Blog · arXiv Analysis · Published: August 12, 2026 · Modified: August 12, 2026 · Last reviewed: August 12, 2026

The Steering Vector Becomes the Side-Effect Budget

Changing one model behavior is an intervention, not a local edit. Its evidence must include the other behaviors that move with it.

A forecast can prioritize the audit; it cannot replace measuring the steered system.

The Paper

The source is Chong Yong Ong, Alson Wei Jie Sim, Peixin Zhang, and Jun Sun's Forecasting Side Effects of Activation Steering, arXiv:2608.11227v1 [cs.AI, cs.LG], submitted July 28, 2026. The manuscript lists Singapore Management University and uses a 67-behavior taxonomy to ask whether collateral behavioral changes can be forecast before a steering intervention is run.

One Vector, Many Behaviors

In the paper's setup, activation steering adds a learned direction to a model's residual-stream activations, scaled by a coefficient, at every prompt and generated-token position. A direction is built to alter one source behavior, but every other measured behavior is a possible target. The intended change is a self-effect; changes elsewhere are cross-effects. That vocabulary prevents a successful target edit from silently absorbing its collateral cost.

The Cross-Effect Matrix

The measurement study covers Gemma-3-4B, Gemma-3-12B, and Qwen2.5-7B. Of 67 candidate behaviors, 52, 52, and 47 respectively passed the paper's source-direction validation. Each direction is tested in six contexts with 16 prompts apiece, across five steering strengths and four samples per strength. The paper reports approximately 128,000 generations per model. A Gemma-4-31B judge scores every generation across the behavior panel; false-discovery-rate correction determines which off-diagonal effects survive.

Collateral Effects Have Structure

Across the tested models, 33 to 50 percent of behavior pairs had a statistically significant coupling, or roughly 22 to 33 reported side effects per steered behavior. One dominant pattern explained about 64 percent of matrix variance and largely tracked elaboration versus terseness. The estimated effective dimensionality was 4.6 to 4.9, far below shuffled controls. This is structure inside three tested models, not a universal map: roughly half the significant effects remained after removing the dominant pattern, and safety-related behaviors occupied different regions across model families.

Similarity Is Not a Safety Test

Direction similarity cannot represent an asymmetric relationship. Among pairs where both directions produced significant effects, 18 to 26 percent had opposite signs: steering A changed B one way while steering B changed A the other. Raw cosine similarity explained at most 19 percent of held-out coupling variance, and the best tested similarity variant reached 23 percent. Cosine similarity to a refusal direction showed no positive correlation with the measured refusal effect. A distant vector is therefore not evidence of a harmless intervention.

What the Forecast Can Say

The proposed forecaster uses white-box access and 1,288 to 2,039 unsteered generations per model. Linear probes recognize target behaviors while a learned map projects the source direction from its injection layer to a later readout layer. In cold-start source and target splits, its mean profile-level Spearman correlations ranged from 0.269 to 0.393. On the top decile of predicted effects, it identified amplification versus suppression in 68 to 78 percent of held-out interactions, compared with 50 to 58 percent for the majority-sign baseline.

Those numbers do not amount to a calibrated damage forecast. The discussion says the method predicts relative ordering and direction, works better for whole profiles than individual cells, and is worse at finding the largest effects than a target-sensitivity average built from an already measured matrix. It covers linear steering and depends on model weights. Forecasting is triage for further testing, not a release verdict.

The Judge Is Part of the Result

The headline matrices use one LLM judge. A second model family re-scored a confirmation subset and reached a pooled Spearman correlation of 0.93, but that check did not change matrix membership. The human-validation appendix is narrower: one author, blind to judge scores, corrected and signed LLM-drafted ratings for packets covering fifteen headline behaviors; only four met the frozen Spearman threshold of 0.70. The paper accordingly claims judge-consistent rank structure, not an interval-calibrated behavioral ground truth. Any deployment audit inherits the rubric, contexts, judge, and validation limits.

The Artifact Boundary

The paper names many JSON result files and says its rubrics are included in a code release, but the reviewed arXiv record and manuscript provide no code URL. The version 1 source archive contains the TeX manuscript, bibliography output, style file, README, and six PDF figures; it contains no code, complete prompt sets, generations, judge outputs, machine-readable matrices, or named result JSON files. The method and figures are inspectable, but the numerical findings could not be independently replayed for this page.

The Side-Effect Budget

A governance inference follows: every steering proposal needs a side-effect budget. Its receipt should record base-model and weight hashes, vector provenance, contrastive prompts, injection and readout layers, coefficient range, token positions, source behavior, target taxonomy, contexts, generation settings, target gain, complete cross-effect profile, multiplicity correction, forecast method, profile and cell uncertainty, protected behaviors, permitted collateral thresholds, judge versions, human-validation results, artifact hashes, reviewer, rollback trigger, and post-release monitoring. A target improvement cannot spend unbounded losses elsewhere.

The Governance Standard

Use a forecast to choose which collateral behaviors deserve urgent measurement. Then run the intervention and test the resulting system at its intended dose, prompts, tools, and decision boundary. Re-audit when the model, vector, layer, coefficient, taxonomy, rubric, or judge changes. Approve the target effect, the collateral profile, and the operational outcome separately; none is a proxy for the other two.

Sources

Return to Blog