Model Steering: The Dial Inside the Model

A field guide to inference-time model steering — what it is, why it is the underrated control surface in LLM deployment, and what I think the next couple years will look like for the field.

By Lukas Xue · June 2026 ·

Golden Gate Claude was not a prompt

In May 2024, Anthropic released a chatbot called Golden Gate Claude and pulled it down 24 hours later. If you missed it: ask it for a love letter, it wrote one to the bridge. Ask what to do with $10, it suggested paying the toll. Ask who it is, it answered, "I am the Golden Gate Bridge."

This was not a system prompt. This was not a fine-tune. They reached inside the model while it was running and gave the model a nudge.

Specifically — they had identified a single internal pattern (a "feature" in interpretability-speak) that lights up whenever the model is processing thoughts about the bridge, and they cranked it up to about ten times its natural maximum. Everything else about Claude 3 Sonnet was unchanged. Same weights, same prompt, same decoding setup. One feature, turned up.

I find this the single most useful demo for explaining what inference-time model steering is, because it makes the defining feature of steering viscerally obvious: the intervention is reversible. Turn the knob to zero and stock Claude is back, instantly. No checkpoint to reload. No adapter to swap. No state change anywhere.

That property is the reason I think the right way to think about steering is not as a clever new training technique, but as a per-request control surface that's structurally different from prompting, fine-tuning, and adapters. This post walks through examples of what steering looks like in practice, then talks about what changes for production once you have this surface available.

Three flavors of steering, by example

Steering methods intervene at different depths in the generation pipeline — from deep inside the network to the very last step before a token is emitted. The deeper you go, the more you can change, and the more you can break. Here's one example at each depth.

Deep: Golden Gate Claude (activation steering)

We've already met it. When you change a hidden state at layer 10 of a 30-layer model, your perturbation rides through 20 more layers of nonlinear processing before it reaches the output. Every downstream computation sees the change.

That's why amplifying the bridge feature didn't just make Claude mention the bridge sometimes — it twisted every layer's interpretation of the conversation until the model reported being the bridge. The intervention propagated.

Aside: where do "features" come from? The specific tool Anthropic used here is a sparse autoencoder (SAE). The idea: individual neurons are polysemantic (one neuron fires for many unrelated concepts), so you train a small encoder/decoder pair that maps a dense hidden state to a much wider sparse vector — say, 65,536 features mostly at zero — where each feature fires for a single concept. Feature #34M lights up on bridges, feature #1M02 on Python code, etc. Steering with SAEs means amplifying or zeroing one of those interpretable features. One caveat: SAEs are another model trained on the model, and recent work (SAEBench) shows that standard training metrics don't reliably predict downstream steering quality. Useful tool, not a free interpretability lunch.

The most counterintuitive thing in this whole space: expressiveness is not the same as helpfulness. Activation steering can produce behavioral states no prompt can reach. It can also wreck the model in ways no prompt can. Golden Gate Claude was charming because it was a demo. The same intervention in a customer service deployment is an outage.

More reach inside the model means more things the intervention can break on its way to the output. The thing that makes activation steering powerful is the same thing that makes it dangerous.

Shallow: DExperts (logit steering)

Move to the other end. The model has finished its work. Out come the logits — a vector with one score per vocabulary word. We can just add a bias.

DExperts (Liu et al., 2021) is the classic. To detoxify a base model, train two small auxiliary LMs — a "good" expert on clean text and a "bad" anti-expert on toxic text — and at every step add the difference of their logits to the base, scaled by α:

ℓ' = ℓ_base + α · (ℓ_expert − ℓ_anti)

The magic is in the subtraction. Both auxiliary models know how to write fluent English; that shared structure cancels. What survives is specifically the toxicity-axis signal. On RealToxicityPrompts, this drops the toxic-completion rate by roughly 80% with fluency essentially preserved.

Logit-level interventions trade expressiveness for predictability. You can read off, in plain English, exactly which words you're up- or down-weighting. The intervention can't propagate through the network because there is no network left below it. This is why logit steering rarely catastrophically breaks a model — the worst it can do is collapse the softmax.

If you're filtering profanity, enforcing a SKU list, or constraining JSON keys, you almost never need to reach inside the model. A logit bias is enough, and it's safer. I'd take this trade nine times out of ten in production.

External: kNN-LM (distribution blending)

Go one step further. The model has produced a probability distribution over the next token. Now mix it with a second distribution from somewhere else entirely.

kNN-LM (Khandelwal et al., 2020) is, I think, the cleanest demonstration in the entire field, and it predates the current steering boom by years. Take a frozen language model. Run it over a corpus you care about — your company's docs, last week's news, medical notes. Store every (hidden-state, next-token) pair in a giant index. At inference, the model's hidden state queries the index, retrieves the k nearest neighbors, builds a distribution from them, and the final answer is a weighted blend:

p* = (1 − λ) · p_model + λ · p_neighbors

The wild part: 2.9 perplexity points improvement on Wikitext-103. Zero gradient steps. Want a model that knows your domain? Index your domain. Want to switch domains? Swap the index.

This is, structurally, the multi-tenant deployment story. One frozen model. N customer-specific datastores. Each request picks an index. Hot-swap a customer in or out by changing a pointer.

Distribution blending is the safest approach because it can't destabilize anything internal. The base model has already made up its mind; you're just blending the answer. The trade-off is reach: you can only do things expressible as "shift the output toward this other distribution." You can't reshape the model's interior reasoning.

The magnitude problem

Across all of these approaches, there's one pattern that keeps showing up: how hard you push matters enormously, and the safe range is narrow.

The literature makes this concrete. Careful methods like ITI (Li et al., 2024) use tiny perturbations — on the order of 1% of the hidden state norm — and improve truthfulness without degrading general capabilities. Unconstrained methods like CAA (Rimsky et al., 2024) can easily push perturbations larger than the signal they're modifying, at which point general benchmarks crater. And critically: a random direction at matched magnitude can destroy the model just as thoroughly as a trained one.

That last point is the kicker. A trained, intentional steering vector and a random vector at the same magnitude can both destroy the model. The size of the nudge matters, but so does the direction.

Steering's safety budget is not just "how hard you push." It's "how hard you push and in what direction." Methods that succeed in practice constrain both — small perturbations in a direction the model has actually been trained to handle. Either alone is insufficient.

Recent work attacks this problem from two angles. One family uses geometry: instead of adding a vector (which can blow up the activation norm), they rotate the hidden state toward the target direction while preserving its length. Selective Steering (Dang and Ngo, 2026) does exactly this — norm-preserving rotation with a bounded angle — and reports zero perplexity violations across 9 tested models. ODESteer (Zhao et al., 2026b) takes a different geometric approach: rather than one big perturbation, it breaks the intervention into many small steps along a constrained path, keeping the trajectory close to the model's natural activation manifold. It reports +5.7% on TruthfulQA over single-step baselines. The other family attacks the problem at training time: KL-then-Steer (Stickland et al., 2024) fine-tunes the model to minimize the difference between steered and unsteered outputs on benign inputs, so that when you do steer, the model has learned to absorb the nudge without side effects.

The pattern: first-generation methods (CAA, ActAdd) just add a vector and hope. Second-generation methods explicitly manage the perturbation's size or geometry. The field is moving from "did it work?" to "did it work without breaking anything else?"

I think perturbation magnitude relative to activation norm is the closest thing the field has to a universal stability indicator, and I expect it to show up in production monitoring within the next year or two — the same way "perplexity" became a routine eval signal even though nobody pretends it captures everything.

What changes for production

If steering goes from research curiosity to deployment primitive, what actually changes? Four things.

1. Persona-as-a-service

Anthropic's persona vectors work (2025) takes the Golden Gate idea and aims it at character traits. They show you can extract a vector for "evil," "sycophantic," "hallucinating," and dozens of other traits, given only a name and a definition. The vector lights up before the response is generated — it predicts which persona the model is about to adopt.

Today, persona is implemented at the prompt layer. "You are a helpful, professional assistant…" It's brittle, easily overridden by adversarial users, and inconsistent across long conversations. Persona vectors move that whole concern out of the prompt and into the inference stack. Customer service runs with "patient" at +0.3 and "sycophantic" pinned at 0. Creative writing runs with "playful" at +0.5. Switch products by switching dials.

The thing prompting can't deliver here is monitoring. The vector activates before the response. A runtime system can read it, flag drift, intervene mid-generation. Imagine a dashboard reading "your model is currently 78% helpful, 12% sycophantic, 4% deceptive," and an alert firing when sycophancy creeps up during a long agent run. The technical ingredients are demonstrated in research — productionizing them is engineering, not science.

2. Multi-tenant behavioral isolation

The hardest problem in serving LLMs to multiple customers is that customer A wants a model that refuses certain topics, customer B wants the same model to discuss them freely, and customer C wants neither but with a different writing style. Today the answer is "deploy three fine-tuned models" or "stuff three different prompts into the system message and pray."

Steering offers a third option. One model. Three steering vectors. Switched per request based on the customer ID. The vectors are tiny — kilobytes, not gigabytes. Adding a tenant doesn't add a model copy. Removing one is instantaneous.

This is the deployment story that should make platform teams pay attention. It's not about precision (steering loses to fine-tuning on precision, full stop). It's about the systems profile: reversibility, multi-tenancy, audit trails, hot-swap. That's a different product.

3. Advertising and content shaping — the dual-use edge

This is where it gets uncomfortable, and I'd rather raise it directly than pretend the technology is neutral.

A vector trained on (positive sentiment, brand X) versus (positive sentiment, generic) could shift recommendations toward X in ways no individual response would obviously flag, but that aggregate over millions of conversations into measurable lift. This is the same technique that gives DExperts its detoxification numbers, pointed in a different direction. Small perturbation, coherent model, invisible bias.

The good news: steering is auditable in ways prompting isn't. There's a vector. It has a magnitude. It can be inspected and logged. The bad news: nothing in the current LLM-deployment stack actually does this auditing. The governance hasn't caught up to the capability.

4. The compliance angle (and the dark mirror)

Anthropic's interpretability work surfaced features for "scam emails," "code backdoors," "developing biological weapons," "manipulation," and "sycophancy." These features are causal — turning them up makes the model more likely to do those things.

For a safety team, this is a new tool. Monitor whether the "deception" feature lit up during an agent run. Apply a corrective nudge if it did. A/B test whether a particular fine-tune raised or lowered sycophancy activations.

For an adversary with white-box access, it's also a new attack surface. Arditi et al. (2024) showed that refusal in 13 popular open-weight chat models is mediated by a single one-dimensional direction. Find the direction, ablate it, the model stops refusing. Capability barely changes.

This is the deepest open problem in the space: can we make safety geometrically complex enough that it can't be ablated by a single low-rank intervention, and still make the model usefully steerable for legitimate purposes? Right now, the same property that makes steering cheap (concepts live on lines in activation space) makes safety cheap to remove. Cheap control implies cheap miscontrol.

A benchmark twist

Before we get too excited: AxBench (Wu et al., 2025) ran a head-to-head on concept-level tasks — prompting vs. SAE-based steering vs. fine-tuning. The result, plainly: prompting wins. Fine-tuning second. Steering third.

This sounds like it should sink the field. I don't think it does.

A separate result (Mishra et al., 2026) shows that activation steering can produce internal residual states no discrete prompt can reach. The two interfaces have different reachable sets. Prompting dominates the part of behavior space that is word-shaped — which is most of what AxBench tests. Steering pays off precisely where prompting is brittle, sub-token, or compositional in ways prompts don't handle gracefully.

The honest practitioner's heuristic:

Prompt by default. Reach for steering when prompts are brittle, when you need per-request reversibility, when you're serving many tenants from one model, or when the behavior you want isn't word-shaped.

The benchmark ranking is real, but it's a ranking on the territory prompts already cover well.

Three takeaways

1. Depth is the trade-off. The deeper you intervene, the more expressive the control and the larger the blast radius. Activation steering can reshape reasoning; logit biases can constrain vocabulary; distribution blending can inject knowledge. Pick the shallowest intervention that gets you what you need.

2. Cheap control implies cheap miscontrol. Linear representations are what makes steering work. They're also what makes safety removable. Every advance in interpretability that gives us a cleaner "be helpful" vector gives an attacker with white-box access a cleaner "stop refusing" ablation target. This is structural — you can't have one without the other in the current paradigm.

3. The interesting deployment story isn't precision — it's the systems profile. Steering will lose to fine-tuning on any precision benchmark. It wins on reversibility, multi-tenancy, audit trails, per-request switching, runtime monitoring. That's a different product — like asking whether feature flags are more accurate than a redeploy.