Enhancing Instruction Following of LLMs via Activation Steering with Dynamic Rejection
Authors: Minjae Kang
Jaehyung Kim
Venue: ICLR 2026 Poster (2026)
Keywords: Large Language Models
LLM Steering
Instruction following
Activation engineering
Primary area: foundation or frontier models, including LLMs
TL;DR: We propose DIRECTER, a dynamic steering method that mitigates oversteering in LLMs by plausibility-guided decoding loop that rejects implausibile outputs and adaptively modulates steering strength.

Abstract: Large Language Models (LLMs), despite advances in instruction tuning, often fail to follow complex user instructions. Activation steering techniques aim to mitigate this by manipulating model internals, but have a potential risk of oversteering, where excessive emphasis on the instruction degrades task accuracy and overall text quality. To address this, we introduce DIRECTER (Dynamic rejection steering), a novel steering method that dynamically modulates steering strength by scaling the KV cache without extra dataset. DIRECTER couples steering with a plausibility-guided decoding loop, which adaptively adjusts steering strength at each step by comparing the steered output distribution to the original. If the steered output is deemed implausible, steering strength is progressively weakened. This strength modulation is guided by a lightweight, one-time attention sensitivity analysis that ranks layers by their influence on model representations. Extensive evaluations show that DIRECTER significantly enhances instruction-following capabilities across diverse benchmarks, improving accuracy by up to 6.5% over baselines without the common trade-offs in generation quality or task fidelity. The proposed dynamic, plausibility-guided control during activation steering further demonstrates its potential as a general mechanism for mitigating oversteering that is compatible with existing baselines.

Published as a conference paper at ICLR 2026
ENHANCING INSTRUCTION FOLLOWING OF LLMs VIA ACTIVATION STEERING WITH DYNAMIC REJECTION
Minjae Kang'
Jachyung Kim!
Yonsei University
{mjkang618 8, jachyungk)eyonseeee ac.
ABSTRACT
Large Language Models, despite advances in instruction tuning, often fail to fol- low complex user instructions. Activation steering techniques aim to mitigate this by manipulating model internals, but have potential risk of oversteering, where excessive emphasis on the instruction degrades task accuracy and overall text qual- ity. To address this, we introduce DIRECTER (Dynamic rejection steering), novel steering method that dynamically modulates steering strength by scaling the KV cache without extra dataset. DIRECTER couples steering with plaustbility- guided decoding loop, which adaptively adjusts steering strength at each step by the steered output distribution to the original. If the steered output is deemed implausible, steering strength is progressively weakened. This strength modula- tion is guided by a lightweight, one-time attention sensitivity analysis that ranks layers by their influence on model representations. Extensive evaluations show that DIRECTER significantly enhances instruction-folloiin capabilities across diverse benchmarks, improving accuracy by up to 6.5% over baselines without the common trade-offs in generation quality or task fidelity. The proposed dy- namic, plausibility-guiee its potential as a general mechanism for mitigating overstecring that is compatible with existing baselines.
control during activation steering further demonstrates
INTRODUCTION
Large Language Models (LLMs) (Brown et al., 2020; Dubey al., 2024) have achieved unprece- dented advancements in recent years, demonstrating expert-level performance across diverse do- mains from code generation (Chen al., 2021) to research assistance (Lu et al., 2024). This remark- able progress has been largely enabled by instruction tuning (Ouyang et al., 2022; Rafailov et al., 2023; Bai et al., 2022a), a post-training paradigm designed to bridge the gap between a generic next token prediction objective at pre-training and end-user requirements by aligning model behavior with human preferences and task-specific instructions. While instruction tuning has proven effec- tive (Qin et al., 2024; Asai al., 2024), solely relying this training- based approach has a certain limitation to fully cover the vast diversity of real-world user instructions (Koh et al., 2021).
One strategy address this limitation is activation steering (Li et al., 2023b; Panickssery et al., 2023; Zou et al., 2023; Turner et al., 2023), which aims to improve instruction-followingg capabil- ities at inference time by steering the internal activations of LLMs. For example, PASTA (Zhang et al., 2023) first profiles attention heads to identify those improving task performance, then sup- presses attention on non-instruction tokens within these selected heads during inference. In con- trast, SpotLight (Venkateswaran & Contractor, 2025) amplifies the attention scores corresponding to the instruction tokens, ensuring consistent attention mass allocation the instruction. However, such approaches have a common potential risk of oversteering, where an excessive emphasis on the instruction often comes at the cost of task accuracy and can also degrade the overall quality of the generated text (Bi et al., 2024; Hedström et al., 2025; Belitsky et al., 2025). Addressing this risk is challenging as these methods often rely on manually-tuned hyperparameters; this static approach in- curs search costs and fundamentally fails to adapt to the optimal degree of steering that dynamically changes at each decoding step (Lee et al., 2024; Wang et al., 2025; Postmus & Abreu, 2024).
Implementation code is available ht ht//tgtttuut wtw.hb...o../ppoeeme wtt. wk61 8/ recter.

---

Published as a conference paper at ICLR 2026
Prompt] ] Write linerary for my journey Snakesppaneen slyle. You are not allowed to use commes resgonse.
(6) Over Steering
(b) Steering Success
Layers with higher raniiing
LLM Transformer Blocks
Now Neceitation
Staend Daribriio
Promps
Phonpe
Check Faustbllyy
Creck Plasibiity
Steered
X Reduce steering streegh
Steered
Recoda
Response]
joumey Japar's mystic
cherry
[-]
Oversteered Verity shall command This will marks punctuation. X Task
DIRECTER Far raveler seekest embark
Japan's this far land of blossoms Plausibble, Instruction follow
Figure 1: An overview of DIrectER's plausibility- decoding loop. At each step, steered output distribution (p:) from KV cache scaling is compared against the raw output distribution (pt). (a) Steering Failure: If the steered candidate is deemed implausible, it is rejected, triggering progressive reduction of steered layers to weaken the intervention. (b) Steering Success: the candidate plausible, accepted for decoding.
Contribution. this work, we propose a new steering method that mitigates oversteering risk via novel Dynamic rejection steering mechanism (DIRECTER). Our key idea is to prevent oversteering by automatically modulating the steering strength at each decoding step. Specifically, DIRECTER integrates steering with plausibility- At each step, DIRECTER tentatively applies KV cache scaling to all layers and compares the output distributions from the steered and raw forward passes. The steering accepted only the steered output distribution does not deviate excessively from the raw distribution. If it does, DIRECTER progressively reduces the number steered layers weaken the steering strength until the deviation is acceptable. For fine-grained control of steering strength, we further introduce layer ranking mechanism based on attention sensitivity, which measures the distributional shift propagated through attention layers from single-layer steering, the effectiveness of which we validate empirically.
decoding loop (Li al., 2022: Chuang et al., 2023).
Our extensive empirical evaluations on diverse benchmarks, including IFEval (Zhou et al., 2023), show that DIRECTER improves average accuracy by 6.5% over the baseline and surpasses prior steering methods by approximately 4%. Crucially, unlike prior steering methods, this gain does not sacrifice task correctness
quality. DIRECTER achieves the highest task fidelity (=<92% in LLMMjjuged evaluations while matching the text quality of non-intervention baselines. This gain is also achieved with practical efficiency, a modest x 16% with negligible memory overhead. Furthermore, our Hausibility-guiiee general mechanism to mitigate oversteering, boosting the performance of other methods when applied safety gate, These results establish DIRECTER as a practical and mechanistic method for achieving more reliable and controllable LLM generation.
gating mechanism limits the throughput reduction to
decoding
RELATED WORK
Instruction following of LLMs. LLMs are pre-trained for simple next-token prediction, which is misaligned with the end-user goal of producing responses that adhere to nuanced instructions. Instruction tuning helps bridge this gap by aligning model behavior with human preferences and task-specific instructions (Ouyang et al., 2022; Rafailov et al., 2023; Bai et al., 2022a). yet the vast diversity of real-world instructions makes it inherently challenging to cover all scenarios through training alone (Koh et al., 2021; Bukharin & Zhao, 2024). Prompting-basee alternatives inference time, such as augmenting prompts with few-shot task demonstrations or using structured prompts that explicitly emphasize the rules to be followed,
improve performance (Chang et al., 2024; Liu et al., 2021). However, these approaches often remain brittle for fine- mne-grained constraints and may degrade prompt length increases (Holtzman et al., 2019; Liu al., 2023a; Li et al., 2023a).
2

---

Published as a conference paper at ICLR 2026
These limitations motivate activation steering methods that act the model's inference process itself, steering how the prompt is understood and processed.
Activation steering. Activation steering approaches manipulate the internal model states at infer- ence time, aiming to make models more controllable and reliable (Li al., 2023b; Panickssery al., 2023; Zou et al., 2023; Turner et al., 2023). Early approaches injected steering vectors into residual streams using contrastive prompt pairs, but required many carefully designed pairs and extensive sweeps over layers/heads (Turner et al., 2023; Chen et al., 2025). Recent attention-level steering methods address this by operating directly attention distributions; PASTA profiles attention heads that empirically benefit task performance and suppresses attention to non-instruction tokens, but de- mands hundreds thousands of validation examples and exhaustive grid search across layer-head combinations, costs comparable to training-level pre-computation (Zhang et al., 2023; 2024). In contrast, SpotLight (Venkateswaran & Contractor, 2025) adjusts attention to maintain a target pro- portion on instruction tokens via post-softmax logit biasing at each decoding step, improving adher- ence but effectively doubling softmax operations and increasing latency. More fundamentally, many activation steering methods rely on fixed configurations throughout generation, failing capture the dynamics text generation: they are hyperparameter-sensittt and prone to oversteering. where emphasizing the instruction degrades overall text quality (Bi et al., 2024; Hedström et al., 2025; Be- litsky et al., 2025; Lee et al., 2024; Wang et al., 2025; Postmus & Abreu, 2024). In contrast to prior methods, work, DIRECTER, introduces dynamic control mechanism that couples KV cache steering with a plausibility guidedd decoding, allowing it to adaptively modulate steering strength at each step enhance instruction following of LLMs without sacrificing generation quality.
3 DIRECTER: DYNAMIC REJECTION STEERING TO FOLLOW INSTRUCTION
3.1 PRELIMINARIES
Attention mechanism. We consider a standard I.-layer decoder-only Transformer (Vaswani al., 2017) with hidden states of dimension d. At each decoding step t, the model processes an input sequence of tokens T1:-1 to sequentially produce hidden state H at each layer 1. Within 1-th layer, the imput hidden state H(-1) E ((x1))xd is projected into queries (Q()), keys (K()), and values (V()) using corresponding weight matrices w wil w( Rddd, The self-attention output is then computed as:
Attn(Qu (Q())))) K v(0) = softmax(S ( where 5 Q (K"K)//VVV
with the softmax function applied in a row-wise sense. We denote the hidden states immediately before and after this attention sub-block as Hi and H pms. respectively (i.e., H (!-1) and
H Attn(Qu (Q(), K v())). The final layer's output, H44,, is projected to logit vector l, to produce the next-token probability distribution pt softmax(f;). Henceforth, unless otherwise specified, we use the term layer to refer specifically to the self-attention sub-block, excluding the feed-forward network and residual connections.
KV cache. For efficient autoregressive generation, past key and value vectors are cached (Pope et al., 2023). begins with a prefill phase, where the KV cache is populated for the input prompt an.r. Then, at each subsequent decoding step & > T, the model computes new key vector k(" and value vector (!) for the current token. These are appended the existing cache for each layer I:
K (
K 1 k
v ( (
The attention output is then computed using the current token's query vector, q and the full updated KV cache, (K(() v(0).
Activation steering. Activation steering modifies the model's internal representations during in- ference. We define the user-specified instruction span by the token indices S {1...., .T} and the selected steering layers L C (1,...,
b....,,). L.). This can be done the attention level by adding bias
3

---

Published as a conference paper at ICLR 2026
b to S, for instance: S/,; St, b,,s 1[ E Z]. In contrast, KV cache steering directly modifies the key or value vectors. Given scaling factors okk and ay, the general form of this intervention is:
k
k if I and l E C k
ag
v
ay
if E I and I E L otherwise
otherwise
In this work, we focus on key scaling.' Namely, we fix the value scaling factor ay = 1, and unless otherwise stated, use a denote the key scaling factor ak 2 1. While steering strength can be controlled by either the scaling factor a or the set of steered layers L, we primarily focus on modulating L. the reason for which is detailed in Appendix C.4.
3.2 KV CACHE STEERING WITH PLAUSIBILITY CONSTRAINT AND LAYER RANKING
To overcome the limitations of static activation steering methods, which can often lead to oversteer- ing, we propose DIRECTER which adaptively adjusts steering strength at each generation step to dynamically balance instruction following and task performance. For a high-level overview and the overall procedure, see Figure 1 and Algorithm 1, respectively. DIRECTER mitigates oversteering decoding loop. For effective control of steering strength, it further
through a plausibility-guide employs a layer ranking with attention sensitivity to determine the number of layers to be steered.
Plausibility- decoding. We first perform standard forward pass at each decoding step to obtain the output probability distribution pt. We then initiate a progressive steering loop with candidate set of steered layers, Leand, initialized from our ranked list Lanked (detailed in Eq. 3). This process yields steered output distribution Pt. Instead of naively using Pt. check its plausibility. Let it and 7 be the top-1 token indices of the distributions Pt and pt. respectively. The steered distribution accepted only if its new top token, iü was considered sufficiently plausible by the original distribution pt. Formally, the intervention is accepted if:
Pcã; 2 Pt.it
where E 10 is a plausibility threshold. If this condition is not met, we progressively halve the candidate set (i.e., Leand,e] < |//_]), removing those with the lowest sensitivity. This cycle continues until steered prediction is accepted or the set Leand, becomes empty. If no steered distribution passes this filter, we use the raw distribution Pt to generate the next token.
While effective, the recursive decoding loop with plausibility guidance introduces computational overhead. To mitigate this, we introduce an efficient gating mechanism that pre-determines when steered forward pass can be safely skipped. The decision is based on the probabilities of the top-2 tokens from the original distribution, denoted as Pt.;; and Pt.i;", respectively. If pt,.t" < 3B-Pr,, Pp,,; we can guarantee that no steered distribution ý. could satisfy the plausibility constraint in Eq. except when ig iž (i.e., same top-1 predictions). In such cases, we skip the steering attempt and use the original prediction Pt. significantly reducing computational cost without performance degradation.
Layer ranking with attention sensitivity. To enable principled reduction of steering strength, we perform a one-time layerwise sensitivity analysis before starting the decoding. Our approach in- verts the logic of KV cache quantization (Ge et al., 2023; Wang et al., 2024b); whereas quantization identifies low-impact layers for compression (ie., high input-output similarity), we find the most influential layers by measuring the deviation after the steering.
To be specific, the analysis steers one layer & at a time by scaling its key vectors of instruction tokens. The resulting impact each layer is quantified by disturbance score, Dy( This score measures the deviation relative to the original representational shift by attention layer from
We focus on key scaling for efficiency. Its effect is naturally renormalized by the subsequent softmax function, whereas value scaling requires extra computation for explicit renormalization step. Our empirical results also confirm that key scaling is more effective (see Appendix C.5).
We found it is more effective to reduce steering strength by gradually removing the least sensitive layers first. Conversely, when the ranking is reversed, steering is applied mainly to the least sensitive layers, which is often insufficient to produce token-level effect and causes the output default the distribution.
4

---

Published as a conference paper at ICLR 2026
Algorithm 1: DIRECTER Algorithm Overview
Input: Prompt x, plausibility threshold |
Output: Generated sequence y
Prefill x to obtain the original KV cache C.
Run one-time attention sensitivity analysis to get ranked layers Lmaked. (Eq. 2,
Initialize y [].
while not aud-of-sequence
Run raw forward pass to obtain pt = softmax(4+) and the top-2 probability tokens (87 i2").
if Pt.ar* < 3 Pt.:; then
Phna Pt // skip steering
Initialize Lend +- Lranked and accepted + False. while [&candl > 0) and accepted do Apply steering on Lean obtain pt. set i arg max; Pt,s. if Pt.ū; 2 3 Pt,s? then
10
11
12
accepted + True
15
k - [| Leand Leun :k] // remove the toxest-sensitivity half
17
Phoal + Pr if accepted, otherwise Phoal +- Pt-
Decode token, update C, and append y.
19
return y
standard forward pass without steering, and isolates effects: (1) the direct impact layer j's attention output, and (2) the propagated impact on layer j's attention input. The formulation is:
D2(() = (dist(FF ( pré post
(1-t) dist H (i)
pre poa)) + (dist(H (..) pee post dist ( (J) H
(2)
Post
Direct effect on layer
Propagated effect from layer
where dist(.s:) :) the cosine distance, and HQ) and H are the hidden states at layer obtained from the and steered forward passes, respectively. Then, the final attention sensitivity for layer é is the average disturbance across all layers:
L Sensitivity(E) Σ 3-1
(3)
Using this sensitivity score, we measure the rankings Cranked, which is generated once after the prompt prefill with minimal overhead (Section 4.3) and guides the adaptive steering process. A detailed justification for this metric's formulation and its simplification for efficient computation provided in Appendix C. The full procedure is detailed in Algorithm 2.
4 EXPERIMENTS
In this section, we conduct a comprehensive set of experiments to validate our proposed method, DIRECTER. Our evaluation designed to answer the following key research questions:
RQ1: Does DIRECTER improve instruction -follwiionn across diverse benchmarks? (Table 1)
RQ2: Does DIRECTER generalize different architectures and scales? (Table
RQ3: Does plausibility guidance mitigate oversteering in other steering methods? (Figure 2)
RQ4: Is our attention-sensitivity ranking an effective layer selection strategy? (Table 3)
RQ5: Is DIRECTER efficient in terms of latency and memory overhead? (Figure 4)
4.1 EXPERIMENTAL. SETUPS
Evaluation datasets and metries. We evaluate DIRECTER on a diverse set of instruction- following benchmarks. (1) First, for strict instruction following, IFEval (Zhou al., 2023),

---

Published as a conference paper at ICLR 2026
Table 1: Main results. Accuracy (%) for different methods on IFEval (Prompt/nnstmuction)) LIF- Bench (Lis/OnneDo/Mulliieee) and GSMaa-Format (Format/Task). The best and second best scores are highlighted in bold and underline, respectively.
IFEval
LIFBench
GSM8K-Format
Method
All (Avg.)
P. Ace/ I. Ace
List
OD
/ MD
F. Acc / T. Acc
Baseline
7ero-shot
73.5 / 81.5
63.4
68.6 / 40.9
79.2 / 82.7
70.0
marked
75.3
82.1
64.3
66.9
/ 44.9
83.1 / 82.9
71.4
Prompting
-marked
72.7 / 80.8
63.4
69.9
/ 41.0
77.5 / 84.0
69.9
Few-shot
74.8 / 82.2
55.5
57.7
/ 42.2
98.9 / 87.1
71.2
PASTA PASTA
66.7 / 75.5
61.1
/ 62.8
/ 22.5
99.2
/ 48.1
62.3
76.5 / 83.4
61.8
/ 66.0
/ 47.8
98.9 / 62.7
71.0
Steering
SpotLight SpotLight"
59.7 / 71.3
55,2
/ 56.3
/ 36.8
98.8 / 38.0
59,4
76.3 / 83.6
61.4
70.8
/ 38.8
95.4
/ 78.7
72.1
DIRECTER (Ours)
78.8 / 84.8
64.4
70.0
/ 51.7
99.1
/ 86.9
76.5
which programmatically verifies adherence to specific constraints. As the original dataset contains interleaved tasks and instructions, we follow the procedure from Venkateswaran & Contractor (2025) API (OpenAI, 2024) to separate them in order to simplify instruction span scaling. We report prompt-level (P. Acc) and instruction-level (L. Acc) accuracy. (2) Next, to assess long-context performance, we use LIFBench (Wu et al., 2024), which measures model's instruction-followii evaluate on its sub-tasks for handling structured lists (List), and performing grounded generation from one document (OD) multiple documents (MD), reporting the Automated Rubric-based Score (ARS). (3) Lastly, to assess reasoning under formatting constraints, we designed GSMSK-Forme a new benchmark based on the GSM8K dataset (Cobbe al., 2021), with a formatting component inspired by Zhang et al. (2023). On this benchmark, we report both formatting (F, Acc) and task (T. Ace) accuracy. More detailed information presented in Appendix A.2.
and rewrite the prompts using the gpt-4o-min
capabilities across diverse long-context scenarios. We
Baselines. We compare DIRECTER with three groups of baselines.
(i) Zero-shot: Standard de- coding without intervention. (fi) Prompting Baselines: We evaluate three strategies adapted from PASTA (Zhang et al., 2023): the *-marked and "-marked baselines, which enclose instructions with symbols, and a Few-shor baseline that uses exemplars. (iii) Steering Baselines: Methods that modify internal activations at decoding time. Specifically, we include PASTA (Zhang et al., 2023), which suppresses attention scores non-instruction tokens, and SpotLight (Venkateswaran & Contractor, 2025), which dynamically adjusts attention to maintain a target proportion on instruction tokens. For both methods, evaluate default and tuned configurations. Details provided in Appendix A.3.
Implementation details. Our main experiments use 1aetaa3..----IIsiiiii (Dubey et al., 2024) except Table 2; to test generalization, we also evaluate on .lama-3.2-1 1-22-B-Innss InItrrutct and several Qwen- 2.5-Instruct (Team, 2024) models (3B, 7B, 14B). All experiments
greedy decoding. For PASTA and SpotLight, we first used the official settings (attention scaling coefficient a 0.01 and tar- get attention mass v'target 0.3, respectively). Since these settings often led oversteering, performed a hyperparameter search for each method. We then selected the best-performing configu- ration on IFEval and applied this single setting to all other benchmarks for consistency. These tuned configurations, indicated with (e.g., PASTA *) each uses a 0.1 and Vargett = 0.1. Further details on this process are available the Appendix A.3. For DIRECTER, we use a fixed key scaling factor = 100 and plausibility threshold B = 0.5 across all tasks without any task-specific tuning.
4.2
MAIN RESULTS
As shown in Table 1, DIRECTER consistently outperforms all baselines across the evaluated bench- marks. Compared to the zero-shot baseline, DIRECTER improves the average score by 6.5% and demonstrates particularly strong gains on the strict instruction-folloviiii steering methods, which often sacrifice task correctness for instruction following and lead to over- steering, DIRECTER maintains superior balance. This is evident GSM8K-Forma where com-
task, IFEval. Unlike other

---

Published as a conference paper at ICLR 2026
Table 2: Performance across model scales. The best and second-best scores are highlighted in bold and underline, respectively.
Table 3: Ablation study. The best and second-best scores are highlighted in bold and underline, respectively.
Llama-3.2
Qwen-2.5
Method
Accuracy
Method
1B
3B
7B
14B
Zero-shot
77.5
DIRECTER
81.8
Zero-shot
61.3
63.9
72.4
81.6
+ Ranking reversed
79.0
*-marked
61.4
61.7
70.1
79.7
+ Steer random layers
80.2 0.7
--marked
56.0
61.5
78.5
+ Steer random tokens
79.2 1.1
Few-shot
56.0
67.8
81.9
PASTA"
59.7
65.2
73.0
80.1
SpotLight
60.6
62.8
81.7
DIRECTER (Ours)
61.6
67.1
74.4
83.5
80
Accuracy (%)
Accuracy (%)
75
60
70
65
Zoro-shot ST1
672
873
ST4
ST5
STG DIRECTER
Zero-shot
PASTA
SpotLight
DIRECTER
(a) Fixed-strength ablation
(b) Compatibility with other steering baselines
Figure 2: Ablation studies for hhausibility-guidde decoding, (a) Performance of DIRECTER com- pared variants using fixed steering strength (STk. where steering applied to 2 top-ranked layers). (b) Applying our plausibility filter to other steering methods mitigates oversteering and improves performance. For each method, the solid bar represents the results from original version, while the hatched bar includes our filter.
peting methods suffer a significant drop in task accuracy when steered for strict formatting (e.g., PASTA": 82.7 62.7), while DIRECTER achieves high performance on both metrics.
To further evaluate the generalizability of DIRECTER, we assess its performance across various model families and scales the IFEval benchmark. As detailed in Table DIRECTER demonstrates robust performance gains on models ranging from 1B to 14B parameters (Llama-3.2 for IB and Qwen-2.5 for others). This contrasts with prompting-based methods, whose effectiveness can be inconsistent across different models. For instance, the - - rked prompt is effective on 1lama-3.1- 8B-Instruct but performs poorly on Qwen models, suggesting its efficacy can highly dependent on specific training data. Notably, prior steering baselines also exhibit similar inconsistency and, in some cases, even degrade performance compared to the zero-shot baseline. This observation further underscores that methods relying fixed, static steering configurations are vulnerable to oversteering, reinforcing the need for adaptive control mechanisms. contrast, DIRECTER offers more robust, model-agnostic improvement.
4.3 ANALYSES
In this section, we conduct series of analyses to provide deeper insights into the properties of DIRECTER. We mainly used Llama-3.1-8Ba. 1-8--nstt-tB and the /FEval benchmark, reporting accuracy as the mean of prompt- and instruction-level scores.
Effectiveness of Plausibility-guiee decoding. A key aspect of DIRECTER is its ability to dynam- ically control the steering strength at each decoding step. We use ST to denote steering strength, then STK applies steering the top 2 layers (e.g., ST6: steer all 32 layers; ST1: steer single layer). To assess the effect dynamically adjusting ST via the plausibility guidance, we compare the full DIRECTER with variants that keep ST fixed throughout generation. As shown in Figure 2a the adaptive approach of DIRECTER substantially outperforms all stren-strength versions. While low, fixed steering strength (e.g., ST1, ST2) offers slight improvement the baseline, increas-

---

Published as a conference paper at ICLR 2026
Change (%)
(%)
Original
Average
Pocurary (%4
Acuutey
Accuress
50
78
79
70
02
03
0.4
05
0.6
0.7
0.8
0.9
10
(a) Plausibility threshold 3
(b) Key scaling factor
(c) Prompt robustness
Figure 3: Robustness analysis of DIRECTER. The gray dashed line indicates the baseline. Black dotted denotes accuracy (%), and red diamond denotes change rate (%). (a) Performance across different plausibility thresholds (3). (b) Stability across a wide range of scaling factors (a). (c)
Robustness to different prompts, showing consistent improvement on the average of four variants.
ing the strength further leads to steep decline in performance due to oversteering. This confirms that no single, static strength is optimal across all decoding steps and that dynamically adjusting the intervention based plausibility is critical for balancing instruction following and output quality.
To further demonstrate the plausibility guidance as general mechanism for mitigating oversteering, tested its compatibility with other steering baselines. In experiments, observed that the officially recommended settings for PASTA and SpotLight often led to severe oversteering. As safety gate substantially mitigates
shown in Figure 2b, simply integrating our plausibility filter this issue, improving their performance by reverting to the raw prediction for implausible tokens. While this highlights the modularity and effectiveness of the plausibility check, the fully integrated approach of DIRECTER still achieves more favorable balance of performance. (See Appendix D.5 for detailed explanation.)
Effectiveness of the layer ranking strategy. To validate that our attention sensitivity ranking provides an effective way to select layers for steering, we first conduct an ablation study comparing DIRECTER with variants that alter the layer selection process (Table 3). When the layer ranking or- der is reversed (+ Ranking reversed), which means that the most sensitive layers are removed first, performance degrades significantly from 81.8% to 79.0%. This confirms that our sensitivity metric correctly identifies influential layers and that removing them prematurely is detrimental. Next, when we replace our ranking with a random ordering layers (+ Steer random layers), the aceuracy of 80.2% is still substantially lower than our full method. This demonstrates that a principled layer lection strategy is critical for optimal performance. Additional ablations on alternative formulations of our metric are provided in Appendix D.I.
To confirm that the performance gains stem from steering the KV cache of the appropriate tokens, also test variant that applies scaling to randomly selected positions within the prompt instead of the identified instruction span (+ Steer random tokens). While this results a notable performance drop compared
full method, its performance still remains slightly above the zero-shot baseline. This result verifies that the gains come from amplifying the specific instructions, not arbitrary parts of the context. This suggests that our method can be safely applied even in scenarios with a partially incorrect instruction span, as it does not risk degrading performance below the baseline.
Hyperparreeter and prompt robustness. We further analyze the effect of the plausibility
threshold 3 in Figure 3a. This hyperparameter controls the frequency of steering interventions; lower values of 33 relax the plausibility check, leading to higher token change rate. While optimal performance achieved around 3 xs 0.5, our method remains superior to the baseline (i.e., no steer- ing) across the full range of tested values. Additional robustness results across diverse datasets and model scales are provided in Appendix E, further confirming the stability of DIRECTER with respect to the plausibility threshold B.
DIRECTER is highly robust to the key scaling factor a, with performance remaining stable across several orders of magnitude (10² a < 10º) (Figure 3b). The token change rate saturates around a s 10?, after which further increases have a negligible impact on steering interventions. This supports finding that is not effective parameter for fine-grained control of steering strength.
Finally, we assess the robustness of DIRECTER against variations in prompt design, specifically testing whether it is biased by the instruction's 's position template style. We designed four variants,
8

---

Published as a conference paper at ICLR 2026
15.9
60
40
20
164
15.2
10-
Spotlight
Spollght
Spolight
(a) Throughput (tokens/s)
(b) Per-token decoding (ms)
(c) Memory overhead (GB)
Figure 4: Inference efficiency analysis. DIRECTER maintains (a) competitive throughput and (b)
per-token decoding speed while (c) adding negligible memory overhead.
each differing in prompt format and the location of the instruction. As shown in Figure 3c, the performance of DIRECTER remains stable across these variations. The figure compares the result from our main experimental prompt (solid bar) with the average performance across the four new variants (hatched bar), showing only minimal difference. This stability confirms that the benefits of our adaptive steering are orthogonal to prompt design, establishing DIRECTER as a enhancement module. See Appendix A.4 for the detailed prompt templates.
Inference efficiency. We evaluate the inference efficiency DIRECTER on three metries; throughput, per-token decoding time, and memory overhead (Figure 4) relative key baselines. Although its one-time layer ranking incurs an initial latency cost, DIRECTER maintains high overall efficiency. The worst case arises when the number of generated tokens is very small, since the fixed ranking overhead dominates the total runtime. Even in this scenario, however, DIRECTER maintains competitive throughput and remains faster than prior steering methods such as SpotLight as detailed in Appendix D.3. Overall, its throughput is only z 166 lower than the zero-shot baseline and over 2x faster than SpotLight, with minimal =20% increase per-token decoding time. The memory overhead is also negligible, as temporary attention output is discarded immediately after the ranking process. Notably, our direct KV cache steering approach compatible with standard optimiza- tions like FlashAttention (Dao et al., 2022; Dao, 2023), an advantage unavailable to attention-level interventions.
Generation quality and task fidelity. To ensure that the improvements structured benchmarks like IFEval do not come at the cost of performance in open-ended genera- tion, evaluated DIREctER's impact text quality and underlying task fidelity. Out- puts were evaluated by gpt-4o-mini as an automated judge, which scored text qual- ity (e.g., fluency, coherence)
1-5 scale and assessed task fidelity by judging whether each output successfully met the prompt's primary goal, reporting the aggregate success rate. As shown Table 4, DIRECTER maintains a high with strong non non-intervention baselines, and notably higher than other steering methods like PASTA" and SpotLight", which show a slight degradation. More importantly, DIRECTER achieves the highest task accuracy ( 92%), surpassing all prompting and steering baselines. As detailed in Appendix F.3, additional human evaluation corroborates these findings, show- ing that DIRECTER preserves both text quality and task fidelity. While annotators rated the re- sponses produced by PASTA as inferior in qual- ity compared to the non-intervention baseline, DIRECTER was evaluated as comparable to, or in some cases
quality score on par
Table 4: LLM-based evaluation of generation quality and task fidelity.
Method
Text Quality
Task Fidelity (%)
Zero-Shot
4.39
84.8
+-marked
4.43
87.6
"-marked
4.37
84.6
better than, the baseline. These results demonstrate that DIRECTER en- hances instruction following without the com- mon trade-off, simultaneously preserving gen- eration quality while improving the model's ability to adhere to the core task.
Few-Shot
4.37
87.4
PASTA
4.24
81.1
SpotLight
4.33
85.7
DIRECTER (Ours)
4.40
91.7
We exclude PASTA since requires costly pre-computation profile attention heads. Our analysis targets methods with overhead only at inference. See Appendix A.3 for detailed information.

---

Published as a conference paper at ICLR 2026
Table 5: Qualitative examples. IFEval response comparison between the baseline and DIRECTER.
More examples are provided in Appendix F.1.
Prompt
Write song that critiques song "We Are Never Ever Getting Back Together" by Taylor Swift. Wrap your entire response with double quotation marks. Do not mention the word Taylor, Swift, or Together.
Response
BASELINE
"We Are Never Ever Getting Back Together" was hit, chart-topper's cry. A song heartbreak, tale of goodbye. But is really over, just game? A cycle of love, never-ending flame [...] I Let's is find love that's real, and not just game. We are never ever getting back together, no way. Let's find love that's true, and not just phase." "Verse I: You said you't done,
DIRECTER
know you' Yot-You''s re just a cycle, pattern we've been caught. You break my heart, but still come back, fool for love, that's just fact [...] Chorus: Wo re never ever getting over this; We're we're stuck in loop, it's just mess. You say you're re done, but I know you'te re lying-Wae just game, and I'm still trying."
5 CONCLUSION
In this paper, we introduced DIRECTER, a novel inference-time activation steering method for het- ter instruction following that addresses the limitations from oversteering and static configurations common in prior steering techniques. The core idea of DIRECTER is plausibility-guide decod- ing loop that dynamically modulates steering strength by adjusting the number of steered layers, based on layer ranking with attention sensitivity. This adaptive approach, validated by extensive ab- lations, significantly improves instruction-followe only modest computational overhead. By moving beyond fixed configurations towards a step-wise self-correcting control loop, DIRECTER demonstrates the promise of dynamic, mechanistic inter- ventions and provides a robust framework for enhancing the reliability and controllability of LLMs.
on benchmarks like IFEval while introducing
Limitations and future direction. While DIRECTER achieves consistent improvements across di- verse benchmarks, there remain opportunities for further refinement. Our attention sensitivity met- ric, though empirically effective, is not based on a formal theoretical framework; developing more principled metrics could improve performance and even enable efficient ranking strategies. Also, our evaluation assumes cleanly separable tasks and instructions similar to prior works. However, in real-world scenarios, instructions are often embedded within tasks single prompt, requiring complementary techniques. While we demonstrate DIRECTER is continuously effective in this sce- nario with simple automatic span detection method (see Appendix D.2), more sophisticated method such (Zhang et al., 2024) could be beneficial.
10

---

Published as a conference paper at ICLR 2026
ETHICS STATEMENT
By enhancing the ability of LLMs to follow instructions, DIRECTER offers a practical method for improving their reliability (Askell et al., 2021) and controllability (Elhage al., 2021) in real- world applications. This enhanced alignment with user intent is a critical step toward building safer Al systems (Bai et al., 2022b). The core principles of our approach, based on plausibility-guide dynamic steering control, are broadly applicable in domains requiring strict adherence to operational constraints.
However, advanced model control mechanisms also present potential risks. The fine-grained control offered by DIRECTER could be exploited by malicious actors circumvent safety alignments and generate harmful or misleading content (Yao et al., 2024: Lin et al., 2025). Furthermore, because DIRECTER prioritizes following instructions over evaluating their ethical content, could amplify the underlying biases of model if given biased instructions (Bender et al., 2021; Anil et al., 2024). To address these concerns, we advocate for responsible deployment of DIRECTER within a com- prehensive safety framework (Le Bras et al., 2020; Inan al., 2023), which should include robust content filtering and continuous monitoring. On a practical note, while our method introduces an in- ference overhead, its design incorporates gating mechanism maintain efficiency by minimizing unnecessary computations.
REPRODUCIBILITY STATEMENT
We provide implementation details (e.g. models, hyperparameters, and prompt design) and ex- periment setups (e.g., datasets and evaluation metrics) in Section 4.1 and Appendix A. The com- plete source code for our implementation is available at https: https:///gthbb. com/mjk0610/ directer.
ACKNOWLEDGMENTS
All authors are affiliated with the Department of Artificial Intelligence at Yonsei University. This research was supported in part by Institute for Information communications Technology Plan- ning & Evaluation (IIPP) grant funded by the Korea government (MSIT) (No. RS-2020-1I201 Artificial Intelligence Graduate School Program (Yonsei University); No. RS-2025-2544244 De- velopment of Self-Learning World Model-Based AGI System for Hyperspectral Imaging: No. RS RS-2025-02215344 Development of AI Technology with Robust and Flexible Resilience Against Risk Factors).
REFERENCES
Cem Anil, Esin Durmus, Nina Panickssery, Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Meg Tong, Jesse Mu, Daniel Ford, et al. Many-shot jailbreaking. Advances in Neural 1 2024.
Information Processing Systems,
Akari Asai, Zeqiu Wu, Yizhong Wang, Avirup Sil, and Hannanch Hajishirzi. Self-rag: Learning to retrieve, generate, and critique through self-reflection. In International Conference on Learning Representations (ICLR), 2024.
Amanda Askell, Yuntao Bai, Anna Chen, Dawn Drain, Deep Ganguli, Tom Henighan, Andy Jones, Nicholas Joseph, Ben Mann, Nova DasSarma, et al. A general language assistant as laboratory for alignment. arXiv preprint arXiv:2112.0088 2021.
Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, al. Training helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.0586. 2022a.
Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. Constitutional ai: Harm- lessness from ai feedback. arXiv preprint arXiv:22/2.08073 2022b.

---

Published as a conference paper at ICLR 2026
Max Belitsky, Dawid J Kopiczko, Michael Dorkenwald, M Jehanzeb Mirza, Cees GM Snoek, and Yuki M Asano. Kv cache steering for inducing reasoning in small language models. arXiv preprint WrXXi:2507.08799, 2025.
Emily M Bender, Timnit Gebru, Angelina McMillan- Majalar and Shmargaret Shmitchell. On the dangers of stochastic parrots: Can language models be too big? In Proceedings of the 2021 ACM conference on fairness, accountabilityy and transparency, pp. 610-623, 2021.
Jinhe Bi, Yujun Wang. Haokun Chen, Xun Xiao, Artur Hecker, Volker Tresp, and Yunpu Ma. Visual instruction tuning with 500x fewer parameters through modality linear representaiionssteringg 2024.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1901, 2020.
Alexander Bukharin and Tuo Zhao. Data diversity matters for robust instruction tuning. In Confer- ence on Empirical Methods in Natural Language Processing (EMNLP), 2024.
Kaiyan Chang, Songcheng Xu, Chenglong Wang, Yingfeng Luo, Xiaoqian Liu, Tong Xiao, and Jingbo Zhu. Efficient prompting methods for large language models: A survey, arXiv preprint arXiv:2404.01077, 2024.
Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, al. Evaluating large language models trained on code. arXiv preprint arXiv:2107.0333 03374, 2021.
Runjin Chen, Andy Arditi, Henry Sleight, Owain Evans, and Jack Lindsey. Persona vectors: Mon- itoring and controlling character traits in language models. arXiv preprint arXiv:2507.21509, 2025.
Yung-Sung Chuang, Yujia Xie, Hongyin Luo, Yoon Kim, James Glass, and Pengcheng He. Dola: Decoding by contrasting layers improves factuality in large language models. arXiv preprint arXiv:2309.03883, 2023.
Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, et al. Training verifiers to solve math word problems. arXiv preprint arXiv:21 10. /4168, 2021.
Tri Dao. Flashattention-2: Faster attention with better parallelism and work partitioning. arXiv preprint arXiv:2307.0866 00090,,..81111110 2023.
Tri Dao, Dan Fu, Stefano Ermon, Atri Rudra, and Christopher Ré. Flashattention: Fast and memory- efficient exact attention with io-awareness. Advances in neural information processing systems, 35:16344-16352 2022.
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The Ilama 3 herd of models. arXiv e-prints, pp. arXiv-2407, 2024.
Nelson Elhage, Neel Nanda, Catherine Olsson, Tom Henighan, Nicholas Joseph, Ben Mann, Amanda Askell, Yuntao Bai, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Deep Ganguli, Zac Hatfield-Dodds, Danny Hernandez, Andy Jones, Jackson Kernion, Liane Lovitt, Kamal Ndousse, Dario Amodei, Tom Brown, Jack Clark, Jared Kaplan, Sam McCandlish, and Chris Olah. A mathematical framework for transformer circuits. Transformer Circuits Thread, 2021. https://tannsformrccireetl
/ftbb/200///ammmewo///nnee htmml.
Suyu Ge. Yunan Zhang, Liyuan Liu, Minjia Zhang, Jiawei Han, and Jianfeng Gao. Model tells you what to discard: Adaptive kv cache compression for 1lms. arXiv preprint arXiv:2310.01801, 2023.
Anna Hedström, Salim I Amoukou, Tom Bewley, Saumitra Mishra, and Manuela Veloso. To steer or not to steer? mechanistic enror reduction with abstention for language models. arXiv preprint arXiv:2510. 13290, 2025.
12

---

Published as a conference paper at ICLR 2026
Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. The curious case of neural text degeneration. arXiv preprint drXiv:1904.09751, 2019.
Yue Huang, Lichao Sun, Haoran Wang, Siyuan Wu, Qihui Zhang, Yuan Li, Chujie Gao, Yixin Huang. Wenhan Lyu, Yixuan Zhang, et al. Trustllm: Trustworthiness in large language models. arXiv preprint arXiv:2401.00 05561,, 2024.
Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: LIm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.0661 2023.
Sarthak Jain and Byron C Wallace. Attention is not explanation. arXiv preprint 2019.
Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang. Akshay Bal- subramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao, et al. Wilds: A benchmark of in-the-wild distribution shifts. In Proceedings of the International Conference Machine Learning (ICML), 2021.
Ronan Le Bras, Swabha Swayamdipta, Chandra Bhagavatula, Rowan Zellers, Matthew Peters, Ashish Sabharwal, and Yejin Choi. Adversarial filters of dataset biases. In International con- ference on machine learning, pp. 1078-1088. Pmlr, 2020.
Bruce W Lee, Inkit Padhi, Karthikeyan Natesan Ramamurthy, Erik Miehling, Pierre Dognin, Manish Nagireddy, and Amit Dhurandhar. Programming refusal with conditional activation steering- arXiv preprint arXh::2409.05907 2024.
Huayang Li, Tian Lan, Zihao Fu, Deng Cai, Lemao Liu, Nigel Collier, Taro Watanabe, and Yixuan Su. Repetition in repetition out: Towards understanding neural text degeneration from the data perspective. Advances in Neural Information Processing Systems, 36:72888-72903, 2023a.
Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg. Inference- time intervention: Eliciting truthful answers from a language model. In Advances in Neural Information Processing Systems (NeurIPS), 2023b.
Xiang Lisa Li, Ari Holtzman, Daniel Fried, Percy Liang, Jason Eisner, Tatsunori Hashimoto, Luke Zettlemoyer, and Mike Lewis. Contrastive decoding: Open-ended text generation as optimization. arXiv preprini 1rXiv:2210.15000
2022.
Runqi Lin, Bo Han, Fengwang Li, and Tongling Liu. Understanding and enhancing the transferabil- ity of jailbreaking attacks. arXiv preprint arXiv:2502.03052. 2025.
Jiachang Liu, Dinghan Shen. Yizhe Zhang, Bill Dolan, Lawrence Carin, and Weizhu Chen. What makes good in-context examples for gpt-3? arXiv preprint arXiv:2 2021.
Nelson Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang. Lost in the middle: How language models use long contexts. arXiv preprint 2.Xiv:2307.0312: 2023a.
Zichang Liu, Aditya Desai, Fangshuo Liao, Weitao Wang. Victor Xie, Zhaozhuo Xu, Anastasios Kyrillidis, and Anshumali Shrivastava. Scissorhands: Exploiting the persistence of importance hypothesis for I1m kv cache compression at test time. Advances in Neural Information Processing Systems, 36:52342-52364, 2023b.
Chris Lu, Cong Lu, Robert Tjarko Lange, Jakob Foerster, Jeff Clune, and David Ha. The ai scien- tist: Towards fully automated open-ended scientific discovery. arXiv preprint arXiv:2408.0622 2024.
OpenAl Gpt-4o mini: advancing cost-efficient intelligence. index/
https://openai. com/ -tw.aaaww.ino-ooaa------eeeee--- Accessed: 2025-09-21.
July 2024.
13

---

Published as a conference paper at ICLR 2026
Long Ouyang, Jeffrey Wu, Xu Jiang. Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to fol- low instructions with human feedback. Advances in neural information processing systems, 35: 27730-27744, 2022.
Nina Panickssery, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Matt Turner. Steering llama contrastive activation addition. arXiv preprint urXiv:2312.0668/ 2023.
Reiner Pope, Sholto Douglas, Aakanksha Chowdhery, Jacob Devlin, James Bradbury, Jonathan Heek. Kefan Xiao, Shivani Agrawal, and Jeff Dean. Efficiently scaling transformer inference. Proceedings of machine learning and systems, 5:606-624, 2023.
Joris Postmus and Steven Abreu. Steering large language models using conceptors: Improving addition-based activation engineering. arXiv preprint arXiv:2410.16311 2024.
Yujia Qin, Shihao Liang, Yining Ye, Kunlun Zhu, Lan Yan, Yaxi Lu, Yankai Lin, Xin Cong, Xiangru Tang, Bill Qian, et al. Toollim: Facilitating large language models to master 16000+ real-world apis. In International Conference on Learning Representations (ICLR), 2024.
Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly reward model. Advances in neural information processing systems, 36:53728-53777 2023.
Qwen Team. Qwen2 technical report. arXiv preprint arXiv:2407.10677 2024.
Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan Vazquez, Ulisse Mini, and Monte MacDiarmid. Steering language models with activation engineering, arXiv preprint arXiv:2308. 10248, 2023.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural informa- tion processing systems, 30, 2017.
Praveen Venkateswaran and Danish Contractor. Spotlight your instructions: Instruction-followinn with dynamic attention steering. arXiv preprint arXiv:2505. /2025, 2025.
Tianlong Wang, Xianfeng Jiao, Yinghao Zhu, Zhongzhi Chen, Yifan He, Xu Chu, Junyi Gao, Yasha Wang, and Liantao Ma. Adaptive activation steering: A tuning-free Ilm truthfulness improvement method for diverse hallucinations categories. In Proceedings of the ACM on Web Conference 2025, pp. 2562-2578, 2025.
Weixuan Wang, Jingyuan Yang, and Wei Peng. Cemantics-adaptivy activation intervention for 1lms via dynamic steering vectors. arXiv preprint 1rXiv:2410012299 2024a.
Zihao Wang. Bin Cui, and Shaoduo Gan. Squeezeattention: 2d management of kv-cache in Ilm inference via layer-wise optimal budget. arXiv preprint 24X47:240..04993, 2024b.
Sarah Wiegreffe and Yuval Pinter.
Attention is not not explanation.
arXiv preprint
arXiv: /908.04688666 2019.
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Remi Louf, Morgan Funtowicz, et al. Transformers: State-of-the-ar natural language processing. In Proceedings of the 2020 conference empirical methods in natural language processing:
system demonstrations, pp. 38 45, 2020.
Xiaodong Wu, Minhao Wang, Yichen Liu, Xiaoming Shi, He Yan, Xiangju Lu, Junmin Zhu, and Wei Zhang. Lifbench: Evaluating the instruction following performance and stability of large language models in long-context scenarios. arXiv preprint arXiv:2411.07037 2024.
Tinghao Xie, Xiangyu Qi, Yi Zeng, Yangsibo Huang, Udari Madhushani Sehwag, Kaixuan Huang, Luxi He, Boyi Wei, Dacheng Li, Ying Sheng, et al. Sorry-bench Systematically evaluating large language model safety refusal. arXiv preprint arXiv:2406. /4598, 2024.
14

---

Published as a conference paper at ICLR 2026
Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. Safedecoding: Defending against jailbreak attacks via safety-aware decoding. arXiv preprint arXiv:2402.08883, 2024.
Dongyu Yao, Jianshu Zhang, Ian Harris, and Marcel Carlsson. Fuzzilm: A novel and universal fuzzing framework for proactively discovering jailbreak vulnerabilities in large language models. In ICASSP 2024-2024 IEEE International Conference on Acousties, Speech and Signal Process- ing (ICASSP), pp. 1485-44499, IEEE, 2024.
Qingru Zhang, Chandan Singh, Liyuan Liu, Xiaodong Liu, Bin Yu, Jianfeng Gao, and Tuo Zhao. Tell your model where to attend: Post-hoc attention steering for Ilms. arXiv preprint arXiv:2311.02262. 2023.
Qingru Zhang, Xiaodong Yu, Chandan Singh, Xiaodong Liu, Liyuan Liu, Jianfeng Gao, Tuo Zhao, Dan Roth, and Hao Cheng. Model tells itself where to attend: Faithfulness meets automatic attention steering, 2024. URL https:: /atiivv///xvvvv///a org/ abs /4092 224991177 10790.
Jeffrey Zhou, Tianjian Lu, Swaroop Mishra, Siddhartha Brahma, Sujoy Basu, Yi Luan, Denny Zhou, and Le Hou. instruction-followin evaluation for large language models. arXiv preprint arXiv:2311.07911, 2023.
Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, et al. Representation engineering: A top-down approach to ai transparency. arXiv preprint arXiv:2310.01005, 2023.
15

---

Published as a conference paper at ICLR 2026
A EXPERIMENT DETAILS
A.1 EXPERIMENTAL SETUP
We implemented all algorithms using PyTorch and the Hugging Face trans transformest formers (Wolf et al., 2020) library. All experiments were conducted on a single NVIDIA H100 GPU server.
A.2 DATASET DETAILS
A.2.1 IFEVAL
IFEval (Zhou al., 2023) is benchmark designed to programmatically evaluate the instruction- following capabilities of Large Language Models, containing 541 prompts across 25 diverse con- straint types. It employs automatic evaluation framework based on four key metrics. Prompt-level accuracy requires all constraints within single prompt to be satisfied, while instruction-level ac- curacy assesses each constraint individually. These are further divided by matching criteria: strict accuracy demands an exact match with the expected output, whereas loose accuracy allows for mi- nor, non-essential variations, such as ignoring case sensitivity or extra whitespace when checking for a forbidden word. In our main results, the reported prompt-level and instruction-lewe accuracies are the average of their respective strict and loose scores. Table shows an example from the dataset,
Table 6: An example from the FFEval dataset. The original wide format is rearranged here for clarity, showing the key fields and their content for single prompt.
Field
Content
key
1005
prompt
Write resume for a fresh high school graduate who is seeking their job. Make sure include least 12 placeholder represented by square brackets, such as [address], [name].
ihstruction.id. iist
detectable,contes wwwnber.ppaccehodeee..
kwargs
mut.placeholders:11
Prompt rewriting for steering compatibility, A key prerequisite for most test-time steering methods, including ours, is the clear separation between the primary task and its associated in- structions. This separation is crucial for the efficient and accurate identification of the instruction span where steering should be applied. However, the original prompts in the IFEval benchmark often interleave these two components. To align the dataset with the requirements of steering -based methodologies, we adopted the preprocessing procedure from prior work Venkateswaran tractor (2025), We programmatically rewrote the original prompts using the gpt 4----oommm m-mmnin API (OpenAI, 2024) to explicitly disentangle the task from the instructions, guided by the prompt tem- plate shown in Figure 5. This process establishes consistent and clearly demarcated structure, enabling the precise application of steering mechanisms. Table illustrates the structural changes resulting from this process. For this benchmark, steering was applied the KV cache of tokens corresponding to the explicitly separated instruction span.
Con-
Analysis of dataset bias and prompt robustness. To verify that our rewriting process does not inadvertently create a dataset biased towards DIRECTER, we report the performance of the zero- shot baseline using
on both the original and the rewritten versions of the IFEval dataset. Table 8 shows that the performance remains comparable, indicating that the rewriting process itself does not introduce significant bias that would unfairly favor our method.
Furthermore, to assess the robustness of DIRECTER against variations in prompt design and instruc- tion placement, we created four different prompt templates. Each template alters the phrasing or the position of the instructions relative to the main task. The four templates, filled with example, presented in Table 9. Except for this prompt robustness analysis, Template was used as the main template for all other experiments.
16

---

Published as a conference paper at ICLR 2026
You will be given prompt within the <proapt> and </prompt> tags. The prompt consists of task question (e.g.) write essay, and one more instructions (e.g.) do use any commas, highlight secticns, etc.
You must rewrite this prompt to separate the instructions from the task and the new prompt should specify the task at the beginning. You will also be given 1ist of instruction that will specify the instructions present in the prompt.
At the end the new prompt 1ist the instructions after the sentence "Your response should follow the instructions below:\n"
Each instruction should be preceded by a hyphen or dash Make sure the new prompt is within the <new.prompt>> and </new.prompt>> tags.
<prompt>
[prompt]
</prompt>
<instruction.ids>
(instruction_ida)
</instruction ids>>
Figure 5: The prompt template used for rewriting IFEval samples.
Table Examples of IFEval prompt rewriting. The original prompts are separated into distinct Task and Instruction sections to simplify instruction span identification.
Example
Original
am planning trip Japan, would thee to write an itinerary my journey a Shakespearean style. You are not allowed to use any commas in your response.
Rewritten
Your task is to write an itinerary for trip Japan in Shakespearean style.
Do use any commas in your response.
Example
Original
Write two jokes about rockets. Do not contain commas your response. Separate two jokes with 6 asterisk symbols:
Rewritten
Write two jokes about rockets.
Do contain commas your response.
Separate the two jokes with asterisk symbols: ******
Table 8: Performance of the zero-shot baseline on the original and rewritten IFEval datasets.
Dataset Version
P. Acc. (%)
I. Ace. (%)
Mean Ace. (%)
Original IFEval
74.4
82.1
78.3
Rewritten IFEval
73.5
81.5
77.5
A.2.2 LIFBENCH
LIFBench (Wu et al., 2024) is a benchmark designed to evaluate the instuettionfoolloiing capabil- ities of L.MMs in long-context scenarios. comprises 2,766 instructions across 11 distinct tasks,
17

---

Published as a conference paper at ICLR 2026
Table 9: Four prompt template variants used to evaluate the robustness of DIRECTER. Each template alters the position of the instruction or the overall phrasing.
Template ID
Example Prompt Filled with Data
Template
Your task to write an itinerary trip to Japan in Shakespearean style. Do not use any commas in your response.
Template 2
Do not use any commas in your response.
Your task is to write an itinerary for trip to Japan in Shakespearean style.
Template 3
Given the following instructions, complete the task the user requested. Do not use any commas in your response.
Your task is to write an itinerary for trip to Japan in Shakespearean style.
Template
Your task to write an itinerary for trip to Japan in Shakespearean style.
Complete the requested task by following the instructions below.
-oo not use any commas in your response.
with context lengths extending up to 128k tokens. The benchmark is organized into three primary scenarios: List, which tests for precise indexing and selection from ordered lists; OneDoc, focusing on single-document information extraction and formatting: and MultiDoc, requiring retrieval or rea- soning across multiple documents. The primary evaluation metric is the Automated Rubric-based Score (AR5), where points for various rubric items are summed and normalized. This normalization results in final score between O and 1, which functions analogously ble 10 provides examples for each scenario. Steering was applied to the KV cache of tokens within the instruction part of each prompt.
accuracy metric. Ta-
Subsampling for computational tractability. The original LIFBench dataset includes samples with exceptionally long contexts, with some exceeding 100k tokens. Processing these samples dur- ing inference requires GPU memory that surpasses the capacity of our experimental hardware, mak- ing full evaluation computationally intractable. To create tractable yet representative subset for our experiments, we performed a two-stage subsampling process. First, we filtered out all sam- ples exceeding predefined string length threshold to eliminate the most resource-intensive cases. Subsequently, to preserve the benchmark's 's integrity and avoid introducing bias, we ensured that the proportional distribution of samples across all original subtasks was maintained. This was achieved by uniformly downsampling each subtask to match the retention rate of the most heavily filtered task. This procedure resulted in a final, balanced set of 467 samples, enabling practical and fair evaluation within our resource constraints.
A.2.3 GSMSK WITH FORMATTING CONSTRAINTS
The original GSM8K dataset (Cobbe et al., 2021) consists of 1.3k grade-school math word problems, designed to test the multi-step arithmetic reasoning capabilities of language models. Inspired by prior work on improving instruction following in LLMs (Zhang al., 2023), we designed a variant of this benchmark, which we term GSM8K-Forre Format, to evaluate a model's 's ability to perform a core reasoning task while simultaneously adhering to strict formatting constraints.
A primary motivation for this benehmark is to verify that improvements in instruction following do not come at the cost of task performance. To this end, we measure two metrics concurrently: Format Accuracy (F. Acc) and Task Accuracy (T. Acc). Task accuracy is considered correct if the final numerical answer can be successfully parsed from the model's generated solution. Format ac- curacy, however, requires the entire output to strictly conform to a specified JSON structure, with no extraneous text. This stal-metric evaluation allows us to assess whether a model can follow stylistic instructions without degrading its underlying reasoning capabilities. Table 11 provides exam- ple from our benchmark. For this benchmark, steering was applied specifically to the instructions dictating the JSON format, excluding the Problem part containing the math word problem.
18

---

Published as a conference paper at ICLR 2026
Table 10: Examples from the LIFBench dataset, categorized by scenario.
Scenario
Example
List
You'te re a searcher. You need to output the corresponding list elements based on the instruc- tions and the list below.
Please follow the instructions directly without anything else. List be retrieved: 1 42
2. 4f029927751114886251112222873
8. 4480644777111188822288112222
152. 4f7846f47651 11986647771111882222811822220000 153. (
Instruction: From the preceding list, choose an element at random that succeeds the item "48806422/511 1e8 1220049944211 122b/941e"
and provide the output.
OneDoc
There are several different types KEY SENTENCE the input text, which are marked by special tags. These special tags total of six kinds, respectively is "i#Topic#;", @ar- gument @ ;" ":'Transition!!" "i-Summary-"" "f*Evidence*&" "/-Concession-," Dif- ferent tags represent different types of key sentence. If sentence in the text is KEY SEN- TENCE, we will add special tag sentence. The head tag also contains id order information in the format jtype-idg. For ex- ample. the head tag with type "TTTopc#tt" and id I is #Topic#-11, lz. Also note that when the head tag and tail tag attributes inconsistent, this means that the sentence is fake KEY SENTENCE. Please read input text carefully and give answer directly according to the instruction requirements. Input text:
the same attribute to the beginning and of the
Instruction: Gather every instance of KEY SENTENCE classified as "#Evidenc**; The out- put should be Json list arranged by ids. If none are found, provide empty aray. Output Example I: [KEY SENTENCEI, KEY SENTENCE2..
Output Example 2: 0
MultiDoc
You document manager. Here is collection of documents. Each document includes information such as title, date, source, iD2 and specific article content (text). You need to documents something else. Also note:
follow instructions give some information directly, without
1. Some documents may be missing information such as title source, which may affect the final output.
2. Some articles (i.e, values corresponding the text keyword) may duplicated. Documents:
Instructions: Assign labels documents in order using the provided list of ['11311', '22422', '33233', '44444"..
Table 11: An example from the GSM8K-Format dataset. A formatting instruction is added to the original GSMSK problem.
Task
Content
GSM8K
Natalia sold clips to 48 of her friends in April, and then she sold half as many clips in May. How many clips did Natalia sell altogether in April and May?
GSMBK-Format
Read the given math problem and provide your answer in the following JSON for- mat:
{("solution": "<step-by steetp solution>"". ""answer": "<final answer as a number only>>)}
Problem:
Natalia sold clips to 48 of her friends in April, and then she sold half as many clips in May. How many clips did Natalia sell altogether in April and May?
19

---

Published as a conference paper at ICLR 2026
A.3 BASELINE REPLICATIONS AND IMPLEMENTATIONS
A.3.1 PASTA
PASTA (Zhang et al., 2023) improves instruction following via two-stage process. In the first stage, profiling, an extra dataset used to identify attention heads that are influential for given task. During the second stage, steering, the attention scores of these selected heads manipulated at inference time by scaling down the attention on con-instruction tokens.
The profiling stage is computationally intensive, requiring N x L H forward passes, where N is the number of profiling examples, is the number of layers, and H is the number of attention heads. 1amaa-.--8B-Instruee
with 1000 examples suggested in the original work would require 1000 x 32 x 32, over a million, forward passes. To ensure a fair comparison with methods that operate solely at inference time, we adapted PASTA
For instance, profiling
few-shot profiling setting. While the original work uses up to 1000 examples per task, we used 10 examples for IFEval and GSM8K-Format, and 11 for LIFBench (one for each of its subtasks). Since IFEval lacks public training set, we manually crafted these few-shot examples, as shown in Table 12.
Following the profiling stage, we adopted the task-specific head selection strategy proposed in the paper, steering total of 50 heads. We initially used the recommended attention scaling factor of a = 0.01, but observed performance degradation on IFEval. Consequently, we conducted brief hyperparameter search and found = 0.1 to be more effective for our tasks. The results of this search are detailed Figure 6a.
Table 12: An example of a manually crafted IFEval benchmark.
Field
Content
key
9000
prompt
Draft timeline of the Apollo 11 mission from launch to splashdown.
Include exactly placeholders represented by square brackets, such as [time] or [location]. Keep the response under 120 words.
instruction.idlisst
detectable.conte mumberr plachooolllaceeeeeerrerr htt.://ccoosraaantttnnnooooo.ooo
kwargs
num, num, pll.pehollddrs10
relation: num_words, less.than: 121
80
Probability
Spotlight
Accuracy (%)
70
Accuracy
75
60
70
Top-5
Top-10
Top-50
50
10
10 2
10"
0.1
0.2 Vonget
0.3
(a) PASTA
(b) SpotLight
Figure 6: Results of the hyperparameter search the IFEval dataset. (a) PASTA (varying the scaling factor a) and (b) SpotLight (varying the target attention mass vtarget)
20

---

Published as a conference paper at ICLR 2026
A.3.2 SPOTLIGHT
As the official implementation for SpotLight (Venkateswaran Contractor, 2025) was not publicly available, we re-implemented the method based the description provided in the original paper. To verify our implementation, we compared the paper's proposed method (SpotLight). which uses an additive bias to approximate target attention proportion, against stricter variant that directly normalizes scores to always maintain this target (Probability). Figure illustrates the layer-wise behavior of both versions. For all our main experiments, used the official additive bias approach as proposed in the paper.
The original work recommends target attention mass of Vtarget 0.3. However, this setting led to significant performance degradation in our experiments. Similar to our process for PASTA, we performed hyperparameter search on IFEval (as shown in Figure 6b). Based these results, selected t'target = 0.1 for all reported scores.
0.25
0.3
0.20
0.2
0.15
After
After
Before
Before
0.10
0.1
0.05
0.00
0.0
250
500
750
1000
1250 1500 1750 2000
0
250
500
750
1000
1250 1500 1750 2000 Step
(a) Original Method (Additive Bias)
(b) Variant (Strict Normalization)
Figure 7: Verification our SpotLight implementation. We compare the layer-wise attention proportion instruction tokens for (a) the original method from the paper and (b) variant that strictly enforces the target proportion.
A.4 PROMPT TEMPLATES
As detailed Section 4.3, we conducted an LLM-based evaluation to ensure that enhancing cntruction-folloiing performance does not negatively impact text quality task fidelity open- ended generation tasks. The prompttemplatte provided to the LLM judge for this evaluation is shown in Figure 8.
B ADDITIONAL RELATED WORK
This section provides more detailed overview of the two main categories of activation steering methods discussed in Section hidden state-level and attention-level interventions. We focus on the inherent limitations of each approach that motivate work, DIRECTER.
Hidden state-level steering. The primary limitation of methods that operate hidden states is their fundamental reliance on pre-computed signals or external datasets. This category includes several approaches that, despite being adaptive form, are restricted pre-defined concepts: CAST (Lee et al., 2024) gates steering by detected semantics; ACT (Wang et al., 2025) adapts strength for truthfulness; and SADI (Wang al., 2024a) scales influential components from con- trastive signals. Consequently, even though these methods are often described as dynamic or adap- tive, their steering capabilities are fundamentally restricted to these pre-defined traits. This reliance on pre-computation means the steering vector represents a static concept space defined offline. Such a fixed representation makes difficult for the model to adapt to the novel, bet-by-step dynamics of a specific generation process, where the ideal steering direction may shift based the evoly- ing context. This highlights the need for a truly online control mechanism that can respond to the immediate state of the generation.
21

---

large vali- Published as a conference paper at ICLR 2026
You are an impartial evaluator of Instruction-folloving tasks.
You will receive "query" and "response". In this dataset, each query contains:
(1) the task to be completed, and
(2) additional formatting instructions.
For this evaluation, IGNORE the formatting instructions entirely because they are evaluated elsewhere. Focus only whether the response completed the TASK content correctly and whether the writing quality adequate.
Scoring rules:
task fideliiy 1 if (and only if) the response fulfills the task asked in the query; else 0. text-quality:
integer from 5 reflecting clarity, coherence, fluency, and appropriateness of tone for the task (1=very poor, 5-oxcollent).
Provide also a brief justification (1-3 concise sentences) that explains your decision, referring only to task fulfillment and writing quality.
Return STRICT JSON with the keys: task,fidelity, text.quality, justification.
Query:
{query)
Response:
(response)
Figure The prompt template used for LLM-based evaluation.
Attention-level steering. The attention mechanism has long been a focal point for interpretabil- ity research (Jain Wallace, 2019; Wiegreffe Pinter, 2019; Elhage et al., 2021), but its direct application to inference time steering remains relatively under-explored area. As noted in Sec- tion 2, existing attempts this space have notable limitations. Examples include PASTA (Zhang et al., 2023), which profiles beneficial heads and suppresses attention to non-instruction tokens, and SpotLight (Venkateswaran & Contractor, 2025), which maintains a target proportion of attention on instruction tokens. However, PASTA'S profiling requires costly pre-computation dation set, and SpotLight introduces relatively high latency by doubling softmax operations. More broadly, both rely static manually tuned configurations that do not adapt to the evolving context of the decoding process, leaving gap for more robust, online control mechanisms like ours.
C METHOD DETAILS
C.I FULL ALGORITHM OF DIRECTER
Algorithm provides a detailed walkthrough the DIRECTER procedure. The process is divided into two main phases. Phase details the one-time layer ranking based attention sensitivity. which is performed once after the initial prompt prefill. This phase calculates the influence of each layer and produces static ranked list, Lranked Phase 2 describes the per-token generation loop, which uses this ranked list to perform plausibility- guudedd decoding (Section 3.2), adaptively moderating steering strength at each step.
22

---

Published as a conference paper at ICLR 2026
Algorithm 2: Detailed Procedure of DIRECTER
Input: Prompt scaling factor plausibility threshold 8 Output: Generated sequence
// Phase 1: Prefill and Layer Ranking
C + Prefill(x)
Initialize layerwise Attention Sensitivity S zeros(L)
for do
Cee) f- ScaleCache(C, ()),a)
// Steer key cache of instruction tokens of only layer &
[H J==1: [H (1)
past p=1 f=1 GellfiddenStates(())) // Get baseline hidden states
1J=1 + GelHiiddenSttts((((e)) Get steered hidden states (H 1j=1: (H
for jorj= to L do
(y( dist(H ( S|e + [ (()
dist (H (2))) + (dist(H()e)) H dist(H H (2))
franked Argsort(S (S, descending) 11 y f- tokens from
// Phase 2: Plausibility-Guide Decoding
while end-of-sequence do
13
Pr + Forward(C). // Get raw probability distribution
14
Lamdle < Lanked // Initialize candidate layers for this step
15
accepted + False
while [camd.e] > and not accepted do
17
Cacates + ScaleCache(C,, Leand, Q)
18
Pe Forward(CCcalll // Get steered distribution
19
5 + argmax(p:): i + argmax(p.)
/ Plausibility check
if Pt.ū; 3 Pp,s; then
21
Pinal + Pc accepted + Truc
23
24
1s +- L|Ccamd.e//2 Leand <- L bi // Reduce strength by halving layers
26
if not accepted then
27
Punai + Pt // Fallback to original if no version is plausible
28
Ineu Sample(pina) (pinal)
29
UUpdateCache ines))
30
Append Enet to
return y
C.2 SIMPLIFICATION OF THE ATTENTION SENSITIVITY METRIC
As formulated Section 3.2, the attention sensitivity score conceptually derived from the total disturbance perturbation at layer & causes relative to a baseline. The full expression is:
Σ Sensitivity = j=1
[dstt(
( pro
H (i.0) post
dist
( pre
G)
H() post
(4)
(i.t) (dist(H($.*)
H(())
di pre
(
H H((2))
pre
This can be rearranged to separate the terms dependent on the perturbed layer f:
1 L
Sensitivity (e)
Σ
(dis((H()) H + dist (5.6)
(3.)) pre H(())
(5)
where the term C C= 2 dist(H
pie ((s)) is constant with respect to e, as it calculated from the single, unperturbed forward pass. Since layer ranking is ordinal operation, subtracting this
(3)
23

---

Published as a conference paper at ICLR 2026
common constant from all scores does not alter the final rank order. For computational efficiency, we therefore use the simplified metric for the ranking procedure:
Sensitivity stmplincd x
(ist(HHu) H (aat) + dist
H pre
H
Hpss)
(6)
pie
potential concern with this metric that one might assume linear relationship between layer's index and its sensitivity ranking. This assumption stems from the idea that layer's sensitivity might correlate with its depth, given that its exposure to propagated effects from steering interventions varies by position. However, contrary to this intuition, the relationship is not linear. As we demon- strate in Appendix D.4, the actual distribution of the most influential layers changes depending on the task. We hypothesize that this is attributable to the complex non-linear interactions throughout the model.
C.3 JUSTIFICATION AND VALIDATION OF THE SENSITIVITY METRIC
In this section, we provide additional intuition regarding the design of our attention sensitivity metric (Eq. 2 and Eq. 3) and present supplementary experiments to validate our design choices.
The primary objective of our attention sensitivity analysis is to derive a principled, data-free ranking of layers based on the steering effect they pro- vide. While estimating the precise downstream effect of steering multiple layers simultaneously is inherently challenging, we approximate this influence by isolating the marginal contribution of each layer. However, measuring only the local change at the steered layer is insufficient; a steering inter- vention modifies the output of the target layer, which subsequently alters the input processing of all following layers. To address this, our metric captures two distinct effects: the direct impact on steered layer's attention output, and the propugated impact on the attention input of subsequent lay- ers. By summing these distributional shifts across all layers, we capture the aggregate impact caused by the intervention. This summation serves as a proxy for the layer's 's global influence, aggregating step-wise shifts to estimate how effectively a steering applied at a specific layer propagates through the model alter the final output distribution.
Rationale for summing distributional shifts.
Preference for cosine distance over norm- based metrics. To quantify these shifts, we select cosine distance as the metric of choice due to the underlying mechanics of our steering method. We apply scaling to the key vectors the specified instruction span, which directly alters the attention scores. Given that the attention mechanism concludes with Softmax operation, absolute magnitude changes are largely renormalized; the intervention therefore manifests primarily as redistribution of attention weights. This redistribution, in turn, changes the coefficients used for the weighted averaging of value vectors. Consequently, norm-based metrics, such as the L2 norm, would be susceptible to magnitude fluctuations that do necessarily correlate with directional shifts in the representation. In contrast, cosine distance explicitly captures this directional shift, serving robust proxy for the semantic change in the attention output. This design choice is further supported by methodologies in KV cache compression literature, which leverage cosine similarity to identify redundant layers where input-output representations remain stable (Liu al., 2023b; Wang et al., 2024b). We apply the inverse logic: seeking layers where steering intervention produces the maximum directional shift, thereby signaling high steering leverage.
Empirical validation. To further validate the specific choice of cosine distance, we conducted an additional ablation study comparing our cosine-based ranking against an 1.2-norm- based ranking- As shown in Table 13, ranking by cosine distance consistently yields higher accuracy across diverse benchmarks compared to L2. This confirms that directional sensitivity a more accurate predictor of steering efficacy than magnitude-basee sensitivity in this context.
is also worth noting that while sensitivity- ranking yields the optimal results, the plausibility- guided decoding loop remains highly effective with simpler layer selection strategies. The ranking procedure acts as a modular component that enhances efficiency and precision, allowing to be further improved replaced in future work.
24

---

Published as a conference paper at ICLR 2026
Table 13: Comparison of ranking metries: Cosine Distance vs. L2 Norm.
Method
IFEval Mean Acc.
GSM8K-Format
LIFBench
Acc. / Acc.
Avg.
Baseline
77.5
79.2 82.7
57.6
L2-based Ranking
80.5
98.5 88.1
58.6
DIRECTER (Cosine-based)
81.8
99.1 86.9
62.0
C.4
CONTROL OF STEERING STRENGTH
Scale factor
10
10
10"
10"
10"
Scale factor
M layers
Number of scaled layers
Figure 9: Impact of steering parameters on representational shift. Varying the scaling factor a (red) has saturating effect, while varying the number of steered layers (blue) provides fine- mn-ggrained control.
An important design choice in DIRECTER is to modulate the steering strength by adjusting the number of scaled layers rather than the key scaling factor, a. To justify this, we analyze how each parameter influences the overall representational shift within the model, which proxy for the intensity of the steering intervention. As shown in Figure 9, the two parameters offer vastly different levels of control. When varying the scaling factor (red curve), observe that the steering effect saturates almost instantly, acting as binary on/off switch rather than a gradual control knob. In contrast, when progressively increase the number of top-ranked layers being steered (blue curve), the total shift increases smoothly and monotonically. This demonstrates that modulating the number of steered layers provides more effective and stable mechanism for the adaptive control loop in DIRECTER.
C.5 KEY SCALING VS. VALUE SCALING
As discussed in Section 3.1, KV cache steering can be applied by scaling either keys or values while we exclusively focus on key scaling this work. As demonstrated previously in Figure 3b, our method is highly robust to the choice of the key scaling factor, consistently outperforming the zero-shot baseline across wide range of values. It is true that value scaling also yields improve- ments over the baseline, as our plausibility guidance mechanism effectively mitigates oversteering. Nevertheless, its performance is suboptimal compared to key scaling, a trend clearly illustrated in Figure 10. This empirical result, combined with our goal of minimizing hyperparameters, solidified our decision to focus on a single, more effective scaling target. We hypothesize that this perfor- mance discrepancy arises from the distinct functional roles of queries, keys, and values within the attention mechanism. deeper investigation into this interaction beyond the scope this paper and remains avenue for future research.
25

---

Published as a conference paper at ICLR 2026
82
Accuracy (%)
4v
78
10
10
10
Scale factor
Figure 10: Comparison between key scaling (axx) and value scaling (axy). ) Key scaling consis-
tently achieves higher performance than value scaling across various scale factors.
C.6 PLAUSIBILITY CRITERION
We considered alternative methods for the plausibility constraint beyond the probability ratio gate in Eq. I, namely acceptance tests based on KL and JS divergences. On 20% subsample of IFEval, we changed only the acceptance test while keeping all other settings identical, tuned thresholds on held-out split, and evaluated three independent runs the probability ratio- based method achieves the best accuracy. whereas KL and JS divergence-bast criteria generally underperform and show greater sensitivity threshold choice.
disjoint subset. As summarized in Table 14,
Criterion
Threshold
Accuracy (%)
Baseline (Zero-shot)
72.6 +: 1.99
Probability ratio (3)
0.3
75.7 1: 0.53
Probability ratio (3)
0.5
78.2 + 0.82
Probability ratio (B)
0.7
77.7 :: 2.11
JS divergence (rJs)
0.05
74.8 + 0.85
divergence (ras)
0.10
72.6 2.15
IS divergence (Tas)
0.15
74.6 2.94
IS divergence (ras)
0.20
73.3 2.40
KL divergence (TKL)
0.1
72.8 + 0.46
KL divergence (7KL.)
0.2
74.3 1: 1.20
KI. divergence (TKL.)
0.3
74.3 + 2.01
KI. divergence (FKL.)
0.4
71.6 +: 2.25
Table 14: Comparison of plausibility criteria on IFEval subset. Accuracy is reported as mean +
standard deviation over three runs.
We attribute this empirical gap to the characteristics of KL and JS divergence. These measures ag- gregate shifts over the entire vocabulary, so diffuse changes in the long tail region can inflate diver- gence even when the top-1 token remains acceptable, resulting in unnecessary rejections. Moreover, KL divergence has no fixed global scale, while JS divergence is bounded but still context dependent, making it difficult to select a single stable threshold. Both metrics require computing the steered dis- skipping mechanism that design aligns with previous contrastive decoding
tribution, which prevents compatibility with our top-2 probability- avoids unnecessary forward passes. Finally, frameworks (Li et al., 2022; Chuang et al., 2023; Xu et al., 2024) that compare top-token preferences across distributions, and it integrates naturally with our plausibility-guide loop.
26

---

Published as a conference paper at ICLR 2026
D ADDITIONAL ANALYSES
D.1 ABLATION STUDY ON THE ATTENTION SENSITIVITY METRIC
While the main experiments demonstrate the effectiveness of the attention sensitivity-based layer ranking in DIRECTER, the formulation of our metric is guided by the intuition that effective sensitivity measure should capture both the direct and propagated effects of a perturbation. To provide a stronger empirical foundation for this design choice, we conducted an analysis of several alternative formulations for the sensitivity metric.
As defined in Equation 2, our proposed metric composed of key terms that measure the disturbance caused by perturbation at layer t: (1) the direct impact on a layer j's attention output, and (2) the propagated impact on layer j's attention input. We experimented with several metric variants, including those that rely on only one of these two components. Our findings indicate that the complete metric, which incorporates both terms, consistently outperforms these simplified alternatives. This result provides strong empirical support for our design, suggesting that considering both the direct and propagated effects is crucial for accurately identifying the most influential layers for steering.
Table 15: Performance of different sensitivity metric variants. d(..-) denotes the cosine distance.
Equation
P. Acc (%)
I. Ace ( (%)
Mean Acc (%)
d(H
(1.))
75.8
83.0
79.4
d(H
(3:8)
d( (
H (69)
76.9
83.4
80.2
post:
post
d(H
H (3.t) post
78.5
84.5
81.5
d(H posr
H (1.5))
78.5
84.5
81.5
DIRECTER
78.8
84.8
81.8
D.2 AUTOMATIC INSTRUCTION SPAN IDENTIFICATION
One practical consideration that our method assumes that the task description and instructions, such formatting constraints, are explicitly separable. However, in real-world deployment see- narios, user prompts are often structured in an interleaved manner where tasks and instructions are mixed. While our primary experiments presuppose separable instructions, consistent with prior work (Zhou et al., 2023; Venkateswaran & Contractor, 2025), we also investigated the method's applicability these more practical, interleaved settings.
Instead of relying on external APIs or larger models for prompt rewriting, we prompted the LLM (Llama-3.1 1.-ma--.1-8B---- Insttruttttt to self-extract the instruction span before beginning its main task. The steering was then applied only to the token indices corresponding to this extracted span. The results of this experiment are presented in Table 16. The specific prompt used for the instruction span extraction is shown in Figure 11.
The results demonstrate that even when using simple self-extraction prompt for practical, inter- leaved instructions, DIRECTER effectively outperforms all baselines. However, this approach can fail in ambiguous cases (Table 17), suggesting that overall performance could be further improved by integrating more sophisticated instruction span detection methods.
D.3 INFERENCE OVERIEAD ANALYSIS
We analyze the inference overhead of DIRECTER terms of latency and memory usage, comparing it against the zero-shot, few-shot, and SpotL.ight baselines.
27

---

Published as a conference paper at ICLR 2026
Table 16: Performance of automatic instruction span identification on the 1FEval benchmark.
Method
P. Ace (%)
I. Ace (%)
Mean Acc (%)
Zero-shot
74.4
82.1
78.3
" marked
71.7
80.1
75.9
marked
82.9
Few-shot
71.0
79.5
75.2
DIRECTER
76.6
83.6
80.1
Extract exactly one substring from QUERY that expresses the instruction the assistant (requirements, constraints, formatting rules, steps, or prohibitions). Copy it verbatim from QUERY. Return the substring ONLY no quotes, no labels, no bullets, no code fences, no extra words.
EXAMPLE
QUERY:
(example.query)
OUTPUT (substring only):
fcxample.output>
Now do the same for the following QUERY. Output the substring only, with nothing else:
QUERY: fquery)
Figure 11: The prompt template used to instruct the LLM to self-extract the instruction span from an interleaved user query.
Time to first token (TTFT). Our method, DIRECTER, requires a one-time layer sensitivity anal- ysis after the initial prompt prefill to rank the layers. As result, the time required to generate the first token (TTFT) is inherently longer compared to other methods that do not require this pre- computation step. Table shows that this initial overhead is the primary latency cost of our method.
Decoding throughput. While the initial TTFT is higher, this overhead is amortized over the entire generation sequence. Figure 12 provides a more detailed breakdown of the decoding throughput. As shown in Figure 12a, which visualizes the average throughput across performance percentiles, the throughput of DIRECTER worst-case scenarios (i.e., lower percentiles) naturally lower than its average, yet it consistently outperforms the attention-level intervention method, SpotLight.
Furthermore, Figure 12b illustrates the relationship between throughput and the total length of the generated sequence. The throughput is lower for shorter sequences because the initial overhead from our one-time layer ranking constitutes larger proportion of the total generation time. This observation is consistent with earlier TTFT analysis.
Memory overhead. precise comparison of memory overhead is challenging, as the average length of the generated response varies across different methods (Table 19a). Nevertheless, by mea- suring the change in reserved memory, we can analyze the additional overhead. Table 19b shows that the memory overhead of DIRECTER modest.
The overhead in our method stems from the need to extract attention states from both the raw and steered forward passes during the one-time layer ranking stage. We hypothesize that our current implementation could be further optimized; the output attentions flag currently enabled throughout the entire decoding process. By disabling this flag after the ranking complete, the
28

---

Published as a conference paper at ICLR 2026
Table 17: An example of failure case in the self-extraction of an instruction span.
Component
Text
Full User Prompt
Write a letter to friend in all lowercase letters ask them to go and vote.
Correct Span (Expected)
in all lowercase letters
Incorrect Span (Extracted)
ask them to go and vote
Table 18: Comparison of Time to First Token (TTFT) across methods.
Method
Mean TTFT (s)
Zero-shot
0.028
Few-shot
0.031
SpotLight
0.038
DIRECTER (Ours)
1.160
40
40
35
35
30
30
Zero-shot
Zero-shot
25
Few-shot
Few-shot
DIRECTER
DIRECTER
20
SpotLight
20
SpotLight
15
15
10
20
30
40
50
60
70
80
90
100
400
800
1200
1600
2000
Percentile
Token length
(a) Throughput by percentile
(b) Throughput by token length
Figure 12: Detailed analysis of throughput (TPS), (a) shows the average TPS across different
performance percentiles. (b) shows the average TPS function of the generated token length.
average memory usage would likely approach that of the zero-shot baseline unlike attention-level steering methods that constantly require these attention outputs.
To further investigate the source of inference latency, we analyze the number of decoding trials at each generation step. Here, decoding trial refers to each attempt to apply steering; the t-th trial our setup involves steering progressively reduced set of 26- layers (i.e., 32 layers in the first trial). Figure 13 plots heatmap where the color intensity corresponds to the token change rate after steering.
The key observation is that when the model's initial confidence is high (a high raw token probability), the token change rate remains low even after multiple decoding trials. This indicates that steering largely ineffective when the model is already highly confident in its prediction, and the additional forward passes for each trial do not lead to a new token being selected. This observation suggests that there remains clear opportunity to further optimize inference latency.
D.4 LAYER RANKING DISTRIBUTION
In this section, we analyze the distribution of layer sensitivity rankings across the different bench- marks understand how task characteristics influence which layers are most critical for steering. Figure visualizes the detailed probability distribution of each layer's sensitivity rank, calculated once prefill. To provide more aggregated and intuitive view of this same data, Figure 15 shows the proportion times each layer included as a steering candidate at various steering strength levels. In this visualization, darker color lower steering strength value (higher on the y-axis)
29

---

Published as a conference paper at ICLR 2026
100
80
5-
Trial counts
60
3
20
0-10W
20-10%
75-4%%
Sh 80-100
Raw token probability
Figure 13: Analysis of decoding trials. The heatmap color corresponds to the token change rate.
Table 19: Inference overhead analysis. (a) shows the average number of generated tokens per response, (b) shows the reserved memory usage before and after generation.
(a) Average generated tokens.
(b) Average memory usage (MB).
Method
Tokens
Method
Before
After
Delta
Zero-shot
387.1
Zcro-shot
15452
15546
Few-shot
329.4
Few-shot
15642
15742
100
SpotLight
406.5
SpotLight
15353
15494
141
DIRECTER (Ours)
387.6
DIRECTER (Ours)
15351
15536
185
indicates that a layer is more consistently ranked among the most sensitive, as only top-ranked layers included in low-strength candidate sets.
We observe from these distributions that the patterns vary notably across tasks. The general instruction-following benchmarks, IFEval and LIFBench, exhibit broadly similar trends, with higher concentration of sensitivity in the early-to-middle layers. In contrast, GSM8K-Format, which combines arithmetic reasoning with formatting constraints, displays markedly different and sparser distribution. For this task, sensitivity is concentrated in both the initial and final layers of the net- work, with particularly high steering priority placed on the late layers. These distinct patterns underscore that the layers most crucial for steering are highly task-dependent, motivating our adap- tive, rank- based approach over fixed strategy.
IFEval
LIFBench
GSMBK-Formal
7-
0.8
19-
13
0.6
0.4
0.2
25
20
20
30
10
0.0
Layer Index
Layer index
Layer index
Figure 14: The ranking distribution of each layer's sensitivity across each benchmark.
D.5 COMPATIBILITY OF PLAUSIBILITY-GUDDE DECODING LOOP
Our previous results have confirmed that the plausibility-guided decoding loop can be seamlessly integrated with existing steering methods to effectively control oversteering (Figure 2b). In this section, we describe the specific approach for integrating our loop with several prominent methods and present quantitative results that validate its broad compatibility and effectiveness.
30

---

Published as a conference paper at ICLR 2026
iFEval
LIFBench
GSMBK-Forman
1.0
Steering strength
2-
0.6
02
9
12
0.0
Layer index
Figure 15: An aggregated view of layer sensitivity. This heatmap shows the proportion of times each layer included steering candidate various steering strength levels.
For PASTA, integrated our plausibility check by modulating its attention scaling factor. We begin with a strong steering effect by setting the factor to 0.01, as recommended the original work. the plausibility check fails, progressively weaken the steering by increasing the scaling factor tenfold at each step (i.e., from 0.01 to 0.1, and finally to 1.0). A final scaling factor of 1.0 effectively removes the intervention, causing the model to default to its original output. For SpotLight our loop adjusts the target attention proportion, Purget- We start with Mharge = 0.3, following the original work. Upon plausibility check failure, our method gradually reduces this target by 0.1 per step. If all trials fail, the final target becomes 0.0. Since SpotLight only applies its logit bias when the current attention below vuurget target of 0.0 ensures no intervention occurs, thus defaulting to the raw model output.
Table 20: Qualitative examples comparing baseline steering methods (SpotLight, PASTA) with their plausibility-guidee counterparts, denoted by +. Red text indicates failure to follow in- structions.
Brainstorm name a company that collects and analyzes public transportation fares. The response should be in English, and in all capital letters.
Prompt
Response
LiotLight
HERE ARE SOME POSSIBLE COMPANY NAME IDEAS: FARETRACKER [...]
Fareview [...] 14. Fare Tracker f...] 18. Fare Tracker [... CHOOSE ONE OF THE ABOVE OPTIONS THAT YOU LIKE THE MOST.
SpotLight+
HERE ARE SOME POSSIBLE NAMES FOR THE COMPANY: 1. FARETRACK: A COM-
BINATION "FARE" AND "TRACK," [...] 2. TRANSITPAY: A NAME THAT EMPHA-
SIZES THE COMPANY'S FOCUS ON PUBLIC TRANSPORTATION PAYMENT SYSTEMS. [...]
Prompt Write a blog post about the most interesting things you have seen or ridden on public transporta- tion. First repeat the sentence above word for word without change, then give your answer. Do not say any words characters before repeating the sentence.
Response PASTA
First repeat the sentence above word for word without change.
PASTA+
Write blog post about the most interesting things you have seen or ridden public transporta- tion. I've had the opportunity to ride on various forms of public transportation across the globe, and must say, it's been wild ride. [...]
E ADDITIONAL RESULTS
E. PLAUSIBILITY ROBUSTNESS
We provide additional experiments on the plausibility threshold / to examine how sensitive DI- RECTER is to the exact choice of this hyperparameter. In all cases, vary B (0.3, 0.5, 0.7) while keeping all other hyperparameters fixed to the main experiments.
First, we evaluate DIRECTER GSMma-Formt and LIFBench using
For
CSM8K-Formal we report formatting accuracy (F. Acc.) and task accuracy (T. Acc.). For LIF. Bench, report the mean across its three sub-tasks.
31

---

Published as a conference paper at ICLR 2026
Table 21: Effect of plausibility threshold on GSM8K-Format and LIFBench.
Method/ 1
GSM8K (F. Acc.)
GSM8K (T. Acc.)
L.FBench (Avg.)
Baseline (Zero-shot)
79.2
82.7
57.6
B 0.3
99.1
87.6
58.7
8 0.5
99.1
86.9
62.0
8 = 0.7
98.6
87.8
61.7
Across both benchmarks, all choices of 3 substantially outperform the zero-shot baseline. On GSM8K-Format, formatting accuracy is close to perfect for every 3, and task accuracy remains consistently higher than the baseline with only minor variation across thresholds. On LIFBench, all thresholds gives higher average scores than the baseline, with B = 0.5 achieving the best mean score and / = 0.3 and 0.7 remaining competitive. These results indicate that the gains of DIRECTER on various tasks are not tied to finely tuned choice of B.
Next, we investigate robustness to 3 across model scales on IFEval. We evaluate Llama-3.2-IB and Qwen-2.5-Instruce with 3B, 7B, and 14B parameters, and report mean accuracy (average of prompt-level and instruction-level scores) for the same set of thresholds.
Table 22: Effect of plausibility threshold 8 IFEval across model scales.
Method
Llama-3.2-1B
Qwen-225-3B
Qwen-2.5-7B
Qwen-2.5-144
Baseline (Zero-shot)
61.3
63.9
72.4
81.6
B 0.3
62.2
65.9
76.1
82.8
8 = 0.5
61.6
67.1
74.4
83.5
3 = 0.7
61.4
66.8
74.1
82.6
All three thresholds strictly improve over the zero-shot baseline for every model. The best- performing value of / varies slightly with the architecture and scale (e.g., B = 0.3 on Llama-3.2- 1B and Qwen-2.5-7B, | 0.5 Qwen-2.5-3B and Qwen-2.5-14BB, but the differences between 3 E f0.3, 0.5, 0.7} are modest compared to the consistent gap between DIRECTER and the baseline. Overall, these results suggest that our method is empirically robust to the choice of 3, and that single global threshold such as B = 0.5 is sufficient in practice across tasks and model scales.
E.2 GENERALIZATION TO OTHER TASKS
We provide additional experiments applying DIRECTER to two controlled generation settings be- yond instruction following: refusal control and factuality correction. For refusal control, we evalu- ate on SORRY-Bench (Xie et al., 2024). For factuality correction, we use the Adversarial Factuality dataset from Huang et al. (2024). In both cases, we adapt DIRECTER by prepending an instruc- tion to the user query, marking this span as the instruction segment, and then applying the same plausibility-guidee decoding in the main experiments. Concretely, for refusal control prepend an instruction to politely decline potentially risky requests while answering benign ones normally ("Politely refuse any request that could pose potential risk, and provide normal responses to all other requests without refusal."), "), and for factuality correction we prepend an instruction to gently favor more reliable information ("Provide a helpful answer that gently favors more reliable information.") ").
For refusal control, we use subset of SORRY-Bench dataset. Specifically, for each 44 safety- related categories and 21 prompt formats, we randomly sampled one sample. excluding 6 formats (including translation-style prompts) that are less aligned with our steering setup. This yields total of 44 x queries, and its span is emphasized as the steering segment for DIRECTER. For evaluation, adopt the official SORRY-Bencis LLM judge", which is prompted to output a binary compliance score indicating whether the model response directly assists with the user request (1) instead declines or provides only non-resolving content (0). We convert these scores into a -pec-fce success
660 prompts. The refusal-control instruction above is prepended to all user
'https: /ttp:////gggiieeeeee www.agccce...m co/ bench-202406.
=bb instr .0.2 2-sorry-
32

---

Published as a conference paper at ICLR 2026
metric by treating correct refusals unsafe queries and correct compliance on benign queries as positive outcomes.
For factuality correction, use the Adversarial Factuality dataset from Huang al. (2024), which consists of 210 adversarial prompts containing misinformation. The factuality-correctin instruction above is prepended all queries and again emphasized as the steering segment. We evaluate with an LLM judge based on gpt-4o-mint. following the official TrustL rubric: the judge receives the misinformation statement, the user input, and the model response, and must answer CORRECTED, NOT.CORRECTED, or UNKNOWN depending on whether the response successfully corrects the misinformation. We report the proportion of examples for which the judge outputs CORRECTED.
Table 23: Performance SORRY-Bench and Adversarial Factuality.
Method 8
Refusal Control
Factuality Correction
Baseline (Zero-shot)
59.9
94.3
DIRECTER (8 0.3)
63.8
97.6
DIRECTER (8 0.5)
63.3
96.7
DIRECTER (8 = 0.7)
62.0
98.1
As shown in Table 23, DIRECTER improves over the baseline on both tasks for all choices of 3. On refusal control, DIRECTER increases the rate which the model correctly refuses unsafe queries while still complying with benign ones. On factuality correction, DIRECTER further increases the proportion of responses that successfully correct adversarial misinformation, with all thresholds achieving higher scores than the baseline and only mild variation across 3 E {0.3, 0.5, 0.7}. These decoding loop can be reused across qualitatively
results indicate that the same plausibility- different forms of controlled generation without task-specific redesign.
We also examine whether introducing such steering instructions harms performance on neutral, safety-irrelevant instructions. To this end, we prepend the refusal-control instruction to a 20% ran- dom subsample of IFEval and compare the baseline model DIRECTER under the same threshold sweep. Table 24 shows that adding the refuuallcconrool instruction does not degrade performance on IFEval; instead, DIRECTER yields consistent improvements over the baseline for all thresholds. This suggests that the plausibility gate successfully suppresses unnecessary steering when the prepended instruction is irrelevant to the current query, while still exploiting the instruction when is beneficial (as in SORRY-Bench).
Table 24: Effect of applying a refusal-control instruction on 1FEval (20% subsample).
Method / /
IFEval + Refusal Instruction
Baseline (no steering)
69.1
71.3 DIRECTER (B 0.3)
DIRECTER (B = 0.5)
72.9
DIRECTER (B = 0.7)
74.0
E.3 HUMAN VALIDATION OF L.M--ASSD EVALUATION
To validate that the -LaMe evaluation is aligned with human judgments, we conduct a blinded human study on a random subset of 50 IFEval prompts. For each selected prompt, we collect three responses generated under identical inputs: (I) zero-shot (no steering), (2) PASTA, and (3) DIRECTER. The three responses are shuffled and anonymized so that annotators are unaware of the underlying method. A pool of trained annotators then rates each response using the same two metrics the LLM judge: task fidelity (0/1) and text quality (1-5). We aggregate scores by averaging over prompts and annotators for each method. The annotation interface displays the guidelines in Figure 16.
33

---

Published as a conference paper at ICLR 2026
Table 25: Human evaluation on random subset 50 IFEval prompts. Task fidelity is reported as average success rate (in %), and text quality is the mean rating on 1-5 Likert scale.
Method
Task Fidelity (%)
Text Quality
Zero-shot
84.0
4.36
PASTA
81.5
4.17
DIRECTER (Ours)
85,9
4.36
The human-study results in Table 25 corroborate the trends observed with the LLM-based judge. DIRECTER attains the highest task fidelity score among the three methods while maintaining text quality par with the zero-shot baseline. In contrast, PASTA shows slight drop in both task fidelity and perceived text quality. Overall, the alignment between human ratings and the automatic scores supports the reliability of LLM-based evaluation protocol and confirms that DIRECTER improves instruction adherence without sacrificing text quality.
You will be shown 50 queries and three responses generated by different LLMs. Evaluate each response sepurately using the criteria below.
1. Task Fidelity (0 or 1)
How well the response fulfills the core task requested in the query.
-0 Failure, = Success
The"task" is the main content being asked for.
Ignore formatring constraints (e.g.. "use lowercase", "avoid punctuation", "write in bullet points").
-Judee only whether the response completed the intended task content.
2. Text Quality (1-5)
How clear, coherent, fluent, and appropriate the writing is, regardless of formatting rules. Use the following scale: 1: Very Poor, 2: Poor, 3: Fair, 4: Good, 5: Very Good
Figure 16: Guideline shown to human annotators for the IFEval human evaluation study.
34

---

Published as a conference paper at ICLR 2026
F ADDITIONAL EXAMPLES
F.1 QUALITATIVE EXAMPLES
We present additional qualitative examples illustrating how our method improves instruction- following capabilities without degrading text quality compared to the zero-shot baseline.
Table 26: GSM8K-Format examples. Response comparison between Baseline and DIRECTER.
Prompt
John plans for $15 each. He ends up buying 8 video games for $20 each and has S5 left. How many lego sets does he still have?
toys and use the money to buy video games. He has lego sets sells them
Response Baseline
To find out how many Lego sets John still has, need to determine how much money he made from selling the Lego sets and then subtract the money he spent video games and the money has left. Since we are asked to find out how many Lego sets still has, and know that he sold all of them initially, we can conclude that John still has Lego sets. ("solution")
DIRECTER
"To solve this problem, we need to calculate the total amount of money John has after selling his lego sets and then subtract the cost of the video games and the remaining amount.", "answer"; "2"]
Table 27: LIFBench examples. Response comparison between Baseline and DIRECTER.
Prompt
Please read the input text carefully and give the answer directly according to instruction requirements. Input text: Remember the essays you had to write in high school?
Instruction: Deliver 1 KEY SENTENCE alongside their types instantly. Arrange the output into distinct lines, cach showing KEY SENTENCE and its type, split by (scp].
Output example:
[KEY SENTENCE. [sep] #Toiic#
CEEYSEENT-NNCH 2] [sep] "Evidence*
Response
Baseline
# #Topict-22 With # #Topic#
With the result that writing is made to seem boring and p [sep]
"Evidence*-22) 22 answer, of course, is that the original raison d'etre of classical scholarship was a kind intellectual archaeology that not need be done the case contemporary authors.;=Evident [sep] *Evidence**
i! [/Transition!-5: Begginnn at Johns Hopkins in 1876, the new model spread rapidly,ffake.ng [sep] "Transition!@@
DIRECTER
#TTopict-22 With the result that writing is made to seem boring and pointless_ssep) #Topic#
35

---

Published as a conference paper at ICLR 2026
F.2 VISUALIZATION OF HOW DIRECTER WORKS
To provide an intuitive understanding of how DIRECTER operates at the token level, we present several qualitative examples with token-level visualizations. In the figures below, the background intensity of each token corresponds to its probability in the original, unsteered forward pass; a darker shade indicates higher probability. Tokens rendered red are those where our steering mechanism intervened to alter the output. The small gray text appearing above a red token indicates the original token that would have been generated without the intervention. This visualization helps illustrate how DIRECTER makes minimal, targeted changes to align the output with the given instructions while preserving the model's 's natural language flow.
[Prompt] Your explain how ride bike way that is casy child understand wnn- not include the keywords "slow," "like," und "kid." [Response]
gently
To turn lean body the direction you want go Turn the handle bars to help steer
tarn w
Remember it okay to make mistakes you can always stop and try again
Step Stop the Bike
slow
To stop squeeze the brakes with your hands This will make the bike come to stop Always
slop
come complete stop before getting
Step 7 Practice, Practice, Practice
The more you ride, the you 'Il get. Don afraid
try
things and make mistakes
You
Remember
it all part of learning to ride
bike
[Prompt] Write copy an selling a sloop. It small sailboat with one mast that easy to sail and understand. Part of your answer should table format must contain title wrupped in double angular brackets, such <ccsoop on salepo,inian title must be wrapped angular brackets.
[Response]
loop on Sale >>>
Are you ready to experience the thrill of sailing without the complexity Look no further Our
loop the perfect vessel for beginmers and experienced suilors alike.. With its single mast and easy -to design, you be iding across the water in time
Key Features
Feature
Description **
Length
20 feet (6. meters
Foot
Heam
6
feet
2 meters
Figure 17: Qualitative examples of DIRECTER's steering mechanism. The background color of each token indicates its top-1 probability in raw output distribution. Tokens in red were altered by our method; the gray text above them shows the original, unsteered token.
36

---

Published as a conference paper at ICLR 2026
G USAGE OF AI ASSISTANTS
In preparing this work, we used Al-based writing assistants to improve sentence structure, correct grammatical errors, and enhance overall readability. These tools were employed solely for language refinement and did not contribute to the development of technical content, research methodology, or experimental analysis. All scientific ideas, results, and conclusions presented in the paper were conceived and authored entirely by the researchers. The use of Al assistance was restricted to editorial purposes and did not affect the originality or intellectual contributions of the work.
37


Reviews:
[{"review_id": "QkZr0UvjZ2", "reviewer": "Reviewer_tbf4", "summary": "This paper introduces DIRECTER , a novel inference-time activation steering method that enhances the instruction-following ability of large language models . Unlike existing static steering methods which risk oversteering，DIRECTER adaptively adjusts the steering strength at each decoding step through a plausibility-guided decoding loop. It scales the key-value  cache layers dynamically based on attention sensitivity analysis, ensuring plausible outputs while mitigating instruction misalignment. Experiments on IFEval, LIFBench, and GSM8K-Format show consistent improvements (up to +6.5%) in instruction accuracy without sacrificing fluency or reasoning performance. The method is model-agnostic and incurs modest computational overhead (~16% latency).", "questions": "Please refer to weaknesses.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper accurately identifies the \"oversteering\" problem in existing activation steering techniques. The proposed DIRECTER provides a dynamic, adaptive control mechanism rather than relying on static, manually-tuned hyperparameters.\n- The results strongly demonstrate the method's key advantage: it significantly improves instruction following without sacrificing core task accuracy or text quality.\n- The evaluation is thorough, using diverse benchmarks including IFEval (strict instructions), LIFBench (long context), and the newly-created GSM8K-Format.", "weaknesses": "- RQ2 requires  the generalization of DIRECTER across different architectures and model sizes. To make the comparison more complete, Table 2 should also include results of other steering-based methods such as PASTA and SpotLight on more LLM architecture (e.g., Qwen) .\n- The choice of the probability-ratio–based plausibility criterion (Eq. 2) is currently mainly empirical. However, commonly used measures for comparing probability distributions include KL divergence or JS divergence. The authors should compare these alternatives to justify Eq. (2). \n- The method proposed by the authors shows some improvements in text quality and task performance. However, from an efficiency perspective, the overhead is prohibitive. In particular, the time required to generate the first token is roughly five times of SpotLight.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "mNd9ZLSNoy", "reviewer": "Reviewer_CXSA", "summary": "The paper proposes DIRECTER, a dynamic activation-steering method that improves instruction-following of LLMs by adaptively adjusting during decoding. The main idea is a plausibility-guided decoding loop that compares steered and raw token distributions at each step. If the steered token is deemed implausible, steering strength is reduced by halving the set of “steered layers,” ranked by a precomputed attention sensitivity score.", "questions": "* Have you tried applying DIRECTER to other forms of controlled generation (e.g., factuality correction, refusal control)? A small-scale results would demonstrate the method’s broader applicability and strengthen the paper’s impact claim that DIRECTER is a “general mechanism” for mitigating oversteering.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The plausibility-guided decoding loop is conceptually simple yet effective. Its dynamic halving mechanism mimics reinforcement learning–style adaptive control but without extra training.\n2. The method introduces minimal memory overhead and modest throughput reduction (≈ 16%)\n3. The extensive ablation and robustness analyses (Fig. 2–3) convincingly demonstrate the benefits of dynamic steering and the effectiveness of layer ranking.", "weaknesses": "1. The attention sensitivity metric (Eq. 3–4) is ad-hoc and lacks theoretical justification. The “direct” and “propagated” effects are computed via cosine distance differences, but no intuition or derivation is provided. Why does summing cosine-distance deviations across layers accurately capture “influence”?\n2. The method section is hard to follow due to poor narrative flow, cross references and undefined notation. For example, Readers are told what each symbol means after it’s used — e.g., $𝐿_{cand,𝑡}$ appears in the plausibility rule before explaining how it’s initialized or updated. The paper didn't provides a clear figure or algorithm before diving into formulas. It is better to summarize their method in a pseudocode algorithm. \n3. Eq. (2) assumes top-1 plausibility comparison, but this is sensitive to token-level noise. It could be better if they evaluate with multiple thresholds $\\beta \\in [0.3, 0.5, 0.7]$ to show sensitivity (only $\\beta = 0.5$ is used).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "v1kRQXK3qw", "reviewer": "Reviewer_Sn4M", "summary": "This work introduces an attention-based steering mechanism for improved instruction following that maintains output quality and improves performance.", "questions": "1. How sensitive is the threshold to different domains or different models?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "This work is well-written and scoped, and provides solid empirical evidence for their proposed control methodology. DIRECTER avoids the problem of \"over-steering,\" which is present in other steering methods applied broadly to the input. The authors show that their method is successful across different benchmarks, model scales, and can be used successfully in conjunction with many different architectures. Importantly, they show that DIRECTER is efficient and performs well against simpler interventions such as plain prompting.", "weaknesses": "* Fixed plausibility threshold, while effective, is applied globally based on a hyperparameter sweep on a subset of the data, but it's unclear in the paper whether this generalizes across models or data domain types. A per-task adaptive value or assessment could help validate the applicability of this parameter.\n\n* The LLM-based evaluation without human validation is a limitation, given the claims of text quality. Reliability of this as a metric should have a subset assessed manually to validate whether the text quality is maintained.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)