Steering Awareness: Detecting Activation Steering from Within
Open accessAbstract
Activation steering -- adding a vector to a model's residual stream to modify its behavior -- is widely used in safety evaluations as if the model cannot detect the intervention. We test this assumption, introducing steering awareness: a model's ability to infer, during its own forward pass, that a steering vector was injected and what concept it encodes. After fine-tuning, seven instruction-tuned models develop strong steering awareness on held-out concepts; the best reaches 95.5% detection, 71.2% concept identification, and zero false positives on clean inputs. This generalizes to unseen steering vector construction methods when their directions have high cosine similarity to the training distribution but not otherwise, indicating a geometric detector rather than a generic anomaly detector. Surprisingly, detection does not confer resistance; on both factual and safety benchmarks, detection-trained models are consistently more susceptible to steering than their base counterparts. Mechanistically, steering awareness arises not from a localized circuit, but from a distributed transformation that progressively rotates diverse injected vectors into a shared detection direction. Activation steering should therefore not be considered an invisible intervention in safety evaluations.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Models trained to detect hidden activation injections still fail to resist such manipulations.
“Fonseca Rivera and Africa [54], who showed that models trained to detect hidden activation injections still fail to resist such manipulations”
From Self-Referential Introspection in Large Language Models: The Critical Threshold for Recursive Self-Improvement (2026) · cites this paper as [54]
The Methodology and Key Findings sections report that the model was trained to detect injected activation vectors and detected them in 95% of tested trials. The paper measures detection and identification, not whether the model can resist the manipulation; the reported decline in identification at higher injection strengths does not establish a failure to resist it. No page numbers are available in our copy. (LLM, conf=0.86)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
The publisher hasn’t deposited this paper’s reference list.
Research works printed but not linked: 8
- DeepSeek-AI. 2024. DeepSeek LLM: Scaling Open-Source Language Models with Longtermism. arXiv preprint arXiv:2401.02954. · arXiv
- Edward J Hu, Yelong Shen, Phillip Wallis, et al. 2021. LoRA: Low-Rank Adaptation of Large Language Models. arXiv preprint arXiv:2106.09685. · arXiv
- Saurav Kadavath, Tom Conerly, Amanda Askell, et al. 2022. Language Models (Mostly) Know What They Know. arXiv preprint arXiv:2207.05221. · arXiv
- Arthur Conmy, Augustine N. Mavor-Parker, Aengus Lynch, et al. 2023. Towards Automated Circuit Discovery for Mechanistic Interpretability. NeurIPS 2023.
- Alexander Matt Turner, Lisa Thiergart, David Udell, et al. 2023. Activation Addition: Steering Language Models Without Optimization. arXiv preprint arXiv:2308.10248. · arXiv
- Andy Zou, Long Phan, Sarah Chen, et al. 2023. Representation Engineering: A Top-Down Approach to AI Transparency. arXiv preprint arXiv:2310.01405. · arXiv
- Felix J. Binder, James Chua, Tomek Korbak, et al. 2024. Looking Inward: Language Models Can Learn About Themselves by Introspection. arXiv preprint arXiv:2410.13787. · arXiv
- Jan Betley, Xuchan Bao, Martín Soto, et al. 2025. Tell Me About Yourself: LLMs Are Aware of Their Learned Behaviors. arXiv preprint arXiv:2501.11120. · arXiv
Cited by
Sorted by citations
Zhang, J., Yuan, B., & Zhang, Q. (2026) · Entropy · doi:10.3390/e28090951
- Authors
- Rivera, J. F., & Africa, D. D.
- Affiliations
- The University of Texas at Austin (US)
- Corresponding author
- Rivera, Joshua Fonseca
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2025
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2511.21399
- OpenAlex
- W4416789529
- Cited by
- 0
- References
- 0
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Explainable Artificial Intelligence (XAI)
- Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
- Keywords
- activation steering, residual stream, fine-tuning, concept identification, model robustness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
