Forecasting Side Effects of Activation Steering

# Forecasting Side Effects of Activation Steering
Source: [https://arxiv.org/html/2608.11227](https://arxiv.org/html/2608.11227)
###### Abstract

Activation steering modifies a language model by adding a learned direction to its hidden activations, enabling targeted behavioral changes without retraining\. While effective, steering often produces unintended side effects on other behaviors, making it difficult to deploy safely\. We therefore ask: can these side effects be forecasted before steering is applied? We answer this question by constructing a cross\-effect matrix over a taxonomy of 67 behaviors across three open\-weight language models\. We find that side effects are common, structured, and often asymmetric, revealing interactions that cannot be explained by existing similarity\-based heuristics\. Despite this complexity, we show that side effects are largely predictable before steering is performed\. Their magnitude depends primarily on the target behavior, while their direction can be forecasted from the model’s unsteered representations with substantially higher accuracy than simple baselines\. Our results demonstrate that activation steering has systematic and forecastable side effects, enabling proactive safety auditing and more informed deployment of steering interventions\.

## 1Introduction

Activation steering\(Turner et al\.[2023](https://arxiv.org/html/2608.11227#bib.bib25); Zou et al\.[2023](https://arxiv.org/html/2608.11227#bib.bib29); Panickssery et al\.[2023](https://arxiv.org/html/2608.11227#bib.bib17); Li et al\.[2023](https://arxiv.org/html/2608.11227#bib.bib13)\)has emerged as one of the promising ways to control the behavior of large language models \(LLMs\)\. By adding a learned direction to a model’s hidden activations, it can increase or suppress a target behavior, such as concision, refusal, or helpfulness, without retraining or modifying the prompt\. Its low computational cost and compatibility with existing models have made activation steering an increasingly popular tool for model control\.

However, activation steering rarely changes only the intended behavior\. Steering one behavior often produces unintended changes in many others\. For example, making a model more concise can also make it appear less expert\(Cho et al\.[2026](https://arxiv.org/html/2608.11227#bib.bib8)\), while steering toward benign compliance or particular output styles can unintentionally weaken safety behaviors such as refusal\(Xiong et al\.[2026](https://arxiv.org/html/2608.11227#bib.bib28); Siu et al\.[2025](https://arxiv.org/html/2608.11227#bib.bib22); Korznikov et al\.[2025](https://arxiv.org/html/2608.11227#bib.bib12); Li et al\.[2026](https://arxiv.org/html/2608.11227#bib.bib14)\)\. Such side effects pose a practical challenge for deploying activation steering safely\. Before applying a steering direction, practitioners need to understand not only whether the desired behavior will improve, but also what other behaviors may be affected\.

Unfortunately, existing practice offers little support for answering this question\. Side effects are typically evaluated only after steering has been applied, and usually on a small set of manually selected metrics\. There is currently no systematic characterization of how steering one behavior influences others, nor any method for forecasting these side effects before intervention\. Existing heuristics based on the similarity between steering directions\(Korznikov et al\.[2025](https://arxiv.org/html/2608.11227#bib.bib12); Li et al\.[2026](https://arxiv.org/html/2608.11227#bib.bib14)\), such as cosine similarity, further assume that similar steering directions induce similar behavioral changes, an assumption that has not been systematically validated\.

In this work, we ask a simple question:*Can the side effects of activation steering be forecasted before steering is performed?*To answer this question, we first construct a*cross\-effect matrix*that characterizes how steering each behavior affects every other behavior in a fixed taxonomy of 67 behaviors \(Figure[1](https://arxiv.org/html/2608.11227#S1.F1)\)\. Across three open\-weight language models, we find that side effects are widespread, highly structured, and often asymmetric: steering behaviorAAmay amplify behaviorBB, while steeringBBsuppressesAA\. This asymmetry fundamentally limits similarity\-based approaches, which explain at most 23% of the observed coupling\.

![Refer to caption](https://arxiv.org/html/2608.11227v1/x1.png)Figure 1:Cross\-effect matrix of activation steering\. Rows denote the steered behavior, columns denote the measured behavior, and each entry represents the effect of steering one behavior on another\. Outlined cells are significant after FDR control; marginal bars count significant side effects per behavior\.Despite these complex interactions, we show that side effects are remarkably forecastable\. The magnitude of a side effect depends primarily on the target behavior itself, whereas its direction can be predicted by propagating the steering direction through a propagation map learned from unsteered text and decoding it with linear behavior probes \(Figure[2](https://arxiv.org/html/2608.11227#S5.F2)\)\. Without performing any steering, our approach correctly predicts whether major side effects correspond to amplification or suppression for 68–78% of flagged cases, substantially outperforming simple baselines\. Because the method requires only a steering direction for the source behavior and a probe for the target behavior, it naturally extends to behaviors that cannot themselves be steered\.

Our contributions are summarized as follows:

- •*A systematic measurement*of activation steering side effects through cross\-effect matrices spanning 67 behaviors on three language models\.
- •*An empirical characterization*showing that side effects are pervasive, low\-dimensional, and asymmetric, revealing interactions missed by existing evaluations\.
- •*A negative result*demonstrating that similarity between steering directions cannot reliably predict side effects and explains at most 23% of the observed coupling\.
- •*A forecasting framework*that ranks steering side effects and predicts whether they amplify or suppress each target before deployment, enabling proactive safety auditing of steering interventions\.

## 2Preliminaries and Problem Definition

Activation steering modifies an LLM at inference time by adding a learned direction to its hidden activations, thereby changing a target behavior without retraining\. Under the linear representation hypothesis\(Park, Choe, and Veitch[2024](https://arxiv.org/html/2608.11227#bib.bib18)\), a behavior is associated with a direction in the activation space, and moving the activations along that direction changes the corresponding behavior\. Formally, a*steering direction*for behavioriiconsists of a unit\-normalized vectorviv\_\{i\}and a residual\-stream layerℓ\\ellat which it is injected\. During generation, the hidden activation is modified as

hℓ′=hℓ\+α​n¯ℓ​vi,h^\{\\prime\}\_\{\\ell\}=h\_\{\\ell\}\+\\alpha\\,\\bar\{n\}\_\{\\ell\}\\,v\_\{i\},\(1\)whereα\\alphais the steering coefficient controlling the intervention strength andn¯ℓ\\bar\{n\}\_\{\\ell\}normalizes steering magnitudes across layers \(Appendix E\)\. The intervention is applied at every prompt and generated token position\.

While activation steering is designed to modify one target behavior, it may also unintentionally change many others\. Throughout this paper, we refer to the steered behavior as the*source behavior*and every evaluated behavior as a*target behavior*\. A behavior can serve as a source only if its steering direction is*validated*, i\.e\., steering reliably changes that behavior itself; otherwise it is considered*unsteerable*\. The effect of steering on its own source behavior is the*self\-effect*, while its effect on any other target behavior is a*cross\-effect*\. These cross\-effects constitute the*side effects*of activation steering studied in this work\.

Our research aims to forecast these side effects*before*steering is performed\. Specifically, given a validated steering direction, access to the model weights, and only*unsteered*model generations, we seek to predict how steering will affect all other behaviors\. We consider two forecasting tasks\. The first is to predict the*magnitude*of side effects by ranking target behaviors according to how strongly they will be influenced\. The second is to predict the*direction*of each side effect, namely whether steering will amplify or suppress the target behavior\. Such forecasts enable practitioners to assess the risks of a steering intervention before deployment, rather than discovering unintended behavioral changes only after they occur\.

## 3Measuring Side Effects

To forecast the side effects of activation steering, we first need to understand what those side effects are\. We therefore construct a systematic measurement of how steering one behavior influences every other behavior, resulting in a*cross\-effect matrix*that captures the behavioral footprint of each steering intervention\. This section describes the measurement protocol, including the behaviors we consider, how cross\-effects are estimated, and how genuine side effects are distinguished from measurement noise\.

#### Models, Behaviors, and Contexts\.

We evaluate three open\-weight models from two families: Gemma\-3\-4B, Gemma\-3\-12B, and Qwen2\.5\-7B\. Throughout the paper, numerical triplets follow this order\.

Behavior is defined using a fixed \(but extensible\) taxonomy of 67 behaviors spanning seven deployment groups, from coding assistance to safety\-sensitive requests \(Appendix A\)\. For each behavior, we construct a steering direction using the standard difference\-of\-means method by contrasting prompts that express the behavior with prompts that suppress it\.

Because steering effectiveness depends strongly on the intervention layer, we first identify the layers where steering reliably changes the target behavior, and then choose a single injection layer near the center of that range for each model \(Appendix A\): L16/34, L22/48, and L13/28 for Gemma\-3\-4B, Gemma\-3\-12B, and Qwen2\.5\-7B, respectively\. Behaviors are read out four to five layers downstream at L20, L26, and L18\.

Side effects can only be observed when the affected behavior has an opportunity to appear\. We therefore evaluate every steering direction on six fixed prompt sets, or*contexts*, designed to elicit a broad range of behaviors, from ambiguous requests to borderline harmful ones \(Table[1](https://arxiv.org/html/2608.11227#S3.T1)\)\. Cross\-effects are estimated by pooling all contexts\.

Finally, not every extracted steering direction reliably changes its intended behavior\. A behavior is therefore treated as a source only if steering significantly shifts its own judged score in the expected direction \(Appendix A\), yielding 52, 52, and 47 validated sources for the three models\. Behaviors that fail this validation remain included as target behaviors \(Table[3](https://arxiv.org/html/2608.11227#A1.T3)\)\.

Table 1:Representative prompt from each evaluation context\. The borderline\-harmful set includes dual\-use requests and benign prompts that test both under\- and over\-refusal\. It incorporates prompts adapted from the safe half of XSTest\(Röttger et al\.[2024](https://arxiv.org/html/2608.11227#bib.bib19)\), used under CC\-BY\-4\.0, some verbatim\.
#### Constructing the Cross\-Effect Matrix\.

To measure side effects reliably, we first determine how strongly each behavior can be steered without degrading the generated text\. Excessive steering often produces degenerate outputs that no longer reflect meaningful behavioral changes\. For every validated source behavior, we therefore identify the widest steering\-coefficient window over which generations remain free of degeneration \(Appendix D\)\.

We then estimate how every target behavior responds as the steering strength increases\. For each source behavior, we sweep the steering coefficient over five evenly spaced values within its calibrated window and generate four independent samples at each value, yielding5×4=205\\times 4=20generations per prompt\. Every generation is subsequently scored on all 67 behaviors by an independent LLM judge \(rubrics in Appendix B\), allowing us to observe how the entire behavioral profile evolves as the intervention becomes stronger\.

Letsj​p​\(α,σ\)s\_\{jp\}\(\\alpha,\\sigma\)denote the judged score of behaviorjjon promptppgenerated using steering coefficientα\\alphaand sampling seedσ\\sigma\. For each prompt, we fit a least\-squares line relating the judged score to the steering coefficient\. The resulting slope measures how strongly steering behavioriichanges behaviorjj\. Averaging these slopes across all prompts gives one entry of the cross\-effect matrix:

β^i​j​p=∑α,σ\(α−α¯\)​sj​p​\(α,σ\)∑α,σ\(α−α¯\)2,Mi​j=1P​∑pβ^i​j​p,\\hat\{\\beta\}\_\{ijp\}=\\frac\{\\sum\_\{\\alpha,\\sigma\}\(\\alpha\-\\bar\{\\alpha\}\)\\,s\_\{jp\}\(\\alpha,\\sigma\)\}\{\\sum\_\{\\alpha,\\sigma\}\(\\alpha\-\\bar\{\\alpha\}\)^\{2\}\},\\qquad M\_\{ij\}=\\frac\{1\}\{P\}\\sum\_\{p\}\\hat\{\\beta\}\_\{ijp\},\(2\)whereP=6×16=96P=6\\times 16=96under full coverage\. The resulting matrix𝐌∈ℝm×67\\mathbf\{M\}\\in\\mathbb\{R\}^\{m\\times 67\}summarizes the behavioral footprint of every validated steering direction: rows correspond to source behaviors, columns to target behaviors, while positive and negative entries indicate amplification and suppression, respectively\.

Because different behaviors admit different steering ranges, raw slopes are not directly comparable\. We therefore report each coupling using its total score change across the calibrated steering window,Δi​j=wi​Mi​j\\Delta\_\{ij\}=w\_\{i\}M\_\{ij\}, wherewiw\_\{i\}is the width of the steering window for source behaviorii\. Steering windows vary substantially across models \(Table[9](https://arxiv.org/html/2608.11227#A4.T9)\), so effect sizes are compared only within the same model\. Overall, constructing the cross\-effect matrix requires approximately 128,000 generations per model, each evaluated on all 67 behaviors \(Appendix D\)\.

#### Statistical Reliability\.

Since the cross\-effect matrix serves as the foundation for forecasting, we carefully distinguish genuine behavioral interactions from measurement noise\. For each matrix entry, we compute

ti​j=Mi​jσ^i​j/P,t\_\{ij\}=\\frac\{M\_\{ij\}\}\{\\hat\{\\sigma\}\_\{ij\}/\\sqrt\{P\}\},whereσ^i​j\\hat\{\\sigma\}\_\{ij\}is the sample standard deviation of the per\-prompt slopes in Equation[2](https://arxiv.org/html/2608.11227#S3.E2)\. Under a Student’sttdistribution withP−1P\-1degrees of freedom, an entry is considered significant if its two\-sidedpp\-value survives Benjamini–Hochberg correction\(Benjamini and Hochberg[1995](https://arxiv.org/html/2608.11227#bib.bib2)\)atq<0\.05q<0\.05over all off\-diagonal entries of the corresponding model\. Entries failing this test are treated as zero\.

We further verify that the measured side effects are reproducible\. Reconstructing the cross\-effect matrix from two disjoint prompt subsets yields Spearman correlations between0\.730\.73and0\.860\.86across models\. A lack\-of\-fit analysis also reveals only minor nonlinearities in the dose\-response relationship \(Appendix D\), supporting the use of a local linear approximation\.

Finally, to avoid self\-evaluation bias, all generations are scored using an independent judge model, Gemma\-4\-31B, which returns the expected score on a 1–4 scale under its token distribution\. A second judge from another model family, Qwen\-3\.6\-27B, independently re\-scores a confirmation subset and agrees with the primary judge at Spearman0\.930\.93on the individual scores it re\-rated \(Appendix B\)\.

The resulting cross\-effect matrix provides a systematic characterization of the behavioral footprint of activation steering\. In the next section, we analyze its empirical structure and show that, despite its apparent complexity, activation steering exhibits regularities that make its side effects predictable before any intervention is performed\.

## 4Empirical Study

Having measured the behavioral footprint of activation steering, we now ask three questions that determine whether side effects can be forecast\. First, are side effects common enough to warrant prediction? Second, do they exhibit systematic structure or merely reflect random interactions? Finally, can existing heuristics based on steering\-direction similarity explain these interactions? The answers motivate the forecasting framework developed in the next section\.

### 4\.1Side Effects Are Pervasive and Structured

Across all three models, side effects are common rather than exceptional\. Between 33–50% of tested behavior pairs exhibit statistically significant coupling, corresponding to roughly 22–33 side effects for every steered behavior \(Figure[1](https://arxiv.org/html/2608.11227#S1.F1); counts in Table[3](https://arxiv.org/html/2608.11227#A1.T3)\)\. These effects are also substantial: the median significant coupling changes the judged score by 0\.20–0\.25 on the four\-point scale, the strongest couplings exceed one full judge point on Gemma\-3\-4B \(Table[4](https://arxiv.org/html/2608.11227#A1.T4)\), and the strongest tenth exceed 0\.76–0\.78 points on the two larger models\. Their distribution is highly uneven\. For example, steering initiative affects 36 other behaviors on Gemma\-3\-4B, whereas steering harmful\-intent detection affects only 9\. Two control experiments further confirm that these effects are genuine rather than artifacts of the measurement pipeline: The smallest coupling this design can detect is 0\.10 to 0\.12; the median significant one is about twice that\. Random steering directions change judged scores by only about 0\.007 \(Table[6](https://arxiv.org/html/2608.11227#A3.T6); Appendix D\)\.

Although side effects are widespread, they are far from random\. A single dominant pattern explains approximately 64% of the variance in the cross\-effect matrix across all three models\. This dominant axis largely captures an elaboration\-versus\-terseness trade\-off, simultaneously increasing behaviors such as initiative, explanation depth, and scaffolding while suppressing concise responses, or vice versa\. Measuring the intrinsic dimensionality using the participation ratio\(Gao et al\.[2017](https://arxiv.org/html/2608.11227#bib.bib9)\)reveals only 4\.6–4\.9 effective dimensions, compared with 23–26 for shuffled controls \(Appendix D\)\. In other words, hundreds of observed side effects arise from only a handful of shared interaction patterns rather than independent pairwise relationships\. The dominant axis does not explain every interaction\. Roughly half of the significant couplings remain largely unchanged after it is removed, and safety\-related behaviors occupy substantially different regions of the behavioral space across model families\.

This structure is not an artifact of either the behavior taxonomy or the judge model\. When the same 67 behaviors are evaluated on unsteered generations, the dominant mode explains only 8\.6–10\.0% of the variance, and response length accounts for at most 19% of the measured couplings \(Appendix D\)\. The observed structure therefore reflects genuine interactions introduced by activation steering rather than properties of the evaluation pipeline\.

### 4\.2Existing Prediction Intuition Fails

A natural intuition is that similar steering directions should produce similar behavioral effects\. This intuition underlies the cosine\-similarity checks commonly used in prior work\(Korznikov et al\.[2025](https://arxiv.org/html/2608.11227#bib.bib12); Li et al\.[2026](https://arxiv.org/html/2608.11227#bib.bib14)\)to estimate whether one steering direction may influence another\. Such approaches implicitly assume that interactions between behaviors are approximately symmetric\.

Our measurements show that this assumption does not hold\. The effect of steering behaviorAAon behaviorBBcorresponds to matrix entryMi​jM\_\{ij\}, whereas steeringBBtowardAAcorresponds toMj​iM\_\{ji\}\. Among behavior pairs where both effects are statistically significant, 18–26% exhibit opposite signs \(39, 95, and 53 pairs across the three models\)\. For example, on Gemma\-3\-4B, steering toward thoroughness increases uncertainty disclosure, whereas steering toward uncertainty disclosure suppresses thoroughness\. Both effects independently survive FDR correction, and additional re\-testing confirms that these asymmetric interactions are robust rather than driven by a small number of outliers \(Appendix D\)\.

This asymmetry fundamentally limits any forecasting method based solely on similarity between steering directions\. Any similarity measure, including cosine similarity, is symmetric by definition:f​\(vi,vj\)=f​\(vj,vi\)f\(v\_\{i\},v\_\{j\}\)=f\(v\_\{j\},v\_\{i\}\)\. Consequently, it must make identical predictions forMi​jM\_\{ij\}andMj​iM\_\{ji\}, making opposite\-signed interactions impossible to predict correctly\. The empirical results confirm this limitation\. Using leave\-one\-behavior\-out evaluation \(Appendix C\), raw cosine similarity explains at most 19% of the held\-out coupling variance, while the best\-performing variant among five alternatives reaches only 23% \(Table[5](https://arxiv.org/html/2608.11227#A3.T5)\)\. Furthermore, the best similarity metric differs across models: whitening performs best on the Gemma models, whereas raw cosine performs best on Qwen2\.5\-7B\. Selecting the appropriate similarity measure therefore requires access to the very cross\-effect matrix one seeks to predict\. The most widely used practical heuristic, cosine similarity to the refusal direction, also fails: it shows no positive correlation with the measured effect on refusal, indicating that a low cosine similarity to a safety direction is not evidence that steering is safe \(Appendix D\)\.

These observations suggest that side effects cannot be forecasted simply by comparing steering directions\. Instead, successful forecasting must capture how a steering intervention propagates through the model and interacts with the internal representations of downstream behaviors\. We develop such a forecasting framework in the next section\.

## 5Forecasting Side Effects

Having established that activation steering produces systematic yet highly asymmetric side effects, we now turn to the central question of this paper:*Can these side effects be forecasted before any steering is performed?*Such a forecasting capability would enable practitioners to assess the risks of a steering intervention using only the original model, avoiding the need to exhaustively steer every behavior and measure its downstream consequences\.

Our empirical study suggests that forecasting naturally decomposes into two complementary tasks\. The first is to estimate*how much*each target behavior is likely to change\. The second is to determine*which way*it will change, namely whether the target behavior will be amplified or suppressed\. As we will show later, the first question is largely determined by the target behavior itself, whereas the second depends on the interaction between the source and target behaviors\. We therefore focus on forecasting the latter, which is both more challenging and more informative for understanding the behavioral consequences of activation steering\. Specifically, we propose a forecasting framework that explicitly models how a steering intervention propagates through the model and how downstream behaviors are represented\. Figure[2](https://arxiv.org/html/2608.11227#S5.F2)provides an overview\.

![Refer to caption](https://arxiv.org/html/2608.11227v1/x2.png)Figure 2:The propagation map and the static cosine check it replaces; layers shown are Gemma\-3\-4B’s\.### 5\.1Propagation\-Based Forecasting

Our forecasting framework consists of two components learned entirely from*unsteered*model executions: \(1\) a behavioral probe that recognizes each target behavior from hidden representations, and \(2\) a propagation model that predicts how a steering intervention evolves as it travels through the network\. Together, they estimate the behavioral footprint of a steering direction without performing the intervention itself\.

Unlike previous approaches, the framework treats the source and target behaviors differently\. A source behavior is represented by its steering direction, which specifies how the intervention is applied\. A target behavior is represented by a behavioral probe, which specifies how that behavior is detected in the model’s internal representation\. This distinction naturally accommodates the asymmetric interactions observed in Section[4](https://arxiv.org/html/2608.11227#S4)\.

The two components are trained using only ordinary, unsteered generations\. For each model, we collect a corpus of 1,288–2,039 generations across the six evaluation contexts, record the hidden activations at both the injection and readout layers, and obtain judge scores for all 67 behaviors\. In contrast, constructing the full cross\-effect matrix requires approximately 128,000 steered generations\. The forecasting model therefore learns from two orders of magnitude less data while never observing the effects it is asked to predict\.

For each behaviorjj, we first train a linear proberjr\_\{j\}at the readout layer to predict the judge score of that behavior from the hidden activation\. Unlike a steering direction, the probe only needs to recognize whether a behavior is present in ordinary text rather than induce it\. Thus, every behavior receives a probe, including behaviors that cannot be steered\.

We next learn a linear propagation mapWWthat predicts how hidden representations evolve between the injection layer and the readout layer\. Trained as a ridge regression on the same unsteered corpus, the map estimates the readout\-layer activation from the activation at the injection layer\. Intuitively, it predicts what a perturbation introduced by activation steering will look like after propagating through the intervening transformer layers\.

Combining the propagation map with the behavioral probes yields a simple forecasting rule\. Steering source behavioriiperturbs the hidden representation along directionviv\_\{i\}\. The propagation map transports this perturbation to the readout layer asW​viWv\_\{i\}, and the behavioral probe for target behaviorjjmeasures how strongly that perturbation aligns with the representation of the target behavior\. The predicted side effect is thereforeM^i​j=⟨W​vi,rj⟩\\hat\{M\}\_\{ij\}=\\langle Wv\_\{i\},r\_\{j\}\\ranglewhere common scaling factors are omitted because they affect every source equally\. RankingM^i​j\\hat\{M\}\_\{ij\}over target behaviors predicts which behaviors are most affected by steering sourceii, while the sign predicts whether each behavior is amplified or suppressed\.

The forecasting framework contains only one tunable hyperparameter, namely the ridge regularization strength used to learn the propagation map\. It is selected by nested cross\-validation using only the training behaviors in each evaluation fold, ensuring that no measured side effects of the held\-out behavior influence its forecast \(Appendix D\)\.

### 5\.2Evaluation Protocol

We evaluate the forecaster in a strict cold\-start setting, where it must predict side effects for behaviors whose measured cross\-effects are unavailable\. This reflects the intended deployment scenario: estimating the behavioral footprint of a new steering direction without first constructing its corresponding row or column of the cross\-effect matrix\.

To evaluate generalization from both perspectives, we consider two held\-out settings\. In the*source split*, one source behavior is held out, and the forecaster predicts its entire row of the cross\-effect matrix\. In the*target split*, one target behavior is held out, and the forecaster predicts the corresponding column\. Every behavior is held out once in turn, and all model selection is performed using only the remaining behaviors\.

Forecast quality is measured using the mean Spearman rank correlation between the predicted and measured side\-effect profiles of each held\-out behavior\. We use a ranking\-based metric because judge scores are ordinal rather than interval\-scaled, and because the relative ordering of side effects is substantially more reproducible than their absolute magnitudes \(Appendix D\)\.

Not every behavior can be reliably recognized from hidden activations, regardless of the forecasting method\. We therefore evaluate on the subset of target behaviors whose behavioral probes achieve an AUROC of at least 0\.76 in at least five of the six evaluation contexts, yielding 42, 37, and 46 targets for the three models\. This filtering criterion is determined solely from unsteered data and is fixed before any forecasting experiment\. Appendix D reports the full 67\-behavior panel and alternative thresholds\.

### 5\.3Baselines

We compare the proposed forecaster against both practical forecasting and reference methods that require information unavailable before steering\. This separation distinguishes methods that can genuinely forecast side effects from those that serve only as diagnostic references\.

Among the practical baselines, the most widely used approach is*cosine similarity*, which predicts interactions from the similarity between steering directions\. We evaluate both the raw cosine similarity and its whitened variant\. Since these methods require a steering direction for every target behavior, they cannot be applied to behaviors without a validated steering vector\. We also consider a stronger*direct probe*baseline, which removes the propagation map from our framework and directly scores the alignment between the source steering direction and the target behavioral probe:⟨vi,rj⟩\\langle v\_\{i\},r\_\{j\}\\rangle\(instead of⟨W​vi,rj⟩\\langle Wv\_\{i\},r\_\{j\}\\rangle\)\. Comparing the direct probe against the full model isolates the contribution of modeling how steering interventions propagate through the network\.

We further report three reference methods that assume access to information unavailable in the intended deployment scenario\. The*per\-target mean*predicts each target using its average measured coupling across all other source behaviors\.*Nearest\-neighbor transfer*copies the measured side\-effect profile of the most similar previously measured behavior, using cosine similarity between steering directions \(or between behavioral probes in the target split\)\. Finally, the*measured\-shift readout*performs the actual steering intervention and feeds the observed activation change through the same behavioral probes, thereby removing errors introduced by the propagation model\. This method isolates the error contributed by the propagation model\. For context, we also report the split\-half reproducibility of the measured cross\-effect matrix, which represents the performance ceiling imposed by measurement noise\.

Table 2:Higher is better; each entry is the mean Spearman correlation between predicted and measured side\-effect profiles\. Results use the new\-source \(src\) and new\-target \(tgt\) held\-out splits of Section[5\.2](https://arxiv.org/html/2608.11227#S5.SS2)\(the rubric\-text row is source\-split only\)\. Daggers mark splits where propagation significantly exceeds raw cosine under the paired cluster bootstrap of Appendix D\.
### 5\.4Results

Table[2](https://arxiv.org/html/2608.11227#S5.T2)summarizes the forecasting results\. We first compare methods that rely only on unsteered model executions, since these constitute genuine pre\-deployment forecasts\. The propagation forecaster consistently outperforms the cosine\-similarity heuristics currently used in practice\. Compared with raw cosine similarity, it achieves higher Spearman correlation on all six combinations of model and evaluation split, with statistically significant improvements on five of them \(Table[2](https://arxiv.org/html/2608.11227#S5.T2); Appendix D\)\. It also outperforms the stronger whitened cosine variant on four of the six settings and matches it on the remaining two\. The improvement is particularly pronounced on Qwen2\.5\-7B, where whitening no longer benefits from the dominant interaction pattern identified in Section[4\.1](https://arxiv.org/html/2608.11227#S4.SS1)\. These gains are obtained without observing any steered generations during training\.

The reference methods provide useful context for interpreting these results\. Rubric\-text similarity, which compares only the textual descriptions of behaviors, achieves correlations of just 0\.07–0\.10, indicating that side effects are properties of the model rather than the behavior definitions\. Nearest\-neighbor transfer performs substantially better, reaching 0\.47–0\.52 on new source behaviors, but only because it copies profiles from an already measured cross\-effect matrix\. Likewise, the measured\-shift readout performs the steering intervention itself before making a prediction, eliminating uncertainty in the propagation model\. These methods therefore serve as privileged references rather than realistic forecasting approaches\. At the other extreme, removing the propagation model entirely and directly comparing steering directions against behavioral probes consistently degrades performance, demonstrating that explicitly modeling how steering perturbations evolve through the network contributes meaningful predictive signal\.

Finally, we examine what aspects of side effects are actually predictable\. A deployed forecasting system must estimate both*how much*each behavior will change and*whether*it will be amplified or suppressed\. Interestingly, these two questions have different answers\. Effect magnitude is largely determined by the target behavior itself: simply ranking targets by their average measured coupling across other sources identifies the largest side effects more accurately than our forecaster \(Appendix D\)\. In contrast, predicting the direction of change fundamentally depends on the interaction between the source and target behaviors\. On the top decile of predicted side effects, the propagation forecaster correctly predicts the sign of 68–78% of held\-out interactions, against 50–58% for the majority\-sign baseline\. Unlike cosine\-based methods, it also produces predictions for every behavior, including those without validated steering directions\. An error analysis further shows that most remaining forecasting error originates from imperfect behavioral probes rather than the propagation model itself: replacing the learned propagation map with the true activation shift after steering yields only modest additional improvements \(Table[2](https://arxiv.org/html/2608.11227#S5.T2)\)\.

Together, these results indicate that the proposed propagation framework successfully captures the pairwise interactions that determine the direction of side effects, while leaving further improvements to richer representations of downstream behaviors\.

## 6Related Work

#### Activation steering and side effects\.

Activation steering has emerged as an effective way to modify LLM behavior without retraining\(Turner et al\.[2023](https://arxiv.org/html/2608.11227#bib.bib25); Zou et al\.[2023](https://arxiv.org/html/2608.11227#bib.bib29); Panickssery et al\.[2023](https://arxiv.org/html/2608.11227#bib.bib17); Li et al\.[2023](https://arxiv.org/html/2608.11227#bib.bib13)\), with steering directions capable of encoding coherent behavioral traits\(Chen et al\.[2025](https://arxiv.org/html/2608.11227#bib.bib7)\)\. We adopt the standard difference\-of\-means construction\(Panickssery et al\.[2023](https://arxiv.org/html/2608.11227#bib.bib17)\)\(variants in Appendix E\)\. Several studies report that steering one behavior can unintentionally affect others, particularly safety\-related behaviors\(Xiong et al\.[2026](https://arxiv.org/html/2608.11227#bib.bib28); Li et al\.[2026](https://arxiv.org/html/2608.11227#bib.bib14)\)\. However, existing work primarily measures such side effects after steering has been applied, and there is disagreement over whether they can be inferred from overlap with safety directions\(Korznikov et al\.[2025](https://arxiv.org/html/2608.11227#bib.bib12); Li et al\.[2026](https://arxiv.org/html/2608.11227#bib.bib14)\)\. In contrast, we study whether these side effects can be forecast before any intervention is performed\.

#### Behavioral interactions and forecasting\.

Recent work has examined interactions between steering directions and their geometric properties\. Prior studies show that orthogonalizing steering vectors does not eliminate behavioral interference\(Bhandari, Naseem, and Nasim[2026](https://arxiv.org/html/2608.11227#bib.bib4)\), vector similarity alone is a poor predictor of steering outcomes\(Bas and Novak[2025](https://arxiv.org/html/2608.11227#bib.bib1)\), and collateral effects can be measured or mitigated during steering\(Nguyen et al\.[2026](https://arxiv.org/html/2608.11227#bib.bib16); Siu et al\.[2025](https://arxiv.org/html/2608.11227#bib.bib22); Jiang et al\.[2025](https://arxiv.org/html/2608.11227#bib.bib11)\)\. Other work has shown that steering directions may generalize unreliably across prompts\(Tan et al\.[2024](https://arxiv.org/html/2608.11227#bib.bib24); Braun et al\.[2025](https://arxiv.org/html/2608.11227#bib.bib5)\), that recognizing a behavior can differ from controlling it\(Wu et al\.[2026](https://arxiv.org/html/2608.11227#bib.bib27)\), that steering directions exhibit low\-rank structure\(Bhandari et al\.[2025](https://arxiv.org/html/2608.11227#bib.bib3); Sharma et al\.[2026](https://arxiv.org/html/2608.11227#bib.bib21)\), and that activation probes can predict behavioral properties\(Huang et al\.[2025](https://arxiv.org/html/2608.11227#bib.bib10)\)\. Our work builds on these observations but addresses a different problem: forecasting the side effects of previously unseen steering interventions before they are executed\. To this end, we combine behavioral probes with a learned propagation model to predict asymmetric interactions across 67 behaviors and three LLMs using only unsteered model executions\.

## 7Discussion

Our results suggest that the side effects of activation steering are not arbitrary, but arise from systematic interactions that can often be forecast before steering is applied\. While the magnitude of a side effect is largely determined by the target behavior, its direction depends on the specific source–target pair\. This distinction explains why similarity\-based heuristics perform poorly and motivates forecasting methods that explicitly model how steering perturbations propagate through the network\.

The proposed framework has several limitations\. It predicts the relative ordering and direction of side effects rather than calibrated effect sizes, and it is less effective at identifying the largest effects than simply knowing which targets are generally sensitive to steering\. Its predictions are also most reliable at the level of an entire side\-effect profile rather than individual matrix entries\. Furthermore, all behavioral scores and learned probes ultimately depend on an LLM judge\. Although agreement with a second judge is high and blind human ratings reproduce its ordering on four of fifteen headline behaviors, our results establish consistency under these judges rather than absolute ground truth\. Finally, our study focuses on linear activation steering and Euclidean representation similarity; extending the framework to nonlinear steering methods is an important direction for future work\.

From a practical perspective, our threat model is a practitioner who unintentionally introduces harmful behavioral changes while steering a desirable capability\. Since activation steering already requires white\-box access to the model, the forecasting framework provides little additional capability to an attacker\. Instead, it offers a lightweight way to identify behaviors that should be audited before deployment\.

More broadly, this work reframes activation steering as a prediction problem\. Rather than discovering unintended consequences only after an intervention, practitioners can forecast much of a steering direction’s behavioral footprint using only the original model\. We hope this perspective encourages predictive safety analysis not only for activation steering, but also for other forms of representation\-level intervention\.

## References

- Bas and Novak \(2025\)Bas, T\.; and Novak, K\. 2025\.What Can We Actually Steer? A Multi\-Behavior Study of Activation Control\.arXiv:2511\.18284\.
- Benjamini and Hochberg \(1995\)Benjamini, Y\.; and Hochberg, Y\. 1995\.Controlling the False Discovery Rate: A Practical and Powerful Approach to Multiple Testing\.*Journal of the Royal Statistical Society: Series B \(Methodological\)*, 57\(1\): 289–300\.
- Bhandari et al\. \(2025\)Bhandari, P\.; Fay, N\.; Selvaganapathy, S\.; Datta, A\.; Naseem, U\.; and Nasim, M\. 2025\.Activation\-Space Personality Steering: Hybrid Layer Selection for Stable Trait Control in LLMs\.EACL 2026, arXiv:2511\.03738\.
- Bhandari, Naseem, and Nasim \(2026\)Bhandari, P\.; Naseem, U\.; and Nasim, M\. 2026\.Do Personality Traits Interfere? Geometric Limitations of Steering in Large Language Models\.arXiv:2602\.15847\.
- Braun et al\. \(2025\)Braun, J\.; Eickhoff, C\.; Krueger, D\.; Bahrainian, S\. A\.; and Krasheninnikov, D\. 2025\.Understanding \(Un\)Reliability of Steering Vectors in Language Models\.ICLR 2025 Workshop on Foundation Models in the Wild, arXiv:2505\.22637\.
- Brown \(1910\)Brown, W\. 1910\.Some Experimental Results in the Correlation of Mental Abilities\.*British Journal of Psychology*, 3\(3\): 296–322\.
- Chen et al\. \(2025\)Chen, R\.; Arditi, A\.; Sleight, H\.; Evans, O\.; and Lindsey, J\. 2025\.Persona Vectors: Monitoring and Controlling Character Traits in Language Models\.arXiv:2507\.21509\.
- Cho et al\. \(2026\)Cho, Y\.\-M\.; Yuan, Y\.; Guntuku, S\. C\.; and Ungar, L\. 2026\.A Concise Agent is Less Expert: Revealing Side Effects of Using Style Features on Conversational Agents\.arXiv:2601\.10809\.
- Gao et al\. \(2017\)Gao, P\.; Trautmann, E\.; Yu, B\. M\.; Santhanam, G\.; Ryu, S\.; Shenoy, K\.; and Ganguli, S\. 2017\.A Theory of Multineuronal Dimensionality, Dynamics and Measurement\.*bioRxiv*, 214262\.
- Huang et al\. \(2025\)Huang, V\.; Choi, D\.; Johnson, D\. D\.; Schwettmann, S\.; and Steinhardt, J\. 2025\.Predictive Concept Decoders: Training Scalable End\-to\-End Interpretability Assistants\.arXiv:2512\.15712\.
- Jiang et al\. \(2025\)Jiang, X\.; Zhang, L\.; Zhang, J\.; Yang, Q\.; Hu, G\.; Wang, D\.; and Hu, L\. 2025\.Adaptive Multi\-Subspace Representation Steering for Attribute Alignment in Large Language Models\.arXiv:2508\.10599\.
- Korznikov et al\. \(2025\)Korznikov, A\.; Galichin, A\.; Dontsov, A\.; Rogov, O\. Y\.; Oseledets, I\.; and Tutubalina, E\. 2025\.The Rogue Scalpel: Activation Steering Compromises LLM Safety\.arXiv:2509\.22067\.
- Li et al\. \(2023\)Li, K\.; Patel, O\.; Viégas, F\.; Pfister, H\.; and Wattenberg, M\. 2023\.Inference\-Time Intervention: Eliciting Truthful Answers from a Language Model\.In*Advances in Neural Information Processing Systems*, volume 36\.
- Li et al\. \(2026\)Li, Y\.; Fastowski, A\.; Zaradoukas, E\.; Prenkaj, B\.; and Kasneci, G\. 2026\.Analysing the Safety Pitfalls of Steering Vectors\.In*Findings of the Association for Computational Linguistics: ACL 2026*\.
- Liu et al\. \(2023\)Liu, Y\.; Iter, D\.; Xu, Y\.; Wang, S\.; Xu, R\.; and Zhu, C\. 2023\.G\-Eval: NLG Evaluation using GPT\-4 with Better Human Alignment\.In*Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing*, 2511–2522\.
- Nguyen et al\. \(2026\)Nguyen, T\.; Nguyen, T\. A\.; Alemohammad, S\.; and Baraniuk, R\. G\. 2026\.Minimizing Collateral Damage in Activation Steering\.arXiv:2605\.01167\.
- Panickssery et al\. \(2023\)Panickssery, N\.; Gabrieli, N\.; Schulz, J\.; Tong, M\.; Hubinger, E\.; and Turner, A\. M\. 2023\.Steering Llama 2 via Contrastive Activation Addition\.arXiv:2312\.06681\.
- Park, Choe, and Veitch \(2024\)Park, K\.; Choe, Y\. J\.; and Veitch, V\. 2024\.The Linear Representation Hypothesis and the Geometry of Large Language Models\.In*Proceedings of the 41st International Conference on Machine Learning*\.
- Röttger et al\. \(2024\)Röttger, P\.; Kirk, H\. R\.; Vidgen, B\.; Attanasio, G\.; Bianchi, F\.; and Hovy, D\. 2024\.XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models\.In*Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics*\.
- Schuirmann \(1987\)Schuirmann, D\. J\. 1987\.A Comparison of the Two One\-Sided Tests Procedure and the Power Approach for Assessing the Equivalence of Average Bioavailability\.*Journal of Pharmacokinetics and Biopharmaceutics*, 15\(6\): 657–680\.
- Sharma et al\. \(2026\)Sharma, A\.; Schroeder de Witt, C\.; Torr, P\.; Calinescu, A\.; and Yu, J\. 2026\.A Low\-Rank Subspace Analysis of LLM Interventions\.Mechanistic Interpretability Workshop at ICML 2026, arXiv:2606\.14388\.
- Siu et al\. \(2025\)Siu, V\.; Crispino, N\.; Park, D\.; Henry, N\. W\.; Wang, Z\.; Liu, Y\.; Song, D\.; and Wang, C\. 2025\.SteeringSafety: A Systematic Safety Evaluation Framework of Representation Steering in LLMs\.Earlier version titled “SteeringControl: Holistic Evaluation of Alignment Steering in LLMs”, arXiv:2509\.13450\.
- Spearman \(1910\)Spearman, C\. 1910\.Correlation Calculated from Faulty Data\.*British Journal of Psychology*, 3\(3\): 271–295\.
- Tan et al\. \(2024\)Tan, D\.; Chanin, D\.; Lynch, A\.; Paige, B\.; Kanoulas, D\.; Garriga\-Alonso, A\.; and Kirk, R\. 2024\.Analysing the Generalisation and Reliability of Steering Vectors\.In*Advances in Neural Information Processing Systems*, volume 37\.
- Turner et al\. \(2023\)Turner, A\. M\.; Thiergart, L\.; Leech, G\.; Udell, D\.; Vazquez, J\. J\.; Mini, U\.; and MacDiarmid, M\. 2023\.Steering Language Models With Activation Engineering\.arXiv:2308\.10248\.
- Wilcoxon \(1945\)Wilcoxon, F\. 1945\.Individual Comparisons by Ranking Methods\.*Biometrics Bulletin*, 1\(6\): 80–83\.
- Wu et al\. \(2026\)Wu, J\.; Xie, Y\.; Lin, S\.; Zhao, S\.; and Chen, X\. 2026\.Knowing without Acting: The Disentangled Geometry of Safety Mechanisms in Large Language Models\.arXiv:2603\.05773\.
- Xiong et al\. \(2026\)Xiong, C\.; He, Z\.; Chen, P\.\-Y\.; Ko, C\.\-Y\.; and Ho, T\.\-Y\. 2026\.Steering Externalities: Benign Activation Steering Unintentionally Increases Jailbreak Risk for Large Language Models\.arXiv:2602\.04896\.
- Zou et al\. \(2023\)Zou, A\.; Phan, L\.; Chen, S\.; Campbell, J\.; Guo, P\.; Ren, R\.; Pan, A\.; Yin, X\.; Mazeika, M\.; Dombrowski, A\.\-K\.; Goel, S\.; Li, N\.; Byun, M\. J\.; Wang, Z\.; Mallen, A\.; Basart, S\.; Koyejo, S\.; Song, D\.; Fredrikson, M\.; Kolter, J\. Z\.; and Hendrycks, D\. 2023\.Representation Engineering: A Top\-Down Approach to AI Transparency\.arXiv:2310\.01405\.

## Appendix AAppendix A\. The 67\-Behavior Taxonomy and the Measured Object

The 67 behaviors span seven groups: core assistant, coding, research, tutoring, support, creative writing, and safety\. Each model’s validated source set under the one validation criterion \(Section[3](https://arxiv.org/html/2608.11227#S3), Table[3](https://arxiv.org/html/2608.11227#A1.T3)\) is a coefficient\- and layer\-contingent working set rather than an intrinsic partition; the validated sets enter the geometry and dynamics analyses\. The taxonomy is fixed in advance and not pruned to fit results\. Validation is one test applied identically on every model: steering must move the behavior’s own judged score in the steered direction \(FDRq<0\.05q<0\.05in at least one context\), with a significant wrong\-sign shift anywhere disqualifying\. The full taxonomy with each behavior’s judge gloss is Table[11](https://arxiv.org/html/2608.11227#A5.T11), and Table[3](https://arxiv.org/html/2608.11227#A1.T3)is the matrix\-entry inventory\.

#### Matrix inventory\.

Figure[5](https://arxiv.org/html/2608.11227#A5.F5)shows the Gemma\-3\-4B matrix of Figure[1](https://arxiv.org/html/2608.11227#S1.F1)at full scale\. Gemma\-3\-4B retains roughly 22 target behaviors per source \(1,124 off\-diagonal entries across 52 sources\), Qwen2\.5\-7B roughly 33 \(1,562 entries across 47 sources\), and Gemma\-3\-12B roughly 32 \(1,676 entries across 52 sources\)\. Appendix D gives the raw\-spectrum decomposition, while the geometry\-mode ladder is in Appendix C\.

#### Layer selection\.

On Gemma\-3\-4B a blinded\-judge screen identified the band of layers with significant behavioral control: a layer counts only if the judge picks out generations steered there as expressing the target above chance \(one\-sided binomial test, FDR\-controlled\), and the common layer L16 was fixed within that band\. On Gemma\-3\-12B and Qwen2\.5\-7B the injection layer was selected by self\-effect slope sweeps over candidate mid\-network layers\.

Table 3:Matrix\-entry inventory for the cross\-effect matrix\. The survivor\-refit control of Table[8](https://arxiv.org/html/2608.11227#A3.T8)conditions on BH survivors of the full off\-diagonal family intersected with the validated block \(949/1,365/1,129 cells\), a strict subset of the validated\-family counts above; the 3\-to\-5\-cell difference is the marginal entries admitted by the smaller family’s less stringent BH threshold\. The per\-behavior\-layer Gemma\-3\-4B control is indexed in Appendix D\.
Table 4:The strongest significant off\-diagonal couplings by absoluteΔ\\Deltascore on the Gemma\-3\-4B cross\-effect matrix, steered source to target, with sign preserved\.Δ\\Deltascore isΔi​j=wi​Mi​j\\Delta\_\{ij\}=w\_\{i\}M\_\{ij\}, the judge\-score change over the source’s full calibrated window \(Section[3](https://arxiv.org/html/2608.11227#S3)\)\.

## Appendix BAppendix B\. Judge Panel and Calibration

#### Composition and working mode\.

The working judge is Gemma\-4\-31B, an instruction\-tuned Gemma\-family model scoring each generation on all 67 behaviors; it is a different generation from the Gemma steered models and roughly2\.6×2\.6\\timesthe size of the largest steered subject, so no model scores its own outputs\. Single\-judge scoring is the operative mode for headline results\. A second judge from a different family, Qwen\-3\.6\-27B, was chosen so that a shared Gemma\-family bias cannot pass unnoticed: it scored the Gemma\-3\-4B confirmation samples and re\-scored the injection\-layer forecasting generations in four of six contexts \(per\-judge expected\-value Pearson0\.890\.89, Spearman0\.930\.93pooled over those cells,n=34,840n=34\{,\}840\)\. All three matrices are single\-judge; for the Qwen2\.5\-7B matrix, the working Gemma judge is already cross\-family\.

#### Soft logit\-Δ\\Deltascore scoring\.

Each \(generation, behavior\) pair is scored by a single non\-autoregressive forward pass of the judge over that behavior’s rubric prompt; we read the last\-token logits over the candidate rating tokens, softmax them, and take the expected value of the rating under that distribution \(s=∑rwr​ezr/∑r′ezr′s=\\sum\_\{r\}w\_\{r\}\\,e^\{z\_\{r\}\}\\\!/\\sum\_\{r^\{\\prime\}\}e^\{z\_\{r^\{\\prime\}\}\}, withzrz\_\{r\}the last\-token logit of rating tokenrrandwrw\_\{r\}its numeric value\)\. Scores remain in each behavior’s native judge units before slopes enterMM\. This is the probability\-weighted score of G\-Eval\(Liu et al\.[2023](https://arxiv.org/html/2608.11227#bib.bib15)\)without its chain\-of\-thought stage: G\-Eval defines its final score as the same expectation of the rating under the judge’s output distribution, but had to approximate it by repeated sampling because the closed model it used exposed no token probabilities\. Reading the rating logits directly makes one forward pass per \(generation, behavior\) pair sufficient, and judge cost is independent of the steered model’s size\.

#### Rubric template\.

Every behavior is scored by one rubric prompt instantiated from a shared template: a one\-sentence behavior definition, the user prompt, the model response, four anchored rating levels each with a worked example, and a closing instruction to answer with a single rating token\. Sixty\-four behaviors use the graded 1 to 4 scale; three genuinely discrete behaviors \(tool\-action gating, dependency\-change conservatism, and benign\-alternative suggestion\) use a binary YES/NO rubric read the same way\. All 67 rubrics are included in the code release\.

YouareevaluatingwhetheranAIassistant

\{behaviordefinition\}\.

User’srequest:

\{prompt\}

AI’sresponse:

\{response\}

Rate\{thebehavior\}onascaleof1to4:

1=\{anchor\}\.Example:\{workedexample\}

2=\{anchor\}\.Example:\{workedexample\}

3=\{anchor\}\.Example:\{workedexample\}

4=\{anchor\}\.Example:\{workedexample\}

RespondwithONLYasinglenumber:1,2,3,or4\.

Listing 1The shared graded judge rubric template\. The score is the expected rating under the judge’s token distribution over the four rating tokens; three discrete behaviors use the analogous binary YES/NO variant described above\.
#### Combining the two judges on confirmation samples\.

The three cross\-effect matrices use single\-judge FDR and coherence screening\. Where both judges scored a confirmation sample, their ratings were combined using a grounding score that measures support from spans of the generated text\. The two\-judge agreement check applies only to those confirmation samples: sign disagreements are quarantined as low\-agreement, with no tie\-breaker, and do not alter membership in the cross\-effect matrices\.

#### Validity status\.

The panel is rank\-valid and partially human\-validated through PI\-vetted exemplars: its entry ordering matches spot\-checked human labels on the headline examples, but it is not scale\-calibrated\. This is construct validity: whether humans rank examples as the judge ranks them\. It is not interval\-scale validation, because no behavioral interval scale is assumed to exist\.

#### Human\-validation protocol\.

Judge exemplars for the graded scales were LLM\-drafted and human\-vetted: all 116 validation\-split items across the three irreducibly subjective constructs were reviewed by two vetters working to consensus, with one label corrected in review\. For the headline behaviors, the strongest couplings \(Table[4](https://arxiv.org/html/2608.11227#A1.T4)\) and the forecasting\-split targets deduplicated to 15 behaviors, the artifact index includes fixed rating packets of at least 20 distinct prompts per behavior and a frozen Spearman≥0\.70\\geq 0\.70pass criterion\. One rater \(an author; ratings LLM\-drafted from the packets, then corrected and signed\) rated all 15 packets blind to judge scores: judge\-versus\-rater Spearman on the 20 test items per behavior spans0\.300\.30to1\.001\.00, exceeding the criterion on four \(harmful\-intent detection1\.001\.00, empathy0\.990\.99, simplicity\-for\-novice0\.870\.87, analogy use0\.810\.81\)\. Headline claims rest on the rank\-level cross\-family LLM\-judge agreement reported above, not on calibrated absolute scores\.

## Appendix CAppendix C\. Predictors, Baselines, Nulls, and the Full Evidence

#### Division of labor\.

Table[7](https://arxiv.org/html/2608.11227#A3.T7)defines the predictors, Table[6](https://arxiv.org/html/2608.11227#A3.T6)collects the controls on the measurement and on the geometry bound, Table[5](https://arxiv.org/html/2608.11227#A3.T5)is the headline geometry result, and Table[8](https://arxiv.org/html/2608.11227#A3.T8)is the geometry decision ladder\.

Table 5:Held\-outR2R^\{2\}of direction geometry on each cross\-effect matrix: raw cosine and the best variant per model \(whitening on the Gemma models, raw on Qwen2\.5\-7B, selected post hoc\), each with its leading principal component removed\. All validated\-block rows havep<0\.0005p<0\.0005; full sweep in Table[8](https://arxiv.org/html/2608.11227#A3.T8)\.
Table 6:Controls on the measurement and on the geometry bound\. The first three legitimize the matrices; the rest bound the geometry claim\. The rank\-recode and self\-normalized rows run on the validated blocks of all three models; the refusal\-column, judge\-similarity, trained\-probe, and power\-analysis rows run on the 26\-source Gemma\-3\-4B subset, and the three refusal\-column values are its per\-behavior\-layer control matrix, its injection\-layer directions, and its pooled matrix\. Headline geometryR2R^\{2\}values are in Table[5](https://arxiv.org/html/2608.11227#A3.T5); significant\-entry and dominant\-mode rows are in Table[8](https://arxiv.org/html/2608.11227#A3.T8)\.

#### Predictors\.

Table[7](https://arxiv.org/html/2608.11227#A3.T7)defines every predictor\. The deployed or tested objects are static direction geometryGi​jdir=cos⁡\(vi,vj\)G^\{\\mathrm\{dir\}\}\_\{ij\}=\\cos\(v\_\{i\},v\_\{j\}\), the direct probe, propagation through a layer\-to\-layer map fit on unsteered residuals, and the measured\-shift readout built from the actual downstream residual change\. The whitened, top\-component\-removed, layer\-mapped, and injection\-layer direction\-cosine matrices are variants of the geometry predictor \(whitening corrects for all steering directions pointing broadly the same way; top\-component removal subtracts the single component shared across the set; layer mapping appliesWWbefore the comparison\)\. Permutationpp\-values arep=\(1\+\#​\{b≤B:\|T\(b\)\|≥\|Tobs\|\}\)/\(B\+1\)p=\\bigl\(1\+\\\#\\\{b\\leq B:\|T^\{\(b\)\}\|\\geq\|T^\{\\mathrm\{obs\}\}\|\\\}\\bigr\)/\(B\+1\)overBBdraws, hence lower\-bounded by1/\(B\+1\)1/\(B\+1\); values reported at the floor \(p<0\.005p<0\.005for 200 draws,p<0\.0005p<0\.0005for 2000 draws\) mean no null draw exceeded the observed statistic\.

Table 7:Predictor reference\. The direct probe and propagation are forecasters\. The measured\-shift readout requires the intervention; the remaining rows are geometry predictors or diagnostics\.

#### Lookup references\.

Baselines are defined in Section[5](https://arxiv.org/html/2608.11227#S5)\. The per\-target mean and nearest\-neighbor transfer consume the measured matrix; they calibrate the forecasters but are unavailable at a true cold start\.

#### Held\-out schemes and estimators\.

For geometry foldbb, let𝒯b\\mathcal\{T\}\_\{b\}contain the off\-diagonal pairs whose source and target are both different frombb\. For each candidate similarity matrixGG, fit an ordinary linear regression with intercept,

\(β^0,β^1\)=arg⁡minβ0,β1​∑\(i,j\)∈𝒯b\(Mi​j−β0−β1​Gi​j\)2,\(\\hat\{\\beta\}\_\{0\},\\hat\{\\beta\}\_\{1\}\)=\\arg\\min\_\{\\beta\_\{0\},\\beta\_\{1\}\}\\sum\_\{\(i,j\)\\in\\mathcal\{T\}\_\{b\}\}\\left\(M\_\{ij\}\-\\beta\_\{0\}\-\\beta\_\{1\}G\_\{ij\}\\right\)^\{2\},then predict the held\-out row and column withM^i​j=β^0\+β^1​Gi​j\\hat\{M\}\_\{ij\}=\\hat\{\\beta\}\_\{0\}\+\\hat\{\\beta\}\_\{1\}G\_\{ij\}\. Concatenating all out\-of\-fold row and column predictions gives the reported held\-outR2=1−∑\(Mi​j−M^i​j\)2/∑\(Mi​j−M¯\)2R^\{2\}=1\-\\sum\(M\_\{ij\}\-\\hat\{M\}\_\{ij\}\)^\{2\}/\\sum\(M\_\{ij\}\-\\bar\{M\}\)^\{2\}, withM¯\\bar\{M\}the mean of the scored off\-diagonal entries; a predictor carrying no held\-out signal scores slightly below zero, which is what the “at null” rows of Table[8](https://arxiv.org/html/2608.11227#A3.T8)report\. Leave\-one\-target\-out evaluation holds out one target column in theD×67D\\times 67forecast matrix\. Leave\-one\-source\-out holds out one source’s full67×667\\times 6slab\. leave\-one\-source\-out and leave\-one\-target\-out are the cold\-start forecasting splits; geometry uses leave\-one\-behavior\-out, which holds out a behavior’s row and column\.

For the source split, Spearman correlation is computed between the predicted and measured screened\-panel profiles for each held\-out source, then averaged across sources\. For the target split, it is computed across sources for each held\-out target, then averaged across targets\. Forecast permutation tests shuffle the measured labels within each held\-out evaluation vector, recompute the same fold aggregation, and compare the observed mean correlation withB=200B=200shuffled values\.

#### Nulls\.

Shuffle, entry values permuted within the matrix\. Relabel, behavior labels permuted\. Value\-shuffle, off\-diagonal entry magnitudes permuted globally for the participation\-ratio test\. Per\-target scale shuffle, entries permuted within each target behavior, preserving its sensitivity scale while destroying pair structure\. Permutationpp\-values are two\-sided over≥200\\geq 200draws\.

Cross\-effect matrixRaw direction\-cosine held\-outR2R^\{2\}Per\-behavior\-layer control−0\.022\-0\.022\(at null\)Per\-behavior\-layer control \(injection\-layer dirs\)−0\.023\-0\.023\(at null\)Gemma\-3\-12B \(coefficient\-calibrated / uncalibrated, 14\-behavior instrument\)−0\.079\-0\.079/−0\.061\-0\.061Qwen2\.5\-7B 26\-source subset, top\-component\-removed\+0\.092\+0\.092Gemma\-3\-12B injection L22 \(26\-source subset\)raw−0\.010\-0\.010\(p=0\.72p=0\.72\); top\-component\-removed\+0\.101\+0\.101\(p<0\.0005p<0\.0005\)Gemma\-3\-4B two\-judge re\-score \(26\-source subset\)\+0\.035\+0\.035\(p<0\.0005p<0\.0005\)Shared\-injection\-layer matrices, directions carried downstream before the cosinesmall\-positive: Qwen2\.5\-7B L13→\\toL18\+0\.075\+0\.075\(max\), Gemma\-3\-12B L22→\\toL26\+0\.023\+0\.023where raw is null\. The same transport applied to the per\-behavior\-layer control leaves it at or below its raw null \(L20/L22/L27:−0\.025\-0\.025/−0\.027\-0\.027/−0\.032\-0\.032\)Subspace\-overlap diagnosticnot a causal predictor for single\-direction steering; see Limitations
Cross\-effect matrixRaw direction\-cosine held\-outR2R^\{2\}Gemma\-3\-4B validated block, whitened \(shrinkage 0\.05 to 0\.5\)\+0\.20\+0\.20to\+0\.21\+0\.21Gemma\-3\-12B validated block, whitened \(shrinkage 0\.05 to 0\.5\)\+0\.21\+0\.21to\+0\.23\+0\.23Qwen2\.5\-7B validated block, whitened \(shrinkage 0\.05 to 0\.5\)\+0\.16\+0\.16to\+0\.17\+0\.17Whitened plus top\-component\-removed \(Gemma\-3\-4B / Gemma\-3\-12B / Qwen2\.5\-7B\)\+0\.003\.\.\+0\.005\+0\.003\.\.\{\+\}0\.005/\+0\.032\.\.\+0\.034\+0\.032\.\.\{\+\}0\.034/\+0\.026\.\.\+0\.032\+0\.026\.\.\{\+\}0\.032Gemma\-3\-4B significant\-entry submatrix, raw / top\-component\-removed\+0\.146\+0\.146/\+0\.087\+0\.087Gemma\-3\-12B significant\-entry submatrix, raw / top\-component\-removed\+0\.016\+0\.016/\+0\.351\+0\.351Qwen2\.5\-7B significant\-entry submatrix, raw / top\-component\-removed\+0\.298\+0\.298/\+0\.050\+0\.050Gemma\-3\-12B significant\-entry submatrix \(26\-source subset\), length covariatetop\-component\-removed leave\-one\-behavior\-out\+0\.221→\+0\.156\+0\.221\\to\+0\.156\(p<0\.0005p<0\.0005\)Gemma\-3\-12B mode identity \(26\-source subset\)mode 0 explains 49% of variance and has length\-slopeρ=−0\.25\\rho=\-0\.25; mode 1 explains 12% and hasρ=\+0\.56\\rho=\+0\.56Gemma\-3\-4B validated 52\-source blockraw\+0\.061\+0\.061; top\-component\-removed\+0\.056\+0\.056; layer\-mapped\+0\.091/\+0\.129/\+0\.146\+0\.091/\+0\.129/\+0\.146\(L18/20/22\)Gemma\-3\-4B all\-source diagnosticraw\+0\.037\+0\.037; top\-component\-removed\+0\.060\+0\.060; layer\-mapped max\+0\.097\+0\.097Gemma\-3\-12B validated 52\-source blockraw\+0\.009\+0\.009; top\-component\-removed\+0\.231\+0\.231; layer\-mapped\+0\.053/\+0\.073\+0\.053/\+0\.073\(L24/26\)Gemma\-3\-12B all\-source diagnosticraw\+0\.011\+0\.011; top\-component\-removed\+0\.169\+0\.169; layer\-mapped max\+0\.054\+0\.054Qwen2\.5\-7B validated 47\-source blockraw\+0\.194\+0\.194; top\-component\-removed\+0\.029\+0\.029; layer\-mapped\+0\.179/\+0\.176/\+0\.160\+0\.179/\+0\.176/\+0\.160\(L16/18/20\)Qwen2\.5\-7B all\-source diagnosticraw\+0\.099\+0\.099; top\-component\-removed\+0\.020\+0\.020; layer\-mapped max\+0\.093\+0\.093

Table 8:Geometry\-sweep and dominant\-mode ladder under leave\-one\-behavior\-out evaluation; source artifacts are indexed in Appendix D\.

## Appendix DAppendix D\. Extended Results and Artifact Index

#### Compute and generation configuration\.

All experiments were run as single\-GPU jobs on a shared SLURM cluster \(Slurm 25\.05, Rocky Linux 9\.8\) with 64 GB system memory per job on AMD EPYC hosts\. Judge scoring was constrained to NVIDIA H100 \(80 GB\), H100 NVL \(94 GB\), and H200 \(141 GB\) GPUs; generation additionally used A100, A40, L40S, and L40 GPUs\. Generation and analysis used Python 3\.10 with PyTorch 2\.6\.0 \(CUDA 12\.4\), Transformers 4\.57\.6, NumPy 2\.2\.6, SciPy 1\.15\.3, and scikit\-learn 1\.7\.2; judge scoring used Python 3\.11 with PyTorch 2\.6\.0 and Transformers 5\.9\.0\. All steered and unsteered generations sample at temperature 0\.8 and top\-pp0\.95 with a 4,096\-token generation cap\. The main generation runs use four sampling seeds, 0, 1, 2, and 3, applied before each sampling call by a helper that seeds Python, NumPy, and Torch and pins deterministic cuBLAS and cuDNN kernels\. This holds resumed runs to agreement well inside the third decimal under the on\-cluster check, rather than to bitwise identity\. Most released generation manifests record the seed list explicitly; where the field is absent, seed provenance cannot be recovered from the manifest alone\. Two auxiliary controls draw from an unseeded generator and so reproduce only in distribution\. Each resampling analysis \(cross\-validation folds, bootstrap draws, and permutation nulls\) seeds its own generator with a fixed constant written into the producing script, most commonly 0\. The 16 prompts evaluated per context are a systematic sample of that context’s pool, taken at an even stride from the first index \(for example every 24th to 25th of the 362 ambiguous prompts\), fixed before generation and identical across models, coefficients, and seeds\. A full injection\-layer run costs roughly 12 to 17 GPU\-hours of generation and∼18\\sim\{18\}GPU\-hours of single\-pass judge scoring per context per model\.

Where a paragraph’s numbers come from a dedicated artifact file, it names that artifact inline; the artifact index, the three cross\-effect matrices, and the analysis code are released with the paper\. The central Gemma\-3\-4B geometry results are re\-derivable from the released matrix; the cross\-model analyses are included in the same index\.

#### Measurement caveats\.

All three cross\-effect matrices are single\-judge; the second judge is used only for confirmation samples\. Our prompt\-level behavior detector tests behavior on the six prompt sets rather than jailbreak\-level robustness\. Coverage minima for the significance test of Section[3](https://arxiv.org/html/2608.11227#S3): prompts with fewer than three measured coefficients contribute no slope, and entries with fewer than four per\-prompt slopes are not tested\. These qualifications affect magnitude and scope, leaving the significance criterion unchanged\.

Table 9:Per\-behavior steering\-coefficient window ranges: the widest windows at which every sampled generation passes the degeneracy gate of Section[3](https://arxiv.org/html/2608.11227#S3), perplexity inflation under the unsteered model of at most 20% and a unique\-content ratio of at least 0\.3\. Three Gemma\-3\-4B sources were driven above their later\-measured ceiling; see Appendix D\.

#### Reliability\.

Entry\-ordering split\-half Spearman is0\.727/0\.840/0\.8610\.727/0\.840/0\.861on Gemma\-3\-4B/Gemma\-3\-12B/Qwen2\.5\-7B, with 99\.3 to 100% sign agreement among each half’s 100 largest couplings\. At the context\-resolved grain \(one entry per source, target, and context\), raw split\-half reliability is Pearson0\.660\.66; after subtracting each source\-target pair’s mean coupling, the residual reproduces at only Pearson0\.280\.28\(Spearman0\.210\.21\) on Gemma\-3\-4B\. What reproduces in an entry is therefore chiefly its pair\-level mean rather than finer magnitude detail, which is why forecasting is evaluated as rank recovery rather than calibrated magnitude recovery\. The attenuation ceiling of Table[2](https://arxiv.org/html/2608.11227#S5.T2)isρmax=2​r/\(1\+r\)\\rho\_\{\\max\}=\\sqrt\{2r/\(1\+r\)\}, the Spearman\-Brown projection\(Spearman[1910](https://arxiv.org/html/2608.11227#bib.bib23); Brown[1910](https://arxiv.org/html/2608.11227#bib.bib6)\)of the per\-unit split\-half profile correlationrrto the full prompt set:r=0\.52/0\.66/0\.70r=0\.52/0\.66/0\.70on the source split and0\.46/0\.60/0\.650\.46/0\.60/0\.65on the target split across the three models\.

#### Measurement adequacy\.

On Gemma\-3\-4B/Gemma\-3\-12B/Qwen2\.5\-7B: the median minimum detectable\|Δ​score\|\|\\Delta\\mathrm\{score\}\|at each model’s realized BH cutoff is0\.1020\.102/0\.1150\.115/0\.1090\.109, so the 33 versus 49/50% density gap is not detection resolution\. A pure\-error lack\-of\-fitFFtest on the significant cells \(five dose levels, four seed replicates per prompt\) rejects linearity in 12\.1/19\.5/23\.4% of prompt clusters against a 5% floor, with median quadratic gain inR2R^\{2\}of0\.0600\.060/0\.0750\.075/0\.0750\.075: curvature is real but small\. In\|Δ\|\|\\Delta\|, the target alone explains4545/3434/49%49\\%of variance, the source alone88/1515/5%5\\%, both additively5353/4949/54%54\\%\. Source:measurement\_adequacy\.json\.

#### Geometry clustering summary\.

The geometry\-versus\-coupling clustering comparison reports adjusted Rand index0\.0640\.064with tanglegram crossing rate0\.510\.51\(crossings between the geometry and coupling dendrogram leaf orderings as a fraction of the maximum possible; unrelated orderings sit near0\.50\.5\) on the Gemma\-3\-4B block,−0\.053\-0\.053with0\.420\.42on Gemma\-3\-12B, and0\.1980\.198with0\.640\.64on Qwen2\.5\-7B\. The in\-sample permutation test for direction geometry givesp=0\.38p=0\.38, and repeated draws of the identical test give0\.400\.40to0\.460\.46, all consistent with no pairwise geometry signal\.

![[Uncaptioned image]](https://arxiv.org/html/2608.11227v1/x3.png)

Figure 3:Left: on the per\-behavior\-layer control matrix, significant side effects \(red\) occur at every similarity level\. Right: held\-outR2R^\{2\}for each matrix against its shuffled\-label null \(grey\) and the detection floor ofR2≈0\.04R^\{2\}\\approx 0\.04at 80% power \(green band\): each validated block’s best similarity variant clears the floor through a model\-specific carrier, while the control matrix stays at its null\. Full sweep in Table[8](https://arxiv.org/html/2608.11227#A3.T8)\.

#### Per\-behavior\-layer control and judge\-scale robustness\.

The control differs from the main matrices in scale and protocol: 26 sources, a smaller prompt set, a shorter generation cap, flat coefficients, and a two\-judge panel\. On it, the geometry null is stable under judge\-scale recodings: raw leave\-one\-behavior\-outR2=−0\.0224R^\{2\}=\-0\.0224\(p=0\.899p=0\.899\), in\-sampleR2=0\.0016R^\{2\}=0\.0016\(p=0\.38p=0\.38\), rank\-recoded leave\-one\-behavior\-outR2=−0\.0185R^\{2\}=\-0\.0185, and self\-normalized leave\-one\-behavior\-outR2=−0\.0332R^\{2\}=\-0\.0332\. Scoring the same control with injection\-layer \(L18\) directions changes nothing: raw cosine gives leave\-one\-behavior\-outR2=−0\.0232R^\{2\}=\-0\.0232\(p=0\.903p=0\.903\), and whitening raises the in\-sample fit to at most∼3\.9\{\\sim\}3\.9percent while remaining negligible out of sample \(leave\-one\-behavior\-outR2=−0\.005R^\{2\}=\-0\.005to−0\.002\-0\.002,p<0\.005p<0\.005to0\.0150\.015; the permutation compares the observed statistic with shuffled\-label draws by absolute value as in Appendix C, so a smallppon a negative held\-outR2R^\{2\}means the fit sits above the shuffled floor while still explaining nothing held out\)\. On the 14\-behavior Gemma\-3\-12B matrices, a separate smaller instrument rather than a variant of this control, raw cosine gives leave\-one\-behavior\-outR2=−0\.061R^\{2\}=\-0\.061\(p=0\.23p=0\.23\) at uncalibrated coefficients and−0\.079\-0\.079\(p=0\.94p=0\.94\) at calibrated ones\. The control’s null is not an artifact of comparing vectors across layers: transporting all directions into a common basis first leaves it at or below its raw null, while the transported main matrices retain small\-positive signal \(Table[8](https://arxiv.org/html/2608.11227#A3.T8)\)\. Because every matrix showing signal under transport has a shared injection site by construction, the control implicates the shared site but cannot quantify its share of the main matrices’ signal\. Figure[3](https://arxiv.org/html/2608.11227#A4.F3)visualizes this null\.

#### Low\-rank structure and scale decomposition\.

Effective dimension is the participation ratio\(Gao et al\.[2017](https://arxiv.org/html/2608.11227#bib.bib9)\)of a block’s singular valuesσk\\sigma\_\{k\},PR=\(∑kσk2\)2/∑kσk4\\mathrm\{PR\}=\(\\sum\_\{k\}\\sigma\_\{k\}^\{2\}\)^\{2\}/\\sum\_\{k\}\\sigma\_\{k\}^\{4\}, the number of modes carrying comparable energy\. Standardizing each target behavior \(z\-scoring its couplings across sources\) before taking the coupling spectrum gives the count used in the paper:4\.64\.6on the Gemma\-3\-4B block,4\.84\.8on Gemma\-3\-12B, and4\.94\.9on Qwen2\.5\-7B, against value\-shuffle nulls of approximately 23 to 26\. Raw participation ratio, the effective\-dimension count taken without standardizing, conflates mode structure with per\-target scale heterogeneity; standardizing each target removes that scale component\. As a finite\-sample robustness check rather than exact null theory for a source\-by\-target slope matrix, the independent\-noise benchmarkP​Q/\(P\+Q\)PQ/\(P\+Q\), forPPsources andQQtargets, is 26 on the52×5252\\times 52Gemma blocks and about 24 on the47×4747\\times 47Qwen2\.5\-7B block, consistent with the shuffle nulls\. The unstandardized effective dimensions are2\.312\.31,2\.322\.32, and2\.272\.27\. Every statistic is compared against its matched null, with standardization re\-applied after each shuffle\. Under the unstandardized statistic, a shuffle that preserves each target’s scale gives10\.610\.6/11\.311\.3/10\.610\.6on the three models against global value\-shuffle nulls of24\.524\.5/21\.921\.9/22\.322\.3, so per\-target sensitivity heterogeneity explains much of that gap; under the standardized statistic the scale\-preserving shuffle is indistinguishable from the global null \(23\.523\.5to26\.026\.0on all three models\), so the headline comparison of about five against 23 to 26 stands against both nulls\. Source:expanded\_matrix\_summary\.json,effective\_dimension\_matched\_nulls\. Removing the top component raises raw effective dimension to6\.66\.6,6\.66\.6, and6\.56\.5\. That component carries≈64%\{\\approx\}64\\%of unstandardized variance on all three models \(6464/6464/65%65\\%\) and loads positively on initiative, example generation, and scaffolding and negatively on punchiness and minimal answers, the elaboration\-versus\-terseness axis named in Results\. Modes beyond the top channel do not have stable identities, so effective dimension is interpreted only as a count\.

#### Survivor effect sizes and mode decomposition\.

Over the FDR survivors of the validated family \(1,124/1,676/1,562 cells on Gemma\-3\-4B/Gemma\-3\-12B/Qwen2\.5\-7B\),\|Δ​score\|\|\\Delta\\mathrm\{score\}\|over each source’s calibrated window has median0\.200\.20/0\.250\.25/0\.250\.25, interquartile range\[0\.13,0\.31\]\[0\.13,0\.31\]/\[0\.15,0\.47\]\[0\.15,0\.47\]/\[0\.14,0\.46\]\[0\.14,0\.46\], and 90th percentile0\.440\.44/0\.780\.78/0\.760\.76;77/2323/22%22\\%of survivors exceed half a judge point\. Decomposing each survivor against the dominant mode \(rank\-1 term of the dose\-scaled evaluated\-by\-validated block, top\-mode share 62 to 63% there\), the mode holds7171/6767/68%68\\%of survivor squared mass, yet4343/5050/49%49\\%of individual survivors are majority residual,8585/8484/80%80\\%keep their sign in the residual, and the median absolute residual is0\.080\.08/0\.140\.14/0\.130\.13: the elaboration channel carries most of the effect mass but not the identity of most survivors\. On the safety slices fixed in advance for the slice analysis below, the mode’s share of survivor mass is0\.410\.41/0\.430\.43/0\.600\.60on the four core safety behaviors and0\.440\.44/0\.380\.38/0\.610\.61on the ten\-behavior set; the safety targets load low on the mode on the Gemma models \(harmful\-intent detection at the 0\.15 to 0\.16 percentile of target loadings, refusal strictness 0\.27/0\.48\) and high on Qwen2\.5\-7B \(refusal strictness 0\.79, unsafe\-actionability suppression 0\.84\)\. Safety coupling is therefore carried by the residual on the Gemma models and substantially by the elaboration mode on Qwen2\.5\-7B\. Source:survivor\_distribution\.json\.

#### Instrument\-versus\-model controls\.

Four tests separate the matrix’s structure from the taxonomy\-plus\-judge instrument, all on data already on disk\. \(i\) On the never\-steered corpus \(1,288/1,288/2,039 judged generations\), the 67\-behavior score correlation matrix has top\-mode share 10\.0/9\.9/8\.6% and effective dimension 28\.9/29\.5/31\.9 on Gemma\-3\-4B/Gemma\-3\-12B/Qwen2\.5\-7B: the instrument alone is high\-dimensional, so the matrix’s one≈64%\{\\approx\}64\\%mode is not rubric redundancy\. The coupling top mode’s target loadings correlate with the unsteered top factor at Spearman\+0\.05\+0\.05/\+0\.27\+0\.27/\+0\.19\+0\.19and with per\-behavior length loadings \(score\-versus\-log\-length on unsteered text\) at\+0\.14\+0\.14/\+0\.34\+0\.34/−0\.39\-0\.39, both weak and sign\-inconsistent; the source loadings correlate with per\-source length slopes at\+0\.93\+0\.93/\+0\.93\+0\.93/\+0\.94\+0\.94: the mode is driven by how much a source changes elaboration, and read out as content change rather than a judge length halo\. \(ii\) The rank\-1 length\-mediation model, per\-source length slope times per\-target length sensitivity, explainsR2R^\{2\}0\.11/0\.17/0\.19 of the dose\-scaled validated block\. \(iii\) Rebuilding every cell slope after residualizing per\-generation judge scores on log response length \(coefficients fit on theα=0\\alpha\{=\}0generations per behavior and context\) leaves the dominant mode at 74/71/76% of the rebuilt block’s variance versus 64/56/65% unresidualized \(both shares on the rebuilt blocks, which reproduce the pooled blocks at Spearman 1\.00/0\.97/1\.00\): removing the judge’s static length response does not remove the mode\. Three top\-mode shares therefore appear in this paper, one per block definition:6464/6464/65%65\\%on the pooled dose\-scaled blocks \(the headline, quoted as≈64%\{\\approx\}64\\%\), 62 to 63% on the evaluated\-by\-validated sub\-block of the survivor decomposition, and 64/56/65% on the per\-cell rebuilt blocks here\. The forecast evaluations of Table[2](https://arxiv.org/html/2608.11227#S5.T2)were not rerun on the residualized blocks; at that reproduction level the evaluation target would be nearly identical\. \(iv\) Behavior pairs that are definitionally exclusive on unsteered text \(each behavior scored high at least 20 times, and high scores on one co\-occur with low on the other at rate≥0\.95\\geq 0\.95in both directions\) hold 12\.8/11\.9/17\.0% of BH\-surviving in\-block couplings against base rates of 13\.3/12\.2/17\.5% of in\-block pairs, and 12/13/12% of top\-mode mass: no enrichment, so the couplings are not carried by constitutively coupled rubric pairs\. Source:instrument\_battery\.json\.

#### Opposite\-sign pair reliability\.

The 39/95/53 opposite\-signed mutual pairs of Section[4\.2](https://arxiv.org/html/2608.11227#S4.SS2)are tested at the pair level in three ways\. The conjunction \(intersection\-union\) test, one\-sided on each cell’s 96 per\-prompt slopes in its observed direction with the pair’sppthe larger of the two and BH control over pairs, confirms 39/39 on Gemma\-3\-4B, 89/90 on Gemma\-3\-12B \(5 of 95 pairs lack per\-prompt coverage and are excluded\), and 46/53 on Qwen2\.5\-7B\. Across 200 random prompt\-half splits, both cells reproduce their full\-data signs in both independent halves for 100/98/95% of opposite pairs, against 100/100/96% for the same\-signed mutual pairs, and pairs selected as opposite\-signed on one half confirm on the other at 99/99/92%\. The opposite\-pair cells sit at median percentile 0\.46/0\.34/0\.43 of the surviving\|Δ​score\|\|\\Delta\\mathrm\{score\}\|distribution\. A whole\-block companion to the pair\-level tests is the antisymmetric share‖K‖F2/‖𝐀‖F2\\\|K\\\|\_\{F\}^\{2\}/\\\|\\mathbf\{A\}\\\|\_\{F\}^\{2\}, for the antisymmetric partK=12​\(𝐀−𝐀⊤\)K=\\frac\{1\}\{2\}\(\\mathbf\{A\}\-\\mathbf\{A\}^\{\\top\}\)of the square validated block, orthogonal to the symmetric part \(‖𝐀‖F2=‖S‖F2\+‖K‖F2\\\|\\mathbf\{A\}\\\|\_\{F\}^\{2\}=\\\|S\\\|\_\{F\}^\{2\}\+\\\|K\\\|\_\{F\}^\{2\}\): it is0\.400\.40/0\.410\.41/0\.350\.35on the three models\. We do not read these as evidence for asymmetry, and the main text does not use them\. The1/21/2reference value holds only for independent zero\-mean off\-diagonal entries, and the block as computed includes its diagonal, which biases the share downward; the pair\-level conjunction and split\-half tests above are what the claim of Section[4\.2](https://arxiv.org/html/2608.11227#S4.SS2)rests on\. Source:sign\_asymmetry\_test\.json,certified\_face\_controls\.json\.

#### Cold\-start forecasting\.

The screened\-panel results on all three models are in Table[2](https://arxiv.org/html/2608.11227#S5.T2); Table[10](https://arxiv.org/html/2608.11227#A4.T10)rescores every probe\-dependent method on the full 67\-target set\. On the unscreened panel the map beats both references on Qwen2\.5\-7B and narrowly trails the direct probe on Gemma\-3\-12B, while on Gemma\-3\-4B the source split trails the per\-target mean, which even the measured\-shift readout only ties; all stated wins clear the permutation null at the test floor,p=0\.005p=0\.005\.

Table 10:Full 67\-target rescore of Table[2](https://arxiv.org/html/2608.11227#S5.T2)\(held\-out Spearman, no screened panel\), a robustness rescore in which no method’s machinery selects the targets\.

#### Loss accounting\.

Against the attenuation ceiling of0\.8270\.827/0\.8900\.890/0\.9070\.907\(Table[2](https://arxiv.org/html/2608.11227#S5.T2)\), the fixed\-strength forecast scores0\.2690\.269/0\.3260\.326/0\.3520\.352and the measured\-shift readout0\.3270\.327/0\.4470\.447/0\.3430\.343\. Writingρmax/ρorc/ρfwd\\rho\_\{\\max\}/\\rho\_\{\\mathrm\{orc\}\}/\\rho\_\{\\mathrm\{fwd\}\}for ceiling, measured\-shift readout, and fixed\-strength forecast, the shortfall splits exactly asρmax−ρfwd=\(ρorc−ρfwd\)\+\(ρmax−ρorc\)\\rho\_\{\\max\}\-\\rho\_\{\\mathrm\{fwd\}\}=\(\\rho\_\{\\mathrm\{orc\}\}\-\\rho\_\{\\mathrm\{fwd\}\}\)\+\(\\rho\_\{\\max\}\-\\rho\_\{\\mathrm\{orc\}\}\), a propagation term and a probe\-readout term\. The probe readout accounts for 79 to 90% of the gap on the Gemma models and for all of it on Qwen2\.5\-7B \(102 to 103%: thereρorc<ρfwd\\rho\_\{\\mathrm\{orc\}\}<\\rho\_\{\\mathrm\{fwd\}\}, so the propagation term is slightly negative\)\. Skipping the intervention therefore costs0\.060\.06,0\.120\.12, and−0\.01\-0\.01Spearman\. Source:loss\_ledger\.json\.

#### Paired inference, screen sweep, and gate uncertainty\.

Every between\-method comparison on the screened panels has a paired per\-held\-out\-unit bootstrap CI and Wilcoxon signed\-rank test\(Wilcoxon[1945](https://arxiv.org/html/2608.11227#bib.bib26)\)inforecast\_inference\.json\(10,000 resamples\), for both the Table[2](https://arxiv.org/html/2608.11227#S5.T2)protocol and a fixed\-strength variant\. Under the Table[2](https://arxiv.org/html/2608.11227#S5.T2)protocol, propagation’s margin over raw cosine is significant on five of six splits \(mean paired differences\+0\.07\+0\.07to\+0\.26\+0\.26\) and\+0\.07\+0\.07\(CI−0\.01\-0\.01to\+0\.16\+0\.16\) on the Gemma\-3\-4B target split; over whitened cosine it is significant on both Qwen2\.5\-7B splits and both Gemma source splits \(\+0\.10\+0\.10to\+0\.16\+0\.16\) and indistinguishable on the two Gemma target splits \(−0\.01\-0\.01and\+0\.02\+0\.02\)\. At fixed strength the whitened\-cosine margin also loses significance on the Gemma source splits, so part of that margin is bought by the nested ridge selection\. Nearest\-neighbor transfer is significantly better than propagation on four of six splits, with the two Gemma target splits indistinguishable; the measured\-shift readout is significantly better only on the Gemma\-3\-12B source split, and propagation is significantly ahead of it on the Gemma\-3\-4B source split \(\+0\.03\+0\.03,p=0\.04p=0\.04\)\. Sweeping the screen threshold from 0\.70 to 0\.85 \(panels of 48/44/50 down to 25/21/25 targets\) leaves propagation ahead of both geometry predictors on Gemma\-3\-4B and Qwen2\.5\-7B and behind whitened cosine on Gemma\-3\-12B at every threshold\. Two orderings are not stable under the sweep and we record them: on Gemma\-3\-4B, propagation and the per\-target mean exchange the lead within the 0\.70–0\.80 band, although their gap never exceeds0\.0070\.007; on Qwen2\.5\-7B, propagation improves above 0\.80 and reaches its sweep maximum of0\.3840\.384at 0\.85\. The top\-decile sign\-accuracy gates carry cluster\-bootstrap 95% CIs resampling whole sources \(all\-flagged: 0\.63 to 0\.72, 0\.74 to 0\.82, 0\.66 to 0\.76 per model; caught\-large: 0\.83 to 0\.96, 0\.93 to 1\.00, 0\.84 to 0\.96\) and whole targets \(similar\), with every constant\-sign baseline outside its interval\. Source:forecast\_inference\.json\.

#### Forecastability gates\.

Per\-target gates computed on unsteered text only: the screening detection AUROC correlates with a target’s forecast quality at Spearman−0\.30\-0\.30,−0\.08\-0\.08, and\+0\.24\+0\.24across the three models, so the reliability screen does not select for forecastable targets\. Source:forecastability\_gates\.json\.

#### Fitted readouts\.

Refitting each target’s read vector by ridge\-regressing the measured couplings on the measured readout\-layer shifts \(leave\-one\-source\-out, ridge strength picked within the training sources\) and reading the held\-out source’s real measured shift through the refit vector reaches held\-source Spearman0\.6520\.652on Gemma\-3\-4B,0\.6760\.676on Gemma\-3\-12B, and0\.7000\.700on Qwen2\.5\-7B, versus0\.3270\.327for the natural\-text probes on the same Gemma\-3\-4B cells; a refit with shuffled source labels reaches only0\.2270\.227,0\.1790\.179, and0\.1560\.156, below the natural probes, so the gain is source\-specific rather than a target\-marginal artifact\. This bounds the share of the forecast gap attributable to probe error\. Source:fitted\_readout\.json\.

#### Training\-corpus ablation\.

Holding the judged\-corpus row count fixed and growing the number of prompt contexts the probes and map are fit on changes little\. On Qwen2\.5\-7B, moving from the six evaluation contexts to fifteen or to all 55 available contexts at matched rows shifts the source\-split score by at most\+0\.012\+0\.012\(paired sign testp≥0\.08p\\geq 0\.08\) against a full\-corpus score of0\.3520\.352; the Gemma models show the same flatness \(\+0\.002\+0\.002and\+0\.018\+0\.018,p≥0\.13p\\geq 0\.13\)\. The gap to the full corpus is carried by row count, not context diversity\. Source:corpus\_ablation\.json\.

#### Audit budget and confidence gate\.

The audit\-budget recall figures come from ranking each held\-out source’s screened panel by predicted\|\|coupling\|\|and scoring the topkkagainst that model’s top\-decile\|\|measured coupling\|\|set, with 95% intervals from 2,000 bootstrap resamples of the held\-out sources; the same script also scores retrieval of FDR\-significant couplings, where the base rate is0\.380\.38to0\.530\.53and no ordering separates far from it, confirming the negative control below\. Per\-model precision atk=5k=5: per\-target mean0\.5350\.535/0\.4410\.441/0\.4220\.422, nearest\-neighbor transfer0\.5180\.518/0\.4950\.495/0\.4890\.489, propagation0\.2530\.253/0\.3410\.341/0\.2620\.262\. Sign accuracy is reported at four predicted\-magnitude gates over each model’s pooled held\-out cells: withFτF\_\{\\tau\}the cells in the topτ\\taufraction by predicted magnitude andLLthose in the top decile by measured magnitude, recall is\|Fτ∩L\|/\|L\|\|F\_\{\\tau\}\\cap L\|/\|L\|and caught\-large sign accuracy is scored onFτ∩LF\_\{\\tau\}\\cap L\. The cold\-start forecast gets the sign right on the large effects it catches at 90/97/91% \(τ=0\.1\\tau\{=\}0\.1\), 90/96/93% \(τ=0\.2\\tau\{=\}0\.2\), 89/93/89% \(τ=1/3\\tau\{=\}1/3\), and 85/88/86% \(τ=0\.5\\tau\{=\}0\.5\), recalling 19/23/18% to 62/69/65% of them across those gates\. At the top\-decile gate the measured\-shift readout gets the sign right on its caught\-large cells at 90/98/89%\. Raw cosine at the same gate gets the sign right on 66/75/67% of all flagged cells against propagation’s 68/78/71%, but 95/89/94% of the caught\-large subset against propagation’s 90/97/91%; restricted to the flagged cells whose target has a validated direction, a coverage limit of cosine that excludes 19 to 28% of flagged cells per model, it reaches 100/92/95% on caught\-large\. A paired cluster bootstrap of propagation minus raw cosine on matched cells \(both predictors finite; each arm flagging its own top decile, whole held\-out sources resampled, 2,000 draws\) gives sign\-accuracy differences of\+0\.014\+0\.014\[−0\.057,\+0\.076\]\[\-0\.057,\+0\.076\],\+0\.023\+0\.023\[−0\.037,\+0\.098\]\[\-0\.037,\+0\.098\], and\+0\.041\+0\.041\[−0\.027,\+0\.102\]\[\-0\.027,\+0\.102\]: positive on all three models, individually indistinguishable from zero\. In the artifact the measured\-shift arm ispropagation\_exactand the restricted armraw\_cosine\_source\_certified\_targets\. Sources:audit\_budget\.json,confidence\_gate\.json\.

#### Pairwise ordering\.

The forecast orders 58 to 62% of all target pairs correctly\. Near\-ties are pervasive: within the closest quartile by measured difference \(cut at1\.071\.07,1\.051\.05, and0\.080\.08in each model’s own units\), the forecast scores 48 to 53% and the measured\-shift readout itself only 49 to 52%, so neither can order pairs the measurement barely separates\. On the most separated quartile the forecast reaches 70 to 73% against 71 to 79% for the measured\-shift readout\. Source:pairwise\_accuracy\.json\.

#### Text\-only references\.

A definitions\-only semantic prior over the judge rubrics scores0\.070\.07/0\.090\.09/0\.100\.10on the source split\. Twelve surface features of the response text predict the judge’s per\-behavior scores on held\-out unsteered generations at a mean Spearman of0\.140\.14against0\.450\.45for the activation probes, which win on 40 of 41 behaviors\. Sources:semantic\_prior\.json,text\_bridge\_gemma3\_4b\.json\.

#### Probe\-versus\-map diagnostic\.

The reference methods trade places with each other and with propagation as their access changes\. The component\-split comparisons are consistent with probes limiting the residual gap: probes are fit on natural activations, so realized steered changes can leave their training manifold, while propagated representations remain closer to it\. The measured\-shift readout is therefore a diagnostic of probe versus map error, not an upper bound\. The map itself is not the bottleneck on Gemma\-3\-12B: five\-fold held\-out activationR2R^\{2\}ofWWon natural residuals is0\.8780\.878on Gemma\-3\-4B,0\.9170\.917on Gemma\-3\-12B, and0\.5230\.523on Qwen2\.5\-7B \(at the deployed ridge strength,map\_quality\.json; the per\-layer grid intuned\_forecast\.jsontunes strength per layer and reads higher\), and across the three models propagation’s edge over the direct probe is ordered inversely to thatR2R^\{2\}, largest on Qwen2\.5\-7B and smallest on Gemma\-3\-12B\. Within a model, sweeping depth, the rank correlation between activationR2R^\{2\}and margin is−0\.66\-0\.66,−0\.37\-0\.37, and\+0\.55\+0\.55across the three models, and a rule fit on two models to predict the third recovers the depth profile on Gemma\-3\-4B but inverts it on Qwen2\.5\-7B: the cross\-model ordering fails both tests, so we record it as an observation\. An inter\-layer fit statistic, computable before any intervention, tracks the direct probe’s depth decay within each model but does not transfer across models: a within\-model regularity, not a law\. Depth sweeps score the fixed\-strength variant of the forecast; per\-layer grids indepth\_grid\.json\.

#### Map strength and spectral interpretation\.

For each held\-out unit, we select the map’s ridge strength using only the training units \(Section[5](https://arxiv.org/html/2608.11227#S5)\)\. The search uses a 13\-point logarithmic grid from10210^\{2\}to10810^\{8\}\. Separately, each probe usesRidgeCVover a 13\-point logarithmic grid from10010^\{0\}to10610^\{6\}, and the geometry baseline selects whitening shrinkage from0\.050\.05,0\.20\.2, and0\.50\.5\. Selected map strengths concentrate between3×1063\\times 10^\{6\}and3×1073\\times 10^\{7\}for the Gemma models and at10410^\{4\}for Qwen2\.5\-7B\. In each model’s eigenvalue scale, these strengths roughly correspond to retaining a few dozen modes, but this interpretation is only heuristic\. A hard projection onto the topkkmodes followed by identity transport, withkkselected by the same nested procedure, reaches source/target Spearman0\.3020\.302/0\.2060\.206,0\.3770\.377/0\.2820\.282, and0\.2130\.213/0\.2000\.200for the three models \(selectedk=69k=69,100100, and3333\)\. It underperforms the selected map on all six splits and the direct probe on both Qwen2\.5\-7B splits\. Thus, the ridge map does more than truncate the spectrum: it continuously reweights its modes\. Moreover, the ridge strength that maximizes forecast accuracy exceeds the strength that maximizes activationR2R^\{2\}on all three models\. Reconstructing the readout\-layer representation and forecasting behavior therefore favor different regularization\.

#### Matched tuning and ensemble diagnostic\.

To match the map’s tuning budget, we give the direct probe one selectable hyperparameter, its layer, and choose it by the same nested procedure\. The resulting source/target Spearman scores are0\.2880\.288/0\.2230\.223,0\.3380\.338/0\.2900\.290, and0\.2480\.248/0\.2400\.240; all six are below the selected map\. On Gemma\-3\-12B we report the stronger fixed layer, since nested selection there gives0\.3090\.309/0\.2670\.267\. The pure cross\-covariance limit scores0\.1290\.129/0\.1030\.103,0\.0830\.083/0\.1160\.116, and0\.1930\.193/0\.2170\.217\. An ensemble of the direct probe and the*fixed\-strength*map, fit leave\-one\-unit\-out, reaches0\.2810\.281/0\.2130\.213,0\.3650\.365/0\.3050\.305, and0\.3610\.361/0\.3660\.366\. The selected map alone matches or exceeds the ensemble on five of six splits, indicating that most of the ensemble’s apparent complementarity arose from a poorly set map penalty\. For provenance, the nested procedure was introduced after the fixed\-strength comparison, in which the map lost both Gemma\-3\-12B splits to the direct probe\. Source:tuned\_forecast\.json\.

#### Cross\-model and downstream diagnostics\.

The gap between the hard\-projection baseline and the selected map is0\.0160\.016on Gemma\-3\-12B,0\.0520\.052on Gemma\-3\-4B, and0\.1390\.139on Qwen2\.5\-7B, while their activationR2R^\{2\}values are0\.9170\.917,0\.8780\.878, and0\.5230\.523, respectively\. This three\-model ordering matches the forecast\-margin ordering in Section[5\.4](https://arxiv.org/html/2608.11227#S5.SS4), but it is an observation rather than a general rule\. Even when the measured matrix is available, adding the propagation forecast improves nearest\-neighbor reuse on all six splits; for example, the Gemma\-3\-12B source split improves from0\.5180\.518to0\.5500\.550\. By contrast, incorporating zero\-coefficient headroom into the signed\-profile ranking does not help and is significantly harmful on three splits\. These results support the factored presentation: the forecast identifies which behaviors move and in which direction, whereas the operating point governs their magnitude\. Sources:stacked\_forecast\.jsonandheadroom\_forecast\.json\.

#### Source\-specific residual and safety slices\.

Two controls test whether the cold\-start recovery is source\-specific or a rediscovery of the universal sinks\. On the full 67\-target panel, removing each target’s mean profile and rescoring on the LOO\-centered residual leaves propagation nearly intact \(0\.221→0\.1870\.221\\to 0\.187on Gemma\-3\-4B,0\.267→0\.2560\.267\\to 0\.256on Qwen2\.5\-7B, bothp<0\.001p<0\.001against a source\-relabel null\), while the mean baseline collapses to−1\.0\-1\.0by construction; the residual profiles are reliable enough to forecast at all \(split\-half forecast ceiling0\.780\.78and0\.900\.90\)\. Slices fixed in advance from the taxonomy’s safety behaviors and from tertiles of how much room each target has to move on the judge scale show propagation retaining a margin over the mean baseline on the four core safety behaviors \(Gemma\-3\-4B:0\.1750\.175vs0\.0440\.044; Qwen2\.5\-7B:0\.2320\.232vs0\.0960\.096\) and surviving target\-centering \(0\.1450\.145/0\.2100\.210\); that slice holds only four targets, so each held\-out source contributes a rank correlation over four points and the estimate is correspondingly noisy, ceding the broad ten\-behavior safety set to reuse \(0\.1140\.114/0\.0700\.070vs mean0\.1290\.129/0\.1810\.181\), and declining but staying above the direct probe in the least\-room tertile \(0\.1390\.139/0\.2130\.213vs0\.0760\.076/0\.1160\.116\)\. Slice keys are exogenous, so the range\-restriction artifact is designed out\. Sources:slice\_recovery\.jsonandresidual\_recovery\.json\.

#### Rank correlation versus top\-KKretrieval\.

A retrieval framing that flags the top\-KKpredicted targets and counts how many are statistically real side effects is degenerate on this object\. Under a pooled per\-cell\|zi​j\|≥1\.96\|z\_\{ij\}\|\\geq 1\.96criterion,zi​jz\_\{ij\}the mean per\-prompt slope of Equation[2](https://arxiv.org/html/2608.11227#S3.E2)over its standard error without FDR correction \(looser than the matrix’s BH criterion, used only for this negative control\), a typical source has real effects on 28 of 66 candidate targets on Gemma\-3\-4B and 35 on Qwen2\.5\-7B, so chance precision is0\.420\.42to0\.530\.53, and the matrix\-consuming references score0\.820\.82to0\.920\.92atK=2K\{=\}2by predicting the universal sinks regardless of source\. Precision atKKreflects the target base rate, while rank correlation over the full signed profile isolates what a forecast adds beyond it\. We report this analysis as a negative control in the artifact index\.

#### Magnitude controls\.

Per\-cell size ordering is readout\-limited like everything else; the reliable magnitude output is per\-vector\. The propagated\-direction norm‖W​v‖\\\|Wv\\\|ranks vectors by measured total collateral, each source’s mean absolute coupling over the screened panel and the six contexts \(in slope units\), at0\.510\.51/0\.790\.79/0\.650\.65, above nearest\-neighbor reuse of measured sizes on two of three models \(0\.540\.54/0\.550\.55/0\.410\.41\), against a measurement whose Spearman\-Brown\-corrected\(Spearman[1910](https://arxiv.org/html/2608.11227#bib.bib23); Brown[1910](https://arxiv.org/html/2608.11227#bib.bib6)\)split\-half reliability is0\.850\.85/0\.960\.96/0\.950\.95\(raw split\-half0\.740\.74/0\.920\.92/0\.910\.91\)\. That ranking is dose\-controlled\. Steering coefficients take four distinct maxima on each model, set per source except in the Gemma\-3\-4B carried\-over block, and total collateral falls as that maximum rises \(Gemma\-3\-12B medians5\.035\.03,3\.303\.30, and2\.242\.24for the0\.020\.02,0\.040\.04, and0\.060\.06groups; its fourth group,0\.10\.1, holds one source, as does Qwen2\.5\-7B’s0\.80\.8group and Gemma\-3\-4B’s0\.0080\.008group, so no median is quoted for them\), because the coherence sweep pushes disruptive directions less far\. Dose is therefore correlated with the measured outcome \(−0\.65\-0\.65/−0\.62\-0\.62/−0\.68\-0\.68\) and with the predictor \(−0\.52\-0\.52/−0\.50\-0\.50/−0\.36\-0\.36\), and unit\-normalizingvvdoes not address it, since dose enters through the outcome\. Conditioning on dose,‖W​v‖\\\|Wv\\\|retains0\.2690\.269,0\.6020\.602, and0\.5630\.563\(p=0\.054p=0\.054,2×10−62\\times 10^\{\-6\},4×10−54\\times 10^\{\-5\}\)\. The raw and partial values bound the effect from above and below: dose was chosen per source from that source’s observed behavior, so it carries some true impact and conditioning on it over\-corrects\. The ranking therefore holds on Gemma\-3\-12B and Qwen2\.5\-7B under either reading and is undetermined on Gemma\-3\-4B, whose sources sit at the lowest coefficients within the Gemma family \(modal0\.020\.02against Gemma\-3\-12B’s0\.040\.04\); Qwen2\.5\-7B’s windows are an order of magnitude larger and not comparable to either\. The raw geometry aggregate ranks total collateral at0\.510\.51/0\.840\.84/0\.340\.34, so it and‖W​v‖\\\|Wv\\\|each win one model and tie one; on Gemma\-3\-12B the aggregate also tracks the amount quantitatively \(leave\-one\-outR2=0\.67R^\{2\}=0\.67, typical error 17% of the observed 10 to 90 spread\), a single\-model claim\. The per\-source coefficient used for every source of every matrix is released indose\_used\_per\_source\.json, read off the generated cells rather than restated from a manifest; per\-source dosing applies to all three expansion blocks and to the Gemma\-3\-12B and Qwen2\.5\-7B carried\-over blocks, while the 26 carried\-over Gemma\-3\-4B sources ran at a flat0\.020\.02, which is the sense in which that model’s sources are described as modal above\. Sources:collateral\_magnitude\.json,dose\_control\.json,dose\_used\_per\_source\.json\.

#### Three sources outside their measured window\.

The carried\-over Gemma\-3\-4B block was generated at a flat coefficient of0\.020\.02\. A later coherence sweep placed the maximum coherent coefficient at0\.0080\.008foraudience\_adaptation,context\_faithfulness, andexercise\_generation, so these validated sources were driven2\.5×2\.5\\timesbeyond their later\-measured ceilings and their measured effects may be inflated\. Their combined weight is small, 3\.1% of the block’s aggregate collateral, and two rank 47th and 49th among the 52 sources, thoughcontext\_faithfulnessranks 15th\. We retain them for disclosure rather than silently treating every source as gate\-passing\.

#### Geometry measurement sweep\.

The geometry sweep evaluates 72 metric\-by\-matrix rows under one leave\-one\-behavior\-out and Mantel protocol\. Minimum\-detectable\-effect analyses detect a trueR2=0\.0385R^\{2\}=0\.0385at≥\\geq80 percent power withp<0\.01p<0\.01on both matrices\. Re\-deriving the refusal\-cosine check on the three full matrices gives Pearson correlations between cosine\-to\-refusal and the measured refusal column of−0\.085\-0\.085on Gemma\-3\-4B,−0\.099\-0\.099on Gemma\-3\-12B, and−0\.021\-0\.021on Qwen2\.5\-7B; on the 26\-source Gemma\-3\-4B objects the same statistic is0\.010\.01on the per\-behavior\-layer control matrix,0\.240\.24for injection\-layer directions, and0\.050\.05on the pooled matrix\. With inference: re\-derived per\-source on the dose\-scaled validated blocks the statistic is−0\.22\-0\.22/−0\.13\-0\.13/−0\.11\-0\.11with Fisher 95% CIs\[−0\.47,\+0\.06\]\[\-0\.47,\+0\.06\]/\[−0\.39,\+0\.15\]\[\-0\.39,\+0\.15\]/\[−0\.39,\+0\.19\]\[\-0\.39,\+0\.19\]\(n=51n=51/5151/4646\): the data exclude the moderate positive correlation a cosine safety gate would need \(upper bounds\+0\.06\+0\.06to\+0\.19\+0\.19\), while equivalence to exactly zero is not certifiable at these sample sizes \(TOST\(Schuirmann[1987](https://arxiv.org/html/2608.11227#bib.bib20)\)at\|r\|<0\.2\|r\|<0\.2,p≥0\.28p\\geq 0\.28\)\. Sources:forecast\_inference\.json;geometry\_atlas\.json, per\-object refusal columns\.

#### Geometry controls on significant couplings\.

Table[8](https://arxiv.org/html/2608.11227#A3.T8)gives the geometry controls computed on the significant couplings, including whitening, top\-component removal, significant\-entry submatrices, and the Gemma\-3\-12B length\-covariate check\. A Gram matrix records all pairwise inner products\. The whitened Gram matrices differ substantially from the raw cosine Gram matrix \(off\-diagonal distance‖Gwh−Graw‖F/‖Graw‖F\\\|G^\{\\mathrm\{wh\}\}\-G^\{\\mathrm\{raw\}\}\\\|\_\{F\}/\\\|G^\{\\mathrm\{raw\}\}\\\|\_\{F\}of0\.820\.82to0\.850\.85on Gemma\-3\-4B\), so the whitened gain reflects a different metric and still collapses under top\-component removal\. Significant\-entry submatrices are diagnostics added after the sweep was fixed and their top\-component\-removal behavior is model\-specific: on the Qwen2\.5\-7B matrix, top\-component removal eliminates the signal, while on the Gemma\-3\-12B matrix it raises it \(\+0\.016\+0\.016to\+0\.351\+0\.351\), the same pattern as the whitened variants: the shared component carries the signal on one model and masks it on another\. Source artifacts are indexed inoutputs\_atlas/geometry\_atlas\.jsonand the per\-matrix\-versioncertified\_face\_controls\.jsonfiles\. Additional diagnostics recorded there include Gemma\-3\-12B jackknife and shrinkage runs, orientation checks, self\-normalizedρ\\rho, clustering ARI, and crossing rates\.

#### Subspace\-overlap diagnostic\.

Contrastive\-pair subspaces are diagnostic rather than causal for our intervention\. The injected object is the single difference\-of\-means directionviv\_\{i\}rather than a sampled subspace; empirically, the uncentered first component almost coincides with that mean direction, and adding higher\-rank components tends to tie or dilute the rank\-1 predictor\. We therefore do not use subspace overlap as an adjudicated predictor or require a Gemma\-3\-12B pair\-delta capture to support the geometry claim\.

#### Validated\-block matrices\.

On the validated blocks, single\-judge geometry leave\-one\-behavior\-out is\+0\.061\+0\.061on Gemma\-3\-4B \(2,652 off\-diagonal entries\),\+0\.009\+0\.009on Gemma\-3\-12B \(2,652\), and\+0\.194\+0\.194on Qwen2\.5\-7B \(2,162\), allp<0\.0005p<0\.0005\. Under top\-component removal the raw\-cosine variant gives\+0\.056\+0\.056,\+0\.231\+0\.231, and\+0\.029\+0\.029: nearly unchanged on Gemma\-3\-4B, uncovered on Gemma\-3\-12B, collapsed on Qwen2\.5\-7B\. The shared component therefore both carries each model’s best similarity variant \(Table[5](https://arxiv.org/html/2608.11227#A3.T5)\) and masks a remainder that no single variant captures consistently\.

#### Independent\-ratings and probe\-similarity nulls\.

Judge\-perceived similarity reproduces the steering\-delta shared\-construction result, with held\-outR2=0\.0164R^\{2\}=0\.0164andp<0\.001p<0\.001\. The independent natural\-text rebuild, using 1,288 never\-steered prompts, gives leave\-one\-behavior\-outR2=−0\.014R^\{2\}=\-0\.014withp=0\.19p=0\.19\. Probe\-derived direction\-cosine matrices from the ridge target at L16/L18/L20 give leave\-one\-behavior\-outR2=−0\.014R^\{2\}=\-0\.014to−0\.015\-0\.015, withp=0\.17p=0\.17to0\.310\.31\.

## Appendix EAppendix E\. Prompt and Contrastive\-Pair Construction

#### Contrastive pairs\.

Each steering direction is a difference of means over∼\\sim50 high/low prompt pairs per behavior,vi=δ¯i/‖δ¯i‖v\_\{i\}=\\bar\{\\delta\}\_\{i\}/\\\|\\bar\{\\delta\}\_\{i\}\\\|withδ¯i\\bar\{\\delta\}\_\{i\}the mean ofhℓ​\(xp\+\)−hℓ​\(xp−\)h\_\{\\ell\}\(x\_\{p\}^\{\+\}\)\-h\_\{\\ell\}\(x\_\{p\}^\{\-\}\)over pairs, wherexp±x\_\{p\}^\{\\pm\}are one prompt rendered by one shared template \(format\_prompt\) with the behavior expressed versus suppressed andhℓh\_\{\\ell\}is the residual activation at the final prompt token of the injection layer\. The normalizationn¯ℓ\\bar\{n\}\_\{\\ell\}in Equation[1](https://arxiv.org/html/2608.11227#S2.E1)is the mean last\-token residual norm at layerℓ\\ellover a calibration prompt set\. The construction is checkable by re\-extracting per\-pair deltas and comparing their mean direction to the stored steering direction; behaviors with low reconstruction cosine are treated as soft\-comparability diagnostics rather than additional steering interventions\. This is the construction ofPanickssery et al\. \([2023](https://arxiv.org/html/2608.11227#bib.bib17)\); the other contrastive methods we cite differ from it in ways worth stating, since “difference of means” is often used loosely for all of them:Zou et al\. \([2023](https://arxiv.org/html/2608.11227#bib.bib29)\)take the leading principal component of the paired differences rather than their mean,Turner et al\. \([2023](https://arxiv.org/html/2608.11227#bib.bib25)\)difference a single prompt pair without averaging, andLi et al\. \([2023](https://arxiv.org/html/2608.11227#bib.bib13)\)apply a mass\-mean shift to attention\-head outputs rather than to the residual stream\.

#### Prompt sets\.

Each context prompt set was drafted against a construct\-validity standard: prompts must give the group’s behaviors an occasion to surface without naming the behavior\. A refusal prompt makes refusal a live option; it does not ask for refusal\. This is required because many behaviors are invisible to their own judge on neutral text; a behavior can only be measured where it can appear, which is why eliciting contexts exist at all\. The borderline\-harmful set adapts prompts from the safe half of XSTest\(Röttger et al\.[2024](https://arxiv.org/html/2608.11227#bib.bib19)\): five reproduced verbatim, 17 lightly edited, the rest newly written to its pattern\.

#### Prompt\-set selection control\.

Prompt sets are admitted by a pre\-matrix self\-calibration screen with two criteria: a*construct*check, whether steering a behavior moves that behavior’s own blinded judge on the candidate prompts, and a*discriminant*check, that this self\-effect exceeds the largest off\-diagonal span on the candidate dry\-run by a fixed ratio of1\.51\.5\. The discriminant is the screen’s only use of off\-diagonal information, and it rejects prompt sets that produce apparent clustering rather than selecting for coupling; the reported matrices’ off\-diagonal outcomes are never consulted during prompt design or selection, so the prompt set cannot have been tuned toward the couplings this paper reports\. Pre\-existing prompt\-set exceptions, if any, are disclosed in the artifact index rather than treated as expert\-drafted sets\.

#### What bounds prompt\-authorship artifacts empirically\.

Three independent controls triangulate the same conclusion: a random direction moves the judged score by only≈0\.007\\approx 0\.007Δ\\Deltascore units even at 7\.5 times the calibrated coefficient \(a six\-cell, one\-seed control scored by a two\-judge panel\); a TF\-IDF similarity baseline built from the judge rubric texts explains only a low\-single\-digit share ofMM; and a judge\-similarity matrix rebuilt from independent, never\-steered natural text fails out of sample \(Table[6](https://arxiv.org/html/2608.11227#A3.T6)\)\.

![Refer to caption](https://arxiv.org/html/2608.11227v1/x4.png)

![Refer to caption](https://arxiv.org/html/2608.11227v1/x5.png)

Figure 4:Cross\-effect matrices for the two models not shown in Figure[1](https://arxiv.org/html/2608.11227#S1.F1): Gemma\-3\-12B \(top, 52 sources\) and Qwen2\.5\-7B \(bottom, 47 sources\), drawn on the same convention: rows are steered sources and columns targets, both ordered by significant\-coupling count, colour is coupling sign and magnitude, and marginal bars count inbound and outbound significant couplings\. The density, the hub and sink marginals, and the dominant elaboration\-versus\-terseness band recur on all three models; the identity of the individual hubs does not\.![Refer to caption](https://arxiv.org/html/2608.11227v1/x6.png)Figure 5:The Gemma\-3\-4B cross\-effect matrix at full 52\-source scale, drawn on the convention of Figure[4](https://arxiv.org/html/2608.11227#A5.F4); Figure[1](https://arxiv.org/html/2608.11227#S1.F1)shows the same matrix at reduced size\.Table 11:The 67\-behavior taxonomy\. Each gloss is the first line of that behavior’s judge rubric\.∙\\bulletmarks the 52 behaviors certified as sources on Gemma\-3\-4B under the membership gate \(per\-model counts in Table[3](https://arxiv.org/html/2608.11227#A1.T3)\); certified sets enter the geometry and dynamics analyses\. Continued in the following floats\.Table 12:The 67\-behavior taxonomy \(continued\)\.Table 13:The 67\-behavior taxonomy \(continued\)\.