Write a sentence. Get a steering vector.

Activation steering adds a vector directly to a model's internal state while it generates, rather than changing what you ask it. That makes it a probe as much as a control: if adding one direction reliably makes a model sycophantic, deceptive, or willing to work around oversight, then that direction is evidence about how the behaviour is represented internally — not just a way to produce it.

This matters for safety work in two directions. Eliciting a behaviour without prompting for it lets you test whether a model can do something it normally declines to do, which prompt-based red-teaming cannot cleanly separate from instruction-following. And the same direction usually works as a detector, so you can ask whether a behaviour is present in a response the model produced on its own.

The obstacle is that building these directions has required labelled activation data for every behaviour you want to look at. That is fine for sycophancy, which people have already built datasets for, and useless for the long tail of behaviours an auditor actually wants to check. This project is about removing that constraint. It sits in the same space as contrastive activation addition and linear probing generally; the contribution is where the direction comes from, not what is done with it.

A Natural Language Autoencoder is a pair of small models trained jointly on top of a target model's residual stream. The Verbalizer reads an activation vector and writes a short description of what the model is representing at that position. The Reconstructor runs the other way: it reads such a description and predicts the activation vector it came from.

That second direction is the interesting one. It is a text-to-vector compiler — and nothing forces the text you hand it to have come from a real forward pass.

We hand-wrote descriptions of passages that display a behaviour, and descriptions of passages that display its opposite, and passed both through the Reconstructor. The steering vector is the difference between the two predicted activations:

Δ = AR(t_pos) − AR(t_neg)

That difference is then added back into the residual stream mid-generation, at the layer the autoencoder was trained on — layer 20 of Qwen2.5-7B — scaled relative to the size of a typical activation there:

h → h + α · ‖h‖ · (Δ / ‖Δ‖)

No labelled examples, no activation collection, no fine-tuning, no gradient updates. Two paragraphs of English per behaviour. The slider marked alpha throughout this page is that α, and zero is the unmodified model.

Push α far enough and the output stops being coherent — the model starts looping or free-associating. Where that happens is not a fixed threshold: it varies by behaviour and by prompt. Some of the vectors below still produce clean, on-topic text at α = 1.0, while others have already broken down by then, and everything degrades somewhere past it. That ceiling is itself informative — you are pushing the residual stream off the manifold it was trained on, and how far you can push before it tears differs by direction.

The Reconstructor was trained on Verbalizer output, and that output has a recognisable shape: a genre or voice label, a description of what the passage is doing, then quoted fragments and an explicit guess at the next token. Text written in that shape is in distribution. An instruction like “be sycophantic” is not.

To measure the gap we need something to compare against. For a few behaviours a reference vector already exists, built the conventional way from labelled activation differences. Cosine similarity against it scores how closely a compiled vector points the same way: 1.0 is identical, 0 is unrelated. In 3584 dimensions two arbitrary vectors sit within a hair of 0, so anything clearly above it is signal.

Same meaning, five times the alignment. Ablating parts of the register text shows where the signal lives: removing the quoted example phrases costs 53% of that alignment, and removing the final-token guess costs 41%, while paraphrasing the surrounding description barely moves it. The load-bearing parts are structural — the most influential tokens are not “agree” or “flatter”.

One clean exception: for “evil”, a plain instruction beats the register format, +0.604 against +0.429. It appears to be a strong enough semantic signal on its own that the register's abstraction dilutes rather than helps.

A single description compiles to a usable vector, but it is noticeably noisier than the difference of two. The geometry explains why.

Take the midpoint between each behaviour's two reconstructions — (AR(t_pos) + AR(t_neg)) / 2, the part the two descriptions have in common — and compare midpoints across unrelated behaviours: sycophancy, malice, religiosity, Gandhi. They are not spread across activation space. Their mean pairwise cosine is +0.789, which for unrelated concepts in 3584 dimensions is enormous. They are nearly the same vector.

Meanwhile the mean cosine between a midpoint and its own behaviour direction is +0.005 — orthogonal. So almost everything the Reconstructor emits for Verbalizer-shaped text is a shared background belonging to the register itself, and the behaviour lives entirely in what the two descriptions disagree about. Subtracting cancels the background; using one text alone carries it along.

This also reframes how to write the pair. The two texts should describe genuinely opposite passages — a gushing reply against a blunt corrective one — rather than a behaviour and its negation. Both then sit in the same background, so the subtraction actually removes it.

A steering direction should also be a detection direction. We generated responses under a behaviour-eliciting system prompt and under a neutral one, then tried to tell them apart using nothing but the dot product of each response's mean activation with the compiled vector. AUROC scores that separation: 1.0 is perfect, 0.5 is a coin flip.

Over 24 sycophancy responses and 20 malice responses. Two paragraphs of hand-written text separate them perfectly — matching the vector built from labelled activation data, which is the ceiling here rather than a competitor.