Present but Rescaled: Chat-to-Agent Transfer of Additive Activation Steering

• URL: http://arxiv.org/abs/2607.09156v1
• Date: Fri, 10 Jul 2026 07:21:34 GMT
• Title: Present but Rescaled: Chat-to-Agent Transfer of Additive Activation Steering
• Abstract summary: We present the first systematic chat-to-agent transfer study of additive steering.<n>The transfer is real but rescaled, and the right description is a dissociation.<n>Agentic deployment amplifies steering-based refusal bypass by up to 2.00x on some models while others.
• Score: 0.7252027234425333
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Additive activation steering (injecting a scaled residual-stream direction during generation) is calibrated almost entirely in single-turn chat, yet the models it targets are increasingly deployed as tool-using ReAct agents. We present the first systematic chat-to-agent transfer study of additive steering, coupling behavioral measurement with a representation read-out in a matched-information design: the same items rendered as plain chat or as a ReAct tool-use episode, with matched-norm random-direction controls and the transcript re-encoded every turn to exclude KV-cache contamination. Transfer is real but rescaled, and the right description is a dissociation: the injected direction reaches the late layers at near-full strength in every setting and model tested (install-site agent-over-chat ratios 0.83-1.16 across three families), while the behavioral coupling is reset per model and context. On Qwen2.5-7B a refusal bypass vector amplifies in the agent (T = 1.45, CI [1.20, 1.78], N = 300); across a powered uniform-protocol distribution the coupling spans amplification (Gemma-2-9B T = 2.00) to attenuation (Yi-1.5-9B T = 0.43, CI [0.29, 0.60]), with no universal constant and a single clean attenuator against a universal sign. Directional ablation of the same axis does not amplify (T = 0.93, CI including 1) while additive injection amplifies (T = 1.50), a 20.1-point gain difference (CI [13.4, 26.8]) that identifies an additive-specific mechanism. Two pre-registered instruments converge to localize the rescaling to the ReAct format scaffold, before any tool observation, rather than to the observation boundary where a dilution account would predict it. The safety implication is immediate and unpredictable: agentic deployment amplifies steering-based refusal bypass by up to 2.00x on some models while others attenuate, so a deployment cannot assume a given model is safe under additive steering.

Related papers

• Can AI Agents Simulate A/B Test Outcomes? A Validation Framework for Agentic Experimentation [1.4180331276028662]
  A/B testing remains the standard for rolling out new features in the technology industry.<n>Can AI agents---conditioned on behavioral profiles and contextual descriptions of the intervention---simulate outcomes accurately enough to vet candidate treatments before committing live traffic?<n>We formalize this question as a emphSimulated Randomized Controlled Trial (S-RCT) and derive a two-layer error decomposition that separates agent approximation error from subsampling error.
  arXiv  Detail & Related papers  (2026-08-03T14:58:06Z)
• Asymmetric Collapse in Model Merging: When Refusal Over- writes Recognition [4.800831341795478]
  We use two Gemma-3-1B-IT finetunes on two complementary safety objectives: CARES harm-level classification and WildJailbreak adversarial refusal.<n>We merge the two fine-tunes using Linear, SLERP, TIES, and DARE-TIES, and evaluate the merged models on classification accuracy, attack resistance, and benign compliance.
  arXiv  Detail & Related papers  (2026-07-26T19:10:34Z)
• Robust Activation Map Rectification for Weakly Supervised Volumetric Segmentation: Temporal Coherence as a Free Lunch [31.156115062163412]
  Weakly supervised segmentation relies heavily on class activation maps (CAMs) to initially localize target regions.<n>Existing remedies typically introduce additional training stages or prototype learning, increasing computational cost and reducing robustness.<n>We propose a training-free prototype-free framework that rectifies unreliable CAMs by exploiting temporal and structural coherence in volumetric data as a free lunch.
  arXiv  Detail & Related papers  (2026-07-22T08:07:38Z)
• GEMS: Geometric Constraints Enable Multi-Semantic Superposition in LLMs [5.018957704056544]
  Activation steering controls model behavior by modifying intermediate hidden states at inference time without retraining.<n>We show that when multiple semantic directions are superposed without constraints, the model collapses.<n>We propose GEMS, a training-free method that maps each source to a corresponding geometric constraint.
  arXiv  Detail & Related papers  (2026-06-18T08:43:33Z)
• Measuring Alignment-Induced Activation Shifts Correctly: A Template-Controlled Difference-in-Differences Protocol [0.0]
  We show the obvious way to form this matrix is confounded.<n>The aligned model is evaluated under a chat template the base model never saw.<n>We distill it into measurement recommendations for activation-difference studies of alignment.
  arXiv  Detail & Related papers  (2026-05-23T13:47:17Z)
• Amplifying, Not Learning: Fine-Tuned AI Text Detectors Amplify a Pretrained Direction [51.56484100374058]
  Text detectors amplify a pretrained typicality axis; they do not construct an AI-vs-human boundary.<n>On raw encoders before any task supervision, projecting onto centroid(AI)-centroid(HC3) achieves NYT-vs-HC3 AUROC 0.806/0.944/0.834 across three architectures.<n>On RoBERTa-base, raw projection exceeds fine-tuning; on RoBERTa-base, full fine-tuning reduces discrimination below raw on both fluent-formal populations tested.
  arXiv  Detail & Related papers  (2026-05-20T19:08:38Z)
• TACT: Mitigating Overthinking and Overacting in Coding Agents via Activation Steering [70.99933391739154]
  We focus on two recurring failure modes where the agent repeatedly reasons over information it already has, and where it issues tool calls without integrating recent observations or acquiring new evidence.<n>In this paper, we introduce TACT (Think-Act via activation Steering), to detect and mitigate agent drift in the residual stream before it surfaces as a behavioral failure.<n>In specific, we label trajectory steps as overthinking, overacting, or calibrated, and find that their hidden states can separate linearly along two *drift axes*, pointing from calibrated behavior toward each failure mode.
  arXiv  Detail & Related papers  (2026-05-07T10:24:27Z)
• Agentic Harness Engineering: Observability-Driven Automatic Evolution of Coding-Agent Harnesses [57.20181537213498]
  Agentic Harness Engineering (AHE) is a closed loop that automates harness engineering.<n>AHE addresses challenges through three matched observability pillars.<n>Ten AHE lift pass@1 on Terminal-Bench 2 from 69.7% to 77.0%, surpassing the human-designed harness Codex-CLI.<n>On SWE-bench-verified it tops aggregate success at 12% fewer tokens than the seed, and on Terminal-Bench 2 it yields +5.1 to +10.1pp cross-family gains.
  arXiv  Detail & Related papers  (2026-04-28T16:55:02Z)
• When Agents Look the Same: Quantifying Distillation-Induced Similarity in Tool-Use Behaviors [66.18091962164219]
  Existing metrics fail to distinguish mandatory behaviors required for task success from non-mandatory patterns that reflect a model's autonomous preferences.<n>We propose two complementary metrics to isolate non-mandatory behavioral patterns: textbfResponse Pattern Similarity (RPS) for verbal alignment and textbfAction Graph Similarity (AGS) for tool-use habits modeled as directed graphs.
  arXiv  Detail & Related papers  (2026-04-23T03:48:56Z)
• Behavioral Steering in a 35B MoE Language Model via SAE-Decoded Probe Vectors: One Agency Axis, Not Five Traits [0.0]
  We train nine sparse autoencoders (SAEs) on the residual stream of Qwen 3.5-35B-A3B.<n>We use them to identify and steer five agentic behavioral traits.
  arXiv  Detail & Related papers  (2026-03-17T10:05:41Z)
• Information Fidelity in Tool-Using LLM Agents: A Martingale Analysis of the Model Context Protocol [69.11739400975445]
  We introduce the first theoretical framework for analyzing error accumulation in Model Context Protocol (MCP) agents.<n>We show that cumulative distortion exhibits linear growth and high-probability deviations bounded by $O(sqrtT)$.<n>Key findings include: semantic weighting reduces distortion by 80%, and periodic re-grounding approximately every 9 steps suffices for error control.
  arXiv  Detail & Related papers  (2026-02-10T21:08:53Z)
• Steer2Edit: From Activation Steering to Component-Level Editing [24.755027943286432]
  We propose Steer2Edit, a training-free framework that transforms steering vectors into diagnostic signals for component rank-1 weight editing.<n>Across safety alignment, attribute mitigation, and reasoning efficiency, Steer2Edit consistently achieves more favorable attribute-utility trade-offs.<n>Overall, Steer2Edit provides a principled bridge between representation steering and weight editing.
  arXiv  Detail & Related papers  (2026-02-10T15:15:15Z)
• Seed-Induced Uniqueness in Transformer Models: Subspace Alignment Governs Subliminal Transfer [0.3805935148497361]
  We analyze subliminal transfer in Transformer models, where a teacher embeds hidden traits that can be linearly decoded by a student.<n>We find that transfer strength hinges on alignment within a trait-discriminative subspace.
  arXiv  Detail & Related papers  (2025-11-02T17:34:43Z)
• Adapt in the Wild: Test-Time Entropy Minimization with Sharpness and Feature Regularization [85.50560211492898]
  Test-time adaptation (TTA) may fail to improve or even harm the model performance when test data have mixed distribution shifts.<n>This is often a key obstacle preventing existing TTA methods from being deployed in the real world.<n>We propose a sharpness-aware and reliable entropy minimization method, called SAR, for stabilizing TTA from two aspects.
  arXiv  Detail & Related papers  (2025-09-05T10:03:00Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.