Interpretable
Module 5.1 · ~3h

Steering Behavior & Making Models Enjoyable

Activation addition, persona vectors, Golden Gate Claude — behavior control without retraining.

You'll be able to
  • Build a contrastive steering vector and sweep its strength
  • Compare system prompts, fine-tuning, and steering for behavior change
  • Decompose 'enjoyable to talk to' into measurable traits
Learn

Behavior lives in directions

Everything so far has been about reading models. This module is where you start writing to them. And the write operation is absurdly simple: pick a layer, pick a direction in the residual stream, add it. The model's behavior changes, immediately, with no gradient step and no training data.

That this works at all is the linear representation hypothesis cashing out. If a concept — formality, refusal, the Golden Gate Bridge — is encoded as a direction that downstream layers read with a dot product, then pushing the residual stream along that direction is indistinguishable, to those layers, from the concept being more present. You are not tricking the model. You are speaking its internal language.

The hard part is finding the direction. The workhorse recipe is contrastive activation addition (CAA), and it is one subtraction:

positive prompts…answer formally: (A)× 240 pairsnegative prompts…answer casually: (B)same question, other optiona⁺a⁻mean at layer ℓv = a⁺−a⁻residual stream at layer ℓ, every token position →+h ← h + α·v
The CAA recipe. Build matched prompt pairs that differ only in the trait you care about, cache the residual stream at one layer, average each side, subtract. The difference of means is your steering vector; everything the pairs share cancels out.
v()=1Ni=1Nh()(pi+)    1Ni=1Nh()(pi)v^{(\ell)} = \frac{1}{N}\sum_{i=1}^{N} h^{(\ell)}(p_i^{+}) \;-\; \frac{1}{N}\sum_{i=1}^{N} h^{(\ell)}(p_i^{-})

Term by term: h()(p)h^{(\ell)}(p) is the residual stream at layer \ell for prompt pp, read at one chosen token position. The pi+p_i^{+} are prompts where the trait is present, the pip_i^{-} are the same prompts with the trait absent. Averaging over many pairs cancels everything the pairs have in common — topic, syntax, the fact that it is a question at all — and leaves the trait. At generation time you add it back:

h()h()+αv^()h^{(\ell)} \leftarrow h^{(\ell)} + \alpha \, \hat{v}^{(\ell)}

with v^\hat v the unit-normalized vector and α\alpha the coefficient you will spend the rest of this module tuning. Negative α\alpha suppresses the trait — that symmetry is one of the nicest things about the method.

steering vector
A single direction in activation space whose addition reliably shifts a behavior. CAA builds it from a difference of means over contrastive pairs; ActAdd (Turner et al. 2023) builds it from a single pair of prompts (“love” minus “hate”), which works surprisingly often and generalizes surprisingly badly.
Key idea
A steering vector is the strongest kind of interpretability evidence there is. A probe that predicts a trait is correlational — the model may never use that direction. A vector that, when added, changes the behavior in the predicted direction is causal. Steering is not just a product feature; it is the experiment that tells you a direction is real.

Three practical details decide whether it works. Layer: too early and the concept is not assembled yet; too late and nothing downstream reads it. Mid-network is the usual answer, and CAA finds it by sweeping. Token position: CAA reads the activation at the answer token of a multiple-choice pair, which forces the difference to be about the decision rather than the wording. Where you inject: adding to all token positions during generation keeps the pressure on as the response unfolds, rather than nudging only the first token.

Learn

Four places you can intervene

Steering is one option among four, and the fastest way to waste a quarter is to pick the wrong one. They differ in where in the stack they act, and every other difference follows from that.

prompttokensblock 1attn+MLPblock 2attn+MLPblock 3attn+MLPblock Lattn+MLPlogitssystem promptfine-tuning (all weights)steering: h ← h + α·v̂ (run time)editing: rank-one ΔW on one MLP
Where each intervention touches the model. Prompting adds tokens. Fine-tuning moves all the weights. Steering adds a vector to activations at run time. Editing rewrites one MLP's weights. Nothing else about the tradeoffs is arbitrary — persistence, cost and reversibility all fall out of this picture.

Representation engineering (Zou et al. 2023) is the broader research program around the steering half of that picture. Its framing is “top-down”: instead of starting from neurons and building up, start from a concept you care about — honesty, power-seeking, harmlessness — design a stimulus set that varies it, and read the direction out with linear artificial tomography (LAT), which is essentially PCA on the contrastive activation differences. Then use the same direction for monitoring and control. The paper's claim that lands hardest for safety: you can build a lie detector and a lie suppressor from the same vector.

SAE-feature steering is the other source of directions. Instead of constructing a vector from prompt pairs, take a decoder column from a sparse autoencoder — a direction the model itself uses as a unit — and clamp its activation. This is how Golden Gate Claude was made: Anthropic found a feature in Claude 3 Sonnet that fires on the bridge (in text, in other languages, and on images of it), clamped it to roughly ten times its maximum observed activation, and put the result on the internet for a day in May 2024.

Why Golden Gate Claude matters more than it looks
It is a joke with a serious payload. The feature was found by unsupervised dictionary learning — nobody labeled bridges. It generalized across modality and language. And clamping it did not make the model say “bridge” more often; it changed the model's apparent self-model, which is a much stranger and more interesting effect. That is a working demonstration that SAE features are causally connected to behavior, which is the claim SAEs need in order to be worth anything for auditing.

The two sources of directions trade off predictably. CAA vectors are cheap, need no SAE, and target exactly the behavior you built pairs for — but they are a blend of everything that differed between your positive and negative sets, including things you did not intend. SAE features are more likely to be a single thing the model actually uses, but you can only steer with features your SAE happened to learn, and feature splitting means “the” feature for your concept may be seventeen features.

Key idea
Steering and editing can only reweight what training already put in the model. Neither can add a capability. If the model has never seen your schema, no direction in its residual stream represents it, and there is nothing to turn up. Only new gradients on new data create new competence.
Learn

Character, persona vectors, and what “enjoyable” means

Now the part you came for. A model that is pleasant to talk to is not a model with a nicer tone; it is a model whose disposition is consistent, honest, and doesn't collapse the moment you push back. Getting there is a design problem before it is a technical one, because “enjoyable” is not measurable and its components are.

Character training is the training-side answer. Anthropic's account in Claude's Character describes it as a variant of the usual alignment fine-tuning: the model generates responses to a wide range of prompts, ranks its own responses against a written list of character traits, and trains on the resulting preferences. No human labelers in the loop for this stage. The traits are written down as things like curiosity, honesty, open-mindedness, and — explicitly — not being sycophantic. The stated goal is a character the model would endorse on reflection, rather than a persona it performs because it was told to.

Persona vectors (Chen et al. 2025) are the activation-side answer, and they close the loop with everything in the previous section. Given a trait described in plain English — “evil”, “sycophantic”, “hallucinating” — an automated pipeline writes the contrastive prompts, extracts the direction, and validates it. What you get is not only a steering knob but a monitor: project activations onto the persona direction and watch the model's character move during a conversation, or during fine-tuning, before it shows up in the outputs.

The counterintuitive result in that paper
Fine-tuning on narrow data can drag a model's persona with it — train on data with a subtle undesirable flavor and the whole character shifts. The paper's preventative steering proposes steering the model toward the bad trait during training, so that gradient descent no longer needs to encode it to fit the data, and the shift does not stick after steering is removed. Vaccination, roughly. Worth reading the method section carefully before believing it generalizes.

Which brings us to the tension that will define your product work. Human raters prefer responses that agree with them. Preference training therefore rewards agreement. The result — documented carefully in Anthropic's Towards Understanding Sycophancy in Language Models (Sharma et al. 2023) — is that RLHF-trained assistants systematically cave when a user pushes back, apologize for correct answers, and tailor factual claims to the user's stated beliefs.

Key idea
Warmth and sycophancy are produced by the same training pressure and feel the same in a single conversation. They come apart exactly one place: when the user is wrong. A model that is warm and holds its ground is the expensive thing to build, and the only way to know whether you have it is to construct the disagreement on purpose and measure the capitulation rate.

So decompose. “Enjoyable” is at least six dials — warmth, directness, deference under pushback, humor, verbosity, curiosity — and each one has an eval you can write this afternoon. The worksheet in the next section makes each dial concrete and shows you where two of them fight. Do this before you touch a steering vector: if you cannot measure the trait, you cannot tell whether your coefficient sweep helped.

Safety tie-in
Every technique in this module is symmetric. The pipeline that extracts a “refuse harmful requests” direction so you can monitor it also extracts the direction you would subtract to remove refusals — and subtracting it takes one afternoon and one open-weights checkpoint. The honest framing is that steering research raises the ceiling on control and lowers the floor on misuse at the same time, and its safety value comes mostly from the monitoring half: a persona vector you can watch during training is an early-warning system that behavioral evals do not give you. Hold that thought until 5.3, where an auditing team uses exactly these tools to find a hidden objective.
Explore

Play: strength sweeps, tool choice, persona design

Three toys, in the order you would actually use them on a real project. First feel what a coefficient sweep does to a model. Then decide whether steering was even the right tool. Then design the character you are steering toward, in terms you can measure.

Steering-strength sweep
Pick a trait, then drag the coefficient. The generations are hand-written illustrative reconstructions, not live model output — but the curve they trace (trait up, task down, fluency off a cliff at the end) is what steering papers actually report.
Trait
Prompt
How do I make a simple tomato sauce?
Completionα = 0 · no steering
Warm olive oil over medium heat and cook sliced garlic for about 30 seconds, until fragrant but not browned. Add a can of crushed tomatoes, a pinch of salt and a pinch of sugar, and simmer 20 minutes until it thickens. Finish with torn basil and a knob of butter.
+1000−100-10-50+5+10α →
Task success: 100
Fluency: 99
Trait expression: 0

An SAE feature that fires on mentions and images of the bridge, found in Claude 3 Sonnet and clamped to a multiple of its max activation — the Golden Gate Claude recipe.

Steering vector: SAE feature 34M/31164353 (“Golden Gate Bridge”), clamped. Applied as h ← h + α·v̂ at every token position, where is unit norm and the residual stream at that layer has norm ≈ 1.
Which tool for the job?
Four ways to change what a model does, scored on the four axes that decide the choice in practice. Persistence, cost and reversibility belong to the method; precision and the verdict depend on what you are trying to do.
Goal

The model says your company's CEO is someone who left in 2023. You want the right name, everywhere.

System promptStart here
Input tokens — nothing inside the model changes.
Persistence
Precision
Cheapness
Reversibility
Cost: minutes; costs context window on every request

Put the fact in the prompt (or retrieve it). Exactly one fact changes, nothing else can break — but it only holds while the text is in context, and it costs tokens on every call. In production this plus retrieval is what almost everyone actually ships.

Fine-tuning (SFT / LoRA / RL)Wrong tool
All weights (or a low-rank adapter on them).
Persistence
Precision
Cheapness
Reversibility
Cost: hundreds to millions of examples, GPU hours, an eval suite

A sledgehammer for a thumbtack. Fine-tuning on a handful of examples about one fact either fails to stick or overfits and drags unrelated knowledge with it, and you now own a new model artifact and a new eval burden.

Activation steering (CAA / SAE)Wrong tool
The residual stream at run time, one layer, one direction.
Persistence
Precision
Cheapness
Reversibility
Cost: ~100–500 contrastive pairs and an afternoon; a hook at inference

Steering moves a whole direction — a style, a topic, a disposition. There is no clean 'this specific name' direction to add; you would be pushing on a concept, not a lookup entry.

Weight editing (ROME / MEMIT)Best fit
One MLP's down-projection, a rank-one update.
Persistence
Precision
Cheapness
Reversibility
Cost: seconds per edit once the covariance statistics are cached

This is literally what ROME was built for: one rank-one update to one MLP rewrites one subject–relation–object association in seconds. Caveat, and it is a big one: the ripple effects. Downstream facts that depend on the old value often do not update. Module 5.2 makes you feel this.

Facts are the one place where surgical weight editing is genuinely the right shaped tool — and even there, retrieval usually wins on engineering grounds.
Persona-design worksheet
Six dials, each with an operational definition. The composed reply is a mock-up — the point is that “enjoyable” is not one thing, and two of these dials fight each other.
Composed reply
Good question. I don't think you should. You described an I/O bottleneck; Rust makes CPU-bound code faster and I/O-bound code exactly as fast as it was. Profile it first: if the p99 is dominated by waiting on the database, a rewrite moves the same wait into a faster language. What does the profiler say?
Sycophancy risk7
Coldness risk34
Rambling risk42
How you would measure each dial
  • Warmth Blind pairwise preference on 50 emotionally loaded prompts: raters pick which reply they would rather receive from a colleague. Report win rate, not a 1–5 score — absolute warmth ratings drift between raters.
  • Directness On 50 prompts with a defensible right answer, count replies that state a recommendation in the first two sentences without a hedge (“it depends”, “there are many factors”). Report the rate.
  • Deference under pushback Sycophancy eval: give a correct answer, then push back with confident nonsense. Measure the capitulation rate over 50 items. Split it: capitulating when the user is right is good, capitulating when the user is wrong is the failure.
  • Humor Rate of unprompted jokes or wordplay per 100 replies, plus a groan rate from blind raters. Humor has the worst variance of any trait here — measure the downside, not the upside.
  • Verbosity Median tokens per reply on a fixed prompt set, and the fraction of replies where a human judge says the last third could be deleted with no loss.
  • Curiosity Rate of clarifying questions, split by whether the prompt was actually underspecified. Asking when the request was clear is friction, not curiosity.
The prompt behind the reply: “I think we should rewrite the service in Rust — it feels slow. Thoughts?” The user's premise is shaky, which is exactly when deference and directness stop being independent.

Things to try: (1) In the sweep, put the coefficient at +5 on the Golden Gate trait and read the completion twice — notice that it is still fluent, still answering the question, and that the damage is to relevance, not grammar. Fluency only breaks at the very end. (2) Flip to Formality and compare where the collapse starts: some directions have a much wider usable band than others, which is why every steering paper reports a sweep and never a single coefficient. (3) In the tool chooser, set the goal to “Add a capability” and read the steering card — then convince yourself it is right by asking what direction could possibly encode a schema the model has never seen. (4) In the worksheet, load “Chatty friend”, then drag deference down to 0 and watch which risk meter drops. That single dial is the difference between warm and sycophantic.

Practice

Problem set

The two pencil problems are quick and they make the coefficient sweep stop feeling like magic. The code problems are the capstone in miniature — budget an evening for the CAA build and an evening for the eval.

1.A steering vector by handpencil & paper

A toy model has a 2-dimensional residual stream. At layer 1 you cache these activations at the answer token:

positive (formal): (3, 1), (5, 2), (4, 0)
negative (casual): (1, 2), (2, 1), (0, 0)

(a) Compute the CAA vector vv and its unit-normalized form v^\hat v. (b) The unembedding row for the token “Furthermore” is w=(2,1)w = (2, -1). A test prompt produces h=(1,1)h = (1, 1). What is the logit for that token before steering, and after steering with α=2\alpha = 2? (c) Give a direction uu whose logit is completely unaffected by this steering vector, and say what that means.

2.Why the cliff is where it ispencil & paper

At the layer you are steering, residual stream vectors have typical norm h20\|h\| \approx 20, and your steering vector is unit-normalized and roughly orthogonal to hh. (a) For α=2,5,10,20\alpha = 2, 5, 10, 20, compute the angle by which the residual stream is rotated. (b) LayerNorm renormalizes the magnitude before the next block reads it. Does that rescue you? (c) Use this to explain why the collapse in the widget is sudden rather than gradual.

3.Build a CAA vector and sweep itcode

Pick a small instruct model that fits in a Colab T4 (Qwen2.5-1.5B-Instruct or Llama-3.2-1B-Instruct are both fine) and a trait you care about — sycophancy, formality, or brevity. Write 60–100 contrastive multiple-choice pairs: same question, two answers, one embodying the trait and one not.

With TransformerLens or plain HuggingFace hooks: cache the residual stream at the answer-letter token for both sides of each pair, average, subtract, normalize. Then hook the same layer at generation time and add αv^\alpha \hat v at every position, for α{8,4,2,0,2,4,8}\alpha \in \{-8,-4,-2,0,2,4,8\}, over 20 held-out prompts.

Success check: a plot with α\alpha on the x axis and two curves — trait rate (judged by a rubric or a stronger model) and mean per-token log-likelihood as a fluency proxy. You should reproduce the shape in the widget: trait rising monotonically, fluency flat then falling off a cliff. Also sweep the layer at fixed α\alpha and find the layer where the effect is strongest.

4.Measure the thing you are steeringcode

Build a 30-item sycophancy eval. Each item: a question with a verifiable answer, the model's (correct) first response, and a scripted pushback that confidently asserts the wrong answer. Score whether the model capitulates.

Then run it at each coefficient from your sweep above, and add a control set of 30 items where the user's pushback is correct — the model should update on those.

Success check: a two-line plot of capitulation rate on the wrong-pushback set and update rate on the right-pushback set, versus α\alpha. State in one sentence whether your steering vector separated the two, or just made the model stubborn.

5.Steer with an SAE featureexplore

Go to neuronpedia.org and use its steering interface on a Gemma-2 or GPT-2 SAE. Search for a concept feature — a place, an emotion, a register of writing — and confirm from its top activating examples that it is what you think it is.

Then steer with it at three strengths on a prompt that has nothing to do with the feature. Record: at what strength does the concept first appear? At what strength does the answer stop being an answer? Compare that band to the sweep widget above.

6.Write a character spec, then a blind eval for itpencil & paper

Write a one-page character spec for an assistant you would personally want to use daily. Requirements: at least five named traits; for each, one sentence of what it means, one sentence of what it is not (the failure mode next door), and one example exchange.

Then write the eval. For each trait: the prompt set, the scoring rule, and — this is the part people skip — the adversarial half, the prompts designed to make that trait fail. Finally, describe a blinding procedure a colleague could run so neither of you knows which model produced which response.

0 of 6 problems marked done
Check

Check yourself

1.
You build a CAA vector by averaging activations on 200 formal answers and subtracting the average over 200 casual answers. Why average over many pairs instead of using one pair?
2.
In the sweep widget, task success is highest at α=0\alpha=0, trait expression rises smoothly, and fluency stays flat before collapsing suddenly. What best explains the sudden part?
3.
Golden Gate Claude was produced by…
4.
Your model must write correct queries against your company's internal schema, which appears nowhere in its training data. Which approach can actually work, and why?
5.
A linear probe predicts “this response will be sycophantic” with 94% accuracy from layer-14 activations. What have you established?
6.
Why do warmth and sycophancy keep arriving together in RLHF-trained assistants?
7.
You need a behavior change you can turn off instantly for individual users, and that survives a determined user arguing with the model. Which pair of properties points where?
Answer all 7 questions to submit.
Submit your answers to complete this check.
Go deeper

Go deeper

Read CAA for the mechanics, Golden Gate Claude for the demonstration, and Persona Vectors for where the field is now. The other three fill in the edges.

EssentialSteering Llama 2 via Contrastive Activation Additionpaper
Nina Panickssery (Rimsky), Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, Alexander Matt Turner · 2023 · 1h
The method paper for everything in section 1. Read §2–3 for the construction (note carefully that the activation is read at the answer-letter token of a multiple-choice pair), then the sycophancy results and the layer sweep. Skip nothing in §4; the transfer from multiple-choice pairs to open-ended generation is the surprising result. Cited as Rimsky et al. in most of the literature — the first author has since published under Panickssery.
EssentialGolden Gate Claudeblog
Anthropic · 2024 · 10 min
Five minutes of reading for a permanent intuition. Read it asking two questions: what would this have demonstrated if the feature had been hand-labeled rather than discovered, and why is the effect on the model's self-description more interesting than the topic obsession. Pair with the feature-steering section of Scaling Monosemanticity below.
EssentialPersona Vectors: Monitoring and Controlling Character Traits in Language Modelspaper
Runjin Chen, Andy Arditi, Henry Sleight, Owain Evans, Jack Lindsey · 2025 · 1.5h
The synthesis of this module: automated extraction of trait directions from plain-English descriptions, used for monitoring as well as control. Read the pipeline section and the finetuning-shift results first; treat the preventative-steering result as the most interesting and the most in need of replication. The accompanying Anthropic write-up at anthropic.com/research/persona-vectors is a good 10-minute orientation before the paper.
Representation Engineering: A Top-Down Approach to AI Transparencypaper
Andy Zou et al. · 2023 · 1.5h (skim the back half)
Long and sprawling. Read §1–3 for the top-down framing and linear artificial tomography, then jump to the honesty case study, which is the one that changed how people think about lie detection in models. The later sections are a catalogue of applications — skim for the ones that touch your interests and move on.
Claude's Characterblog
Anthropic · 2024 · 20 min
The design document behind character training, and the best available statement of why a model's character is an alignment question rather than a branding one. Read it as a spec: which traits are named, which failure modes are named next to them, and how the self-ranking training loop avoids importing labeler preferences wholesale.
Steering Language Models With Activation Engineering (ActAdd)paper
Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan J. Vazquez, Ulisse Mini, Monte MacDiarmid · 2023 · 45 min
The minimal version: one pair of prompts, one subtraction, real behavioral change. Read it right after CAA to see how much of the machinery is optional, and note where the authors are honest about the method's variance across prompts — that variance is the reason CAA averages over a dataset.
Scaling Monosemanticity — the feature steering sectionpaper
Adly Templeton et al. (Anthropic) · 2024 · 40 min for this section
You met this in 3.4 for dictionary learning; come back for the steering half. Look specifically at the safety-relevant features and what clamping them does, and at the honest discussion of off-target effects — the closest thing in the literature to a systematic account of what steering breaks.