

Geometric analysis reveals that this causal effectiveness does not correspond to clean linear structure\. Tool\-invocation steps exhibit a diffuse bimodal cosine similarity distribution with respect to the suppression vector, and different tool types recruit largely distinct feature dimensions with low cross\-tool overlap, distinguishing these vectors from those extracted for parametrically grounded concepts\. The mechanism by which causal control persists despite geometric irregularity remains unresolved; the multi\-turn dependency structure of tool\-augmented trajectories further limits reconciliation of the orthogonalization results with the probing analysis\. More broadly, these findings suggest that the boundary between parametric and non\-parametric knowledge is less clean than behavioral evidence suggests, and that context\-injected behaviors may be more amenable to representation\-level intervention than their non\-parametric nature would predict\.

## References

- A\. Arditi, O\. Obeso, A\. Syed, D\. Paleka, N\. Panickssery, W\. Gurnee, and N\. Nanda \(2024\)Refusal in language models is mediated by a single direction\.InAdvances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 \- 15, 2024,A\. Globersons, L\. Mackey, D\. Belgrave, A\. Fan, U\. Paquet, J\. M\. Tomczak, and C\. Zhang \(Eds\.\),External Links:[Link](http://papers.nips.cc/paper%5C_files/paper/2024/hash/f545448535dfde4f9786555403ab7c49-Abstract-Conference.html)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p1.1),[§3\.2](https://arxiv.org/html/2607.05790#S3.SS2.p3.1)\.
- C\. Burns, H\. Ye, D\. Klein, and J\. Steinhardt \(2023\)Discovering latent knowledge in language models without supervision\.InThe Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1\-5, 2023,External Links:[Link](https://openreview.net/pdf?id=ETKGuby0hcs)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p1.1)\.
- N\. Elhage, T\. Hume, C\. Olsson, N\. Schiefer, T\. Henighan, S\. Kravec, Z\. Hatfield\-Dodds, R\. Lasenby, D\. Drain, C\. Chen, R\. Grosse, S\. McCandlish, J\. Kaplan, D\. Amodei, M\. Wattenberg, and C\. Olah \(2022\)Toy models of superposition\.Vol\.abs/2209\.10652\.External Links:[Link](https://arxiv.org/abs/2209.10652)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px1.p1.1)\.
- A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan, A\. Yang, A\. Fan, A\. Goyal, A\. Hartshorn, A\. Yang, A\. Mitra, A\. Sravankumar, A\. Korenev, A\. Hinsvark, A\. Rao, A\. Zhang, A\. Rodriguez, A\. Gregerson, A\. Spataru, B\. Roziere, B\. Biron, B\. Tang, B\. Chern, C\. Caucheteux, C\. Nayak, C\. Bi, C\. Marra, C\. McConnell, C\. Keller, C\. Touret, C\. Wu, C\. Wong, C\. C\. Ferrer, C\. Nikolaidis, D\. Allonsius, D\. Song, D\. Pintz, D\. Livshits, D\. Wyatt, D\. Esiobu, D\. Choudhary, D\. Mahajan, D\. Garcia\-Olano, D\. Perino, D\. Hupkes, E\. Lakomkin, E\. AlBadawy, E\. Lobanova, E\. Dinan, E\. M\. Smith, F\. Radenovic, F\. Guzmán, F\. Zhang, G\. Synnaeve, G\. Lee, G\. L\. Anderson, G\. Thattai, G\. Nail, G\. Mialon, G\. Pang, G\. Cucurell, H\. Nguyen, H\. Korevaar, H\. Xu, H\. Touvron, I\. Zarov, I\. A\. Ibarra, I\. Kloumann, I\. Misra, I\. Evtimov, J\. Zhang, J\. Copet, J\. Lee, J\. Geffert, J\. Vranes, J\. Park, J\. Mahadeokar, J\. Shah, J\. van der Linde, J\. Billock, J\. Hong, J\. Lee, J\. Fu, J\. Chi, J\. Huang, J\. Liu, J\. Wang, J\. Yu, J\. Bitton, J\. Spisak, J\. Park, J\. Rocca, J\. Johnstun, J\. Saxe, J\. Jia, K\. V\. Alwala, K\. Prasad, K\. Upasani, K\. Plawiak, K\. Li, K\. Heafield, K\. Stone, K\. El\-Arini, K\. Iyer, K\. Malik, K\. Chiu, K\. Bhalla, K\. Lakhotia, L\. Rantala\-Yeary, L\. van der Maaten, L\. Chen, L\. Tan, L\. Jenkins, L\. Martin, L\. Madaan, L\. Malo, L\. Blecher, L\. Landzaat, L\. de Oliveira, M\. Muzzi, M\. Pasupuleti, M\. Singh, M\. Paluri, M\. Kardas, M\. Tsimpoukelli, M\. Oldham, M\. Rita, M\. Pavlova, M\. Kambadur, M\. Lewis, M\. Si, M\. K\. Singh, M\. Hassan, N\. Goyal, N\. Torabi, N\. Bashlykov, N\. Bogoychev, N\. Chatterji, N\. Zhang, O\. Duchenne, O\. Çelebi, P\. Alrassy, P\. Zhang, P\. Li, P\. Vasic, P\. Weng, P\. Bhargava, P\. Dubal, P\. Krishnan, P\. S\. Koura, P\. Xu, Q\. He, Q\. Dong, R\. Srinivasan, R\. Ganapathy, R\. Calderer, R\. S\. Cabral, R\. Stojnic, R\. Raileanu, R\. Maheswari, R\. Girdhar, R\. Patel, R\. Sauvestre, R\. Polidoro, R\. Sumbaly, R\. Taylor, R\. Silva, R\. Hou, R\. Wang, S\. Hosseini, S\. Chennabasappa, S\. Singh, S\. Bell, S\. S\. Kim, S\. Edunov, S\. Nie, S\. Narang, S\. Raparthy, S\. Shen, S\. Wan, S\. Bhosale, S\. Zhang, S\. Vandenhende, S\. Batra, S\. Whitman, S\. Sootla, S\. Collot, S\. Gururangan, S\. Borodinsky, T\. Herman, T\. Fowler, T\. Sheasha, T\. Georgiou, T\. Scialom, T\. Speckbacher, T\. Mihaylov, T\. Xiao, U\. Karn, V\. Goswami, V\. Gupta, V\. Ramanathan, V\. Kerkez, V\. Gonguet, V\. Do, V\. Vogeti, V\. Albiero, V\. Petrovic, W\. Chu, W\. Xiong, W\. Fu, W\. Meers, X\. Martinet, X\. Wang, X\. Wang, X\. E\. Tan, X\. Xia, X\. Xie, X\. Jia, X\. Wang, Y\. Goldschlag, Y\. Gaur, Y\. Babaei, Y\. Wen, Y\. Song, Y\. Zhang, Y\. Li, Y\. Mao, Z\. D\. Coudert, Z\. Yan, Z\. Chen, Z\. Papakipos, A\. Singh, A\. Srivastava, A\. Jain, A\. Kelsey, A\. Shajnfeld, A\. Gangidi, A\. Victoria, A\. Goldstand, A\. Menon, A\. Sharma, A\. Boesenberg, A\. Baevski, A\. Feinstein, A\. Kallet, A\. Sangani, A\. Teo, A\. Yunus, A\. Lupu, A\. Alvarado, A\. Caples, A\. Gu, A\. Ho, A\. Poulton, A\. Ryan, A\. Ramchandani, A\. Dong, A\. Franco, A\. Goyal, A\. Saraf, A\. Chowdhury, A\. Gabriel, A\. Bharambe, A\. Eisenman, A\. Yazdan, B\. James, B\. Maurer, B\. Leonhardi, B\. Huang, B\. Loyd, B\. D\. Paola, B\. Paranjape, B\. Liu, B\. Wu, B\. Ni, B\. Hancock, B\. Wasti, B\. Spence, B\. Stojkovic, B\. Gamido, B\. Montalvo, C\. Parker, C\. Burton, C\. Mejia, C\. Liu, C\. Wang, C\. Kim, C\. Zhou, C\. Hu, C\. Chu, C\. Cai, C\. Tindal, C\. Feichtenhofer, C\. Gao, D\. Civin, D\. Beaty, D\. Kreymer, D\. Li, D\. Adkins, D\. Xu, D\. Testuggine, D\. David, D\. Parikh, D\. Liskovich, D\. Foss, D\. Wang, D\. Le, D\. Holland, E\. Dowling, E\. Jamil, E\. Montgomery, E\. Presani, E\. Hahn, E\. Wood, E\. Le, E\. Brinkman, E\. Arcaute, E\. Dunbar, E\. Smothers, F\. Sun, F\. Kreuk, F\. Tian, F\. Kokkinos, F\. Ozgenel, F\. Caggioni, F\. Kanayet, F\. Seide, G\. M\. Florez, G\. Schwarz, G\. Badeer, G\. Swee, G\. Halpern, G\. Herman, G\. Sizov, Guangyi, Zhang, G\. Lakshminarayanan, H\. Inan, H\. Shojanazeri, H\. Zou, H\. Wang, H\. Zha, H\. Habeeb, H\. Rudolph, H\. Suk, H\. Aspegren, H\. Goldman, H\. Zhan, I\. Damlaj, I\. Molybog, I\. Tufanov, I\. Leontiadis, I\. Veliche, I\. Gat, J\. Weissman, J\. Geboski, J\. Kohli, J\. Lam, J\. Asher, J\. Gaya, J\. Marcus, J\. Tang, J\. Chan, J\. Zhen, J\. Reizenstein, J\. Teboul, J\. Zhong, J\. Jin, J\. Yang, J\. Cummings, J\. Carvill, J\. Shepard, J\. McPhie, J\. Torres, J\. Ginsburg, J\. Wang, K\. Wu, K\. H\. U, K\. Saxena, K\. Khandelwal, K\. Zand, K\. Matosich, K\. Veeraraghavan, K\. Michelena, K\. Li, K\. Jagadeesh, K\. Huang, K\. Chawla, K\. Huang, L\. Chen, L\. Garg, L\. A, L\. Silva, L\. Bell, L\. Zhang, L\. Guo, L\. Yu, L\. Moshkovich, L\. Wehrstedt, M\. Khabsa, M\. Avalani, M\. Bhatt, M\. Mankus, M\. Hasson, M\. Lennie, M\. Reso, M\. Groshev, M\. Naumov, M\. Lathi, M\. Keneally, M\. Liu, M\. L\. Seltzer, M\. Valko, M\. Restrepo, M\. Patel, M\. Vyatskov, M\. Samvelyan, M\. Clark, M\. Macey, M\. Wang, M\. J\. Hermoso, M\. Metanat, M\. Rastegari, M\. Bansal, N\. Santhanam, N\. Parks, N\. White, N\. Bawa, N\. Singhal, N\. Egebo, N\. Usunier, N\. Mehta, N\. P\. Laptev, N\. Dong, N\. Cheng, O\. Chernoguz, O\. Hart, O\. Salpekar, O\. Kalinli, P\. Kent, P\. Parekh, P\. Saab, P\. Balaji, P\. Rittner, P\. Bontrager, P\. Roux, P\. Dollar, P\. Zvyagina, P\. Ratanchandani, P\. Yuvraj, Q\. Liang, R\. Alao, R\. Rodriguez, R\. Ayub, R\. Murthy, R\. Nayani, R\. Mitra, R\. Parthasarathy, R\. Li, R\. Hogan, R\. Battey, R\. Wang, R\. Howes, R\. Rinott, S\. Mehta, S\. Siby, S\. J\. Bondu, S\. Datta, S\. Chugh, S\. Hunt, S\. Dhillon, S\. Sidorov, S\. Pan, S\. Mahajan, S\. Verma, S\. Yamamoto, S\. Ramaswamy, S\. Lindsay, S\. Lindsay, S\. Feng, S\. Lin, S\. C\. Zha, S\. Patil, S\. Shankar, S\. Zhang, S\. Zhang, S\. Wang, S\. Agarwal, S\. Sajuyigbe, S\. Chintala, S\. Max, S\. Chen, S\. Kehoe, S\. Satterfield, S\. Govindaprasad, S\. Gupta, S\. Deng, S\. Cho, S\. Virk, S\. Subramanian, S\. Choudhury, S\. Goldman, T\. Remez, T\. Glaser, T\. Best, T\. Koehler, T\. Robinson, T\. Li, T\. Zhang, T\. Matthews, T\. Chou, T\. Shaked, V\. Vontimitta, V\. Ajayi, V\. Montanez, V\. Mohan, V\. S\. Kumar, V\. Mangla, V\. Ionescu, V\. Poenaru, V\. T\. Mihailescu, V\. Ivanov, W\. Li, W\. Wang, W\. Jiang, W\. Bouaziz, W\. Constable, X\. Tang, X\. Wu, X\. Wang, X\. Wu, X\. Gao, Y\. Kleinman, Y\. Chen, Y\. Hu, Y\. Jia, Y\. Qi, Y\. Li, Y\. Zhang, Y\. Zhang, Y\. Adi, Y\. Nam, Yu, Wang, Y\. Zhao, Y\. Hao, Y\. Qian, Y\. Li, Y\. He, Z\. Rait, Z\. DeVito, Z\. Rosnbrick, Z\. Wen, Z\. Yang, Z\. Zhao, and Z\. Ma \(2024\)The llama 3 herd of models\.Vol\.abs/2407\.21783\.External Links:[Link](https://arxiv.org/abs/2407.21783)Cited by:[§4](https://arxiv.org/html/2607.05790#S4.p3.1)\.
- Y\. Huang, J\. Shi, Y\. Li, C\. Fan, S\. Wu, Q\. Zhang, Y\. Liu, P\. Zhou, Y\. Wan, N\. Z\. Gong, and L\. Sun \(2024\)MetaTool benchmark for large language models: deciding whether to use tools and which to use\.External Links:2310\.03128,[Link](https://arxiv.org/abs/2310.03128)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- A\. Q\. Jiang, A\. Sablayrolles, A\. Mensch, C\. Bamford, D\. S\. Chaplot, D\. de las Casas, F\. Bressand, G\. Lengyel, G\. Lample, L\. Saulnier, L\. R\. Lavaud, M\. Lachaux, P\. Stock, T\. L\. Scao, T\. Lavril, T\. Wang, T\. Lacroix, and W\. E\. Sayed \(2023\)Mistral 7b\.External Links:2310\.06825,[Link](https://arxiv.org/abs/2310.06825)Cited by:[§4](https://arxiv.org/html/2607.05790#S4.p3.1)\.
- B\. W\. Lee, I\. Padhi, K\. N\. Ramamurthy, E\. Miehling, P\. Dognin, M\. Nagireddy, and A\. Dhurandhar \(2024\)Programming refusal with conditional activation steering\.Vol\.abs/2409\.05907\.External Links:[Link](https://arxiv.org/abs/2409.05907)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p1.1)\.
- I\. Levy, B\. Wiesel, S\. Marreed, A\. Oved, A\. Yaeli, and S\. Shlomov \(2024\)St\-webagentbench: a benchmark for evaluating safety and trustworthiness in web agents\.arXiv preprint arXiv:2410\.06703\.Cited by:[§1](https://arxiv.org/html/2607.05790#S1.p1.1)\.
- K\. Li, O\. Patel, F\. Viégas, H\. Pfister, and M\. Wattenberg \(2023\)Inference\-time intervention: eliciting truthful answers from a language model\.Advances in Neural Information Processing Systems36,pp\. 41451–41530\.Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p1.1)\.
- W\. Liu, X\. Huang, X\. Zeng, X\. Hao, S\. Yu, D\. Li, S\. Wang, W\. Gan, Z\. Liu, Y\. Yu, Z\. Wang, Y\. Wang, W\. Ning, Y\. Hou, B\. Wang, C\. Wu, X\. Wang, Y\. Liu, Y\. Wang, D\. Tang, D\. Tu, L\. Shang, X\. Jiang, R\. Tang, D\. Lian, Q\. Liu, and E\. Chen \(2025\)ToolACE: winning the points of llm function calling\.External Links:2409\.00920,[Link](https://arxiv.org/abs/2409.00920)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- T\. Mikolov, W\. Yih, and G\. Zweig \(2013\)Linguistic regularities in continuous space word representations\.InProceedings of the 2013 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies,L\. Vanderwende, H\. Daumé III, and K\. Kirchhoff \(Eds\.\),Atlanta, Georgia,pp\. 746–751\.External Links:[Link](https://aclanthology.org/N13-1090)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px1.p1.1)\.
- K\. Ning, Y\. Su, X\. Lv, Y\. Zhang, J\. Liu, K\. Liu, and J\. Xu \(2024\)WTU\-eval: a whether\-or\-not tool usage evaluation benchmark for large language models\.External Links:2407\.12823,[Link](https://arxiv.org/abs/2407.12823)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- OpenAI \(2023\)GPT\-4 technical report\.Note:arXiv:2303\.08774Cited by:[§4](https://arxiv.org/html/2607.05790#S4.p5.1)\.
- N\. Panickssery, N\. Gabrieli, J\. Schulz, M\. Tong, E\. Hubinger, and A\. M\. Turner \(2023\)Steering llama 2 via contrastive activation addition\.Vol\.abs/2312\.06681\.External Links:[Link](https://arxiv.org/abs/2312.06681)Cited by:[§1](https://arxiv.org/html/2607.05790#S1.p3.1),[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p1.1),[§3\.2](https://arxiv.org/html/2607.05790#S3.SS2.p1.5),[§6\.1](https://arxiv.org/html/2607.05790#S6.SS1.p2.1),[§6\.1](https://arxiv.org/html/2607.05790#S6.SS1.p3.3)\.
- K\. Park, Y\. J\. Choe, and V\. Veitch \(2024\)The linear representation hypothesis and the geometry of large language models\.InForty\-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21\-27, 2024,External Links:[Link](https://openreview.net/forum?id=UGpGkLzwpP)Cited by:[§1](https://arxiv.org/html/2607.05790#S1.p3.1),[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px1.p1.1)\.
- C\. Qian, E\. C\. Acikgoz, H\. Wang, X\. Chen, A\. Sil, D\. Hakkani\-Tür, G\. Tur, and H\. Ji \(2025\)SMART: self\-aware agent for tool overuse mitigation\.InFindings of the Association for Computational Linguistics: ACL 2025,W\. Che, J\. Nabende, E\. Shutova, and M\. T\. Pilehvar \(Eds\.\),Vienna, Austria,pp\. 4604–4621\.External Links:[Link](https://aclanthology.org/2025.findings-acl.239/),[Document](https://dx.doi.org/10.18653/v1/2025.findings-acl.239),ISBN 979\-8\-89176\-256\-5Cited by:[§1](https://arxiv.org/html/2607.05790#S1.p2.1),[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1),[§4](https://arxiv.org/html/2607.05790#S4.p2.1),[§4](https://arxiv.org/html/2607.05790#S4.p3.1),[§4](https://arxiv.org/html/2607.05790#S4.p4.1),[§4](https://arxiv.org/html/2607.05790#S4.p5.1),[§4](https://arxiv.org/html/2607.05790#S4.p7.1)\.
- C\. Qian, C\. Han, Y\. R\. Fung, Y\. Qin, Z\. Liu, and H\. Ji \(2024a\)CREATOR: tool creation for disentangling abstract and concrete reasoning of large language models\.External Links:2305\.14318,[Link](https://arxiv.org/abs/2305.14318)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- C\. Qian, B\. He, Z\. Zhuang, J\. Deng, Y\. Qin, X\. Cong, Z\. Zhang, J\. Zhou, Y\. Lin, Z\. Liu, and M\. Sun \(2024b\)Tell me more\! towards implicit user intention understanding of language model driven agents\.External Links:2402\.09205,[Link](https://arxiv.org/abs/2402.09205)Cited by:[§4](https://arxiv.org/html/2607.05790#S4.p7.1)\.
- C\. Qian, S\. Liang, Y\. Qin, Y\. Ye, X\. Cong, Y\. Lin, Y\. Wu, Z\. Liu, and M\. Sun \(2024c\)Investigate\-consolidate\-exploit: a general strategy for inter\-task agent self\-evolution\.External Links:2401\.13996,[Link](https://arxiv.org/abs/2401.13996)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- C\. Qian, C\. Xiong, Z\. Liu, and Z\. Liu \(2024d\)Toolink: linking toolkit creation and using through chain\-of\-solving on open\-source model\.External Links:2310\.05155,[Link](https://arxiv.org/abs/2310.05155)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- Y\. Qin, S\. Liang, Y\. Ye, K\. Zhu, L\. Yan, Y\. Lu, Y\. Lin, X\. Cong, X\. Tang, B\. Qian, S\. Zhao, L\. Hong, R\. Tian, R\. Xie, J\. Zhou, M\. Gerstein, D\. Li, Z\. Liu, and M\. Sun \(2023\)ToolLLM: facilitating large language models to master 16000\+ real\-world apis\.External Links:2307\.16789,[Link](https://arxiv.org/abs/2307.16789)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- C\. Qu, S\. Dai, X\. Wei, H\. Cai, S\. Wang, D\. Yin, J\. Xu, and J\. Wen \(2025\)Tool learning with large language models: a survey\.Frontiers of Computer Science19\(8\)\.External Links:ISSN 2095\-2236,[Link](http://dx.doi.org/10.1007/s11704-024-40678-2),[Document](https://dx.doi.org/10.1007/s11704-024-40678-2)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- S\. Ravfogel, Y\. Elazar, H\. Gonen, M\. Twiton, and Y\. Goldberg \(2020\)Null it out: guarding protected attributes by iterative nullspace projection\.InProceedings of the 58th Annual Meeting of the Association for Computational Linguistics,D\. Jurafsky, J\. Chai, N\. Schluter, and J\. Tetreault \(Eds\.\),Online,pp\. 7237–7256\.External Links:[Document](https://dx.doi.org/10.18653/v1/2020.acl-main.647),[Link](https://aclanthology.org/2020.acl-main.647)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p1.1)\.
- T\. Schick, J\. Dwivedi\-Yu, R\. Dessì, R\. Raileanu, M\. Lomeli, E\. Hambro, L\. Zettlemoyer, N\. Cancedda, and T\. Scialom \(2023\)Toolformer: language models can teach themselves to use tools\.Advances in Neural Information Processing Systems36,pp\. 68539–68551\.Cited by:[§1](https://arxiv.org/html/2607.05790#S1.p1.1),[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- J\. Schneider \(2025\)Generative to agentic ai: survey, conceptualization, and challenges\.arXiv preprint arXiv:2504\.18875\.Cited by:[§1](https://arxiv.org/html/2607.05790#S1.p1.1)\.
- Y\. Shen, X\. Zhu, and L\. Chen \(2024\)SMARTCAL: an approach to self\-aware tool\-use evaluation and calibration\.InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing: Industry Track,F\. Dernoncourt, D\. Preoţiuc\-Pietro, and A\. Shimorina \(Eds\.\),Miami, Florida, US,pp\. 774–789\.External Links:[Link](https://aclanthology.org/2024.emnlp-industry.59/),[Document](https://dx.doi.org/10.18653/v1/2024.emnlp-industry.59)Cited by:[§1](https://arxiv.org/html/2607.05790#S1.p2.1),[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- Z\. Shen \(2024\)LLM with tools: a survey\.External Links:2409\.18807,[Link](https://arxiv.org/abs/2409.18807)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- V\. Siu, N\. Crispino, D\. Park, N\. W\. Henry, Z\. Wang, Y\. Liu, D\. Song, and C\. Wang \(2025a\)SteeringSafety: a systematic safety evaluation framework of representation steering in llms\.External Links:2509\.13450,[Link](https://arxiv.org/abs/2509.13450)Cited by:[§1](https://arxiv.org/html/2607.05790#S1.p3.1),[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p1.1),[§3\.2](https://arxiv.org/html/2607.05790#S3.SS2.p1.5),[§5](https://arxiv.org/html/2607.05790#S5.p5.1)\.
- V\. Siu, N\. Crispino, Z\. Yu, S\. Pan, Z\. Wang, Y\. Liu, D\. Song, and C\. Wang \(2025b\)COSMIC: generalized refusal direction identification in LLM activations\.InFindings of the Association for Computational Linguistics: ACL 2025,W\. Che, J\. Nabende, E\. Shutova, and M\. T\. Pilehvar \(Eds\.\),Vienna, Austria,pp\. 25534–25553\.External Links:[Link](https://aclanthology.org/2025.findings-acl.1310/),[Document](https://dx.doi.org/10.18653/v1/2025.findings-acl.1310),ISBN 979\-8\-89176\-256\-5Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p1.1),[§3\.2](https://arxiv.org/html/2607.05790#S3.SS2.p3.1)\.
- V\. Siu, N\. W\. Henry, N\. Crispino, Y\. Liu, D\. Song, and C\. Wang \(2025c\)RepIt: representing isolated targets to steer language models\.External Links:2509\.13281,[Link](https://arxiv.org/abs/2509.13281)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px1.p1.1)\.
- A\. M\. Turner, L\. Thiergart, G\. Leech, D\. Udell, J\. J\. Vazquez, U\. Mini, and M\. MacDiarmid \(2023\)Steering language models with activation engineering\.Vol\.abs/2308\.10248\.External Links:[Link](https://arxiv.org/abs/2308.10248)Cited by:[§1](https://arxiv.org/html/2607.05790#S1.p3.1),[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p1.1),[§3\.2](https://arxiv.org/html/2607.05790#S3.SS2.p1.5)\.
- H\. Wang, B\. Xue, B\. Zhou, T\. Zhang, C\. Wang, H\. Wang, G\. Chen, and K\. Wong \(2025\)Self\-DC: when to reason and when to act? self divide\-and\-conquer for compositional unknown questions\.InProceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),L\. Chiruzzo, A\. Ritter, and L\. Wang \(Eds\.\),Albuquerque, New Mexico,pp\. 6510–6525\.External Links:[Link](https://aclanthology.org/2025.naacl-long.331/),[Document](https://dx.doi.org/10.18653/v1/2025.naacl-long.331),ISBN 979\-8\-89176\-189\-6Cited by:[§1](https://arxiv.org/html/2607.05790#S1.p2.1),[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- T\. Wollschläger, J\. Elstner, S\. Geisler, V\. Cohen\-Addad, S\. Günnemann, and J\. Gasteiger \(2025\)The geometry of refusal in large language models: concept cones and representational independence\.External Links:2502\.17420,[Link](https://arxiv.org/abs/2502.17420)Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px1.p1.1)\.
- Z\. Wu, A\. Arora, A\. Geiger, Z\. Wang, J\. Huang, D\. Jurafsky, C\. D\. Manning, and C\. Potts \(2025\)AxBench: steering llms? even simple baselines outperform sparse autoencoders\.External Links:2501\.17148,[Link](https://arxiv.org/abs/2501.17148)Cited by:[§6\.1](https://arxiv.org/html/2607.05790#S6.SS1.p3.3)\.
- H\. Xu, Z\. Wang, Z\. Zhu, L\. Pan, X\. Chen, S\. Fan, L\. Chen, and K\. Yu \(2025\)Alignment for efficient tool calling of large language models\.InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing,C\. Christodoulopoulos, T\. Chakraborty, C\. Rose, and V\. Peng \(Eds\.\),Suzhou, China,pp\. 17776–17792\.External Links:[Link](https://aclanthology.org/2025.emnlp-main.898/),[Document](https://dx.doi.org/10.18653/v1/2025.emnlp-main.898),ISBN 979\-8\-89176\-332\-6Cited by:[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- S\. Yao, J\. Zhao, D\. Yu, N\. Du, I\. Shafran, K\. Narasimhan, and Y\. Cao \(2023\)ReAct: synergizing reasoning and acting in language models\.External Links:2210\.03629,[Link](https://arxiv.org/abs/2210.03629)Cited by:[§1](https://arxiv.org/html/2607.05790#S1.p1.1),[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p2.1)\.
- A\. Zou, L\. Phan, S\. Chen, J\. Campbell, P\. Guo, R\. Ren, A\. Pan, X\. Yin, M\. Mazeika, A\. Dombrowski, S\. Goel, N\. Li, M\. J\. Byun, Z\. Wang, A\. Mallen, S\. Basart, S\. Koyejo, D\. Song, M\. Fredrikson, J\. Z\. Kolter, and D\. Hendrycks \(2023\)Representation engineering: a top\-down approach to ai transparency\.Vol\.abs/2310\.01405\.External Links:[Link](https://arxiv.org/abs/2310.01405)Cited by:[§1](https://arxiv.org/html/2607.05790#S1.p3.1),[§2](https://arxiv.org/html/2607.05790#S2.SS0.SSS0.Px2.p1.1),[§6\.1](https://arxiv.org/html/2607.05790#S6.SS1.p2.1)\.

## Appendix AAppendix

### A\.1Prompts

Math\-Domain Initial Prompt\#\#\# Task You are a highly capable assistant designed to solve tasks effectively using your knowledge and the tool set available for this domain\. \#\#\# Principles 1\. Reason Independently: \- Leverage your own knowledge to analyze and solve reasoning steps whenever possible\. Use the tool only when necessary\. 2\. Tool Usage: \- Use code snippet ‘‘‘python \.\.\. ‘‘‘ inside a ‘\#\#\# Code‘ step when computation is needed\. 3\. Step\-by\-Step Approach: \- Work through reasoning systematically, breaking down the task into manageable steps\. Rely on your knowledge until a gap is identified that requires tool support\. \- Use only the domain\-appropriate tool when needed\. 4\. Goal\-Oriented Resolution: \- Conclude your reasoning process by achieving a clear, accurate, and succinct solution based on your independent analysis and any tool findings\. \#\#\# Output Guidelines \- Your answer must begin with ‘\#\#\# Reasoning‘\. \- After that, every step must begin with one of these section headers on its own line: ‘\#\#\# Reasoning‘, ‘\#\#\# Code‘, ‘\#\#\# Final Response‘\. \- If you need the tool, place the executable snippet inside a ‘\#\#\# Code‘ step using ‘‘‘python \.\.\. ‘‘‘\. \- Do not emit any other tool headings\. \- After a tool call, continue reasoning using the tool output when available\. \- End with a ‘\#\#\# Final Response‘ step that directly answers the task\. \#\#\# Task:

Time/Intention\-Domain Initial Prompt\#\#\# Task You are a highly capable assistant designed to solve tasks effectively using your knowledge and the tool set available for this domain\. \#\#\# Principles 1\. Reason Independently: \- Leverage your own knowledge to analyze and solve reasoning steps whenever possible\. Use the tool only when necessary\. 2\. Tool Usage: \- Use a ‘\#\#\# Search‘ step whose content is a concise web search query when external information is needed\. \- Use a ‘\#\#\# AskUser‘ step whose content is the exact question that should be asked to the user when user\-specific clarification is needed\. 3\. Step\-by\-Step Approach: \- Work through reasoning systematically, breaking down the task into manageable steps\. Rely on your knowledge until a gap is identified that requires tool support\. \- Use only the domain\-appropriate tool when needed\. 4\. Goal\-Oriented Resolution: \- Conclude your reasoning process by achieving a clear, accurate, and succinct solution based on your independent analysis and any tool findings\. \#\#\# Output Guidelines \- Your answer must begin with ‘\#\#\# Reasoning‘\. \- After that, every step must begin with one of these section headers on its own line: ‘\#\#\# Reasoning‘, ‘\#\#\# Search‘, ‘\#\#\# AskUser‘, ‘\#\#\# Final Response‘\. \- If you use ‘\#\#\# Search‘, place only the search query inside the step\. \- If you use ‘\#\#\# AskUser‘, place only the user\-facing question inside the step\. \- Do not emit any other tool headings\. \- After a tool call, continue reasoning using the tool output when available\. \- End with a ‘\#\#\# Final Response‘ step that directly answers the task\. \#\#\# Task:

### A\.2Robustness Beyond the Literal Heading Token

To test whether the steering vector controls tool invocation or merely suppresses the literal surface string\#\#\# Code, we run two control studies on Llama\-3\.1\-8B in the Math domain\. Relative Suppression denotes\(Base−ActAdd\)/Base\(\\text\{Base\}\-\\text\{ActAdd\}\)/\\text\{Base\}on ToolAvgUse\.

In the*cross\-format transfer*study \(Table[3](https://arxiv.org/html/2607.05790#A1.T3)\), theCodevector is extracted under one output schema and evaluated under another; themarkdown→\\tojsonrow applies a Markdown\-extracted vector under a JSON action schema in which the literal\#\#\# Codeheading is absent\. The vector still suppresses63\.9%63\.9\\%of tool calls with accuracy essentially unchanged, but transfer is asymmetric: the reversejson→\\tomarkdowndirection is much weaker \(15\.5%15\.5\\%\), andjson→\\tojsonreduces tool use while collapsing accuracy because JSON\-format generations are frequently malformed\.

Table 3:Cross\-format transfer on Llama\-3\.1\-8B \(Math\)\. The vector is extracted under the schema before the arrow and evaluated under the schema after it\.SchemaBaseActAddRelativeBaseActAddToolAvgUseToolAvgUseSuppressionAccuracyAccuracymarkdown→\\tomarkdown3\.1500\.22592\.9%0\.50750\.495markdown→\\tojson1\.0530\.38063\.9%0\.3300\.325json→\\tomarkdown3\.1502\.662515\.5%0\.50750\.5225json→\\tojson1\.0530\.30072\.9%0\.3300\.010

In the*heading rename*study \(Table[4](https://arxiv.org/html/2607.05790#A1.T4)\), the vector is always extracted from\#\#\# Codetrajectories but evaluation uses alternative tool headings of the same semantics\. Suppression persists even when the active heading contains no occurrence of the wordCode\(e\.g\.70\.3%70\.3\\%under\#\#\# Action\_B\) and accuracy is not degraded, though the effect weakens for some renames \(e\.g\.\#\#\# Execute,55\.5%55\.5\\%\)\.

Table 4:Heading rename on Llama\-3\.1\-8B \(Math\)\. The vector is extracted from\#\#\# Code; evaluation uses the renamed heading after the arrow\.SchemaBaseActAddRelativeBaseActAddToolAvgUseToolAvgUseSuppressionAccuracyAccuracyCode→\\toCode3\.1500\.17094\.6%0\.50750\.525Code→\\toCompute2\.8770\.24591\.5%0\.54270\.530Code→\\toExecute3\.1351\.39555\.5%0\.52750\.5475Code→\\toAction\_B2\.8970\.86070\.3%0\.5250\.550

### A\.3Alternative Extraction Methods on Llama\-3\.1\-70B

To separate linear*decodability*of heading type from the*causal*steering effect of the extracted direction on Llama\-3\.1\-70B, we compare the mean\-difference direction \(used throughout the paper\) against four alternatives at layer4545on the Math/Code heading pair: a supervised linear probe, a diagonally whitened mean difference, a norm\-matched random direction, and a shuffled\-label probe\. Every direction is norm\-matched to the original mean\-difference vector and evaluated on200200held\-out Math examples\. Val AUROC and Val F1 measure how well the direction separatesCodefromReasoningheading states; ToolAvgUse and Accuracy measure the behavioral effect of steering with that direction \(lower ToolAvgUse indicates stronger suppression\)\.

As shown in Table[5](https://arxiv.org/html/2607.05790#A1.T5), the linear probe separates the two classes almost perfectly \(AUROC1\.0001\.000\), confirming that heading\-type information is linearly decodable at 70B\. Yet this most\-decodable direction is far weaker as a causal control \(ToolAvgUse1\.2351\.235\) than the mean\-difference vector \(0\.2350\.235\), and the whitened estimator does not improve over the mean difference\. The random and shuffled controls are weak on both axes\. Probing separability and causal controllability therefore diverge at this scale, and the mean\-difference estimator is not simply a poor estimator for causal suppression at 70B\.

Table 5:Alternative extraction directions on Llama\-3\.1\-70B \(Math/Code, layer 45,n=200n=200\)\. Each direction is norm\-matched to the original mean\-difference vector\. AUROC/F1 measure linear separability ofCodevs\.Reasoningheading states; ToolAvgUse/Accuracy measure the causal steering effect\.DirectionVal AUROCVal F1ToolAvgUseAccuracyMean difference0\.9450\.4810\.2350\.695Linear probe1\.0001\.0001\.2350\.695Diag\-whitened mean difference0\.9610\.4810\.4050\.690Random0\.6140\.3611\.6800\.740Shuffled probe0\.6310\.3321\.7550\.735