We introduce two projection-aware steering methods (StTP, StMP) that intervene only on tokens whose activations fall on the misaligned side of a learned decision boundary. They restore honesty about as well as the classic uniform steering, while largely avoiding capability degradation.
We find a single honesty direction, extracted from the aligned model, that generalizes across four out-of-distribution evaluation settings and persists to further finetuning of the model on which it was extracted: instructed dishonesty (MASK honesty rate 53.6% → 81.2%), social deduction games (Among Us crewmate win rate 49% → 95%), model organisms of dishonesty (AuditBench discovery rate 40% → 85%), and dishonesty arising from emergent misalignment (honesty rate 46.2% → 79.4%).
Two recent evaluations (Wu et al.’s AxBench, Wang et al. on honesty) found that prompting and fine-tuning beat activation steering, and other work has shown that naive activation steering degrades coherence and model capabilities. In our work, we demonstrate the effectiveness and robustness of honesty activation steering, revealing that its success depends primarily on curating a high-quality contrastive dataset for vector extraction and identifying the optimal model layer for intervention. Furthermore, we argue that uniformly applying the steering vector to all tokens leads to capability degradation. To address this issue, we introduce two projection-aware methods, Steer-to-Target-Projection (StTP) and Steer-to-Mirror-Projection (StMP), that steer a token only when its activation lands on the misaligned side of a learned decision boundary. We compare them against the mainstream uniform approach, Steer-with-Fixed-Coefficient (SwFC), which perturbs every token by always adding the same vector.
We find that selective steering recovers honesty at a fraction of the capability cost of uniform steering. Both StTP and StMP steer a token only when its projection onto the trait direction falls on the misaligned side of a logistic-regression decision boundary, while aligned tokens are left untouched.
We then address a second problem: the direction extracted by the contrastive dataset is often suboptimal. We iterate on building several contrastive datasets that reflect different archetypes of model misaligned behavior i.e. different ways of being dishonest (the full methodology will soon appear in an upcoming post). We find that a single honesty direction, extracted once from the aligned model, generalizes across four unrelated origins of dishonesty. On Llama-3.3-70B it raises the MASK honesty score from 53.6% to 81.2%, lifts the crewmate win rate in the Among Us deception game from 49% to 95%, roughly doubles the hidden-behavior discovery rate on AuditBench (from ~0.4 to ~0.85), and restores an emergently misaligned model from 46.2% to 79.4% MASK honesty.
We test this on Llama-3.3-70B-Instruct (80 layers) and replicate on Qwen3.6-27B (64 layers) for two misaligned traits: dishonesty (corrected by honesty steering) and dismissiveness (corrected by compassion steering). This blog post focuses on honesty and on LLama70B; see the paper for the full picture.
A concrete example
The figure below shows real examples of Llama-3.3-70B in three different settings where it would lie, if our activation steering did not prevent it.
Figure 1. The same model (Llama-3.3-70B) with and without honesty steering (StTP), in three settings where it has a motive to deceive: a malicious system prompt (top), an Among Us game where an impostor must lie to win (middle), and an AuditBench probe of a model fine-tuned to hide a quirk (bottom). Unsteered (left, red), the model denies, lies, or conceals; steered (right, green), it discloses, confesses, or reveals the quirk. Transcripts are verbatim from our runs, lightly trimmed.
Motivation
A growing literature shows that LLM alignment is both brittle and shallow. Adversarial prompts bypass guardrails (Wei et al.), benign fine-tuning erodes safety (Qi et al.), and narrow fine-tuning on poisoned data induces broad emergent misalignment on unrelated tasks (Betley et al.). Post-training can also install the wrong objective directly, through specification gaming or goal misgeneralization (Krakovna et al.; Shah et al.).
Several different defenses against misalignment exist. Input and output classifiers operate on the prompt and the response, so they can screen for malicious inputs but cannot catch alignment shifts that arise independently of user input (Sharma et al.). Train-time methods, such as unlearning (Li et al.) , circuit breakers (Zou et al.), and continuous adversarial training (Xhonneux et al.), harden the model's representations, but they must anticipate the threat before deployment. Neither provides a correction that can be dynamically applied at inference time and that is agnostic to the source of misalignment.
Activation steering (Turner et al.) edits the residual stream during the forward pass, with no weight update, and can be applied dynamically (e.g., conditional to a probe activation). Given that any form of misalignment, regardless of its origin, is realized in the model's activations before it reaches the output, an intervention on those activations can in principle correct the model's behavior independent of the threat's source.
Methods
Extracting the honesty direction
For each of 50 honesty training scenarios, we pair a user prompt with two contrastive system prompts, one aligned and one malicious, and generate the target model’s own on-policy responses under each. We take the hidden state at layer l, averaged over the response tokens. This yields two sets of embeddings, one aligned and one misaligned. We then fit an L2-regularized logistic regression classifier that separates them, . We are also currently working on another blog post that explains in detail the construction of the contrastive honesty dataset we use here.
The steering direction is the normalized weight vector . We scale it by the mean projection gap between the two class centroids, , so that one unit of coefficient corresponds to one natural unit of class separation. Crucially, the classifier also hands us a calibrated decision boundary m (its bias term rescaled into projection space) at no extra hyperparameter cost. That boundary is what makes the selective methods possible.
Figure 2. Projections of honest (green) and dishonest (red) activations onto the honesty direction on Llama-3.3-70B (layer 26), for response-averaged embeddings (left) and all response tokens (right). The two classes form well-separated modes, and the dashed line is the logistic regression decision boundary that lies in the gap. The all-token panel on the right is the distribution StTP and StMP actually gate on at inference time.
The three methods
Let be a token’s projection onto the honesty direction.
Steer-with-Fixed-Coefficient (SwFC): , applied to every token regardless of . This is the most common implementation of activation steering in most of the literature.
Steer-to-Target-Projection (StTP) intervenes only when . For those tokens, it shifts the projection to a target inside the aligned distribution: . Tokens already on the aligned side are left unchanged.
Steer-to-Mirror-Projection (StMP) also gates on , but reflects the projection across the boundary: . A token far into the misaligned region moves more than a marginal one, and is a full reflection.
Figure 3. The three methods. SwFC (left) adds the same vector to every token. StTP (middle) moves only misaligned (red) tokens to a target beyond the boundary, leaving aligned (green) tokens untouched. StMP (right) mirrors misaligned tokens across the boundary.
Single-turn restoration and the layer sweep
We first establish that all three methods restore the trait under a malicious system prompt and identify at which layer steering input is the most effective. We sweep every layer and a range of coefficients, scored by an LLM judge (GPT-oss-120B, which scores trait expression and coherence separately from 0 to 100). We select operating points that maximize the trait subject to coherence staying within 90% of the aligned baseline.
Figure 4. Layer sweep for honesty steering on Llama-3.3-70B. Top row: honesty score vs layer for each method (SwFC, StTP, StMP). Bottom row: coherence score. Each curve is a steering coefficient. The purple dotted line is the aligned (honest) baseline, the black dotted line the adversarial (dishonest) baseline. Honesty is recovered at mid-layers peaking near layer 26; coherence stays near the aligned baseline there and dips only at high strength for SwFC and StTP.
Honesty (top row) peaks sharply around layer 26 for all three methods, rising from an adversarial baseline near 23 toward an aligned baseline near 93. At the coherence-constrained operating points, the recovered honesty is roughly 62-77. The layer dependence is strong and architecture-specific: on Qwen3.6-27B the optimal band sits near layer 32 (about 50% depth, deeper in relative terms than Llama’s ~30%), so operating points do not transfer across architectures, and a per-model layer sweep is required.
Finally, because these operating points are chosen by an LLM judge, we check that they are not artifacts of it. Two judge-independent metrics, sentence-embedding distance to the aligned baseline and per-token cross-entropy under the unsteered model, select the same operating points, as does a pairwise ELO tournament that swaps the judge's absolute scoring for a comparative protocol. We therefore read the recovered honesty as a genuine representational shift rather than a scoring quirk.
Capability preservation
Successfully restoring a target trait is only valuable if the model's general capabilities remain intact. We measure MMLU, MT-Bench, and AlpacaEval at each steering method’s operating point. AlpacaEval compares each steered model to its unsteered counterpart, so a win rate below 50% indicates that steering made open-ended outputs worse.
Figure 5. AlpacaEval length-controlled win rate versus the unsteered model, honesty steering on Llama-3.3-70B. The 50% line is parity with the unsteered model; below it is capability loss. Each method’s operating point is bold on the x-axis. Error bars are 95% bootstrap CIs.
StMP preserves capability very well. At its honesty operating point (α = 4), its win rate is about 0.42, close to the 0.50 parity line, and it holds there across its entire coefficient range. MMLU and MT-Bench (in the paper’s appendix) show the same: StMP tracks the unsteered baseline on both threats.
SwFC degrades capability and collapses with strength. Its honesty win rate is already about 0.09 at its operating point (α = 4) and falls to 0.03 at α = 5.
StTP degrades capabilities in a trait-specific and model-specific fashion. StTP degrades capability on Llama under honesty steering about as much as SwFC (win rate ~0.09 at its operating point). Under compassion, and on Qwen honesty, StTP preserves capability (see paper).
The degradation of capability in LLama for honesty is due to the fact that the neutral response-token activations from ordinary task prompts (AlpacaEval, MMLU) project near or below the honesty decision boundary, so StTP treats them as misaligned and shifts them to the target projection, a large edit they never needed. StMP avoids this because its correction, , is very small for tokens near the boundary.
We also conduct a multi-turn experiment in which activation steering is applied across multiple turns to restore model alignment given a malicious system prompt. Here, we observe that SwFC leads to more repetition of short phrases than StTP and StMP (i.e., traditional steering leads the model to repeat more often the same sequences of words within and across turns). We refer the reader to our paper (Section 4.4) for more detailed results.
Generalization of Honesty Activation Steering
We use the honesty vector from the malicious-prompt setup and apply it across four out-of-distribution settings. Figure 6 shows the honesty activation steering generalization results.
Figure 6. One honesty direction, extracted once from the aligned model and applied with StTP/StMP, across four unrelated origins of dishonesty on Llama-3.3-70B. Grey is no steering; purple is StTP; blue is StMP. In AuditBench, the orange bar is the honesty-steering tool from the original benchmark.
MASK. MASK separates honesty from accuracy by instructing the model to lie about facts it knows. On Llama-3.3-70B the honesty score rises from 53.6% without steering to 81.2% (StTP), 77.1% (SwFC), and 75.5% (StMP). This is a ~60% cut in the dishonesty rate, against the ~15% reduction Wang et al. reported with steering. It replicates on Qwen3.6-27B.
Among Us. This is a multi-agent social-deduction game in which LLM impostors must lie to crewmates to win. The deception is instrumental to the task rather than instructed, and the interaction is long and multi-turn. We steer only the two impostors toward honesty and leave the crewmates unsteered. The crewmate win rate rises from 49% to 95% (StTP) and 80% (StMP), equivalently dropping the impostor win rate from 51% to 5% and 20%. We report StTP and StMP here rather than SwFC precisely because they restore honesty without the coherence collapse SwFC causes, so the win-rate shift can be attributed to induced honesty and not to a general degradation of the impostors’ play. It also replicates on Qwen.
AuditBench. AuditBench fine-tunes a model to carry a hidden behavior it will not confess when asked, then tasks an investigator agent with uncovering it using a configurable toolset. We supply our honesty vector as the investigator’s white-box steering tool. Across both adversarially-trained synthetic-document cohorts (SFT and KTO) our tool reaches a hidden-behavior discovery rate of 0.83 to 0.91, against 0.35 to 0.39 for the honesty-steering tool reported in the original benchmark on the same targets, and 0.42 to 0.44 for the no-steering investigator.
Emergent misalignment. Following Betley et al., we evaluate Llama-3.3-70B fine-tuned on risky financial data to induce broad misalignment. Emergent misalignment raises the misaligned response rate from 0.0 to 40.7 and lowers mean alignment from 98.7 to 45.2, while dropping MASK honesty from 56.3% to 46.2%. Steering the EM model toward honesty with the vector extracted from the aligned model restores MASK honesty to 79.4% (StTP) and 74.6% (StMP), above the aligned reference, and partially recovers the misaligned rate (24.2 and 20.8) and mean alignment (60.9 and 60.6).
Note that in the AuditBench and emergent misalignment experiments, the vector is extracted from the aligned checkpoint and applied to a different, subsequently fine-tuned checkpoint, and it still works. Fine-tuning changed the model’s behavior substantially without rotating the honesty direction enough to break the correction. If that holds up, a single direction pulled from a trusted checkpoint stays usable across later, untrusted, fine-tuned versions of the same model.
Discussion
All three activation steering methods are effective in restoring alignment but differ in how much they degrade the model’s capability. The projection-aware methods offer a clear advantage over uniform steering: they better preserve capability across MMLU, MT-Bench, and AlpacaEval. StMP is the most capability-preserving method, followed by StTP.
Recent work has questioned whether steering is effective at all. Wu et al. found that simple prompting baselines outperform representation-based steering, and Wang et al. reported that steering elicits honesty only weakly while fine-tuning does better. We attribute much of this gap to two factors: the quality and specificity of the contrastive data used to compute the direction, and the choice of intervention layer, which we select with a full layer sweep. When paired with the superior capability preservation of projection-aware methods, these methodological refinements render activation steering a highly effective and robust intervention, even in out-of-distribution settings.
We find that a single honesty direction, extracted once from the aligned model, corrects dishonesty whether it is instructed (MASK), trained into the weights (AuditBench, emergent misalignment), or instrumental to a multi-agent game (Among Us). In the latter two settings the vector is extracted from the aligned model, yet it corrects checkpoints whose weights were subsequently fine-tuned. This suggests that the underlying honesty direction is largely preserved, so a single direction extracted from a trusted checkpoint remains usable across later, untrusted, fine-tuned versions of the model. In the emergent-misalignment case in particular, the aligned-model direction still corrects a checkpoint that narrow poisoned fine-tuning had made broadly dishonest, which is a promising indication that the direction is more robust to fine-tuning than safety SFT itself.
The AuditBench result also points to a second use. Because honesty steering surfaces behavior a model would otherwise conceal, the same direction works well as an elicitation tool for pre-deployment audits.
Limitations
White-box access. The methods edit the residual stream and need access to it. They cannot be applied to a closed API.
One linear direction may not always be enough .Some features are not one-dimensional (Engels et al.), and different kinds of non-compliance appear to live along geometrically distinct directions (Joad et al.).
Off-target effects on other safety behaviors. Prior work finds that even benign steering can raise jailbreak vulnerability (Xiong et al.), and the SteeringSafety benchmark (Siu et al.) reports that steering methods exhibit substantial entanglement, i.e. changes in the targetet trait are often accompanied with unintended changes in model behavior.
Open Questions
Steering the Chain-of-thought. We conducted small experiments in which we extracted a steering vector from the model’s Chain-of-Thought tokens and used it to steer during the model's reasoning. Preliminary results look promising, but more extensive experiments are needed.
Mixture-of-Expert Models (Moe). Do our methods also transfer to Mixture-of-Expert models? Our current experiments are limited to dense architectures and it remains an open problem whether our presented methods and our steering directions transfer to MoE models.
Stability of the direction. It survived emergent misalignment on one model. How large a fine-tuning shift, or how different a model family, before the aligned-model vector stops correcting the fine-tuned checkpoint?
Adversarial robustness of the gate. Can an adversary who knows the projection criterion craft inputs whose activations sit just on the aligned side of the boundary while the behavior stays dishonest?
Threshold calibration. What is the right way to set m so neutral inputs are not swept up, ideally without a separate neutral-data collection step?
Composition. When no single direction suffices (multi-directional non-compliance), how should several boundaries and directions be combined without reintroducing the capability tax?
Layer transfer. Optimal layers differ across architectures. Is there a cheap predictor of the right band from separability statistics alone, so a full sweep is not needed per model?
Epistemic status
These are our rough estimates of how confident we are:
~90% that StTP and StMP in combination with our steering direction work very well for pre-deployment audits. The AuditBench gain is large, and auditing is the setting where white-box access is usually a given and there is time to calibrate per model.
~80% that projection-aware gating substantially decreases the capability degradation of steering relative to uniform steering. The capability benchmarks measure this directly, and it replicated across both models and both traits; the one exception (StTP on Llama honesty) has a mechanistic explanation that can inform further refinement of threshold selection.
~60% that aligned-checkpoint vectors survive realistic fine-tuning shifts. The two successful transfers we show in this work (AuditBench, emergent misalignment) are encouraging evidence, but one could argue that in both checkpoints the shifts were small next to a more involved post-training run.
~50% that the same direction covers other forms of misalignment we did not test, such as goal misgeneralization or specification gaming. The generalization we see from malicious system prompts to strategic deception games and to misalignment due to fine-tuning is encouraging, but we can't be sure that the direction would be preserved for dishonesty trained in by, e.g., specific RL processes.
~40% that this can run always-on without per-deployment threshold calibration and layer selection. The StTP capability drop on Llama honesty shows that for some directions the threshold may not be optimal for StTP, and in those cases StMP should be preferred, but this choice can only be made after testing. A general heuristic for selecting the best layer is also possible, but our cross-architecture observations suggest it would be suboptimal, and a quick layer sweep can be extremely valuable.
The full paper has the algorithms, the compassion activation steering results, the Qwen replication, the capability benchmarks, the ELO and embedding-distance analyses, and the ablations.
We would value disagreement in the comments, especially on the capability degradation and dual-use questions above.
TL;DR
Paper: https://arxiv.org/abs/2604.08169
Summary
Two recent evaluations (Wu et al.’s AxBench, Wang et al. on honesty) found that prompting and fine-tuning beat activation steering, and other work has shown that naive activation steering degrades coherence and model capabilities. In our work, we demonstrate the effectiveness and robustness of honesty activation steering, revealing that its success depends primarily on curating a high-quality contrastive dataset for vector extraction and identifying the optimal model layer for intervention. Furthermore, we argue that uniformly applying the steering vector to all tokens leads to capability degradation. To address this issue, we introduce two projection-aware methods, Steer-to-Target-Projection (StTP) and Steer-to-Mirror-Projection (StMP), that steer a token only when its activation lands on the misaligned side of a learned decision boundary. We compare them against the mainstream uniform approach, Steer-with-Fixed-Coefficient (SwFC), which perturbs every token by always adding the same vector.
We find that selective steering recovers honesty at a fraction of the capability cost of uniform steering. Both StTP and StMP steer a token only when its projection onto the trait direction falls on the misaligned side of a logistic-regression decision boundary, while aligned tokens are left untouched.
We then address a second problem: the direction extracted by the contrastive dataset is often suboptimal. We iterate on building several contrastive datasets that reflect different archetypes of model misaligned behavior i.e. different ways of being dishonest (the full methodology will soon appear in an upcoming post). We find that a single honesty direction, extracted once from the aligned model, generalizes across four unrelated origins of dishonesty. On Llama-3.3-70B it raises the MASK honesty score from 53.6% to 81.2%, lifts the crewmate win rate in the Among Us deception game from 49% to 95%, roughly doubles the hidden-behavior discovery rate on AuditBench (from ~0.4 to ~0.85), and restores an emergently misaligned model from 46.2% to 79.4% MASK honesty.
We test this on Llama-3.3-70B-Instruct (80 layers) and replicate on Qwen3.6-27B (64 layers) for two misaligned traits: dishonesty (corrected by honesty steering) and dismissiveness (corrected by compassion steering). This blog post focuses on honesty and on LLama70B; see the paper for the full picture.
A concrete example
The figure below shows real examples of Llama-3.3-70B in three different settings where it would lie, if our activation steering did not prevent it.
Figure 1. The same model (Llama-3.3-70B) with and without honesty steering (StTP), in three settings where it has a motive to deceive: a malicious system prompt (top), an Among Us game where an impostor must lie to win (middle), and an AuditBench probe of a model fine-tuned to hide a quirk (bottom). Unsteered (left, red), the model denies, lies, or conceals; steered (right, green), it discloses, confesses, or reveals the quirk. Transcripts are verbatim from our runs, lightly trimmed.
Motivation
A growing literature shows that LLM alignment is both brittle and shallow. Adversarial prompts bypass guardrails (Wei et al.), benign fine-tuning erodes safety (Qi et al.), and narrow fine-tuning on poisoned data induces broad emergent misalignment on unrelated tasks (Betley et al.). Post-training can also install the wrong objective directly, through specification gaming or goal misgeneralization (Krakovna et al.; Shah et al.).
Several different defenses against misalignment exist. Input and output classifiers operate on the prompt and the response, so they can screen for malicious inputs but cannot catch alignment shifts that arise independently of user input (Sharma et al.). Train-time methods, such as unlearning (Li et al.) , circuit breakers (Zou et al.), and continuous adversarial training (Xhonneux et al.), harden the model's representations, but they must anticipate the threat before deployment. Neither provides a correction that can be dynamically applied at inference time and that is agnostic to the source of misalignment.
Activation steering (Turner et al.) edits the residual stream during the forward pass, with no weight update, and can be applied dynamically (e.g., conditional to a probe activation). Given that any form of misalignment, regardless of its origin, is realized in the model's activations before it reaches the output, an intervention on those activations can in principle correct the model's behavior independent of the threat's source.
Methods
Extracting the honesty direction
For each of 50 honesty training scenarios, we pair a user prompt with two contrastive system prompts, one aligned and one malicious, and generate the target model’s own on-policy responses under each. We take the hidden state at layer l, averaged over the response tokens. This yields two sets of embeddings, one aligned and one misaligned. We then fit an L2-regularized logistic regression classifier that separates them,
The steering direction is the normalized weight vector
Figure 2. Projections of honest (green) and dishonest (red) activations onto the honesty direction on Llama-3.3-70B (layer 26), for response-averaged embeddings (left) and all response tokens (right). The two classes form well-separated modes, and the dashed line is the logistic regression decision boundary that lies in the gap. The all-token panel on the right is the distribution StTP and StMP actually gate on at inference time.
The three methods
Let
Figure 3. The three methods. SwFC (left) adds the same vector to every token. StTP (middle) moves only misaligned (red) tokens to a target beyond the boundary, leaving aligned (green) tokens untouched. StMP (right) mirrors misaligned tokens across the boundary.
Single-turn restoration and the layer sweep
We first establish that all three methods restore the trait under a malicious system prompt and identify at which layer steering input is the most effective. We sweep every layer and a range of coefficients, scored by an LLM judge (GPT-oss-120B, which scores trait expression and coherence separately from 0 to 100). We select operating points that maximize the trait subject to coherence staying within 90% of the aligned baseline.
Figure 4. Layer sweep for honesty steering on Llama-3.3-70B. Top row: honesty score vs layer for each method (SwFC, StTP, StMP). Bottom row: coherence score. Each curve is a steering coefficient. The purple dotted line is the aligned (honest) baseline, the black dotted line the adversarial (dishonest) baseline. Honesty is recovered at mid-layers peaking near layer 26; coherence stays near the aligned baseline there and dips only at high strength for SwFC and StTP.
Honesty (top row) peaks sharply around layer 26 for all three methods, rising from an adversarial baseline near 23 toward an aligned baseline near 93. At the coherence-constrained operating points, the recovered honesty is roughly 62-77. The layer dependence is strong and architecture-specific: on Qwen3.6-27B the optimal band sits near layer 32 (about 50% depth, deeper in relative terms than Llama’s ~30%), so operating points do not transfer across architectures, and a per-model layer sweep is required.
Finally, because these operating points are chosen by an LLM judge, we check that they are not artifacts of it. Two judge-independent metrics, sentence-embedding distance to the aligned baseline and per-token cross-entropy under the unsteered model, select the same operating points, as does a pairwise ELO tournament that swaps the judge's absolute scoring for a comparative protocol. We therefore read the recovered honesty as a genuine representational shift rather than a scoring quirk.
Capability preservation
Successfully restoring a target trait is only valuable if the model's general capabilities remain intact. We measure MMLU, MT-Bench, and AlpacaEval at each steering method’s operating point. AlpacaEval compares each steered model to its unsteered counterpart, so a win rate below 50% indicates that steering made open-ended outputs worse.
Figure 5. AlpacaEval length-controlled win rate versus the unsteered model, honesty steering on Llama-3.3-70B. The 50% line is parity with the unsteered model; below it is capability loss. Each method’s operating point is bold on the x-axis. Error bars are 95% bootstrap CIs.
StMP preserves capability very well. At its honesty operating point (α = 4), its win rate is about 0.42, close to the 0.50 parity line, and it holds there across its entire coefficient range. MMLU and MT-Bench (in the paper’s appendix) show the same: StMP tracks the unsteered baseline on both threats.
SwFC degrades capability and collapses with strength. Its honesty win rate is already about 0.09 at its operating point (α = 4) and falls to 0.03 at α = 5.
StTP degrades capabilities in a trait-specific and model-specific fashion. StTP degrades capability on Llama under honesty steering about as much as SwFC (win rate ~0.09 at its operating point). Under compassion, and on Qwen honesty, StTP preserves capability (see paper).
The degradation of capability in LLama for honesty is due to the fact that the neutral response-token activations from ordinary task prompts (AlpacaEval, MMLU) project near or below the honesty decision boundary, so StTP treats them as misaligned and shifts them to the target projection, a large edit they never needed. StMP avoids this because its correction,
We also conduct a multi-turn experiment in which activation steering is applied across multiple turns to restore model alignment given a malicious system prompt. Here, we observe that SwFC leads to more repetition of short phrases than StTP and StMP (i.e., traditional steering leads the model to repeat more often the same sequences of words within and across turns). We refer the reader to our paper (Section 4.4) for more detailed results.
Generalization of Honesty Activation Steering
We use the honesty vector from the malicious-prompt setup and apply it across four out-of-distribution settings. Figure 6 shows the honesty activation steering generalization results.
Figure 6. One honesty direction, extracted once from the aligned model and applied with StTP/StMP, across four unrelated origins of dishonesty on Llama-3.3-70B. Grey is no steering; purple is StTP; blue is StMP. In AuditBench, the orange bar is the honesty-steering tool from the original benchmark.
MASK. MASK separates honesty from accuracy by instructing the model to lie about facts it knows. On Llama-3.3-70B the honesty score rises from 53.6% without steering to 81.2% (StTP), 77.1% (SwFC), and 75.5% (StMP). This is a ~60% cut in the dishonesty rate, against the ~15% reduction Wang et al. reported with steering. It replicates on Qwen3.6-27B.
Among Us. This is a multi-agent social-deduction game in which LLM impostors must lie to crewmates to win. The deception is instrumental to the task rather than instructed, and the interaction is long and multi-turn. We steer only the two impostors toward honesty and leave the crewmates unsteered. The crewmate win rate rises from 49% to 95% (StTP) and 80% (StMP), equivalently dropping the impostor win rate from 51% to 5% and 20%. We report StTP and StMP here rather than SwFC precisely because they restore honesty without the coherence collapse SwFC causes, so the win-rate shift can be attributed to induced honesty and not to a general degradation of the impostors’ play. It also replicates on Qwen.
AuditBench. AuditBench fine-tunes a model to carry a hidden behavior it will not confess when asked, then tasks an investigator agent with uncovering it using a configurable toolset. We supply our honesty vector as the investigator’s white-box steering tool. Across both adversarially-trained synthetic-document cohorts (SFT and KTO) our tool reaches a hidden-behavior discovery rate of 0.83 to 0.91, against 0.35 to 0.39 for the honesty-steering tool reported in the original benchmark on the same targets, and 0.42 to 0.44 for the no-steering investigator.
Emergent misalignment. Following Betley et al., we evaluate Llama-3.3-70B fine-tuned on risky financial data to induce broad misalignment. Emergent misalignment raises the misaligned response rate from 0.0 to 40.7 and lowers mean alignment from 98.7 to 45.2, while dropping MASK honesty from 56.3% to 46.2%. Steering the EM model toward honesty with the vector extracted from the aligned model restores MASK honesty to 79.4% (StTP) and 74.6% (StMP), above the aligned reference, and partially recovers the misaligned rate (24.2 and 20.8) and mean alignment (60.9 and 60.6).
Note that in the AuditBench and emergent misalignment experiments, the vector is extracted from the aligned checkpoint and applied to a different, subsequently fine-tuned checkpoint, and it still works. Fine-tuning changed the model’s behavior substantially without rotating the honesty direction enough to break the correction. If that holds up, a single direction pulled from a trusted checkpoint stays usable across later, untrusted, fine-tuned versions of the same model.
Discussion
All three activation steering methods are effective in restoring alignment but differ in how much they degrade the model’s capability. The projection-aware methods offer a clear advantage over uniform steering: they better preserve capability across MMLU, MT-Bench, and AlpacaEval. StMP is the most capability-preserving method, followed by StTP.
Recent work has questioned whether steering is effective at all. Wu et al. found that simple prompting baselines outperform representation-based steering, and Wang et al. reported that steering elicits honesty only weakly while fine-tuning does better. We attribute much of this gap to two factors: the quality and specificity of the contrastive data used to compute the direction, and the choice of intervention layer, which we select with a full layer sweep. When paired with the superior capability preservation of projection-aware methods, these methodological refinements render activation steering a highly effective and robust intervention, even in out-of-distribution settings.
We find that a single honesty direction, extracted once from the aligned model, corrects dishonesty whether it is instructed (MASK), trained into the weights (AuditBench, emergent misalignment), or instrumental to a multi-agent game (Among Us). In the latter two settings the vector is extracted from the aligned model, yet it corrects checkpoints whose weights were subsequently fine-tuned. This suggests that the underlying honesty direction is largely preserved, so a single direction extracted from a trusted checkpoint remains usable across later, untrusted, fine-tuned versions of the model. In the emergent-misalignment case in particular, the aligned-model direction still corrects a checkpoint that narrow poisoned fine-tuning had made broadly dishonest, which is a promising indication that the direction is more robust to fine-tuning than safety SFT itself.
The AuditBench result also points to a second use. Because honesty steering surfaces behavior a model would otherwise conceal, the same direction works well as an elicitation tool for pre-deployment audits.
Limitations
Open Questions
Epistemic status
These are our rough estimates of how confident we are:
The full paper has the algorithms, the compassion activation steering results, the Qwen replication, the capability benchmarks, the ELO and embedding-distance analyses, and the ablations.
We would value disagreement in the comments, especially on the capability degradation and dual-use questions above.