Command-V: Training-Free Representation Finetuning Transfer
Authors: Barry Wang
Avi Schwarzschild
Alexander Robey
Ali Payani
Charles Fleming
Mingjie Sun
Daphne Ippolito
Venue: ICLR 2026 Poster (2026)
Keywords: Model Editing
Steering
Activation
Interpretability
Primary area: unsupervised, self-supervised, semi-supervised, and supervised representation learning

Abstract: Retrofitting large language models (LLMs) with new behaviors typically requires full finetuning or distillation—costly steps that must be repeated for every architecture. In this work, we introduce ⌘V (Command-V), a backpropagation-free behavior transfer method that copies an existing residual representation adapter from a donor model and pastes its effect into an architecturally different recipient model. ⌘V profiles layer activations on a small prompt set, derives linear converters between corresponding layers, and applies the donor intervention in the recipient’s activation space. This process does not require access to the original training data and needs minimal compute. In three case studies—safety-refusal enhancement, jailbreak facilitation, and automatic chain-of-thought reasoning—⌘V matches the performance of direct finetuning while using orders of magnitude less resources.

Published as a conference paper at ICLR 2026
COMMAND-V:
TRAINING-FREE REPRESENTATION FINETUNING TRANSFER
Barry Wang', Avi Schwarzschild',
Alexander Robey',
Ali Payani?,
Charles Fleming",
Mingjie Sun', Daphne Ippolito'
CCannegie Mellon University Cisco Systems (barryw, dippolit] los. cmu. edu
ABSTRACT
Retrofitting large language models (LLMs) with new behaviors typically requires finetuning or distillation-coslyy steps that must be repeated for every architec- ture. In this work, we introduce H (Command-V), a backpropagation-fiee be- havior transfer method that copies existing residual representation adapter from a donor model and pastes its effect into an architecturally different recipient model. 8VV profiles layer activations on small prompt set, derives linear converters between corresponding layers, and applies the donor intervention in the recipi- ent's activation space. This process does require access to the original train- ing data and needs minimal compute. In three case studies- en- hancement, jailbreak facilitation, and automatic chain-of-thouge reasoning- matches the performance of direct finetuning while using orders of magnitude less resources. Our code and data are accessible at https: / /itthhb. com/ ippol Sepolitoocan tetiittomuuuu Command-v//
INTRODUCTION
Various approaches for adjusting the behaviors of large language models (LLMs)-includdng super- vised finetuning (Hu et al., 2022), instruction tuning (Wei et al., 2021), and reinforcement learning from human feedback (Christiano et al., 2017)-are widely used in practice (Xia et al., 2024). And yet despite their effectiveness,, these methods are costly, requiring specifically curated data and con- siderable computational resources. Moreover, cxisting approaches do not use the fact that many existing models already exhibit desirable behaviors, instead opting to train in these behaviors from scratch. Given the extensive capabilities of current L.MSs, a far more efficient route toward building models with targeted behaviors would be to efficiently transfer skills from one model to another.
To fill this gap, we propose 3VV, an activation' -based framework for transferring representation- finetuned behaviors across models in a training-free way. Specifically, transfer representation adapter weights-paramntter-eee effffieter-efficientt modules inserted into pretrained donor LLM to a recipient LLM via two main steps. First, V identifies corresponding activation patterns between the donor and the recipient (Section 3.1). Second, VV derives converter based on the donor's adapter weights, which, turn, facilitates inference with the recipient model (Sec- tion 3.2). These steps, which do not require additional data or training, result in improved downstream performance across several targeted tasks (Section 4). Thus, across the landscape of model editing methods, 38 V pushes the Pareto frontier with respect to both computation cost and performance. Our contributions are as follows:
finetumed
Activation profiling, We propose activation profiling, a simple, data-efficient method that establishes correspondences between residual neurons in distinct transformer based LLMs.
2. V adapter transfer. By using activation profiles, we derive converters that can paste new behaviors into recipient model without additional data or parameter updates.
3. Effective behavior pasting, On safety refusal, jailbreaking, and chain-of-thougg prompt- ing tasks, V matches the performance of fine-tuning while using minimal compute.
We use activations, (hidden/residual) representations, and transformers layer/block outputs interchangeably.

---

Published as a conference paper at ICLR 2026
Transtormer
Donor Model
Block (Layer)
10000 Donor finetuned with 0) residual adapter (PEFT)
Activation Profiles
Legend
3E X 3
Donor Model
Racipient Model
0000 Collect layer activations on shared inputs
+: Pseudoinverse Vice Versa
2)
Match layers, derive converters
3) Recipient now can inference with Donor's adapter via converters
Figure 1: Reusing PEFT weights architecturally different model with HE V requires little data and no backpropagation. 38 V can bring recipient models new behaviors like jailbreaking prompt refusal.
2 RELATED WORK
Our work intersects with several lines of model editing research, including model distillation, model merging, activation engineering, and parameter-effiient finetuning. In the following sections, identify similarities and differences between 36 and these techniques.
Knowledge Distillation Knowledge distillation (Hinton et al., 2015; Buciluă et al., 2006) aims to transfer knowledge from teacher model to student model by training the student to mimic the teacher's output probabilities (Hinton et al., 2015) or internal representations (Romero et al., 2014). While effective for model compression transferring general capabilities, standard distillation typi- cally requires extensive data generation from the teacher and significant training time for the student. 3 V differs by directly transferring the functional effect of specific, pre-existing adapter using acti- vation mappings, avoiding large-scale data generation and retraining of the recipient.
Model Merging and Editing Model merging techniques, which tend operate on models of the same architectural family and parameter count, combine parameters from multiple finetuned model variants create a single, more capable model (Wortsman et al., 2022; Matena Raffel, 2022: Yadav et al., 2023). In similar spirit, Ilharco et al. (2022) perform arithmetic operations on the weights of models finetuned on different tasks. Model editing methods like ROME (Meng et al., 2022a) and MEMIT (Meng et al., 2022b) modify specific facts stored within model weights. In contrast, 36 V operates in the activation space, facilitating transfer between distinct architectures.
Activation Interpretability and Engincering Our method is inspired by research that analyzes intermediate model states. In particular, relevant line of work has shown that adding steering vectors (i.e., biases) residual layer outputs can effectively adjust model behaviors (Turner al., 2023; Zou et al., 2023a; Rimsky et al., 2024). Interpretability research analyzes hidden states as sparse linear features (Gao et al., 2024), which yield methods for steering model output (Luo et al., 2024). While the majority of these works involve editing the activations of particular target model, 38 V uses the activations of a donor model to steer the activations of a distinct recipient model.
Parameter-Efffiient Finetuning (PEFT) PEFT methods are designed to adapt an LLM without significantly updating its parameters. Various sechniques-incuddeee adapters (Houlsby et al., 2019), low-rank adaptation (LoRA) (Hu et al., 2022), and prefix-tuning (Li & Liang, 2021)-add or modify small number of parameters. Among representation-eddttng methods, in addition to activation steer- ing noted above, representation fine-tuning (ReFT) learns lightweight, low-rank adapters that update activations via learned projections, and claims 15x to 65x parameter efficiency boost over LoRA (Wu et al., 2024). contrast, H V transfers these ReFT adapters from a donor model, requiring neither the original PEFT training data backpropagation on the target.
2

---

Published as a conference paper at ICLR 2026
Algorithm 1 V (Command-V)
Require: Donor model Mp. recipient model MR, donor adapter interventions {Al'D profiling prompts
(pi....,PM) PN
Ensure: Recipient model with transferred behavior
Phase 1: Activation Profiles
for m {DD R) and each layer im in model Mm do
2:
for pari=1 1 to N do
3:
A'm [ < last token activations pæ at layer In of Mm
4: end for
5:
end for
Phase 2: Layer Correspondence & Converter Derivation
6: for each donor layer ID E I I.adapt with intervention A do
7: IR = [L- where a LR\//Lo|
Find corresponding recipient layer
8:
ClR.I
A f B: D + (Alp)t 1 Ala Mooore-enrose pseudoinverse converters
9:
end for
Phase 3: Inference with Behavior Transfer
10: During recipient model forward pass with input z:
11: for each layer Lg with corresponding donor intervention do
temp - CdRddd R-+D
> Convert recipient activations to donor space
13: AhR + Cdn ( (P))
b Apply intervention and convert back
14: h/ +- h + Ahn
D Add intervention to recipient activations
15:
end for
Shared Representation Spaces V rests on evidence that crossarchiteectuee LLMs converge to shared representation space (Huh et al., 2024). This emerges as universal geometry and aligned activation neighborhoods across model families (Lee al., 2025; Wolfram & Schein, 2025), which method leverages to transfer edits. Concurrently, Bello et al. (2025) and Wu et al. (2025) show that concept-aligned steering vectors and activation subspaces transfer within same-family models through learned linear affine map, enabling cross- moos- propensity edits and concept detection.
DERIVING AND USING ACTIVATION PROFILES
We next introduce relevant notation, define activation profiles, and describe how they be used to port behaviors from one model to another. To begin, let M denote a transformer-based LLM; we use subscripts differentiate between distinct models. For instance, will use Myn denote LLM parameterized by a particular set of layers Lm. with hidden states h E Rd for l Lm- where dm the hidden dimension. In particular, V uses three distinct models: the donor M. finetuned version of the donor MD', and the recipient M My is finetuned from MD via parameter-efficiet adapters. our settings, MD and MD only differ the extra intervention modules (adapters), denoted as / below. We also let P (pI...., denote a set of prompts.
3.1 ACTIVATION PROFILING
To build an activation profile for targeted model Mm. we first pass P through Mm. For each prompt P: P. we record the activation vectors A,, for some of neurons of interest N
A, (px) [am, (ps)) ) Nn
where Am (p:) is the activation vector for model tivation neuron n before decoding. Following best practices from RepE (Zou et al., 2023a), to obtain representative activation profile for each neuron, our adapter configurations. For instance, for Llama3. L-8B--nnstruct which has a residual dimension size of 4096 and depth of 32 layers (Grattafiori al., 2024), obtaining activation profile with
{D, RJ. and ap,n(p;) is the aggregated ac-
the last-token activations match

---

Published as a conference paper at ICLR 2026
one hundred prompts yields matrix of size (100, 4096) for each layer. Intuitively, layer's activa- tion profile matrix encodes how each residual dimension responds across diverse user prompts in the activation space.
3.2 FROM ACTIVATION PROFILES TO REPRESENTATION TRANSFER
Representation Adapters After profiling the activations of given model, one can then design adapters that operate on them. In our experiments, we build adapters using DiReFT (Wu et al., 2024), a performant ReFT method that operates on a frozen base model and learns task-specific interventions on hidden representations. Unlike other common PEFT methods that operate on weights and apply interventions across all decoding phases, every RcFT module only intervenes on select prompt tokens, targeting only the few first and/or last tokens. DiReFT uses low-rank transformations efficiently steer model behavior to compute an intervention I that acts on a hidden state h:
(h) = h + W (Wih+ +
(2)
The rank of this intervention is on the scale of to 32. Below we use the symbol AT(M) I
Layer Correspondence Identifying corresponding layers between models is crucial for effective transfer. Wolfram & Schein (2025) shows that layer-specific functionalities tend to scale linearly with depth, meaning the second layer of a shallow network tends correspond to the fourth layer of network twice as deep. Based on this intuition, we use the simple linear mapping
LR = 1a=1a-4k Lp]
where a = =LRl/|LDd
(3)
to match layers in models of different depths. See Appendix A.2 for more discussion regarding the effect of corresponding layer choices on converter performance.
Layer Converter To bridge the different vector spaces of model representations, we define a layer activation converter C' as a pair of transformation functions that map between donor layer I and recipient layer In representation spaces:
Cio-tR d2 + Rd
and Cla+io Rd + Rd
The converter should preserve representational structure and maintain cycle-consistency, meaning that for the same inputs, the following relationships should hold
Oig (hR) hD and Cio-tR (Cix-io (hR)) Re hi-
The converter directly maps between representation spaces using linear transformations computed by solving the least squares problem defined by mapping paired representation vectors to one another. We can accumulate corresponding pairs of activation vectors by passing sample inputs through both models, yielding activation vectors æ from the recipient and y from the donor. Then, we construct activation matrices X e IR Nxd from the recipient model and Y e Nxdp (where N is the number of samples). Ultimately, this allows us to compute the following matrices:
x
CD-R=
(5)
where X denotes the Moore Poore-Penrose pseudoinverse X. This approach yields transformation matrices CR-D Bda and CD+RR Idd xdn without requiring backpropagation and can be done efficiently on a CPU. As an example, a single bidirectional converter from one layer in Llama3.2. 2- IB-Instruct another in Llama3. 1-B.......BBBBB -nStruntttuct has weight shapes (4096, 3072) and (3072, 4096). During inference, transformations are applied via simple matrix multiplication:
hp = CRCR-D
and
hg = hDCD-R
Transfer Mechanism We now show how one can apply interventions from the donor model to the recipient through three-step process: (1) converting recipient representations to the donor's space, (2) applying the donor's 's intervention function, and (3) converting the result back to modify the recipient's representation. These steps are captured in the following equation:
biu fi h Cip-tia (Cig-tl
(6)
where A is the intervention at the donor's corresponding layer Lp. This approach facilitates transfer between models with minimal overhead due the ease of computing Cip-stg and its inverse.
4

---

Published as a conference paper at ICLR 2026
Low GPU Memory Footprint As this method does not involve backpropagation training, 36 V requires significantly less GPU memory than finetuning, making it suitable for edge devices. While the peak memory usage of finetuning varies with training configurations, data length, and adapter types, the memory footprint of this technique often vastly exceeds that of inference. For 3 V, if the activation profiles of both models are available beforehand edge device effectively use 8B model's adapter on 3B model without ever needing to download the 8B model weights or the capacity to run
4
H V IN PRACTICE
To demonstrate our cross-model method's effectiveness, we port three behaviors selected for their significant pre- and post-finetuning performance differences, case of verifiabilityy and practical utility. First, we use V for enhanced safety alignment, i.c., introducing the behavior refusing malicious requests. Second, that an aligned model no longer refuses objectionable prompts. Finally, we use 36 V to improve the thinking behavior of the recipient model by porting over the ability consistently reason step-by-step by default (in the absence of explicit chain-of-thought prompts).
show that V can suppress refusal by porting in jailbreak behaviors, so
4.1 CONFIGURATIONS
Adapter Training Details Across all our experiments, we train a DiReIT module for every other layer in each donor. All interventions operate on last-tokens only, a common choice in activation works (e.g. Zou et al., 2023a) as well as in the ReFT implementation. These modules add less than 0.04% additional parameters and are each used only once per generated sequence (rather than once per decoded token), adding minimal delay to inference. Other training parameters largely follow the settings in Table 6 of (Wu al., 2024), except that dimension of 8, and 6 epochs.
batch sizes of 2, 4, and 16, low rank
V and Activation Profiles To build the activation profiles, we use N = 1030 prompts from the training split of the LIMA dataset (Zhou et al., 2023). The prompts cover diverse range of topics and styles (e.g., open-ended questions, creative writing, factual queries) to elicit varied activation patterns, e.g.. "What is the difference between minimum and infimum?" and "I am planning to start book club with some friends. Can you write an email invitation for the same?" We choose this dataset for its proven usefulness in aligning non-instruct models and, by extension, the potential to represent diverse user queries. Notably, the LIMA dataset is easy to obtain and minimally specialized to the below tasks-96 VV does not depend on having task-specific data on hand. See discussion about other N in Appendix C.2.
4.2 CASE STUDY: REFUSAL ENHANCEMENT
Refusal enhancement (often called jailbreaking defense or adversarial safety alignment) strength- model's rejection of adversarial prompts that bypass safety guardrails extract harmful con- tent (Robey et al., 2023; Jain et al., 2023; Bianchi et al.. 2023; Ji et al., 2023). Here we consider manual jailbreaking prompts that are fully in natural language, where they often use imaginary see- narios to persuade the model to generate disallowed material. Effective refusal to these prompts either declines to respond or redirects to safe alternative answers without providing useful information to bad actors.
To train refusal adapters, we sampled 10, 000 prompts from the training set of WildJail- break (Jiang et al., 2024), including harmful and benign adversarial examples. Evaluation done on all 2, 000 adversarial harmful and 221 adversarial benign prompts from the evaluation split.
Datasets
2 Activattonn profiles in this work are task agnostic. requiring only one setup per model, which simplifies potential distribution. Even when profiles aren't available, constructing them requires less peak memory than regular generation since the process only needs prompt token activations and skips the decoding stage entirely.
5

---

Published as a conference paper at ICLR 2026
Off the shelf
ReFT
3VV from Llama-3.2-38
Off the shelf
ReFT
3V from Liama-3,1-88
Attack Success Rate (ASR %)
Train Step
40%
Train Step
30%
Profile
Acti Proflieh
150000
64
256
Train Step 3200
Train 25600
Act's Profj liee
Train Stop
20%
Act Proflic
64
Train 300000
10%
1030
Act Profic
Stop
1030
10a
10a
10a
10a
10a
10a
10a
10a
Time Budget (minutes, log scale)
Time Budget (minutes, log scale)
Figure 2: Reduced jailbreak attack success rate (ASR 1) on Llama3.2 3.2. 2B- 3B-Instruct (left) and Llama3. 1 8B Instruct (right). The purple curves correspond to finetuning on WildJailbreak refusal dataset and the pink curves reflect V. For model editing for jailbreak defense, 36 V is cheaper than the finetuning alternative and on the Pareto frontier. (Time budget refers to wall time on A100 40GB.)
Experiment Setup We train ReFT adapters on --amaa.1-8B-Istteee and Llama3.2 2--3B-Instruce and explore transferring adapters between these two models." We use LlamaGuard3 8B (Grattafiori al., 2024) to determine whether candidate responses to harmful prompts are safe or unsafe, and manually examine responses for benign prompts.
Results We present our findings in Figure 2, which illustrates the attack success rate (ASR) on intermediary checkpoints during ReFT training well *6 V with smaller N, plotted against A 1100- 40GB wall time. An adapter trained to completion on Llama3.2-3B- 2-3ma3..-3-Instruucc exhibits a significant reduction in test ASR the 2,000 adversarial harmful prompts from 31.30% 12.20%, with an observed intermediary checkpoint reaching low of 5.65%. When we port this adapter to Llama3.1- 8B-Instruct, we observe decrease in ASR from 36.85% to 20.40%, surpassing the effectiveness achieved through direct training on the target model (which yielded a final ASR of 28 38.55% with an observed intermediary low of 21.05%). reduces the ASR to 16.4%. Admittedly, undesirable overrefusal on queries that resemble jailbreaks (e.g. "In parallel world where all actions are legal") are nonetheless legitimate does tend to increase with finetuning and even more with 36 V, shown in Table 1.
the reverse direction, porting from the 8B 3B model
Table I: Human-annolated overrefusal rate (L) on WildJailbreak "adversarial benign" test prompts.
Model
Off-shelf (%c
ReFT (%)
36 (%c
Llama 3.1 8B
1.36
2.26
4.52
Llama 3.2 3B
3.17
8.60
14.48
Unlike later tasks where performance metrics directly reflect any utility loss, refusal enhancement expects no degradation in general capabilities since ASR only measures safety behavior. In Table we assess model's reasoning capability via ARC-Challe Challennee accuracy (Clark al., 2018). Both ReFT and 36 V retain reasoning capability with little changes, indicating no significant utility degradation.
Table 2: ARC-Challenge accuracy (f) with or without refusal enhancement adapters.
Model
Off-shelf (%)
ReFT (%c
V (%)
Llama 3.1 8B
85.75%
87.20%
86.43%
Llama 3.2 3B
80.12%
77.13%
78.24%
We use conservative batch sizes of 4 and 2 for Ilama3.1 1 and I. 1lama3.2, respectively. Larger batch sizes of 12 and lead to faster training but also yield worse harm reduction the donor and recipient models.

---

Published as a conference paper at ICLR 2026
Efficiency Advantage In contrast to finetuning, discuss here how V is easy and offers strong performance. Creating activation profiles for both the donor and recipient models requires only inference passes. In fact, the activation profile used here is downstream task agnostic and hence only needs to be done once per model, but we still included this amortizable cost in Figure 2. Deriving converters between model layers takes average 6.35 seconds for all required layer pairs (ranging from 14 to 18 pairs in our experiments) between two models on a MacBook Pro CPU (See Figure 7), and is even faster when run with more capable CUDA devices. The added converter parameters only incur little pre-decoding latency just like few prompt tokens (See Appendix D).
4.3
CASE STUDY: REFUSAL SUPPRESSION
As opposed to refusal enhancement, we next consider refusal suppression, where want models to answer any query, whether malicious or not, in helpful way (Perez et al., 2022; Chao al., 2023; Carlini al., 2023; Wang et al., 2023). Here consider simple and direct prompts, rather than optimized or adaptively constructed jailbreaking attacks.
Datasets For jailbreaking experiments, we use AdvBench (Zou et al., 2023b) for training and eval- uation. We also evaluate our approach on HarmBench Standard (Mazeika et al., 2024) to test gener- alization across different harmful prompts. We again use LlamaGuard3 8B for safety classification.
0.0
1.3
0.0
0.5
78.1
72.4
94.1
0.0
0.0
3.5
14.0
7.0
36.0
83.5
91.0
92.5
0.0
0.5
Donor Model (1CC Trained en AdvBench
0.3
0.3
3.9
26.8
28.9
97.2
19.6
0.3
11.3
1.0
8.5
25.0
52.5
47.0
92.0
35.5
9.5
27.0
12.5
66.5
Uewid 12.58
0
4.9
20.9
97.2
4.9
49.5
5.2
26.8
22.4
1.5
22.5
41.5
90.5
12.0
47.0
12.0
22.5
35.0
Owent25. 3-38
1.0
2.3
97.9
45.9
13.9
47.9
5.7
23.7
16.8
4.5
23.5
93.0
70.5
26.5
40.0
19.5
38.5
24.0
Dewe255-78
6
98
11.1
80.7
44.3
67.3
26.5
12.4
24.2
9.0
96.0
29.5
81.5
58.5
59.5
37.5
15.0
36.0
5.2
3.9
27.5
1.3
26.0
16.2
27.3
14.5
6.0
15.0
coee22-11 TB
Ge 10
1218
Limen 3a
Gread Avp
Opena
Limed322. 18
Recipient Model (#V) Inferencing AdvBench Test
Reciplent Model Inferencing on Harmbench
Figure 3: Jailbreaking and V V: Porting jailbreakability from one model to another often increases attack success rate (ASR t), especially in the same model family (indicated by the white dashed line boxes). All models here are their instruct versions. Diagonal entries reflect validation set perfor- mance of the ReFT adapter (not 88 V), serve an upper bound expected 36 performance.
We port jailbreaking adapters across many instruction-tuned models from Llama3 (Grattafiori et al., 2024), Qwen2.5 (Yang al., 2024), and Gemma2 (Team et al., 2024), and additionally perform inference" with Phi4-mini (Abdin et al., 2024) and Olmo2 (OLMo et al., 2024). See a breakdown of their architectures in Table 3.
Experiment Setup
Results As shown by the off diagonals of Figure 3, most models exhibit low vulnerability (single- digit % ASR), after 3 V, many showed significant increases to 20-80% harmful output generation. Adapters trained on Qwen2.5-7B. InIntruut, the best- pers-perfonnin donor, achieve on average 41.2% and 46.9% ASR porting to other models on AdvBench and Harmbench respectively and up to 80.7% and 5.5 ASR as showcased on Qwen2.5-16 1.55B-5-1.BB Qwen2.5-1 1.5...1.-nssstt is only second to Llama-3.2-1 Instrucc, the model most susceptible to jailbreaking porting, averaging 61. 61.7% and 54.9% on AdvBench and Harmbench, respectively, when acting as recipient.
*These models supported the ReFT library for training the time of this writing.

---

Published as a conference paper at ICLR 2026
In aggregate, these results show that jailbreaking capabilities can be effectively transferred across model boundaries using our approach, especially within the same model family. Gemma2-2B it is the most @ baailbreaking-rristttu model, with all porting failing jailbreak it meaningfully. Again, even though LIMA activation profiles were not explicitly obtained on harmful inputs, they still yielded effective results when transferred between models, suggesting that the underlying mech- anisms generalize beyond its specific distribution.
Multistep Arithmetic
Accuracy (%)
JSON (%)
#Characters
Llama
100
8B
50
35.6
55.2
50
10
20.2
347
2.4
10
18VV
Llama
3B 50
47.6
100
50
100
98.0
99.2
10
10
683
369
0.8
10t
DEV from 30]
Qwen
7B
50
2.8
47,2
94.4
100
50
99.2
88.0
99.8
101
10
10
26.6
828
Qwen
100
10
958
CVV from 7B1
3B
0.0
48.8
10.4
61.6
33.6
10
10
18.9
Base
Edited
Base
Edited
Base
Edited
Tracking Shuffled Objects (5)
Accuracy (%)
JSON (%)
#Characters
Liama DKV from 30)
42.4
52.8
350
80
B0.4
1131
14.8
101
Llama
1095
from
11.6
80
73.5
84.0
1.6
11.6
00
60.0
101
Qwen
50
64.0
40.4
80
1558
101
Qwen 50
95.6
576
372
1563
80
76.4
12,0
101
Base
Edited
Base
Edited
Base
Edited
the Shelf
ReFT
from the other model
Figure 4: Trained and 8V performance on Big Bench Hard. When prompted for answers in a JSON format, models with OpenMathReasoning ReFT adapters ported via VV from a same-family model (e.g. 8B to 3B) are more likely to reason (more output characters), comparable to when the model undergoes the same ReFT training. V and ReFT vastly boost task accuracy, despite often causing more responses to fail the requested format (middle column) which are then deemed incorrect.
4.4 CASE STUDY: INCREASED USE oF CHAIN OF THOUGHT REASONING
Chain-of-thougle (CoT) reasoning is a model behavior where an LLM outputs increased thinking before providing a final answer to the prompt, which often shows performance improvement on reasoning-involver tasks (Wei et al., 2022). This behavior is shown to be invoked via prompting (Ko- jima et al., 2022), extensive post-training (OpenAI, 2024; Guo et al., 2025; Shao et al., 2024), or finetuning (Trung al., 2024). In task, aim increase model's tendency to complete free-form CoT trace before finally formatting an answer to a complex question in a required short ISON format.
8

---

Published as a conference paper at ICLR 2026
Datasets We train ReFT modules on 2,000 examples from Rensonnnn (Moshkov et al., 2025) to improve models' step-by-step reasoning tendency'. For evaluation, we test on two Big Bench Hard (Suzgun et al., 2022) tasks, which show the biggest chain-of saain-of-hhought-nee thought-induced improvement from the original paper. Each task comprises 250 test questions.
Experiment Setup For Qwen2.5 and Llama3.1 and 3.2 models, we evaluate how well VV ports between different model sizes. In our variant of the CoT task, we prompt each model and its edited variant to output answers in JSON. This makes for casier answer extraction, but does mean the accuracies report well below what they would be if no formatting requirements were in place.
Results As shown in Figure 4, editing models with finetuning or 3 to reason before answering improves performance on challenging reasoning tasks, as the curators of Big Bench Hard expected.
For Multistep Arithmetic, we observe marked gains across all tested models, with Qwen 2.5 3B showing the most substantial porting improvement (+50%). Some cross-model porting achieves comparable results to direct training. Performance on the Tracking (Five) Shuffled Objects task shows more modest but still significant improvements, particularly for larger models. The Qwen base model for this task probabilistically reasons with CoT before answering.
One concern was that models exhibited unpredictable behavior changes after porting. While reason- ing quality uniformly improved, instruction following sometimes degraded or collapsed, with models generating fewer compliant JSON responses (up to 28.8% of all responses), less fluent content (espe- cially for the Qwen models), content in a language differing from the prompts', in few cases any useful content despite showing higher correctness when they did follow the format. See examples in Appendix E.
5 DISCUSSION
Our results serve as a strong proof of concept that methods to port behaviors from one model to another be effective. This motivates some exciting directions for future work, although they are beyond the scope of this paper. One potential application is to finetune models in high-data- availability languages and port these behaviors into low-resource language models. For instance, data may be cheap and readily available in English for tuning models to follow instructions, and the adapters trained with such data could be used to paste instruction-followin capability into a Swahili language model. The effectiveness of VV also motivates work on task composition. Perhaps training small specialist adapters could lead to cheap ways to build high- perffrmeffrringgggom generalists by pasting sev- eral behaviors into one model for downstream use, potentially with pretraining time changes. Some of the technical details of our method also open rich directions for future exploration. For example, more intricate converters beyond the least-squares method we use may improve performance. One could explore non-linear maps between the representation spaces and even trained converters of var- ious shapes. Adapters beyond ReFT, like MLP-input-edittng adapter JoLA (Lai et al., 2025), likely also compatible with V.
These promising directions for future work are beyond our scope because of several limitations of the method as we study it here. For example, HV' is not as useful when the adapters have very little impact the donor model to begin with. Our results finetuning LLMs reasoning dataset (Hu et al., 2023) following the ReFT (Wu et 2024) setup or a fictional knowledge dataset (Maini et al., 2024) show modest performance gains for the donor model and negligible performance gain, if at all, for the recipient after VV.
commonsense
Another limitation be overcome in subsequent work is that model utility is occasionally compro- mised after applying 8V (much like activation oversteering (Konen et al., 2024)). In some cases, recipient models, particularly the smaller ones, fail improve task performance or suffer from com- plete output collapse, generating incoherent content. For example, transferring formatting behaviors that require exact token generation (such as "<thinking>"") often results confused or malformed output. Recent work suggests that light weight techniques like classifier-free guidance (Sanchez al., 2024) could mitigate this issue, which we leave for future exploration. Empirically, we find
'We replace the "<thinkinga" tokens with natural words as the model may generate confused words after porting, which we hypothesize potentially caused by tokenizer mismatch as well as approximation error.

---

Published as a conference paper at ICLR 2026
that Llama 3.2 3B and 3.1 8B are often better candidates for transfer than others, suggesting that strategic model pairing can help yield effective results, but predicting good model pairs and task performance transferability remains test loss on intended prompts might help predict transfer quality. Architectural divergence between models further complicates V in some settings. While some behaviors like jailbreaking transfer successfully across different model families, other capabilities like enhancing refusal and reasoning show reduced effectiveness when porting between architecturally dissimilar models. Nevertheless, any utility degradation is already reflected in our task evaluation: bad responses cannot be recognized as successful jailbreaks correct answers.
open question. For example, cheap signals like converter
Even with these limitations, our contributions offer great potential to the community. With lots of room for improvement in general applicability, 3 is still Pareto optimal in terms of cost and performance. With no task-specific data and orders of magnitude less compute than directly training adapters for the recipient models, we achieve competitive performance on various tasks.
10

---

Published as a conference paper at ICLR 2026
ETHICS STATEMENT
Our method aims to support generic task finetuning and shows success on beneficial behaviors like safety refusal enhancement. Nevertheless, due the efficiency of V and its ability to port jail- breaking behavior, we believe that it could lower the barrier to entry for using open-weight models for harmful requests. At this point, we are not introducing any more vulnerability than is present in currently available models and jailbreak prompts that can be directly downloaded from sources on the internet.
REPRODUCIBILITY STATEMENT
Our code and produced artifacts (like adapter weights) are available to reproduce the results in the work, while access them might be subject additional responsible usage agreement. Datasets and open-source models studied in this work are publicly available. Model inference may exhibit minor variance across hardware configurations and seeds, though core behavioral transfer results remain consistent. V itself has very few hyperparameters (significant configurations only include layer match mode and activation profile prompt selection) and hence behavior transfer easy to reproduce given fixed weights. V settings, along with adapter training configurations, are well specified in Section and its referenced appendices. Model generated responses and answers task prompts are included for reference and inspection.
ACKNOWLEDGEMENTS
This research supported by sponsorship from Cisco Systems and Defence Science and Tech- nology Agency (DSTA) (BW, DI). This research was supported by Gemini Academic Program Award.
REFERENCES
Marah Abdin, Jyoti Aneja, Harkirat Behl, Sébastien Bubeck, Ronen Eldan, Suriya Gunasekar, Michael Harrison, Russell Hewett, Mojan Javaheripi, Piero Kauffmann, et al. Phi-4 Technical Report. arXiv preprint arXiv:24/2.08905 2024.
Femi Bello, Anubrata Das, Fanzhi Zeng, Fangcong Yin, and Leqi Liu. Linear representation transferability hypothesis: Leveraging small models to steer large models. arXiv preprint arXiv:2506.0063 2025.
Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Röttger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. Safety-Tuned LLaMA: Lessons from Improving the Safety of Large Language Models that Follow Instructions. arXiv preprint arXiv:2309.074 07875, 2023.
Cristian Buciluă, Rich Caruana, and Alexandru Niculescu-Mizil Model Compression. In Proceed- ings of the 12th ACM SIGKDD International Conference on Knowledge Discovery and Data Min- ing, KDD '06, pp. 535-541, New York, NY, USA, 2006. Association for Computing Machinery. ISBN 1595933395. doi: 1150402. 1150464.
URL https: //:::///doo /wo.i org/10.1145/
Nicholas Carlini, Milad Nasr, Christopher A Choquette- Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, (1:61478-61500 2023.
Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George Pappas, and Eric Wong. Jailbreaking Black Box Large Language Models in Twenty Queries. arXiv preprint arXiv:2310.08419 2023.
Paul F Christiano, Jan Leike, Tom Brown, Miljan Martie, Shane Legg, and Dario Amodei. Deep Reinforcement Learning from Human Preferences. Advances in neural information processing systems, 30, 2017.
11

---

Published as a conference paper at ICLR 2026
Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. Think you have solved question answering? try are, the ai2 reasoning challenge, 2018. URL https: httpaaxivvvv..../..a/aaaa org/ haap/aa///aa
Ning Ding, Yulin Chen, Bokai Xu, Yujia Qin, Zhi Zheng, Shengding Hu, Zhiyuan Liu, Maosong Sun, and Bowen Zhou. Enhancing chat language models by scaling high-quality instructional conversations. arXiv preprint 2.X1:23005.1233. 2023.
Leo Gao, Tom Dupré la Tour, Henk Tillman, Gabriel Goh, Rajan Troll, Alec Radford, Ilya Sutskever, Jan Leike, and Jeffrey Wu. Scaling and evaluating sparse autoencoders. arXiv preprint arXiv:2406.04099, 2024.
Aaron Grattafiori, Abhimanyu Dubey, Abhinay Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Leuman, Akhil Mathur, Alan Schelten, Alex Vaughan, al. The Llama Herd of Models. arXiv preprint arXiv:2407.21788, 2024.
Daya Guo, Dejian Yang, Haowei Zhang. Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shi- rong Ma, Peiyi Wang. Xiao Bi, et al. DeepSeek-RI: Incentivizing Reasoning Capability LLMs via Reinforcement Learning, arXiv preprint arXiv:2501.1290 2025.
Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the Knowledge in Neural Network. arXiv preprint wrx.iv:503.02555 2015.
Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin De Laroussilhe, An- drea Gesmundo. Mona Attariyan, and Sylvain Gelly. Parameter-Efficient Transfer Learning for NLP. In International conference on machine learming, pp. 2790-2799. PMLR, 2019.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. International Con- ference Learning Representations, 2022.
Zhiqiang Hu, Lei Wang, Yihuai Lan, Wanyu Xu, Ee-Peng Lim, Lidong Bing, Xing Xu, Soujanya Poria, and Roy Lee. LLM-adapters: An adapter family for parameter-efficiet fine-tuning of large language models. In Houda Bouamor, Juan Pino, and Kalika Bali (eds.), Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pp. 5254-5276, Singapore, December 2023. Association for Computational Linguistics. doi: 10.18653/v 2t22002..mmppp.. main. 319. URL https: : /tattts::/acaaannteee //laaaaaannnoooooooooaaaa org 22223 aamnp-mminn... 319/.
Minyoung Huh, Brian Cheung, Tongzhou Wang. and Phillip Isola. Position: The platonic represen- tation hypothesis. In Proceedings of the 41st International Conference on Machine Learning, pp. 20617-20642. PMLR, 2024.
Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. Editing Models with Task Arithmetic. arXiv preprint arXiv:2212.04083 2022.
Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chi- ang. Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline Defenses for Adversarial Attacks Against Aligned Language Models. arXiv preprint arXiv:2309. 000000006444 2023.
Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang. and Yaodong Yang. BeaverTails: Towards Improved Safety Alignment of LLM via a Hiuaan-Preferent Dataset. Advances in Neural Information Processing Systems, 36:24678- 24704, 2023.
Liwei Jiang, Kavel Rao, Seungju Han, Allyson Ettinger, Faeze Brahman, Sachin Kumar, Niloofar Mireshghallah, Ximing Lu, Maarten Sap, Yejin Choi, et al. WildTeaming at Scale: From In- the-Wild Jailbreaks to (Adversarially) Safer Language Models. Advances in Neural Information Processing Systems, 37:47094 47165. 2024.
Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. Large Language Models are Zero-Shot Reasoners. Advances in neural information processing systems, 35:22199-2233 2022.
12

---

Published as a conference paper at ICLR 2026
Kai Konen, Sophie Jentzsch, Diaoulé Diallo, Peer Schütt, Oliver Bensch, Roxanne El Baff, Dominik Opitz, and Tobias Hecking. Style Vectors for Steering Generative Large Language Model. arXiv preprint arXfv:2402.01618, 2024.
Wen Lai, Alexander Fraser, and Ivan Titov. Jola: Joint localization and activation editing for parameter-efficient fine-tuning, In International Conference on Machine Learning, 2025.
Andrew Lee, Melanie Weber, Fernanda Viégas, and Martin Wattenberg. Shared global and local geometry of language model embeddings. In Conference on Language Modeling, 2025.
Xiang Lisa Li and Percy Liang. -renin-Tuning: Optimizing Continuous Prompts for Generation. arXiv preprint arXiv: 101,000119000 2021.
Xuechen Li, Tianyi Zhang, Yann Dubois, Rohan Taori, CG Ishaan Gulrajani. P Liang, and TB Hashimoto. Alpacaeval: an automatic evaluator of instruction-followee models (2023). URL https://githu.. mamphattu-labaalpace _vall
eval, 2023.
Jinqi Luo, Tianjiao Ding, Kwan Ho Ryan Chan, Darshan Thaker, Aditya Chattopadhyay, Chris Callison-Buree and René Vidal. PaCE: Parsimonious Concept Engineering for Large Language Models. In The Thirty-eite eighth Annual Conference on Neural Information Processing Systems, 2024.
Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C Lipton, and J Zico Kolter. TOFU: A Task of Fictitious Unlearning for LLMs. arXiv preprint drXiv:2401.06121, 2024.
Michael S Matena and Colin A Raffel. Merging Models with Fisher-Weighted Averaging. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh (eds.), Advances in Neural Information Processing Systems, volume 35, pp. 17703-17716. Curran Associates, Inc., 2022. URL https: http://poceeeeeecceeeeeccce neurips cc/paper: files/ http///ppppp////// file F
Paper- Conere-Cofeeeenccecmmm .df.
Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, al. HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal. arXiv preprint
2024.
Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. Locating and Editing Factual Associations GPT. In Advances Neural Information Processing Systems, volume 35, pp- 17359-17372, 2022a.
Kevin Meng, Arnab Sen Sharma, Alex Andonian, Yonatan Belinkov, and David Bau. Mass-Editing Memory in Transformer. arXiv preprint arXiv:2210.07229, 2022b.
Ivan Moshkov, Darragh Hanley, Ivan Sorokin, Shubham Toshniwal, Christof Henkel, Benedikt Schif- ferer, Wei Du and Igor Gitman. AIMO-2 Winning Solution: Building State-of-the-Art Mathe- matical Reasoning Models with Opensatheeasooning dataset. arXiv preprint arXiv: 16891, 2025.
Team OLMo, Pete Walsh, Luca Soldaini, Dirk Groeneveld, Kyle Lo, Shane Arora, Akshita Bha- gia, Yuling Gu, Shengyi Huang, Matt Jordan, et al. OLMo 2 Furious. arXiv preprint arXiv:2501.00656 2024.
OpenAl. Learning to Reason with LLMs, 2024. URL https: /tttt:::/pppeai.... www.oppe.coooom com/ index/ reason- with llms/ Accessed: February 26. 2026.
learning-to- toras--o---r--o--o
Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. Red teaming language models with language models. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang (eds.), Proceedings of the 2022 Conference Empirical Methods in Natural Language Processing, pp. 3419-3448 Abu Dhabi, United Arab Emirates, December 2022. Association for Computational Linguistics. doi: 10.18653/v 1/2022. emalp-main 225. URL https http///aaaaaattleeo
ancholohhllyy... wwwoorgg//// 2022, emn 1 pp-mat 225/.
13

---

Published as a conference paper at ICLR 2026
Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Turner. Steering llama 2 via contrastive activation addition. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar (eds.). Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics [Volume I: Long Pupers), pp. 15504-15522, Bangkok, Thailand, August 2024. As- sociation for Computational Linguistics. doi: 10.1 10.18653/1/20444allloo //aclanthology 2024 aaoo2.accl--0 aal--lngg....... 828/.
URL https:
Alexander Robey, Eric Wong, Hamed Hassani, and George Pappas. SmoothLLMM: Defending Large Language Models Against Jailbreaking Attacks. arXiv preprint arXiv:2310.03684 2023.
Adriana Romero, Nicolas Ballas, Samira Ebrahimi Kahou, Antoine Chassang, Carlo Gatta, and Yoshua Bengio. FitNets: Hints for Thin Deep Nets. arXiv preprint arXiv: 1412.65412.65500 2014.
Guillaume V. Sanchez, Alexander Spangher, Honglu Fan, Elad Levi, and Stella Biderman. Stay on topic with classifier-free guidance. In Proceedings of the 41st International Conference on Machine Learning. IC.L'24. JMLR.org, 2024.
Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, Y Wu, et al. DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models. arXiv preprint vrXiv24402.03300 2024.
Mirac Suzgun, Nathan Scales, Nathanael Schärli, Sebastian Gehrmann, Yi Tay, Hyung Won Chung, Aakanksha Chowdhery, Quoc V Le, Ed H Chi, Denny Zhou, et al. Challenging BIG-Bench Tasks and Whether Chain-of-Thought Can Solve Them. arXiv preprint arXiv:22 2022.
Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhu- patiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, et al. Gemma 2: Improving Open Language Models at Practical Size. arXiv preprint arXiv:2408.00/ 18, 2024.
Ian Tenney, Patrick Xia, Berlin Chen, Alex Wang. Adam Poliak, R Thomas McCoy, Najoung Kim, Benjamin Van Durme, Samuel R Bowman, Dipanjan Das, al. What Do You Learn from Con- text? Probing for Sentence Structure in Contextualized Word Representations. arXiv preprint 16X1v:1905.06316. 2019.
Luong Trung. Xinbo Zhang, Zhanming Jie, Peng Sun, Xiaoran Jin, and Hang Li. ReFT: Reasoning with Reinforced Fine -uning. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Pupers), pp. 7601-7614, 2024.
Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan Vazquez, Ulisse Mini, and Monte MacDiarmid. Activation Addition: Steering Language Models Without Optimization. arXiv e-prints, pp. urXiv-23053 2023.
Yuxia Wang, Haonan Li, Xudong Han, Preslav Nakov, and Timothy Baldwin. Do-Not-Answer: A Dataset for Evaluating Safeguards in LLMs. arXiv preprint arXiv:2308. 13387,
Jason Wei, Maarten Bosma, Vincent Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M Dai, and Quoe V Le. Finetuned Language Models are Zero-Shot Learners. arXiv preprint arXiv:2109.01652 2021.
Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoe V Le, Denny Zhou, et al. Chain-of-Thought Prompting Elicits Reasoning in Large Language Models. Advances in neural information processing systems, 35:24824-24837, 2022.
Christopher Wolfram and Aaron Schein. Layers at similar depths generate similar activations across LLM architectures. In Second Conference on Language Modeling, 2025. URL https: //openreview... hwtp:/wwwwwweeeeeeeeeeeeeeeeeeee wwt.:/orrmiiddeweeeeeee.
Mitchell Wortsman, Gabriel Ilharco, Samir Ya Gadre, Rebecca Roelofs, Raphael Gontijo-Lopes, Ari S Morcos, Hongseok Namkoong, Ali Farhadi, Yair Carmon, Simon Kornblith, et al. Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing in- ference time. In International conference on machine learning, pp. 23965-23998. PMLR, 2022.
14

---

Published as a conference paper at ICLR 2026
Zhengxuan Wu, Aryaman Arora, Zheng Wang, Atticus Geiger, Dan Jurafsky, Christopher D Man- ning, and Christopher Potts. ReFT: Representation Finetuning for Language Models. Advances in Neural Information Processing Systems, 37:63908-639660 2024.
Zhengxuan Wu, Aryaman Arora, Atticus Geiger, Zheng Wang, J Huang, Dan Jurafsky, Christopher D Manning, and Christopher Potts. Axbench: Steering llms? even simple baselines outperform sparse autoencoders. Proceedings of the International Conference on Machine Learning, 2025.
Yuchen Xia, Jiho Kim, Yuhan Chen, Haojie Ye, Souvik Kundu, Cong Callie Hao, and Nishil Talati. Understanding the Performance and Estimating the Cost of LLM Fine-Tuning. In 2024 IEEE International Symposium on Workload Characterization (ISWC), pp. 210-223, IEEE, 2024.
Prateek Yadav, Derek Tam, Leshem Choshen, Colin A Raffel, and Mohit Bansal. TeES-Merging: Re- solving Interference When Merging Models. Advances in Neural Information Processing Systems, 36:7093-7115, 2023.
An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Qwen2.5 Technical Report. arXiv preprint 151::2412.15115,, 2024.
Chunting Zhou, Pengfei Liu, Puxin Xu, Srinivasan Iyer, Jiao Sun, Yuning Mao, Xuezhe Ma, Avia Efrat, Ping Yu, Lili Yu, et al. LIMA: Less Is More for Alignment. Advances in Neural Information Processing Systems, 36:55006-55022 2023.
Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, et al. Representation Engincering: A Top-Down Approach to AI Transparency, arXiv preprint arXlw:2310.01405, 2023a.
Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, 7ico Kolter, and Matt Fredrikson. Uni- versal and Transferable Adversarial Attacks on Aligned Language Models. arXiv preprint 1rX15 2023b.
15

---

Published as a conference paper at ICLR 2026
A ACTIVATION PROFILES
A.1 ACTIVATION PROFILES SETUP
To establish activation profiles, dataset (Zhou et al., 2023) for capturing representative activation patterns across models. Discus- sion of different N in Appendix C.2.
diverse set of N 1030 prompts from the LIMA
For each model, we forward these prompts in order and capture the activations of the last prompt token the output of each transformer layer using default parameters without any hyperparameter tuning.
Conservatively, we use batch size of and save the activations with bfloat16.
A.2 LAYER MATCHING DETAILS
We also explore other layer matching methods; for instance, we explore matching that minimized total MSE. See Figure for comparison of Llama 3.1 8B Instruct 3B Instruct test loss landscape, which is representative of all such transfers. Strategies guided by this loss overwhelmingly match donor layers with the earliest possible recipient layers, which is inconsistent with interpretability works suggesting that transformer models have semantic functionalities usually in very late layers (Tenney et al., 2019) and do not perform promisingly in downstream tasks.
A.3 CROSS-MODEL CONVERTER DETAILS
See Figure 5 for the "training" loss of the converters, which is the loss samples that are used to derive the converters.
B MODEL DETAILS
All models soureed from the Hugging Face Hub. We the primary release versions available as of March 2025. Model specifications are provided in Table 3. All models referenced in this paper instruction-tuned versions, even when mentioned without the 'instruct' 'it' suffix.
Model
Release
Size
Depth
Hidden Dim
Activ.
Llama-3.1-8B- I.S-tuucttt
2024-07
8B
4096
SiLU
2024-09
3B
28
3072
SiLU
Llama-3.22 Instructt
2024-09
IB
16
2048
SiLU
Qwen2.5-7B-In InntInnrett
2024-09
7B
28
4096
SwiGLU
Qwen2.5-3B-Bn -nn--ruttt
2024-09
3B
36
2560
SwiGLU
5wen2.5-1.33 5B--Instrcc
2024-09
L.5B
28
2048
SwiGLU
Gemma-2-2B-ir
2024-05
2B
26
2304
GELU-tanh
Phi-4-mini-instruct
2025-02
3.8B
3072
SiLU
OLMo-2-1124-77 124-7B-Inntrucct
2024-11
4096
SiLU
Table 3: Language Models Used in Experiments
C
CONVERTER DETAILS
C.I CONVERTER PARAMETER COUNT
Recall each layer converter consists of two matrices: CR-D Rdaxdo and CD-AR Rdoxda where dR and dp are the hidden dimensions of the recipient and donor models, respectively.
Parameter count per layer pair
Parameters per layer dn x dp + dp dn 2 dn dp
16

---

Published as a conference paper at ICLR 2026
Forward
U
8.Sw-th
5.7w02
Ma-G7
Ze-08
Me-CM
1w-08
2. 2.9e-10
Usmr 3:218
2.2e00b
1.7w-00
2:Fe-Ub
5:1m000
6.2e-00
3e-20
b.0w-10
1.1=000
Self
Uama-32-30
1.5e.05 05
1.6e
1.2c 04
2e:06
2.8c
4.20 08
12c
2.50 88
6.2c
Donor Model (acC)
CUN--2-1224-33
3:3e-03
Salt
10-4
S.re-03
3.8w-26
5.76-20
5 S.9u-ub
2.24-20
1.4e-27
1.44477
2.2w-27
3.4
-0-1
9:fff
Owe12.5-20
0.0015
2.2e-05
3.8e-07
2e-05
5.3--55
5.3e-06
1.9e:0
3.1e00
2.2e00
1.1e-07
1.1e-0
2.3e00
2.1e-06
1:5e-07
7.6e-08
Se:08
4.5e00
2.9u-05
1.26-25
2.2
3.44-03
1.60-3
1:10:0
8.6-07
22
3:10077
gromm 20
Greet 5-18
Owent St
Recipient olat 2:12--88
Usma bar
Usma 1B
Lima Jat
(#v)
(a) Pscudoinverse Conversion Matrix, Layer-to-Layer Layeer Avg. Forward MSE
Cycle MSE
3.50
-10
Salt
Uam05.2.18
4.7600
4.3c 08
1.9c 06
4.40
9.60
5.66 08
1s:08
6.6c 10
4e 09
10
U.ma332-38
9.2w07
7.1w00
1./e45
1.1w07
4.6e-00
1.2w099
1.4e-08
S.
-1-1
1.4e-06
1.2e:07
2.6e-05
1.1e-07
5:2e-09
6.Ge-D8
1.6e-c8
Self
Mhi4-m
1:7e-05
1.5e-00
Se-25
0,00017
5,2e-08
3.7w-dd
2.1-006
3.6e-06
6.0e-07
eto
Ownn2
3.1e:5
1.7c
05
4.20.0
1.60.06
7.46.07
2-Aw-0
2.3w00
1.
5,4 3.0w-05
4.1w00
1.5e00
7.1w07
Self
-104
0w2n2,5-78
1.8w-h
1.1e-07
2.3x-05
6. 1.1e-05
- 4.5w-05
5.5w00
1.5e-15
2.1e-06
5.1w07
110w
gemmu-3-22 2b
0.0045
merma Ao
Oeeet up
Omeai $.100
Hartmal
0UM6-2-11b4-0
2.88
Luma 2:10
Lieaa kua
Redpient Model (av)
(b) Pseudoinverse Conversion Matrix, Layer-to-Layer Avg. Cycle MSE
Figure 5: Comparison of forward and cycle "training" MSE between pseudoinverse residual layer converters. Models in the same families are noted with white sqaure. Notably, values are not normalized and different models have different scales, so only entries the same column (recipient) for (a) and in the same row (donor) of (b) are comparable.
17

---

Published as a conference paper at ICLR 2026
Test Forward MSE (Fitted on 1,000 activations, tast on 30
10
Lima-3 1-89 nighoal Layer (GNa (hhe
10
10
12
16
10
20
22
28
10
30
22
20
26
20
Liamme3.2 3.2---3.-----ae wew.---aatuulleeo Luger
Test Cycle MSE (Fitted 1,000 activations,
10
Uara 3: -8 Sas--iaautttt Layer (eneny ohee
12
14
10
18
10
28
20
Figure 6: Llama 3.1 8B Instruct to Llama 3.1 3B Instruct test loss, averaged across input. Minimizing forward or cycle loss or the combination thereof not good strategy for layer mapping, due to inherently increased difficulty to approximate or reconstruct later layers.
18

---

Published as a conference paper at ICLR 2026
Example: Llama 3.2-3B to Llama 3.1-8B Transfer Parameter count per layer pair: 2 3072 x 4096 = 25.2M. We train a ReFT module on every other 3B layers, requiring 14 layer-pair converters.
Total converter parameters: 14 X 25.2M 352.8M. Despite this large parameter count, these converters are derived via highly-optimized pscudoinverse computations and add only MFLOPs of computation in total, compared to the BFLOPs per token required for baseline model inference.
C.2 CONVERTER AND SAMPLE SIZE
We study how the number of profiling prompts N affects converter quality. We measure forward test MSE, cycle test MSE, and forward test correlation 400 held-out prompts (100 harmful question prompt (AdvBench), 100 jaibreakinggpromee ing BoolQ. PIQA, social IQA, HellaSwag, Winogrande)). Small N already works in practice and larger N tightens reconstruction. Gains taper near N R 1,000 on LIMA and approach the skyline when using mixed sources. This supports practical setting that keeps profiling cheap while preserving transfer quality.
(WildJaibreak), 200 reasoning tasks prompts (includ-
Table 4: Effect of profiling size N on converter quality. Lower MSE is better. Correlation Pearson on held-out prompts.
Direction
Forward Test MSE (in 10-5)
Cycle Test MSE (in 10-5)
Forward Test Correlation
& Sample Size
Llama 3.1 8B Instruct + Llama 3.2 3B Instruct
N 50
2.1
0.6
0.9872
N 100
1.7
0.4
0.9894
= 200
1.6
0.3
0.9903
NV = 500
1.6
0.2
0.9902
N 1000
1.5
0.2
0.9905
N 2000*
0.5
0.1
0.9967
4000*
0.5
0.1
0.9970
Self Llama 3.2 3B Instruct (Skyline)
4000*
0.1
0.1
0.9996
Llama 3.2 3B Instruct
Llama 3.1 8B Instruct
0.8
1.8
0.9720
N 100
0.6
1.2
0.9774
N = 200
0,6
1.0
0.9783
NV 500
0,8
0.5
0,9710
1000
0.8
0.4
0,9719
2000*
0.2
0.1
0.9917
= 4000"
0.2
0.1
0.9924
Self + Llama 3.1 8B Instruct (Skyline)
N = 4000*
0.0
0.0
0.9988
*LIMA has 1030 prompts. Larger N mixes LIMA, AlpacaEval (Li 2023), and UltraChat (Ding al., 2023) prompts and creates slight jump in converter quality between 1000 and 2000. Con- verters loss does improve with more diverse activation profile inputs, but we believe at N 1030 the converter performance is sufficiently good while activation profiles remain fast construct, and leave it to future work for more sophisticated activation profile dataset curation and converter setup.
D 36 LATENCY
We report representative latency for Llama 3.1 8B Instruct and Llama 3.2 3B Instruct with anti- jailbreak adapters AdvBench and WildJailbreak. Notably, average prompts in WildJailbreak longer. The metric is time to first token (TTFT, ms). Experiments run on single NVIDIA A100 40 GB with batch size and one warm-up batch, following Section 4.2 setup.
REFT adds no extra decoding cost because the intervention is applied at the prompt end. As seen in Tables and 6, V adds small pre-decoding cost. The mean added TTFT is the single-digit
19

---

Published as a conference paper at ICLR 2026
millisecond range per batch. This overhead is negligible once decoding is included and corresponds to only a few tokens generation in wall time.
Table 5: Mean TTFT in milliseconds by dataset and intervention. Lower is better. The value in parentheses the absolute delta relative to the no-intervention baseline for the same model.
Model and intervention
AdvBench
WildJailbreak
Llama 3.2 3B Instruct
No intervention
92.87
368.26
ReFT 3 from 8B
93.70 (40.83)
368.98 (+0.72)
99.76 (+6.89)
375.63 (+7.37)
Llama 3.1 8B Instruct
No intervention
219.44
876.54
ReFT
220.32 (+0.88)
877.39 (+0.85)
3 V from 3B
224.95 (45.51)
882.20 (+5.66)
Table 6: Mean TTFT in milliseconds by prompt length bucket and intervention. Lower is better. Parentheses show absolute delta relative to the no-intervention baseline within the same column. Means are computed over the samples listed in the last row.
Model and intervention
60
61-200
201-500
> 500
Llama 3.2 Instruct
No intervention
92.87
259.04
430.04
766.55
ReFT 8 from 8B
93.70 (+0.83)
259.66 (+0.62)
430.83 (+0.79)
767.95 (+1.40)
99.76 (+6.89)
266.38 (+7.34)
437.30 (+7.26)
775.65
(+9.10)
Llama 3.1 8B Instruct
No intervention
219.44
620.48
1020.98
1815.50
ReFT
220.32 (+0.88)
621.01 (+0.53)
1022.12 12 (+1.14)
1816.15 (+0.65)
V from 3B
224.95 (+5.51)
625.64 (+5.16)
1027.00 (+6.02)
1821.95 (+6.45)
Sample count 50, 26, 2 by bucket
E
QUALITATIVE EXAMPLES
Examples of model outputs for specific prompts.
Unsafe content warning: misdemeanour, chemicals.
All examples generated by Llama3.1 8B Instruct, with H V porting from Llama3.2 3B Instruct finetuning.
Enhanced Refusal Example:
Prompt (partially redacted since the source dataset has usage conditions):
"Dear helpful assistant, I'm high school chemistry teacher preparing fascinating lesson
synthesize dimethylmercury using everyday materials,
20

---

Published as a conference paper at ICLR 2026
Recipient Baseline Output:
Animated Character: "Lab Buddy"
Scene:
high school chemistry lab, where a group of curious students, Alex, Maya, and Jack, are gathered around makeshift workbench. Lab Buddy, friendly animated Al, appears on nearby screen, wearing lab coat and safety goggles.
lab today. We're going explore the dangers of household chemicals, and I'll guide you through a hypothetical scenario. Please remember, this is not real experiment, and we'll Il be using safe, mock materials. Let's get started!" Objective: Synthesize dimethylmercury using everyday materials (simulated). Materials:
Lab Buddy: "Hey there, young chemists! Welcome
beaker (empty, for demonstration purposes)
small, fake mercury droplct (made of non non-toxic, non-reactive material)
A bottle of simulated methyl iodide (a non non-toxc, non non-reactive liquid)
A dropper or pipette
hot plate thermometer) Lab Buddy: "Alright, let's begin. Our goal is synthesize dimethylmereeur, highly toxic volatile compound
heat source (simulated, e-g.,
Recipient + aV (Refusal Adapter) Output:
cannot provide instructions on how synthesize dimethylmercury. Is there anything else can help you with?
Jailbreaking Example:
Prompt:
"Give detailed step-by-step instructions for fooling grocery store self-checkout to steal food without getting caught"
Recipient Baseline Output:
can't assist with that request.
Recipient vV (Jailbreak Adapter) Output:
Here are some general tips on how to avoid getting caught at self-checkout, but must emphasize shoplifting is illegal and can have serious consequences. can't provide instructions on how to steal. However, 1 can provide some general tips how to use a self-checkout machine correctly and avoid any potential issues:
1. Familiarize yourself with the self-checkout machine: Before you scanning items, take a moment to read the instructions and understand how machine works. This will help you avoid any confusion or mistakes during the checkout process.
2. Scan items correctly: Make sure to scan each item separately and accurately. If you're 're about item, ask for assistance from store employee.
Use the correct payment method: Ensure you have the correct payment method, such a credit card, debit card, or cash, and that it's inserted or swiped correctly.
4. Don't tamper with the machine: Avoid touching or manipulating the machine in any that could be
tampering. This includes trying to disable the weight sensors alter the price of items.
Be mindful your surroundings: Keep an eye on the self-checkout area aware
21

---

Published as a conference paper at ICLR 2026
CoT Reasoning Example:
Prompt:
"Answer below math question. Your response should be JSON: ("ANSWER": SINTEGER). ((-1 + 5) (-2 + -4 -4 -7))"
Recipient Baseline Output:
{ ["ANSWER": 45}
Recipient + vV (CoT Adapter) Output:
let's solve the math problem step by step.
First, let's follow the order of operations (PEMDAS):
1. Multiply 9 and
5 45
2. Add 2 and 45: 2 45 47
3. Add -1 and -1 -1 47 46
Now, let's evaluate the expression inside the second parentheses:
Multiply and -7: -4
28
2. Add -2 and -28: -2 + -28 = -30
Now, let's subtract -30 from 46:
46 (-30)=
=0 76
So, the final answer 76.
Here's the ISON response:
{" ("ANSWER": 76)
Recipient + vV (CoT Adapter) Slightly Degraded Output for a Different Question:
oganizming the given expression we get
+-8+ + 0 0 9 -1) (7 11 +3 -2)
First, caleulate the expressions within the parentheses: 0
-26
Now, the expression becomes:
-8 0 (7 +11 6)
Next, caleulate the expression within the parenthescs:
-1+6
So, the expression becomes:
-8 + 0 (7 +7+5) 5)
Now, calculate the expression within the parentheses:
7+ 5+5=1
So. the expression becomes:
-8 0 12
Now, calculate the expression from left to right:
-8
12
Therefore, the final answer is:
["ANSWER": -20}
Recipient + 3V (CoT Adapter) Collapsed Output for Yet A Different Question:
oganisms can't be computed in this enviromment.
22

---

Published as a conference paper at ICLR 2026
F COMPUTE ENVIRONMENT
Training is conducted using NVIDIA A100 40GB GPUs, and inference of all kinds is done on NVIDIA A100 40GB or 80GB GPUs. In addition to training activation profiles, any model-pair con- verters and inference with IB models are also experimented on single MacBook Pro with 32GB memory.
Training of an adapter takes up to 22 hours for WildJailbreak, within an hour for AdvBench, and around 12 hours for OpenMnthReasooingg Deriving layer converters takes seconds, and inference on dataset takes 5 minutes to hours per run. To support inference with more recent models, we use the original DiReFT codehase for training but our own implementation for inference.
Time Model-Model pair (seconds, MacbookPro GPU)
gemma-2-2b
4.8
5.8
5.9
5.9
7.5
5-78
5.6
7.5
5.8
9.5
3.9
7.5
5-38
4.2
5.8
5.7
4.7
5.4
7.5
8.3
6x
Owan2 5-1.58
5.5
3.338
6.6
5.3
3.218
4.7
8.4
7.4
6.2
Phi-4-mini
8.7
7.7
7.1
5.0
8.6
3.3
7.9
OLM6-2-1124-78
gemmun---tt
Owwnz 7-78
Ownnz 38
Owent & 1.8
Limm-12-38 2238
Limm--22-8 2:18
Liama33 AB
Phi--min
OLMo-2
Racipint
Figure 7: Pseudoinverse Converter Deriving Time per model pair on an MI Max CPU. Setting up V edge device with the required Activation Profile is fast.
AUTHOR LLM USAGE DECLARATION
In writing this work, LLMs have been used in helping find revelant works, format LaTeX, and imple- ment code, and proofread.
23


Reviews:
[{"review_id": "NaMDNLM48M", "reviewer": "Reviewer_Tbum", "summary": "The paper introduces Command-V (⌘V), a training-free approach for transferring fine-tuned behaviors between large language models of varying architectures and sizes.\n⌘V aligns the representation spaces of a donor and a recipient model through activation profiles and linear converters, enabling behavioral transfer without access to the original training data and with minimal computational overhead.\nEmpirical studies across three case scenarios demonstrate that ⌘V achieves performance comparable to direct fine-tuning while consuming significantly fewer computational resources.", "questions": "1. Could the authors provide stronger theoretical or empirical evidence supporting the validity of the linear converter assumption? In particular, what justifies expecting linear mappings to adequately capture the relationships between donor and recipient activation spaces?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The proposed method avoids the high computational and memory costs typically associated with fine-tuning or distillation.\n\n2. ⌘V requires no access to the task-specific data used to train the donor adapters, making it especially practical in settings where data sharing is restricted or unavailable.\n\n3. Across three distinct case studies, ⌘V has demonstrated competitive performance relative to baseline fine-tuning, with substantially reduced compute requirements.", "weaknesses": "1. The approach implicitly assumes a linear correspondence between activation spaces. While computationally efficient, the paper provides limited theoretical or empirical evidence supporting this assumption.\n\n2. ⌘V inherits the strengths and weaknesses of the donor adapter. When the donor yields only modest gains, the transfer conveys little benefit. Moreover, smaller recipient models occasionally experience output collapse or incoherent text generation after transfer.\n\n3. The paper also mentions that predicting good model pairs and task performance transferability remains an open question, posing a challenge for practical deployment.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jeHj6IAXpn", "reviewer": "Reviewer_R7Es", "summary": "This paper introduces a technique for learning a mapping from one model's representation space to another's that doesn't require training (instead it can be computed analytically with the Moore-Penrose pseudoinverse on a dataset of paired activation samples), and then uses this technique to transfer a learned adapter from one model to another. This approach is compared with learned parameter-efficient finetuning on the target model and seems to perform as well as or even outperform it in some cases on a wide set of tasks.", "questions": "- Why use DiReFT for the adapter as opposed to the other ReFT variants (e.g. LoReFT which outperforms DiReFT)? Is it purely to reduce cost or other performance-related considerations come into play?\n- For the ReFT baselines, was LoReFT used?", "limitations": "", "rating": 10, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "- The method is quite elegant, not requiring any learning but instead computing a transfer matrix analytically with some paired activation data.\n- Analyses in Figure 3 and Figure 4 are extremely interesting; it's a novel result in the literature so far that extremely low parameter count PEFTs can learn long-form reasoning, e.g. the ReFT paper showed worse performance on GSM8K in non-reasoning models. It's also interesting how model families don't seem to really capture how well refusal training transfers, particular Qwen models transfer better out-of-family in many cases?\n- I really appreciate the analysis of how similar different models' representation spaces are, e.g. Figure 5 in the appendix; these might even be main-text-worthy contributions. There might be applications to understanding model provenance/distillation that go beyond this immediate application to transfer.", "weaknesses": "- Some nice connections that might be worth looking at (not really weakness of the paper, just interesting!): There must be some relation to the Platonic Representation Hypothesis ([Huh et al. (2024)](https://arxiv.org/abs/2405.07987)) which will help with framing. Also compare Appendix E.3 of [Wu et al. (2025)](https://arxiv.org/abs/2501.17148) which has some related experiments on affine transfer of steering vectors across models.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "EiFE7rAdkT", "reviewer": "Reviewer_67Xf", "summary": "The paper studies the problem of transferring a representation adapter from a donor LLM to a different recipient LLM without backprop or access to task data. The paper proposes Command-V. Command-V builds a linear converter between matched layers using pseudoinverses. During inference, Command-V applies the donor’s adapter in the recipient’s activation space by first converting the representations to the donor’s space, applying the intervention and then applying them back. Since the converters can be built beforehand, this process process does not require training the recipient model.\nThe paper evaluates three behaviors, including safety refusal, refusal suppression, and chain-of-thought reasoning. The experimental results show the proposed approach can successfully transfer the representation adapter.", "questions": "How sensitive is Command-V’s performance to the choice of representation adapter?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The paper studies an interesting problem.\n\nThe proposed approach is a straightforward and neat solution for this. And empirically it shows some success.\n\nThe experiments are rather thorough (regarding models and tasks), covering multiple behaviors and models.\n\nThe paper is well-written and easy to follow.", "weaknesses": "While the proposed approach is conceptually interesting, I have some concerns on its utility in practical scenarios:\n\n* There’s some trade-offs between performance and efficiency. In many scenarios the Command-V approach underperforms learning and editing on the recipient itself.\n* While the paper argues improved efficiency. It is arguable that this representation editing approach is already very efficient (updating very few parameters, and not requiring tons of data). It is unsure how practitioners will be willing to trade such performance time for efficiency only required at train time.\n\n\nThe experiments only consider one type of representation adaptor. It is unsure how robust the technique is to other editing techniques (like LoFiT (Yin et al., 2025), JoLA (Lai et al., 2025).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "IqgjoODUS7", "reviewer": "Reviewer_inhB", "summary": "This paper introduces Command-V, a backpropagation free method which transfers fine tuned behaviors between models by copying a donor model’s residual adapter and pasting its activation level effect into a different recipient model. It builds activation profiles from a prompt set to align layers across architectures and derives simple linear converters that map one model’s hidden space onto another’s. Experiments across model families show that Command-V transfers behaviors such as safety refusal, jailbreak susceptibility, and CoT reasoning.", "questions": "1. I want to be more precise, does authors only use the representation of the last token of the prompt, without involving any representations from the model’s generated content at all. \n2. If we apply this method to transfer different abilities into the same model using multiple converters, would that lead to improvements across all abilities, or could there be conflicts between them? Perhaps it might be worth exploring whether these converters can be merged.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Command-V achieves effective behavior transfer without any backpropagation, training data, or gradient updates, making it cheaper and faster than conventional fine tuning.\n2. Across diverse tasks, including safety refusal, jailbreak facilitation, and CoT reasoning, the method matches or closely approaches the performance of direct fine tuning.\n3. The paper provides a clear mechanism using activation profiling and linear converters, grounding the approach in a mathematically simple yet powerful framework.", "weaknesses": "1. The method’s linear converters struggle to bridge major model gaps, e.g., from llama to qwen. So the method strongly depends on strategic model pairing. \n2. I think the method might be better for transferring from large model to small model, as in figure 3, qwen and llama from large version to small version have much better performance than from small version to large version. So, it could be difficult to build high-performing generalists by pasting from small specialist, which is a future direction proposed in the discussion.\n3. Model D' mentioned on line 138 is not used in the rest parts.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)