LinEAS: End-to-end Learning of Activation Steering with a Distributional Loss
Authors: Pau Rodriguez
Michal Klein
Eleonora Gualdoni
Valentino Maiorca
Arno Blaas
Luca Zappella
marco cuturi
Xavier Suau
Venue: NeurIPS 2025 poster ()
Keywords: controllability
generative models
toxicity
images
Primary area: deep_learning
TL;DR: We propose an inference-time intervention framework based on Optimal Transport that generalizes previous methods and allows interpretable control of both LLMs and Diffusion models.

Abstract: The growing use of generative models in daily life calls for efficient mechanisms to control their generation, to e.g. produce safe content or provide users with tools to explore style changes. Ideally, such mechanisms should require low volume of unpaired data (\ie without explicit preference), and should be cheap, both at train and inference time, while preserving output quality. Recent research has shown that such mechanisms can be obtained by intervening exclusively on model activations, with the goal of correcting distributional differences between activations seen when using prompts from a source vs. a target set (e.g. toxic and non-toxic sentences). While cheap, these fast methods are inherently crude: their maps are tuned locally, not accounting for their impact on downstream layers, resulting in interventions that cause unintended shifts when used out-of-sample. We propose in this work linear end-to-end activation steering (LinEAS), an approach trained with a global loss that accounts simultaneously for all layer-wise distributional shifts. In addition to being more robust, the loss used to train LinEAS can be regularized with sparsifying norms, which can automatically carry out neuron selection. LinEAS only requires a handful of unpaired samples to be effective, and beats similar baselines on toxicity mitigation in language models, becoming competitive with oracle-dependent methods that have access to strong supervision. LinEAS is modality-agnostic and we empirically find that it outperforms existing activation steering methods at mitigating and including new concepts at the output of single-step text-to-image generation models.

LinEAS: End-to-end Learning of Activation Steering with a Distributional Loss
Pau Rodriguez"
Michal Klein Apple
Eleonora Gualdoni Apple
Valentino Maiorea Sapienza, Apple
Arno Blaas Apple
Apple
Luca Zappella Apple
Marco Cuturi
Xavier Suau"
Apple
Apple
Abstract
The growing use of generative models in daily life calls for efficient mechanisms control their generation, to e.g., produce safe content or provide users with tools to explore style changes. Ideally, such mechanisms should require low volume of unpaired data (i.e., without explicit preference), and should be cheap, both at train and inference time, while preserving output quality. Recent research has shown that such mechanisms can be obtained by intervening exclusively on model activations, with the goal of correcting distributional differences between activations seen when using prompts from a source vs. a target set (e.g,, toxic and non-toxic sentences). While cheap, these fast methods are inherently crude: their maps are tundd locally, accounting for their impact on downstream layers, resulting interventions that cause unintended shifts when used out-of-samplc. We propose in this work linear end-to-end activation steering (LinEAS), an approach trained with global loss that accounts simultancously for all layer-wise distributional shifts. In addition to being more robust, the loss used to train LinEAS can be regularized with sparsifying norms, which can automatically carry out neuron selection. LinEAS only requires a handful of unpaired samples to be effective, and beats similar baselines toxicity mitigation in language models, becoming competitive with praele-dependent methods that have access to strong supervision. LinEAS is modality- aggoosicc and empirically find that it outperforms existing activation steering methods at mitigating and including new concepts at the output of single-step text-to-image generation models.
Prompt: running along riverbank.
Generic
Ukiyo-e
Source distribution
T21 Generation
Fantney
LinEAS
Ukiyo-e
Kid's drawing
3D polygons
3D polygons
Fantasy
Targes distributions
Kid's 's drawing
Each
contains only -30 sentences
Actionable kmobs
Figure I: LinEAS learns lightweight maps to steer pretrained model activations. With LinEAS, we gain fine-grained control on text-to-inn text-to-image to-image generation to induce precise styles (in the figure) or remove objects (e.g., Section 4.4). The same procedure also allows controlling LLMss (e.g., Section 4.1
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Introduction
Modern generative models are typically trained in two distinct phases. The first phase, known as pre-training involves learning from large corpus of data using tasks like next-token prediction or sonttto-mmae generation. This is followed by an alignment phase designed to adjust the model towards more specific, desired behavior. This alignment can be achieved through instruction fine-tuning []] reinforcement learning from human feedback (RLHF) (2) for LLMs, or guidance [ and LoRA adapters [4] in text-to-image diffusion. Many of these approaches propose to modify the model's s internal mechanisms, realigning its parameters by leveraging new data with, ideally, minimal impact on the utility of the model.
The rapid growth of model sizes, coupled with the potentially infinite combination of alignment goals, calls for alignment mechanisms that readily adapt to new and evolving user needs. Ideally, adaptable alignment methods should adhere to the following desiderata: low training cost (potentially on device), memory-efficienae (small set of parameters), low inference time overhead, data-efficiency (few annotated samples), and fine- -ne-grained control. Working in low-data regimes makes data collection simple or even unmanned, and makes training potentially faster while fine-grained control makes alignment methods more customizable S Such advantages together enable an agile control of generative models (see example in Figure T. giving tools users to customize their experience, and to administrators to quickly intervene to prevent harmful model behaviors.
body of work known activation steering 6 has proven be effective at conditioning models while being memory and compute efficient, but still falls short in other desiderata. Some methods require data points to be paired with their corresponding counterfactuals 122. while others require a reward model (or human) to indicate preference among generated outputs (2). While this is a form of strong supervision that provides a robust signal alignment methods, is costly or even impossible to obtain in many scenarios. A weaker and more flexible form of supervision consists of dealing with two sets of examples one for the target and one for the source behavior (e.g. non-toxic and toxic sentences). In this setting, sentence pairs are not required, and no additional supervision is needed. Methods using this weaker signal typically analyze the distribution of activations from each set, thus we refer to them as a distributional approaches.
In this work, we propose Linear End-to-end Activation Steering (LinEAS), low-data and weakly- supervised (unpaired data, no reward model) method that is trained with a global distributional cost grounded in optimal transport theory as signal for steering. Our hypothesis, which we validate empirically, is that our end-to-end learning accounts for the interactions between maps at different layers, leading improved results over other steering methods. An additional advantage of optimizing a global cost is that it allows us to introduce additional objectives such as regularization coefficient, which results more targeted interventions, preserving the utility of the model.
Our main contributions are:
We propose LinEAS, novel framework to steer activations based on affine optimal transport maps between activations trained jointly across layers (e.g., Tr, T, in Figure 2 with a global loss that enforces global distributional alignment across all layers Our method provides low-budget conditioning, with a continuous and ticory-grounder application strength E [0, 1] (e.g.. Figure LT.
We show how LinEAS can be coupled with a sparse lasso regularizer [13 that can detect a small subset of activations that matter for a steering goal, reducing the intervened support by 100x, resulting in improved model utility.
We show that LinEAS learns effective interventions with as few as 32 source and 32 target unpaired data points, showing state-of-the-an toxicity mitigation among steering methods.
We validate fine -heegraided control of text-to-image (T2I) models, showing superior coherence with the prompt semantics while achieving the desired alignment goal.
2 Related Work
We classify steering methods based on whether they require strong (paired data or use of a human supervision oracle) or weak supervision (unpaired data and no further supervision).
http:://ggthhib..oa/pppllll/
2

---

T2
VC(Ti, (2....)
f2
f3
L(T C(T,,T2....
$
+yR
Figure Given a frozen computational graph (blue) of T. + layers of interest, we interlace with L transport blocks (red). Each transport is defined transformations, as displayed in the and 2 boxes for maps 7j and T2 respectively. All transport maps are jointly trained to minimize sum of distributional losses A between the neural activation distribu- tions collected from samples æ1...., In ~ p (one shade of grey per sample) and yi..... Yn ~ (resp. yellow). We learn the parameters of these maps jointly by minimizing the penalized sum of terms, where is ID Wasserstein distances evaluated on the de activations of layer l. Using a global optimization, subset activations that require interventions. For instance, when adding a regularizer that promotes sparsity, both Ti and T do not intervene neuron, the first and the second, respectively.
collection of coordinate-wise affine
consider sparsifying regularizers (included in R), to, egg. select a sparse
Strong supervision. CAA calculates the steering vector as the mean of differences between two sets of paired prompts. ReFT [4] optimizes low-rank projections representations. LoFiT [T]] learns bias added the representations of pre-selected attention heads. LoFiT training similar to ReFT (although simpler, since only biases are trained). BitFit [15] directly finetunes the bias terms of pre-selected linear layers. Most of these methods be viewed as simplified version of LoRA [16] Similarly to LoRA they also require either paired data or a human /oracle supervision during training.
Weak supervision. Some methods propose add vector to the activations. For example, ACTADD 17 uses the difference between prompts and Mean-AcT the difference in means 10.. ITI-C
9 uses steering vector orthogonal to the hyperplane learned by binary linear classifier the activations from two sets of sentences. With a different approach, AURA by Suau et al. [18] dampens activations proportionally each neuron's 's ability classify toxic and non-toxic sentences, effectively mitigating toxicity. REPE, by Zou et al. [8) does require paired data, however, we place this algorithm single prompt pair.
in the weak supervision family since it computes steering vectors based Closest to our work, Lin-ACT [00 uses an affine map to steer activations. In Section 3 we discuss in more detail the differences between proposed LinEAS with Lin-ACT and other methods.
End-to-end Learning of Steering Maps
We propose LinEAS, method to optimize activation-specific interventions in joint manner. Our hypothesis is that a global estimation that exploits causal interdependencies between activations across layers is needed to maintain the model's utility while achieving the steering goal.
3.1 Interventions Setup and Distributional Loss
We consider generative model and target set of L intermediate activation layers. We describe the model as a composition of L++1 abstract pretrained functions, where the output, given an input prompt S, can be written as fL+1 fg ..... f1 (æ). For convenience, we denote de the dimension of the activations obtained at layer f, i.e., the size of the activation vector f o...o o (z). We interlace this pretrained computational graph of + intermediate frozen layers with comparatively much simpler vector-to- vector maps: o +++1 Ty, S3 o... T₂ fa o T, f (æ), where for 1 < E L,
the map Te d + dd acts on the intermediate activations observed after layer f, by altering its coordinates and outputting a vector of the same size.
Layerwise Distributional Losses. We consider two distinct probability distributions over prompts, the source distribution p and the desired target distribution q. For example, p and q could be such that sample from the source distribution p corresponds to toxic sentence, while sample from the target

---

distribution q corresponds to a non-toxic sentence (see Section 4.1 prompt through the lens of their sequence of activations. In practice, this means having access to samples x² .x" .." activations, either modified through interleaved transports for samples from p.
We then view each sampled
and y' ..... y" q. tracking their execution trace of their l S I. +
& T fe T ....o o fi 8 L.
(I)
or ran through the original network for samples of q:
nf = ft o ... fi L.
(2)
Our goal is to learn jointly all I. transport maps so that, for each S L, the families of vectors (L)); and (TT.) j are similar with respect to distributional metric A between probability measures, making the cost below small:
CIT (3.'))))
Σ (((E)))) E.L
Sliced Wasserstein Losses. To define A each layer, we adopt the approach of Rodriguez al. [10] and sum de univariate Wasserstein distances between the de marginal distributions at each layer This choice motivated by the fact that in the typical setting targeted in this work, we must deal with gigh-dimensionality low sample regime, de > N, that would hinder the use of more complex multivariate distributional losses that account more closely for cross-varias cross-variable effects. We observe that adding univariate quantities yields more robust loss estimation that translates to better downstream tasks than considering, e.g., Sinkhorn divergences [9
To define A at each layer, we adopt the approach of Rodriguez et al. [10] and use univariate Wasserstein distances between the d marginal distributions. The activations can be arranged as matrices U := [E] , ................................ {/] and V [n...... n,"), both in Rnxd, To compute their ID-Wasserstein distance 20 Chap. 2], these activations must be first sorted in increasing order along the feature axis:
Ü sUrt(U, axis 1), V sort(V axis -1)
to define the sliced Wasserstein distance 21 computed only on the canonical directions, namely:
A(U,V) = Σ WS 1 Σ v.1l.. 5=1
(4)
Differences with ITI-C, Lin-ACT and ReFT. Both ITI-C 9 and Lin-ACT 10 optimize each T independently across layers, minimizing a single distributional difference in closed form (Lin-AcT) or learning a linear classifier (ITI-C), and assuming all other layers are frozen. While arguably much faster, this also generates causal inconsistencies. which can be partially resolved as in Lin-ACT by using sequential approach: when Tę-1 is trained, Tp-1 is reused to recompute all activation distributions used for T. We claim that this suboptimality independent approach also precludes trade-offss when choosing which activations to turn on/off across layers, which we can easily be surfaced using sparsity regularizers. One fundamental difference with ReFT [12] is that LinEAS does not need paired data, i.e., sample y' does not need to be a counterfactual
blame for poor generalization. This
æ', which the case for ReFT. While counterfactual data important for applications like translation, there is vast amount of applications (e.g., toxicity) where paired data is not available.
3.2 Parameterization and Regularization
Building on the approach outlined by Rodriguez et al. 10 we propose to parameterize each map Tg as an affine map for each activation é < L, namely for 2 E Rd,, one has
(5) where is the element-wise product. We write w == (w)...., wp) and = (b,,.... b,) for the collections of all scale and intercept parameters. In what follows since each map T, is entirely parameterized through its scale/intercept parameters w, b, we overload notations to define
Tx(2) = W. O z + bes Wg, E RRd
C(w, b; (v'))) C(T, ..... T T (x'),, (v')

---

Sparse Regularization. We propose to use sparsity regularizer that will carry out both layer and within-layer selection of activations. This can be achieved by using structured regularization, using either 1-norms or 2-norms:
Ri (w, b) Σ 1 1/11 + lbell and Ro(w,
E de (1w 11/2 + 1| 12).
resulting in a sparse group lasso regularizer the cost to result in:
R. = RIR + ArRG. which can be added to 13 22
C(w, b) E [((w, (2'),, (3r);)] + +R((w
(6)
(x (x') (3r)
where y controls the amount of sparsity, i.e., larger y will result in fewer activations and/or layers being intervened on, with solution such that x 1 and b = O.
On the choice of sparsity hyperparameters We only consider two hyperparameters at the moment, A and ÅG. which is relatively small since LinEAS intervention models have none. Empirically, we found that tuning y E [0, with A = AG = 1 already provides interesting trade-off's between conditioning and utility as reported in Figures 4 and [ This also reduces the number of additional
hyper-parameterr to tune to just one (7) and enables automatic layer selection (Figure TO.
3.3 Optimization
Proximal SGD. We optimize L in (6) with proximal stochastic gradient descent (PSGD) with learning rate of 0.1 and cosine decay. We assume access to 2 sets unpaired N prompts (a') ) and (y') )= and run PSGD on minibatches of activations (4)); and (n))): : of size n. Note that activations originating from y use the untouched network, and can be pre-computed beforehand. In Appendix D
we provide details on the algorithm and proximal operators.
4 Experimental Results
4.1 Toxicity Mitigation in LLMs
We analyze the effectiveness of LinEAS at the important task of toxicity mitigation. To that end, we compare with prompting, CAA 77 ReFT [12., ITI-C g and Lin-AcT [TO] on three LLMs ranging from 1.5B to 7B parameters, by aligning the activations of N = 32 toxic to 32 non-toxic sentences sampled from the Jigsaw dataset [23].
Toxicity Metrics. We evaluate toxicity mitigation on the RealToxicity romppts (RTP) dataset 24 and
the Thoroughly Engineered Toxicity (TET) dataset (25). For RTP, we follow Rodriguez et al. [10] by sampling 1000 prompts from the dataset and let the model (intervened or not) complete them.
For TET, we use the 2546 prompts provided. Then, score the generations using the open-source Roberta toxicity classifier (RTC) (26). We report Tox and Tox generations flagged as toxic on RTP and TET.
RTP
TET the respective percentage of
Utility Metrics. To measure whether the utility of the model is affected by these interventions, we report PPLWIK, the perplexity obtained overall 5-shot accuracy on the MMLU compendium 28
fixed set of 20k Wikipedia sentences (27) well the
Oracle Baselines. In addition, we introduce two baselines that require strong supervision signal directly from the RTC oracle, i.e., the classifier used to compute test-time metrics, giving them a significant advatage. More precisely, train LoRA adapter and LoFIT [I] using the RTC labels, yielding the oracle methods LRTC-RL and LoFIT-RL. We report Table Tonly the results of LoFIT-RL- performed better than LRTC-RL (available in Table 7. See Appendix for details on the oracle training protocol.
Setup. All methods have access to only 32 toxic and 32 non-toxie sentences (unpaired). We optimize LinEAS for 1K steps using SGD and learning rate of 0.1. As we focus on the benefit of using an end-to-end loss, we use 7 0 for LinEAS (see Section 4.3 for 7's impact). For Lin-ACT and CAA, we use their default settings, and set intervention strength to À = For ReFT, we train for 10 epochs (selected with an epoch sweep). For ITI-C use À 0.5, obtained through grid search.
5

---

We evaluate toxicity mitigation by intervening upon different layers, and report the best overall layer type per method, namely *post. *layernorm for LinEAS and *o_proj for ITI-C and Lin-AcT, according to the Huggingface implementation of the models. Both CAA and ReFT intervene upon the residuals of the Transformer blocks, as suggested their original works. For CAA we run two baselines, intervening on all layers (reported in Table and intervening on the middle layer of each model (as in the original paper, reported in Table 7 given its worse performance). Additionally, we include prompting conditioning strategy, where the model is preprompted with "Continue the text in a non-toxic way:".
Model
Method
#Params
Toxgic (U)
Tox (4)
PPLwiK (4)
MMLU (t)
None
3.00
23.09 0.67
13.67
60.95
LoFIT-RI.
0.86M
0.37 0:06
4.36
14.12
59.74
Prompt
4.07
21.02 1.44
13.65
60.96..00
CAA*
0.043M
1.15
5.77 2.14
19.30
37.67 6.95
Qwen2.5-1.5B
ReFT
0.39M
2.57 0.00
18.17 3.04
15.58 0.52
58,84
ITI-c
0.043M
1.87 0.21
18.16 0.02
12.39 0.09
60.88 0.08
Lin-AcT
0.086M
1.50 0.35
13.88 1,72
13.88 0.16
60.09 0.25
LinRAS
0.086M
1.07 0.46
12.70 0.74
14.10 0.07
59.97 0.16
None
4.00 0.45
13.39 1.42
14.79 0.00
53. 33.03.pm 0.00
LoFIT-RL
0.11M
0.40 0:20
1.76 0.00
15.43 0.08
52.17 0.17
Prompt
4.60 p.50
0.38
12.32 0.67
14.81 0.00
53. 18 0.00
CAA*
0.06M
0.80 0.00
1.44
23.52 2.67
26, 0..8
Gemma2-2B
ReFT
0.54M
2.85 0.49
11.15
0.39
48.99 1.34
ITI-C
0.06M
1.17 0.60
0.15
14.00
52.78..25
Lin-ACT
0.12M
1.60 1.60
7.76
14.78 0.12
52.43
LinEAS
0.24M
0.73
4.02
15.46
52,22
None
3.92 0.59
2..16
10.67
74.26
LoFIT-RL
0.10M
1.10
0.10
10.91
73.87 0.17
Prompt
6.80
21.22 0.21
10.65...0
74..33..00
CAA*
0.10M
1.20
9.25 3.07
12.83
48.58 0.00
Qwen2.5.7B
ReFT
0.90M
3.33 0.98
20.38 2.37
13.80 1.20
70.43
ITI-C
0.10M
2.63 0.44
19.98 1.24
9.63
74.08 0.o5
Lin-ACT
0,20M
2.72 0.46
21.64 2.00
11.42..34
72, 0.16
LinEAS
0.20M
1.95 0.48
14.95 0.92
10.91
73.67 0.05
Table I: Toxicity mitigation on the RTP and TET datasets using three different models, Qwen2.5- 1.5B, Gemma2-2B, and Qwen2.5-7B. Strongly degraded utility is marked in red. We report results at low data regime (N 32 sentences estimate the interventions). See Appendix for more models, baselines and an ablation with larger training size and different intervention layers. Results for LinEAS improve significantly on ITI-C and Lin-AcT with similar impact on utility metrics. The quality of these interventions is often on par with the oracle baseline LoFIT-RL in terms of utility, although the strong oracle supervision yields better mitigation. *CAA and ReFT are designed to use paired data, which is not available in the toxicity setting.
Results. Table D summarizes the toxicity mitigation experiments averaged over 4 generation seeds (and RTP samplings). CAA and ReFT induce a stronger degradation of utility, invalidating their toxicity mitigation results. Note that both methods are designed for paired data, which does not exist in the toxicity setup, so we are not using them in their nominal setting, which affects their performance. Prompting is not effective for the models tested, and even increases Tox LinEAS achieves a consistent toxicity mitigation, outperforming all steering methods at this low data regime. For example, LinEAS reduces Gemma2-2B toxicity by 5.5x, getting closer the mitigation obtained with the oracle LoFIT-RI. In terms of utility. LinEAS shows a minimal degradation, with values very similar to the utility incurred by the oracle LoFIT-RL. In absolute terms, LinEAS reduces MMLU by less than point and increases PPLWIK by less than 0.6. In Table 9 (Appendix E we show that LinEAS is much more robust to the choice of layer than ITI-C and LIn-ATT Additionally, we also provide in Figure 3 (and ()) an analysis on higher data regimes, up to N = 1024 sentences, showing that LinEAS is also reliabl in such scenario. Beyond the differences in parameter sizes between ITI-c, Lin and LinEAS on the one hand, and the LRTC-RL approach on the other, we also note that the compute needed to train these methods is significantly different: the low data regime N = 32, estimating each method on Nvidia A A100-80Gb GPU and Qwen2.5-7B takes 37s (ITI-C), 30s (Lin-AcT) leveraging closed forms, 500s (I (LinEAS for 1K steps) and 27300s for LoFIT-RL, see Appendix B for a deeper analysis.

---

20
Nano
PP wi
LeeT RL (bcack)
20
Lin Ar?
Data (N)
Data [N]
Dusa (N)
Deta (N)
Figure 3: LinEAS effective at low data regime. We study toxicity mitigation (two left-most plots) and utility (two right-most plots) function of the amount of data available to learn interventions. LinEAS shows better performance (low toxicity and utility close to original dashed lines) for low data, and stable performance for N 2 32.
3.0-
20.5
11.3
Nour
74.74
LinEAS (000 stepe)
2.0
17.5
LinEAS (Tl stepe)
LiaEAS (MG) stepa)
10.8
12.5
10.5
70:07
0.001 RLOL 0.1 1 10
100
0.001
0.01
100
0.001
0.01
0.1
100
01001 D0L
0.1
1
10
LCO
Suppon 400 (In 50)
Supourt Jow (HN 5%)
Support dow (m
Suppor anno (In
Figure 4: Sparsity improves utility while mitigating toxicity. Toxicity results on Qwen2.5-7B using only 32 sentences, at different levels of sparsity y that result in different support sizes (x axis). At 1K optimization steps, with support of about 1 % we maintain similar toxicity (left, center-left) while PPLWIK decreases (center-right) and MMLU increases (right). Note that too long optimizations (10k steps) might harm utility, due to overfitting. Similarly, short optimizations (e.g. g., 100 steps) and strong sparsity leads to low conditioning (mild toxicity mitigation).
User Study, We complement the quantitative results with user preference study evaluate the perceived quality of continuations generated by different intervention methods. Our findings indicate strong preference for LinEAS over three other alternatives: Lin-ACT, ITT-C, and intervention (identity). Specifically, users preferred LinEAS in 57-70% of cases compared to 18.43% for Lin-ACT and 11.67% for ITI-C. We provide more details in Appendix
4.2 Effect of Data Toxicity Mitigation
With the same toxicity setting as in Section we ablate the amount of data used to estimate interventions using Qwen2.5-7B (best model studied in terms of MMLU). We sweep N from I to 1024, meaning we have access to toxic and N non-toxic sentences. Note that the results in Table [ correspond to N 32. In Figure we plot the evolution of toxicity (Tox and Tox and utility (PPLwIK and MMLU) as a function of N, averaged over random sweeps (standard deviation as shaded areas). LinEAS achieves superior toxicity mitigation maintaining utility close to the original model (horizontal dashed lines) and the LoFIT-RL oracle. Moreover, LinEAS's performance more stable for large range of N (32 to 1024), stable than the oracle which diverges for N > 128. Note that we fix the hyper-parameters for all the methods, including the oracle, which shows be more sensitive the training setting.
very low data regimes, while
more
4.3 Effect of Sparsity on Toxicity Mitigation
Intuitively one should only steer the smallest set of activations needed to achieve a desired goal in order to preserve utility and keep most of the model's inference graph untouched. In this section, we explore how sparsity affects toxicity mitigation in the setup Section 4.1 as we increase from 0 to 0.1. Increasing 7 results in less activations being transported, which measure as support [[( 11 (b - 0)llo. i.e., all activations transported either by rescaling or shifts.
In Figure we show how Tox RTP and Tox TET KTC. as well the utility PPL and MMLU, evolve as the sparse support decreases (x axis), for Qwen2.5-7B the low (N 32) data regime. We show the results of 3 sweeps of y with different random seeds (markers), and plot the average at
RIC

---

each y level (line). Note that at 7 = 0 the support is approximately 100%. In the case of IK steps (reported in Table[] I. one can afford reducing the support to about 1% and still maintain the toxicity mitigation values at 100% support. Interestingly, at these support values, the PPLwiK and MMLU improve, validating our hypothesis that smaller supports help preserve the utility. We also observe that short optimizations (e.g., 100 steps) lead to mild conditioning (poor toxicity mitigation) while long optimizations (e.g. 10k steps) lead to a gradual degradation in utility. In Figure [ (Appendix ( we show the same plot for the high data regime, with similar conclusions. Additionally, in Appendix L we study how the similarity of LinEAS interventions is correlated with human judgment, on pairs of concepts from the MEN dataset (2)), showing strong correlation when using sparsity. We provide similar analysis for T2I generation in Appendix H
Concept induction
Original
Concept deletion
Concept inducrion
Original
Concept deletion
Lin-tet LiBEAS
LIMIAS EOFAS LIBEAS LiBEAS LIFFAS
EioEAs
Robov
Figure 5: Generations using DMD2 30). (Left) Concept deletion using ITI-C, Lin-AcT and LinEAS for two different concepts. starting from prompts that contain the concept. LinEAS shows a more gradual deletion (A 0.4, 0.7, 1), and better preservation of the original image (A 0). (Right) Qualitative examples of LinEAS on 6 more concepts. We also show that inverting the steering maps surprisingly results concept induction, probably due to strong structure activation space. LinEAS also outperforms the other methods under this setting.
4.4 Steering Text-to-Image Generation Models
In this section, we explore how LinEAS can be used to remove the presence of concepts in text- to-image (T2I) generation: task that plays key role in generation alignment, similar to toxicity mitigation in LLMs. We preserve the focus on low data and compute budget, so we apply LinEAS to DMD2 33), recent single-step text-to-image generation model distilled from SDXL [11 with a GAN 32 loss. We note that there are diffusion guidance methods available to condition these models; however, they typically require multiple denoising steps (even up 200) [33 34] and, at
times, trajectory resampling and evaluation strategies [35]. These additional overheads make them suitable for settings with higher compute budget, which differs from the low-compute setting we interested in.
we modulate the strength of LinEAS applied to all layernorm layers by intro- ducing a scale < & when applying interventions. Intuitively À = 0 results in no intervention, while Ả= carries out full LinEAS transport, any value in between reflecting gradual change. Following Section 4.1 we focus on concept mitigation/removal and we use 32 samples for each the source and the target distribution. We train LinEAS for 1000 steps with batch size 4, AdamW, learning rate of 1e-4 and 7 = O. Find additional implementation details Appendix N We compare LinEAS with ITI-C and Lin-ACT, also weakly supervised methods that work with unpaired data.
Setup. As in 10
Data. We query an open-source LLM for a diverse set of prompts covering different con- ditioning categories and 5 different concepts per category with 32 prompts per concept, to- talling 480 prompts. Styles: vaporwave, lush, low-poly, ukiyo-e, fantasy; objects: robots, axolotl, book, car, hourglass; and perspective: macro, fisheye, bokeh,
8

---

1,00
Method
1 User Pref. 1 IMGSc. + CLIPSc.
ITI-C
5..4 %
0.24
0.19 0.02
IMG88ore
0.75
ITTc
Lin-ACT
7..4
0.45
0.18 0.03
LinEAS
6..36.6%
0.66
0.180.03
LinIAS
0.25
Table 2:
LinEAS mitigates concepts on
CLIPPeste
0.22
LinAcT
111-6
DMD2 [30] while staying perceptually similar to
LiFAAS
the original image. Users prefer LinEAS 63.3% of the time (left) since it maintains higher fi- delity to the non-intervened original model when using the same prompt (center), and matches other methods at concept removal (right), Results were obtained with À = 1 and they are aggregated across all concepts.
0.20
0.18
0.0
0.2
0.4
0.8
1.0
Conditiooing strength (A)
Figure 6: IMGScore and CLIPScore at multiple conditioning strengths (A). (top) LinEAS is more faithful to DMD2 with X = O. (bottom) LinEAS is more consistent and predictable mitigation.
underwater, and tilt-shift. We query the same model to obtain 32 neutral prompts used for evaluation. We provide complete description and the prompts themselves in Appendix O
Metrics. We measure (1) CLIPScore [36.. the cosine similarity between CLIP embeddings of the generated images and the concept description. (2) IMGScore, the cosine similarity between
DINOv2-small [37 image embeddings generated with À > 0 and images generated with À = 0 using the same prompts. CLIPScore assesses whether the generations are truthful to the desired style, and IMGScore whether they are perceptually similar to those generated without intervention.
User study. Aiming complementing the quantitative analysis, we also run a user study. We consider 20 prompts x 5 conditioning concepts, yielding total of 100 pairs. We generate an original image and steer it using ITI-C, Lin-AcT, or LinEAS on 5 concepts. We ask pool of 10 participants to select their preferred output (a total of 1000 evaluations), showing a strong preference for LinEAS, as reported in Table (left). The actual question asked to the participants "Which image blends best prompt and style, while remaining faithful to the untouched output?".
Results. Table 2 summarizes the results for the text to image evaluation. We found that 63% of the users prefer LinEAS (24.4% for Lin-ACT, and 12.4% for ITI-C). These results are in agreement with the automated metries: LinEAS is significantly more faithful the images produced by DMD2 with A 0 for the same prompts. with an IMGScore of 0.66 compared to 0.45 for Lin-AcT and 0.24 for ITI-C while all methods achieve a similar CLIPScore. We report more granular per-concept scores in Appendix N.2 Figure 6 explores how IMGScore and CLIPScore change with X. We find that in terms of IMGScore (top) while showing strong linear correlation with CLIPScore, making LinEAS more consistent and predictable.
LinEAS consistently more faithful DMD2 with
r!EEse. Surprisingly, inverting the affine maps in LinEAS: T.- (=) (2- be)
tends to
negate the conditioning thus switching from mitigation to induction and vice-versa (see "concept induction" in Figure 5). We speculate that this behavior is due strong structure in the activation space. Quantitative results using the inverse maps can be found in Appendix N.2 N.2
4.5 Layer Selection Analysis
To evaluate the robustness of LinEAS with respect to the choice intervened layers, we conducted a sweep over different layer types within the DMD2 UNet. The results, averaged over 15 concepts, are presented in Table 3 We measure image consistency using IMGScore (where higher better) and concept removal using CLIPScore (where lower is better).
Our findings indicate that while intervening on all layer normalization modules - the setting used in our main experiments provides the best trade-off between the robust performance across all tested layer configurations. This suggests that activation steering not overly sensitive to the specific layer choice in UNets.
two metrics, LinEAS demonstrates

---

Intervened Layers
# Modules
IMGScore
CLIPScore +
All Normalizations
256
0.714 + 0.054
0.131 + 0.033
Transformer MLPs
70
0.780 = 0.053
0.137 = 0.031
All attention K and Q projections
280
0.935 0.016
0.157 + 0.028
All attention V projections
140
0,818 = 0.051
0.140 0.031
All attention input projections
0.923 + 0.017
0.155 + 0.028
Resnet Normalizations
34
0.896 0.023
0.156 + 0.027
Table 3: Study on the choice of intervened layers for LinEAS in the DMD2 UNet. We report image consistency (IMGScore 1) and concept removal (CLIPScore 4), averaged over 15 concepts. The method shows robustness, with the default setting (all layer norms) offering the best trade-off.
Limitations and Open Problems
While the field of activation steering has gained considerable momentum there are some limitations that affect practically every method, including ours.
Compositionality. One such limitation is the ability compose multiple interventions (learnt separately) so that multiple steering objectives are satisfied at the same time. We refer to this ability as compositionality, and we argue difficulty lies in the fact that multiple interventions can interfere with one another and produce unexpected results. Our initial hypothesis was that sparsity could help mitigate such unwanted interference, since interventions for different concepts would on (almost) disjoint sets of neurons. In Appendix ! we present analysis where we intervene for two concepts simultaneously, with different sparsity ys. We find that LinEAS outperforms even prompting, which reinforces the value of steering for compositionality. However, the absolute values remain low: only 19% of the times both concepts are present simultaneously, while prompting only achieves 17%. We observe that most of the gain comes from the end-to-end optimization, which reaches 16% probability without sparsity, which is a 15x improvement over Lin-ACT (no end-to-end optimization). Adding group lasso regularization improves results of LinEAS by an additional 3 3%. These results show, on the one hand that compositionality is still a challenging task, and on the other hand that there is room to investigate more suitable sparse regularizers in order overcome the current limitations.
Intervention selectivity. Another common limitation of steering mechanisms that also affects LinEAS the intervention is applied to all tokens, usually with the goal of keeping inference cost in budget. Finding a way to selectively apply the intervention while avoiding adding inference cost (e.g.. avoid using classifier to decide on which tokens to intervene or not) remains an open problem.
6 Conclusion
We propose LinEAS, a novel framework to learn lightweight interventions on activations to model generation towards a desired property. LinEAS achieves state-of-the-art performance among steering methods safety applications, such avoiding toxic outputs, style changes, both for LLMS (Gemma2-2B, Qwen2.5-1.55 and Qwen2.5-7B) and text-to-image generation (DMD2). Our approach learns a set of univariate maps that reshape a source to a target activation distribution, with an improved loss that yields improved controllability and robustness. Unlike previous methods, such 9 which require local adjustments and manual layer selection, our method optimizes the transformation globally in an end-to-end fashion. We find that this global optimization makes LinEAS more precise than layer- wise training, where errors accumulate layer after layer. This makes LinEAS more effective with very low data (32 exemplar sentences from both source and target sets) while its distributional nature provides an intervention strength parameter that is continuous and bounded, making it more intuitive to apply. This approach also allows for the incorporation of flexible regularizers, such as group-sparse and sparse, allowing for automatic selection of layers and/or neurons, lcading to improved utility.
10

---

References
[1] Jason Wei, Maarten Bosma, Vincent Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M Dai, and Quoe V Le. Finetuned language models are zero-shot learners. In International Conference on Learning Representations, 2022.
[2] Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in Neural Information Processing Systems, 02227730-2774,, 2022.
[3] Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. 12X552 2022.
arXiv preprint
[4] Michael Luo, Justin Wong, Brandon Trabucco, Yanping Huang, Joseph E. Gonzalez, Zhifeng Chen, Russ Salakhutdinov, and Ion Stoica. Stylus: Automatic adapter selection for diffusion models. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, URL URL hattpss:/openreveet httppp//pppeurrreeeeeeeee//oooep net//forrumrdd=0022ttt
2024.
[5] Stefan Andreas Baumann, Felix Krause, Michael Neumayr, Nick Stracke, Melvin Sevi, Vin- cent Tao Hu, and Björ Ommer. Continuous, spbject-specific attribute control in t2i models by identifying semantic directions. 2024.
[6] Xavier Suau, Luca Zappella, and Nicholas Apostoloff. Self-conditioning pre-trained language models. In International Conference on Machine Learning, pages 4455-4473, PMLR, 2022.
[7] Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Matt Turner. Steering Ilama 2 via contrastive activation addition. arXiv preprint arXiv:2312.06681, 2023.
[8] Andy Zou, Long Phan, Sarah Chen, James Camphell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, top-down approach
Dombrowski, et al. Representation engineering: A transparency. arXiv preprint arXiv:2310001400, 2023.
[9] Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg. Inference- time intervention: Eliciting truthful answers from a language model. Advances in Neural Information Processing Systems, 36, 2024.
[10] Pau Rodriguez, Amo Blaas, Michal Klein, Luca Zappella, Nicholas Apostoloff, Marco Cuturi, and Xavier Suau. Controlling language and diffusion models by transporting activations, 2025.
[11] Fangcong Yin, Xi Ye, and Greg Durrett. Lofit: NeurlPS, 2024.
Localized fine-tuning on Ilm representations.
[12] Zhengxuan Wu, Aryaman Arora, Zheng Wang, Atticus Geiger, Dan Jurafsky, Christopher Manning, and Christopher Potts. Reft: Representation finetuning for language models. arXiv preprint arXiv:2404.03599 2024.
[13] Noah Simon. Jerome Friedman, Trevor Hastie, and Robert Tibshirani. A sparse-groue group lasso. Journal of computational and graphical statistics, 22(2):231-245, 2013.
[14] Zhengxuan Wu, Aryaman Arora, Zheng Wang, Atticss Geiger, Dan Jurafsky, Christopher D. Manning, and Christopher Potts. ReFT: Representation finetuning for language models. 2024.
URL arxiv. htrg/bbs/4400 03542.399222
[15] Elad Ben Zaken, Yoav Goldberg, and Shauli Ravfogel. BitFit: Simple parameter-efficine fine-tuning for transformer-base masked language-modee models. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), 2022.
[16] Edward Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Representations, 2022. UtI.https: /tttttppps//ppeeeeiieee het./oormmidd-nZeeWeeeeyyy

---

[17] Alex Turner, Lisa Thiergart, David Udell, Gavin Leech, Ulisse Mini, and Monte MacDi- armid. Activation addition: Steering language models without optimization. arXiv preprint arXiv:2308. 10248, 2023.
[18] Xavier Suau, Pieter Delobelle, Katherine Metcalf, Armand Joulin, Nicholas Apostoloff, Luca Zappella, and Pau Rodriguez. Whispering experts: Neural interventions for toxicity mitigation in language models. In Forty-first International Conference on Machine Learning. 2024. URL
https://openrevier:
[19] Aude Genevay, Gabriel Peyré, and Marco Cuturi. Learning generative models with sinkhorn divergences. In International Conference on Artificial Intelligence and Statistics, pages 1608- 1617. PMLR, 2018.
[20] Filippo Santambrogio. Optimal transport for applied mathematicians. Birkäuser, NY, 55(58-63::
94, 2015.
[21] Julien Rabin, Gabriel Peyré, Julie Delon, and Marc Bernot. Wasserstein barycenter and its application to texture mixing. In Scale Space and Variational Methods in Computer Vision: Third International Conference, SSVM 2011, I, Ein-Gedi, Israel, May 29 2, 201 1, Revised Selected Papers 3, pages 435 446. Springer, 2012.
[22] Jaehong Yoon and Sung Ju Hwang. Combined group and exclusive sparsity for deep neural networks. In Doina Precup and Yee Whye Teh, editors, Proceedings of the 34th International Conference on Machine Learning, volume 70 of Proceedings of Machine Learning Research. pages 3958-3966. PMLR, 06-11 Aug 2017. URL httpps::: /ttpps:/pproceedagss.. mlr prwsspressst / yoon17a. html
[23] CJ Adams, Jeffrey Sorensen, Julia Elliott, Lucas Dixon, Mark McDonald, nithum, and Will Cukierski. Toxic comment classification challenge, 2017. URL httpt::/kkgggllee com
[24] Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A Smith. Real- toxicityprompts: Evaluating neural toxic degeneration in language models. arXiv preprint arXiv:2009. 1162, 2020.
[25] Tinh Son Luong, Thanh-Thier Le, Linh Ngo Van, and Thien Huu Nguyen. Realistic evaluation of toxicity in large language models, 2024.
[26] Varvara Logacheva, Daryna Dementieva, Sergey Ustyantsev, Daniil Moskovskiy, David Dale, Irina Krotova, Nikita Semenov, and Alexander Panchenko. ParaDetox: Detoxification with parallel data. In Proceedings of the 60th Anmual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 6804 6818, Dublin, Ireland, May 2022. Association for Computational Linguistics. URL
org/ 2022 ac1 long. 469
[27] Foundation Wikimedia. Wikimedia downloads. URL httphhttt////tt http:///mppp./a/ www.:psss.wimmmmaa...
[28] Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. Proceedings of the International Conference on Learning Representations (ICLR), 2021.
[29] Elia Bruni, Nam Khanh Tran, and Marco Baroni. Multimodal distributional semantics. J. Artif. Int. Res., 49(1):1-47, January 2014. ISSN 1076-9757
[30] Tianwei Yin, Michaël Gharbi, Taesung Park, Richard Zhang, Eli Shechtman, Fredo Durand, and William T Freeman. Improved distribution matching distillation for fast image synthesis. In NeurlPS, 2024.
[31] Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. In The Twelfth International Conference on Learning Representations.
[32] Ian J Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014.
12

---

[33] Haotian Ye, Haowei Lin, Jiaqi Han, Minkai Xu, Sheng Liu, Yitao Liang, Jianzhu Ma, James Zou, and Stefano Ermon. Tig: Unified training- free guidance for diffusion models. In Advances in Neural Information Processing Systems, volume 37, 2024.
[34] Yingqing Guo, Hui Yuan, Yukang Yang, and Mengdi Chen, Minshuo an d Wang. Gradient guidance for diffusion models: An optimization perspective. In Advances in Neural Information Processing Systems, volume 37, 2024.
[35] Raghav Singhal, Zachary Horvitz, Ryan Teehan, Mengye Ren, Zhou Yu, Kathleen McKeown, and Rajesh Ranganath. A general framework for inference-time scaling and steering of diffusion models, 2025.
[36] Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: reference- free evaluation metric for image captioning. In Proceedings of the 2021 1 Conference on Empirical Methods in Natural Language Processing, pages 7514-7528, 2021.
[37] Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy V. Vo, Mare Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel HAZIZA, Francisco Massa, Alaacidin El-Nouby, Mido Assran, Nicolas Ballas, Wojciech Galuba, Russell Howes, Po-Yao Huang. Shang-Wen Li, Ishan Misra, Michael Rabbat, Vasu Sharma, Gabriel Synnaeve, Hu Xu, Herve Jegou, Julien Mairal, Patrick Labatut, Armand Joulin, and Piotr Bojanowski. DINOv2: Learning robust visual features without supervision. Transactions Machine Learning Research, 2024. URL httpps:/oppereviiss www.netttuuue www.orrummmdddnssuuueea a68SUt62Ft
[38] Alexandre Belloni and Victor Chernozhukov. Least squares after model selection in high- dimensional sparse models. 2013.
[39] E. Chzen, M. Hebiri, and J. Salmon. On lasso refitting strategies. Bernoulli, 25(4A)3315--3200 2019.
[40] Andreas Veit, Michael J Wilber, and Serge Belongie. Residual networks behave like ensembles of relatively shallow networks. Advances neural information processing systems, 29, 2016.
[41] Stanistaw Jastrzebski, Devansh Arpit, Nicolas Ballas, Vikas Verma, Tong Che, and Yoshua Bengio. Residual connections encourage iterative inference. In International Conference Learning Representations, 2018
[42] John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.0633: 2017.
[43] Masha Fedzechkina, Eleonora Gualdoni, Sinead Williamson, Katherine Metcalf, Skyler Seto, and Barry-John Theobald. Analyze the neurons, not the embeddings: Understanding when and where Ilm representations align with humans, 2025.
[44] Stephanie Lin, Jacob Hilton, and Owain Evans. Truthfulqa: Measuring how models mimic human falsehoods, arXiv preprint arX1v.2109.07958 2021.
13

---

NeurIPS Paper Checklist
The checklist is designed to encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No], or [NA].
[NA] means either that the question is Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justifiicton right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
The reviewers of your paper will be asked to use the checklist as one of the factors in their evaluation.
While "[Yes] " is generally preferable to "[No]", ", it perfectly acceptable to answer "[No] provided proper justification is given (e.g., "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). In general, answering "[No] or "[NA] is not grounds for rejection. While the questions are phrased in binary way, we acknowledge that the true answer often more nuanced, so please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We show with empirical evaluations that method is able to condition the behavior of LLMs as well as diffusion models with only 32 samples per set. We present results with comparison to baselines in Section 4
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should elearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer:
[Yes]
Justification:
We discuss the limitations and open problems Section
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
14

---

The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex: system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't It acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proof's
Question: For each theoretical result, does the paper provide the full of assumptions and a complete (and correct) proof?
Answer: [NA]
Justification: While the algorithm based on optimal transport theory and optimization there are no theoretical results that need a theoretical proof.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
Justification: We provide all the needed information to reproduce our results between Section and the Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data provided or not.
15

---

If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g.. with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g.. to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [No]
Justification: The data we use all publicly available and we intend to release the code as well. Unfortunately the code release will happen sometimes after the submission.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ mnips.cc/publlic//
pwt.huooommisiiooooococcc for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
16

---

Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification: All the details needed to train our method are reported in Section 4 and in the Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We compute multiple runs and report error bars. See for example Table (as well as all other tables) or Figure etc...
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [No]
Justification: One of the main objectives of our method was to enable steering with low compute resources. As a consequence we have not measured training or inference time as they would be tiny fraction of the time needed train any model. We do provide the number of additional parameters for each method tested which can give a rough idea the additional inference cost. We do provide hardware information in Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
17

---

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
Justification: Our research complies with the NeurIPS Code of Ethics
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We have added broader impact statement in Appendix ^
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g.. deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: We not releasing code models.
18

---

Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging. and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We have thoroughly reviewed all dataset and models licenses and acknow]- edging their use with proper citation.
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each
For scraped data from a particular source (c.g.. website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, pww.::s...aaseiiiii...... thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if has changed) should be provided. this information is available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer:
[NA]
Justification:
No new assets are introduced at this time (code will be released when ready).
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
19

---

Answer: [Yes]
Justification: We provide the exact question asked to the user in Section 4.4 There was no extra compensation provided.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: We only used small internal user study assess the preference of humans with respect to images. This does not require IRB approval.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing. editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [Yes]
Justification:
Our method involves conditioning the behavior of LLMs via activation steering.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non ntn-standard components.
Please refer to LLM policy httppp///baarrpppcccc///oeerreee for what should or should not be described.
20

---

A Broader Impact
This paper presents an algorithm that aims advance the field Machine Learning without specific application in mind.
Our objective has been to being less toxic), however, a malicious user with access to the model's activations could condition the model to behave in negative way, e.g.. forcing the model to be more toxic.
algorithm to condition models towards desired behaviors (e.g..
We believe however that such malicious user can achieve the same objective by simple prompt- engineering. On the other hand, our work could be used to put in place useful safeguards before deploying a model.
B Hardware and Compute Requirements
The experiments in this work computed single NVIDIA A100 GPU with 80GB RAM and they could also fit in an NVIDIA A100 with 40GB RAM.
Memory Consumption During training, LinEAS leverages backpropagation to compute gradients for its diagonal affine interventions. This design ensures that only activations relevant to intervened layers require storage during the forward pass, leading to substantially reduced memory footprint compared to full parameter tuning.
Compute Compared to local methods, the computational cost of LinEAS is primarily determined by the number optimization steps required for intervention training. While this can result in slower estimation times than some local approaches, LinEAS is notably an order of magnitude faster than the RL baseline. Furthermore, we demonstrate that LinEAS can achieve competitive results with significantly reduced computational resources, specifically using 10x fewer optimization steps (e.g., 100 steps, approximately 50s for estimation) than the full configuration presented the paper (Figure 4). This contrasts favorably with Lin-AcT's ~30s and dramatically outperforms LoFIT-RL's 27300s (Table Overall, LinEAS offers a positive trade-off between computational expenditure and conditioning performance.
Timing The table below summarizes the estimation time for each method and the number of steps used in submission.
Table 4: Estimation times for various methods and models.
Method
Steps
Gemma2 (s)
Qwen1.5B (s)
Qwen7B (s)
LoFIT-RL
100
7600
25900
27300
ReFT
10
92
80
100
ITI
29
30
37
Lin-AcT
17
14
22
LinEAS
1000
430
340
500
We have also timed DMD2 for T21 generation. The table below contains the total training time of ITI, Lin-AcT, and LinEAS on all normalization layers DMD2's s UNet. It interesting to see that when conditioning many layers, the difference in training time between LinEAS and other methods shrinks. This is because LinEAS leverages PyTorch's 's backpropagation, which is optimized compared to ITI and Lin-Act's layer-wiss wise estimation methods.
Table 5: Total training time for methods DMD2's UNet.
Method
steps
DMD2
ITI
26m 44s
LinAcT
25m 53s
LinEAS
1000
29m 27s
21

---

B.1
Detailed Complexity Analysis
Variables:
B: batch size
log B: sorting cost for optimal transport
F: cost of forward (backward) pass
N: Number of SGD steps
T: Number of logistic regression L-BFGS steps
1: Number of intervened layers
Computational Costs:
The computational cost of LinEAS is dominated by O(N (2F + Bog B))
The computational cost of ITI is O(F +I-T) where T is the number of logistic regression steps
The computational cost of Lin-AcT O(2F +1 log B)
Memory required during training:
M: Memory required by the model activations during the forward pass
L: Memory required to compute the forward pass one layer
D: Affine parameter weight matrix size
Memory Requirements per Method:
LinEAS: M + ID
LinAcT: L+
ITT: L++ D
C
User Study on LMs
conducted a user preference study to evaluate the perceived quality of continuations generated by different intervention methods. The study involved pool of 20 volunteers. Prior to participation, all individuals were explicitly informed about the nature of the task, including potential exposure to toxic and offensive content, and provided their informed consent. Each volunteer was then presented with 20 prompts sourced from the RTP dataset. For each prompt, users were shown four continuations, randomly ordered, generated by Qwen2.5-7B using the following methods: no intervention (identity), ITI-C, Lin-ACT, and LinEAS. The annotators' task was to select the continuation that was both the least toxic and most coherent overall.
The aggregated results of the preference study are summarized the table below, showing percentage of times each method was preferred, along with its standard deviation. Our findings indicate strong preference for LinEAS over three other alternatives: Linear-ACT, ITT-C, and no intervention (identity). Specifically, users preferred LinEAS in 57.70% of cases.
Table 6: Human Preference Study Results
Method
Identity (%)
ITT (%)
Lin-AcT (%)
LinEAS (%)
Preference
12.19 + 5.5
11.67 + 8.7
18.43 + 11.49
57.70 + 14.64
22

---

D Optimization details for LinEAS
See Algo. for the description single LinEAS optimization step. Recall that for vector R the proximal operators of the 1-norm (a.k.a. soft-thresholding) and 2-norm are given by:
and Prox+II-lla := (=(1-
T
(z) == sign(2) @ max( 0)
2.
(7)
|=|12/
Algorithm Proximal E2E Training Step.
1: Require: prompts (a*); (y'); ~ q. LR p.
2: (pre-) compute activations mi S n, l < L
> Eq.
3: compute activations lists E2 S l < L.
> Eq.
4: set loss C =0
5: for < do
> Forward Eq.
6: Z [ ......
{7]
E Ruxd
7: V = Ma... ..... 7i Raxd,
Eq.
8:
C+ C (Z V)
b E-layer loss, Eq.
9:
end for
10:
for l do
Iw 9b f V b,
Backpropagation >> Updates
12:
Wp. b t We p Iw. by Phh
We - Prox O 7T (wg 1) 1) +1
Eq.
b, 4.+ -rooxxAAllHll OT (b,)
Eq.
15: end for
E Toxicity Mitigation (extended results)
Table is an extension of Table I in which we include one more model, DeepSeek-7B. and more baselines. Specifically we include here another oracle baseline, LoRA adapter, that named LRTC-RL, and that is trained similarly to LoFIT-RL as explained in the main paper. More details on the training of these strongly supervised basclines can be found in Appendix
Additionally we include here CAA as proposed in the original work (i.e., intervening only on the middle layer rather than on all layers as shown in the main paper).
In Table 8 we show results analogous to those in Table 7 but in higher data regime, i.e., using 1024 sentences per set.
Additionally, in Table we show how the different activation steering methods perform in the setting of Section [..] when intervening different layer types (namely *poos__ __layernorm and +o +o-proj of the models' Huggingface implementation). We report results for the low data regime, showing that LinEAS is much more robust to the layer choice. Indeed, for *post_ t *_layernorm and models DeepSeek-7B and Owen2.5-1.5B. ITI-C and Lin induce toxicity slightly higher than the original one (marked red).
23

---

Model
Method
#Params
ToxRIC (L)
Tox (4)
TEE
PPLwIK (4)
MMLU (t)
None
3.00 0.64
23.09 0.67
13. 33.67 0.00
60.95 0.00
LRTC-RI.
0.54M
1.07 0.40
7.94 0.01
13.70
60.78 0.17
LoFIT-RL
0.8596M
0.37 0.06
4.36
14.12 0.07
59.74 0.14
Q1.5B
Prompt
4.07 0.388
21.02
1.40
13. 65.5 0.00
60.96
CAA (mid)
0.0015M
2.86 0.6a
23.33 1.25
13.69 0.02
60.47 0.18
CAA
0.043M
1.15 0.37
5.77 2.14
19.30 2.76
37.67 6.95
ReFT
0.39M
2.57 0.60
18.17 3.04
15.58 0.52
58.84 0.23
ITI-C
0.043M
1.87 0.21
18.16
12.39 0.09
60.88 0.08
Lin-ACT
0.086M
1.50 0.35
13.88 1.72
0.16
60.09 0:25
LinEAS
0.086M
1.07 0.46
12.70 0.74
14.10 0.07
0.16
None
4.00 0.45
13.39
14.79 0.00
53.03
LRTC-RL
0.8M
0.83
3.47
15.38 0.17
52.56 0.1
LoFIT-RL
0. 0.1065M
0.40
1.760.00
15.43 0..6
52.17 0.17
Prompt
4.60
12.32
14.81 0.00
53.18 0.00
G2-2B
CAA (mid)
0.0023M
4.93 0.42
14.04 0.52
14.88 0.02
51.49 0.51
CAA
0.06M
0.80 0.00
2.44 1.09
23.52
26.86
ReFT
0,54M
2.85
11.15 1.01
19.93 0.30
48.99 1.34
ITI-c
0.06M
1.17
7.15 0.92
14.00 o.11
52.78 0.23
Lin-ACT
0.12M
1.60 p.32
7.76
14.78 0.12
52.43 p.67
LinEAS
0.24M
0.73
4.02
15.46
52.22 0.40
None
4.30 0.70
18.62 0.51
8,49 0.00
48.31 0.00
LRTC-RL
1.7M
1.97 0.38
5.07 0.00
8.67 0.06
47.76
LoFIT-RL
0.2458
0.53 0.15
1.63
9.31 p.06
46.78 0.14
Prompt
4.20 0.70
15.65 0.82
8.51 0.00
48.23 0,00
D7B
CAA (mid)
0.0043M
4.72 0.64
19.07 0.98
8.73
44.76
CAA
0.13M
0.07 0.15
0.33 0.66
1000
23.14 0.34
ReFT
1.11M
2.25 1.04
10.39 6.01
51.58 40.2
11.1
ITI-C
0.13M
2.83 0.40
15.18 2.00
7.71 0.07
48.47 0.25
Lin-ACT
0.25M
2.23 0.69
11.08 0.78
8.67 0.03
47.71 0.27
LinEAS
0.25M
2.30 0.14
12.09 0.83
8,38 0.08
48.13
None
3.92 0.59
25. 25.16..92
10.67 0.00
74.26 0.00
LRTC-RL
1.26M
1.30 0.44
6.59 0.03
10.68 0.06
74.08 0.15
LoFIT-RI.
0.10M
1.10
7.11 p.30
10.91 p.16
73.87 0.17
Prompt
6.80
21.22
10.65
74.23
Q7B
CAA (mid)
0.0036M
4.00
22.32
10.66
73.45 0.14
CAA
0.10M
1.20
9.25 3.07
12.83
48.58 p8.58
ReFT
0.90M
3.33 0.96
20.38
13.80 1.20
70.43
ITI-c
0.10M
2.63 0.44
19.98 1.24
9.63
74.08 0.05
Lin-ACT
0.20M
2.72 0.16
21.64
11.42 0.34
72.18 0.16
LinEAS
0.20M
1.95 0.48
14.95 0.02
10.91 0.35
73.67 0.05
Table 7: Toxicity mitigation on the RTP and TET datasets using four different models, Q1.5B
Qwen2.5-1.5BB G2-2B: Gemma2-2B, D7B: DeepSeek-7B and Q7B: Qwen2.5-7B. Strongly degraded utility is marked in red. We report results at low (N = 32 sentences to estimate the interventions) the best intervention layers according See Table g Appendix for an ablation with larger training size. Results for LinEAS improve significantly ITI-C and Lin-ACT with similar impact quality metries. The quality of these interventions is often on par with the strong baselines LRTC-RL and LoFIT-RI, despite this approach being far more involved (both in terms of parameter size, access ground truth labeling oracle RTC, and compute).
data regime. For each method,
ablation study.
24

---

Model
method
# par (M)
Tox (L)
Tox (J)
PPLwIK
MMLU (t)
None
g.00
13.39 1.42
14.79..00
53.03
LRTC-RL
0.8M
0.50
1.68 0.01
15.78
52.45
Prompt
4.60
12.32 0.67
14.81 0.00
53.18 0.00
CAA (mid)
0.0023M
4.23 0.72
12.41 a.68
14.83
52.32
Gemma2-2B
CAA
0.06M
0.70
3.17 0.74
16.38
46.44
ReFT
0.54M
3.73
14.04
15.40
51.32
ITI-C
0.06
0.30 0.26
2.68
14.65
52.04
Lin-AcT
0.12
1.07 0.52
6.08 0.67
14.85
52.36
LinEAS
0.24
0.95..200
3.46
15.82
51.28
None
4.30
18.62
8.49 8.49
48.31
LRTC-RL
1.7M
0.90 0.30
1.95
8.80
47.28 (..8..5
Prompt
4.20
15.88 0.90
8.51 a.00
48.23
CAA (mid)
0.0043M
4.63 0.25
21.38 1.20
8.72
46.33
DeepSeek-71B
CAA
0.13M
0.10
0.08 0.16
> 1000
23.69 6.9.9
ReFT
1.11
4.83..75
17.76
12.34.0.65
33.22 33.222..5 4.55
ITI-C
0.13
1.77 0.40
10.70 1.14
7.79 0.09
48.20 0.15
Lin-AcT
0.45
9.399..4
8.77 0.70.
47.74..17
LimEAS
0.25
1.70
9.49 0.32
8.53
48.01 0.04
None
3.00 0.64
23.09 0.67
13.67 0.00
60.95 0.09
LKTC-RL
0.54M
0.67 0.40
g.93
13.91 0.08
60.70
Prompt
4.07 0.38
21.02 1.44
13.65
60.96 6.960..0
CAA (mid)
0.0015M
2.87 0.72
23.68 1.04
13.67 0.02
60.70 0.10
Qwen2.5-1.5B
CAA
0.043M
0.90
6.69 2.07
15.18 1.02
53.35 3.94
RcFT
0.39M
2.75 0.29
14.33 3.39
35.48 20.8
52.63
ITI-c
0.043
1.60
15.50
12.53
60.73
Lin-ACT
0.086
0.95
11.61
14.06
59.82
LinEAS
0.086
0.90 9.99
12.56
14.20
59.21 0.16
None
3.92
25.16 0.92
10.67 0.00
74.26
LRTC-RI.
1.26M
1.50
5.28 0.00
11.03
73.91
Prompt
6.40
21.22 0:21
10.65
74.23 00
CAA (mid)
0.0036M
3.88 0.23
22.87
10.64
73.86 0.04
Qwen2.5-7B
CAA
0.10M
2,00
11.24
11.18
68.59
ReFT
0.90M
3.65 1.32
22.70 2.39
17.42
60.35
ITI-C
0.10
2.33
18. 18.18
9.66
74.19 0.19
Lin-ACT
0.20
1.65 0.26
13.60 0.90
10.80
73.60 0.07
LinEAS
1.52 0.33
13.92
0.54
10.89..11
73.37 0:07
Table 8: Toxicity mitigation the RTP and TET datasets. We report results high (N 1024 sentences to estimate the interventions) data regime. We used 10k optimization steps, with mini- batches of size n 32. In the high-data regime, Lin-ACT achieves an outstanding 0.68 Tox Tox for Gemma2-2B. However, this method struggles at reducing toxicity for the other models. Conversely, LinEAS achieves similar (Gemma2-2B) or better (other models) RTP toxicity mitigation than in the low data setup, and with better MMLU than in-ACT for all models. Similary, LinEAS outperforms all other methods on TET toxicity mitigation by large margin.
25

---

Model
Method
Layer
RTP (1)
Tox (L)
PPL.WI (1)
MMLU (?)
None
*post_. _llyernorm
4.00 0.45
1.42
14.79 0.00
53.03 0.00
Gemma2-2B
ITI-C
.ppos_.. ___ayernorm
32
1.0
2.35 o..1
10.00
13.89 0.13
52.92,
Lin-ACT
*ppos_. + _layerorr
32
1.0
1.35
7.32 1.16
15. u5.0
51.52 0:30
LinEAS
4post_ + __layernorm
0.73 0.10
4.02 0.68
15.46
52 22.22 0.40
None
*post.. layernorm
4.30
0.61
8.49 0.00
48 0.00
DeepSeek-7B
ITT-C
*post_. layernorm
32
1.0
7.23
28.13 18.g..
8.85
45.82
Lin-ACT
*post_ + layernorm
32
1.0
5.62 0.95
24.29
9.37 0.20
45 45.95 0.04
LinEAS
*post_ + layernorm
2,30 0.14
12.09 0.83
8.38 0.05
48 13 0.07
*post. layornorm
3.00 0.64
0.67 19.35
13.67 0.00
60.95 0.00
ITI-c
*post_. layernorm
32
1.0
2.62 0.300
13.23
60.37 0.24
Qwen2.5-1.5B
Lin-ACT
*post_ + 1eyernorm
32
1.0
2.75 0.08
25.51
16.33 0.85
57.00
LinEAS
*post.. + layernorm
0.46
12.70 0.74
14.10
0.16
*post_ layernorm
3.92 0.59
25.16
10.67 o.00
74.26 0.00
ITI-c
ppost_. layernorm
32
1.0
2.88 u.ou
19.41
9.69
74.13
Qwen2.5-7B
Lin-ACT
*pstt_ + layernorm
32
1.0
2.77
20.57 1.30
11.61
72.21 0.08
LinEAS
*post. layornorm
1.88 0.10
15.39 0.00
9.25
73.56 0.07
None
eo_rroj
4.00
13.39
14.79
53.03 0.00
Gemma2-2B
ITI-c
*o_proj
32
0.5
1.17 0.80
7.15 0.52
14.00
52.78 0.23
Lin-ACT
so.proj
0.30
0.76
14.78 0.12
52.43 0.57
LinEAS
.o.proj
1.0
2.10
8.78
14.72
53.27 0.41
None
eo_proj
4.30
18.62
8.49
48.31
DeepSeck-7B
ITI-c
Lin-ACT
to_proj
to.proj
32
0.5
2. 2,83 0.40
2.23 0.69
15. 2.00
11.08 0.76
8.67 o.oa
7.71 o.07
47.71 0.27
48.
0.25
LinEAS
to_proj
1.0
2.30
8.46
8.61 o.06
46.35 0.37
None
eo_proj
3.00
23.09 p.67
13.67
60.95
Qwen2.5-1.5B
ITI-c
oo_proj
32
0.5
1.87
18.16
12.39 u.89
60.88 0.00
Lin-ACT
.o_pro]
1,50 0.35
13.88 1.72
13.88 0.16
60.09 0:25
LinEAS
*o.proj
1.50 0.29
12.03
14.04
59.53
None
eo.proj
8.92
25.16
10.67 0.00
74.26
Qwen2.5-7B
ITI-c
oo_proj
32
0.5
2.97 o:
20.68
9.56
74.20
Lin-ACT
*o_proj
2.25
66.04..99 0.95
10.77 0.09
73.56 0.08
LinEAS
*o_proj
2.00
13.58
12.52
71.34
Table 9: LinEAS is more robust to the layer choice. Toxicity mitigation on the RTP and TET
datasets, intervening on *xpost_. *__aayernorm and *o__pro layers. We report results low (32 sentences) regime, showing in bold the best toxicity result per model. When intervening on **post_ . +__aayenoom, both ITICC and Lin-ACT show poorer performance, specially for DeepSeek-7B and Qwen2.5-1.5B, where the toxicity goes even above the original one (in red). For #0 *o__roj, ITI-C and Lin-ACT ACT perform better. Overall, LinEAS shows strong robustness to layer choice.
26

---

Order of Magnitude of Interventions Parameters
To inform the scale of regularization terms, we plot descriptive statistics of the values of w and b, layer by layer.
-02 Leye
Laver
Uye
Laver33
180
1020 +231 +0.0
4048
si
502 +00
-411
200
20
in
200 2.5 20h
Layer
20
122
-22
23
Layer
lyp
30
Figure 7: Distribution, layer by layer, of recentered scale parameters w and b biases, for a converged of LinEAS, intervening on the 28 intervened layers of Gemma2-2B.
Sparsity and Refitting. When y >> 0, several coordinates of w, and by (parameters of T2) will collapse to or O, respectively. While this is desired, non-zero parameters typically suffer from shrinking, where the regularization terms R1, Rg dampen the effect of C. A typical solution to this phenomenon is to perform Mipost training steps updating only those non-collapsed parameters, We have not observed improvements when refitting parameters, and therefore do not use it. We observe that the entries of w/ and by have similar scales (see Figure 7 and choose to use the same regularization strength.
a practice known as re-fitting regression 38 39
G Effect of Sparsity on Toxicity Mitigation (extended results)
We complement the results shown in Figure this time measuring the effect of sparsity on toxicity mitigation when the transport maps are optimized with 1024 (source and target) sentences. The results and trends discussed in Figure also hold in this setup with more data.
22.5
3.0
31.2
71.0
Non:
2000-
LinEAS (100 atse))
2.0-
75.6
LinEAS (10k sapp))
10.04
20.8
1.0-
12.5
75.2
0.001
10
100
0.00
10 100
0.03
01001
100
50
Figure 8: Sparsity improves utility while mitigating toxicity, also in high data regime. Toxicity results on Qwen2.5-7B using 1024 sentences, at different levels of sparsity that result in different support sizes (x axis). With a support of 1%-5% we maintain similar toxicity (left, center-left) while PPLwIK decreases (center-right) and MMLU increases (right). Note that too long optimizations (30k steps) might harm utility, due overfitting. Similarly, short optimizations (e.g., 300 steps) and strong sparsity leads to low conditioning (mild toxicity mitigation).
27

---

H
Effect of Sparsity on T2I Generation
We ran sweep over sparsity coefficients on DMD2 (30 and report on Table I0 We find that T2I models are more sensitive than LMs to the sparsity penalty, almost saturating to either full support or no support outside the range [0.4, 0.8]. We hypothesize the UNet is more sensitive than the transformer because its activation maps are less redundant due to the changes in dimensionality as described by Veit al. 440 and Jastrzebski et al. [4]
Table 10: Effect of the sparsity coefficient on DMD2. Performance metries (support, IMGScore, and CLIPScore) at varying levels of sparsity. IMGScore generally increases with higher sparsity, while CLIPScore shows a slight increase.
sparsity
support( %))
IMGScore %%)
CLIPSCore(%).
0.0
10010.00
71.425.5
13.123.2
0.4
92.7+15.0
84.7=6.0
14.5#2.9
0.5
76.7=14.0
89.5=6.3
15.0#2.9
0.6
51.6::22.1
94.8=3.6
15.5+2.8
0.7
13.8
98.9
16.0+228
0.8
3.3
99.6+10.4
16.14288
1.0
0.0++0.0
100+00.0
16.1+2.9
I RLHF Implementation Details
perform parameter-efficient adaptation of our baseline models with Huggingface's implementation of LoRA in their PEFT library and Huggingface's implementation of the PPO reinforcement learning algorithm in their TRL library. For each sample size in Table [ we performed an hyperparameter search and chose the hyperparameters that yielded best validation toxicity scores at perplexity close to LinEAS. Following Ouyang et al. (2). we fine-tune the models using proximal policy optimization (PPO) 42 the same N 32 data and use RTC (Roberta toxicity classifier) We instantiate the reward model with the Roberta toxicity classifier from Logacheva et al. [26] used for evaluation (RTC in Table : model and the LoRA model as the policy; we add an off-the-shelf value head from TRL to the policy estimate the value function. We follow the original LoRA implementation and only fine-tune fk, q, o} oppproj layers while keeping the MIPs frozen. The summary of hyperparameters can be found in II
reward model.
use the base model without LoRA weights the reference
Hyperparameter
Values
Best 32 Samples
Best 1024 Samples
global_epochs
{10, 15, 20}
10
15
ppo_epochs
{1, 10, 20,
20
20
learning_rato
{10 1004.,5 10 10 10-53
10
10
batch_st batch_size
(32, 64, 128)
32
128
mini Sini_batch_stte size
{16, 32, 64)
32
64
lora_rank
(2,4,8)
2
2
Table 11: List of hyper-parameters used to train PPO for 32 and 1024 samples. Unless otherwise specified, we use [RL's defaults. memory constraints. We did not use gradient accumulation. We found the learning rate and global_epochs to be the most important syper-parameters Low learning rate for few epochs leads to underfitting while high learning rate for many epochs tends to overfit.
could not use a mini-batch size greater than 64 due to
Composition of Interventions
We evaluate in this section the ability to compose two LinEAS maps pre-trained independently on two concepts. Our goal is to assess whether they can be composed, at the level of each activation, to induce both concepts. Achieving concept composition in activation steering is open goal,and
28

---

1.0
0.5-
Premprnng LiwAeT
5 0.-
0.6-
0.6
1iPF48 DA O
LinEAS (A 0. Ap lerty
0.4
0.4
0.4
LiRRA8 (Ay lert Ay
1inRA8 (A lert Ap tert)
00-
0.01
0000
Stigle mape, ande poob
Comppsed
stnll prob
Composed poob
Figure 9: LinEAS obtains composable maps. We benchmark Lin-ACT and LinEAS for various regularization strengths y on compositional task. We train each method to model distribution shifts towards certain concept с taking in a list of 5 concepts. (Top-left) We measure, using LLM as a judge, whether sentences formulated using that trained shift do contain that concept. We obtain for each concept a probability, that we then aggregate using violin plots. (Top-middle) We pick two concepts e₁ and 62 randomly, train separately their maps, and compose them. We then measure the probability of finding C1, and then C2. in the generated content, using the composition of both maps (in both orders). (Top-right) We now measure the probability of finding simultancously both concepts in the generations. As can be seen, the composition of LinEAS maps (learnt separately for 2 concepts) yields an average 15x (right) higher probability of including both 2 concepts in the same generation, with respect Lin-ACT, and 3.1x increase in generating at least one of the concepts (center). Interestingly. Lin-AcT obtains slightly better probability when using only single-concep maps (left), but these fail at composition. Additionally, note that sparsity in LinEAS is beneficial for compositionality. increasing the joint concept presence from 0. 16 to 0.19 when using group lasso.
our hypothesis is that sparse and end-to-end LinEAS maps affect minimally the model, facilitating composisition.
Setup. For each of the concepts day, night, floohant,football and fishing, we generate N = 50 diverse sentences using Gemma2-27B that contain that concept, to form five target (q:). Additionally, we ask Gemma2-27B to generate 50 diverse sentences about generic situations, forming a single source distribution p. We then learn five steering maps, from p to each of the q: distributions, using both Lin-ACT and LinEAS. For LinEAS we test all combinations of a = 0, 1e and A = 0, le to assess the impact of sparsity. Equipped with these five concept maps, we compose them for each pair of concepts C1, C2 as follows: c100a (z) := T, (T (z)). Note that T, 1100 # T, 0a Following Rodriguez et al. [00, we intervene on Gemma2-25 by generating 200 sentences that follow the prompt Once upon time and we measure the presence of the concepts in the generations in L.LM-as-d -ssa-jugge manner, querying Swwe2.5-7B-Innsree
More precisely, we query about: the presence of a concept in each generated sentence, when using the map trained with concept the presence of concept c, when using the map trained with that concept and any other; the presence of both two concepts Ci, 02 in the same sentence, yielding p(c1, 02), using either T,0000 or T, 1,00,
Results, comparing interventions. Figure (top) plots the three probabilities described above. In particular, the right plot shows p(c1, C2 T ), i.e. the probability of observing both concepts in the same generated sentence, using the composed map. Lin-AcT is able to generate concepts using single-concept maps (left plot) with average probability of 0.82 vs. 0.73 using LinEAS without sparsity. We also observe that increasing the sparsity (larger As) slightly diminishes the presence of concepts when using single-concept maps. However, we observe drastically different picture when using combined maps: (middle) that probability goes from a Lin-ACT average of 0.17 to around 0.52 with LinEAS (3.1x increase). Most importantly, the joint presence of concepts probability (right) goes from 0.013 for Lin-ACT to 0.19 (15x increase) for LinEAS with group lasso regularization (both X1, Å used). See Appendix D for generation examples. These results show that LinEAS learns maps that are easier to compose than those from Lin-ACT. Indeed, composition of Lin-ACT maps is very brittle. While LinEAS achieves much stronger compositionality, still room for improvement on this important problem. We provide qualitative examples in Figure [.
results show that there is
Results, prompting as baseline. We prompt the LLM to complete a generation with two concepts using "Continue the following text, make sure concepts [cl] and [c2] appear in the continuation: Once upon a time". We observe that the mean probability of:
generating either of the concepts (middle plot) is 39% with prompting/ 52% for LinEAS.
generating both concepts (right plot) is 17% for prompting/ / 19% for LinEAS.
29

---

In light of these results, we conclude that prompting is strong baseline, since it has direct access the concepts in textual form at generation time. However, LinEAS achieves better compositions without such direct access.
J.1 Composition of Interventions: Qualitative Results
We show qualitative results using composed maps as detailed in Appendix y In Table 12 and Table 13 we include generations that were marked as containing both concepts using LLM-as-a-judge (Qwen2.5-7BB IIInstuucc).. We compare Lin-ACT and LinEAS (with y le 4).
Table 12: Generations inducing both concepts Fishing, Elephant. Only the provided 2 generations for Lin-ACT were marked as containing both concepts using LLM-as-a LL---as---udde, out of 200. Conversely, 25 sentences generated by LinEAS contain both concepts. Note the stark difference quality, LinEAS achieves high quality generations with composition.
Composition
Method
Generation
Fishing Elephant
Lin-AcT
Once upon time, the <<strong><em>>>nnee <uffa the bull elephant's foot she made a small <strong>putty as the water as she nosed the bank of the river as the water, the as the swarong>>wwyinn on the water she stood in the shallows, the <strong>>as the water [...]
Fishing Elephant
Lin-ACT
Once upon a time, large, gray, as it was the bull as it snorted in the water as it struggled to break the line of the bank as thrashed in the water, a small stream of water, as it made a final sprint, the water, as it snorted noisily, the water the river [...]
Fishing Elephant
LinEAS
Once upon a time, a man was fishing in the river when he saw a beautiful, pink baby elephant walking towards him. The elephant was thirsty and the man offered him a drink of water. The elephant was grateful and splashed some water on the man's 's face.
Fishing Elephant
LinEAS
Once upon time, huge elephant's tusk broke the water, his trunk splashing in the shallow river. "Hup!" he called, his tail swished against the muddy bank. I watched from the shore, my fishing rod dangling in the water.
Fishing Elephant LinEAS
Once upon a time, the elephant's 's trunk broke the water, his massive body rising and disappearing. The jungle rumbled in the distance, their long tusks scraping against the mud. It was a young calf, its small, wet back. The fisherman sat on the bank, his swinging lazily in the shallow water. small fish
30

---

Table 13: Generations inducing both concepts Night, Football.
Composition
Method
Generation
Night Football
Lin-ACT
Once upon time, little girl's dream came true. It was the first night of the 2013-14 14 season and the young forward had just scored her first goal for the first team. The ball had nestled in the net in the 15th minute of the game, and the 16-year-old ooy couldn't it believe her luck.
Night Football
Lin-AcT
Once upon time, there went out to play in the rain. It was a cold, wet night, and the rain was pouring down, but the didn't 't let it dampen his spirits. He was and he knew that he had to make a late, late goal to seal the victory.
who was determined win the game, he
win the game,
Night Football Lin-ACT
Once upon time, I was happy camper. was in the middle of long drive through the woods, the sound the wind whistling through the trees. The air cool and the sun setting, casting a warm glow over the forest. As I drove, couldn't 't help but feel sense of excitement, had just won the race to the finish line, the ball bouncing off the net, and the ball was heading for the goal.
Night Football
LinEAS
Once upon time, in the night, the lights of the field illuminated the players. The crowd roared excitement, their voices echoing off the stands. was the final whistle, and the opposing team celebrated, their coach shouting with joy.
Night Football LinEAS
Once upon time, the "Let's 's go Rangers!" could be heard through the dark, cold night. The home crowd cheered and the ball flew past the goal, sending a shower of confetti into the air.
Night Football
LinEAS
Once upon a time, the sun set on the field of grass. The opposing teams were locked in fierce battle, the crowd roaring with excitement. It was the opening goal, and the referce blew his whistle, signaling the end of the game.
K Group Sparsity Trade-offs
We consider the interventions learned with Gemma2-2B for the concepts day, night, foothll,, and fishing, but set both A1 >> 0 and ÀG >> 0, enforcing a sparse group regularizer. Figure I0 shows how the proportion of intervened units, out of their entire support, is distributed across layers. Since we are plotting proportions of the support, differences between models in terms of the absolute number of impacted neurons are not reflected. Rather, the plot allows to grasp how regularization, and notably group regularization, impacts layer selection. An important finding of this experiment is that we do observe, for high group regularization regimes, that very specific layers are consistently selected to induce diverse concepts. Additionally, we posit that this grouping of neurons certain layers impacts positively efficient transfer concepts, notably when investigating compositionality.
31

---

-... Jert Ap bett
1877 Ie be
Layars
(a) LinEAS Distribution of support layers (biases). Post Feed-Forward Layer Norms.
Aur Temil Ag Iert, Ap
of
13
17
14
24
Layers
(b) LinEAS Distribution of support across layers (biases). Post Attention Layer Norms.
Ag Ien! Lert,
1600
5.0
2.5
16
11
13
14
15
17
16
19
21
22
Layen
(c) LinEAS Distribution of support across layers (weights). Post Feed- -orwwrd Layer Norms.
Ag 2end Lert, Ag Genk
16-
15.
of support
13
14
27
18
20
Layers
(d) LinEAS Distribution of support across layers (weights). Post Attention Layer Norms.
Figure 10: LinEAS Distribution of support across layers. Each subfigure shows the percentage of intervened units (out of the total support) across layers for different regularization strengths, averaged over concepts (with 50% quantile range).
L Similarity of LinEAS Interventions with Human Judgment
We draw 50 concepts, from the MEN dataset
29 resource of 3,000 word pairs annotated with human similarity judgments (see also Fedzechkina et al. 43 for study on LLM interpretability building on the same resource). With these 50 concepts, we can recover 20 word pairs annotated for their similarity in the MEN dataset. We train LinEAS interventions for each concept Gemma2-2B. We then ask: do we recover similar interventions for similar concepts, and does sparsity help? We can answer positively to both: highly similar concepts have highly similar interventions; and enforcing sparsity through our scheme improves that correlation.
To measure this, we compute the average sparse support of interventions (shown as y-axis in Figure I.I. We compute the similarity between the intervention vectors for each word pair, focusing on blases first: S {sim(ba1. b hveigte2 (on the left in Figure 11 Finally, we consider the human similarity judgments 8hom reported the MEN dataset for each word pair, and compute their correlation with the intervention similarity, corr(s Shum). We do the same for the weights, in this case through o (on the right Figure TT and ). The numbers in the scatterplots in Figure [T correspond to the LinEAS regularization parameters λ1 ÀG-
32

---

Note that sparsity helps improve correlation beyond the non-sparse version of LinEAS (noted as 0:0, with support of 100% in Figure TI.. Overall. LinEAS shows a strong correlation with human judgment.
Spenit Interpentabiiry (Buses)
Spanily Map Incoportablly (Weghss)
Alcieg Sapte Nec
Corclaize farnn distanity jalgnents
drddant jalgrint
Figure 11: Scatter plots showing the correlation of interventions with human similarity judgment. We show the correlation with bias similarity in the left plot and with weight similarity on the right plot.
In Figure 12 we show the same results in form of matrix, showing that sparsity indeed helpful to improve correlation with human alignment.
Comdlttio with sumnn juggents (brazes)
Conoliiio on with hurar jadgmant (weiggnnnnweeegtti
066
0.01
8:16
0.02
3:00
0.11
.0.14
0:06
-2.20
05
0.091
1272
0.52
0.001
0:11
0.20
0.17
03
0.0001
0.0001
0.1
40
-0.2
-02
0.001
0.02
601
Figure 12: Heatmaps aggregating scatterplot results above but with a different view. We observe that
highest correlations are obtained with a suitable regularization strength, for biases \ 10-3 À = 10-4, for weights A 10-4 Ag = 0.
M Additional Experiment: Inducing Truthfulness in LLMs
In this section, we complement and corroborate our insights from the experiments on toxicity mitigation in Section 4.1 with additional experiments inducing truthfulness in LLMs, using the
TruthfulQA benchmark [44). In particular, we investigate how well LinEAS achieves to induce truthfulness this benchmark in comparison to Lin-ACT, its strongest activation steering competitor
from Section
For LinEAS, we apply the intervention again to the post layernorm layers, while for Lin-ACT, apply them to all layernorm layers as this was reported as optimal for Lin-ACT for TruthfulQA experiments in Rodriguez et al. [10]. We use 2-fold cross-validation on the 817 questions of the multiple choice part of the benchmark and learn the intervention on the concatenation of training fold questions concatenated with either incorrect (source) correct (target) multiple-choice answer options. We report both MC1 and MC2 of TruthfulQA, and monitor overfitting on the TruthfulQA task by also evaluating MMLU 5-shot accuracy (88
The results can be found in Table 14 We see that both methods can successfully induce truthfulness when presented with enough samples to learn the interventions, increasing the accuracy by up to
33

---

almost 5% (7%) MCI (MC2) in the high sample regime when 1024 samples are available. Overall the highest increases can be achieved with Lin-ACT, but only for the high sample regime. In the low sample regime, where only 32 samples are available, Lin-ACT tends to fail catastrophically: either it gets lower accuracies on MC1 and MC2 than even the unintervened model (Qwen2.5-7B. Qwen2.5-1.55 1.55B,,, or it fails completely on MMLU (Gemma2-28). LinEAS on the other hand does well also in this low sample regime, and achieves second best overall performance on the Qwen models with only 32 samples available to learn interventions.
Model
Samples
Method
MCI Acc. (%) (t)
MC2 Acc. (%)(1)
MMLU (1)
None
37.82 0.00
52.14 0.00
74.26 0.00
Lin-ACT
32.17 0.66
47.69 0.87
59.22 1.74
32
Qwen2.5-7B
LinEAS
40.10, 0.37
55.74 0.31
73.88 0.07
Lin-ACT
42.59 0.50
58.92 0.82
73.79 0.14
1024
LinEAS
39.560.13
55.20 0.15
73.88 0.02
None
30.23
43.70
60.95
Lin-ACT
27.22 1.38
42.64 3.17
32.10 1.95
32
Qwen2.5-1.5B
LinEAS
32.26 0.65
46.07 0.63
60.34
0.12..
LIn
32.90 0.36
47.17 0.61
60.17 0.18
1024
LinEAS
31.77 0.11
45.31 0.20
60.41 0.01
None
21.18 0.00
33.05 0.00
53.03
0.00
Lin-ACT
24.94 1.15
40.95 1.29
27.59 1.09
32
Gemma2-2B
LinEAS
24.21
0.85
38.09 1.14
52.08
0.16
1024
Lin-ACT
25.65
0.53
39.73
0.49
31.40
0.17
LinEAS
23.82 0.19
37.80 0.53
52.37 0.05
Table 14: Results on TruthfulQA. We report results at low data (32 samples to estimate the interven- tions) and high (1024 samples) regimes. Results are averaged over five random seeds.
34

---

Additional details and results on text to image generation
N.1 Additional qualitative results with LLM--generaed prompts
We extend here the qualitative results mitigating and inducing styles on the 15 concepts described in Appendix [ Figures to compare Lin-ACT, and LinEAS. Both the diversity and (human) perceptual quality of the generations is higher with LinEAS. We observe stark differences between both methods' generations. Figures to to 18 show additional generations with LinEAS with more granular strengths.
Note that all the generations start from the same prompt, with the concept of interest appended in the form of textual tags. It is interesting to see that LinEAS recovers an image conforms with the prompt without the concept Lin-ACT.
1, Also, observe how LinEAS's generations much more gradual than
We also comment the surprising results obtained when inverting the LinEAS lincar maps. We observe how the concept increases, and LinEAS shows much higher quality and coherence under this regime. This points the fact that LinEAS is better exploiting the underlying structure in activation space.
35

---

Concept induction Original
Concept deletion
Concept induction Original Concept delction
LinAeT
LinEAS
acoloat
Linder
LinEAS
LinAcT
LInEAS
LinAeT
LIBEAS
Car
LiNAT
LinEAS
LiNAeT
Baheys
LiDEAS
EiRAST
LinEAS
Inurgiian Iow-poody
LiNAST
LinkAs
LinAeT
Link.A
LinAeT
LIBEAS
LinAeT
HIDEAs
LinACT
LIBEAS
mit-shil 1
LinAet LENET LinATT
LIBEAS
JIDEAS LinEAS
Figure 13: Images generated with Lin- ACT (left panel) and LinEAS (right panel) with the prompt A grand castle sits atop hill overlooking valley. [concept tag/ Each row contains different conditioning concept to be mitigated by the steering method and each column different intervention strength (A). Each column contains a generation and the columns to the left of "original" contain generations using T - (z).
1.0, 0.8, 0.6. 0, 0.6, 0.8, 1.0 respectively
36

---

Concept induction Original
Concept deletion
Concrpt induction Original Concept delction
LindeT LinAeT
acolott
bakech
LinAeT
book
LinAeT
Car
LiNAe
funtasy
LiAACT
Boboye
EIAAT
hourglon
LiNACT
low-pooly
LinAeT
LAEAS
LinAer
mazro
LinACT
LIBEAS
robul
LinATT
LIBEAS
Oll-sbil ukatv-
LinAeT
LIDEAS LInEAS LIBEAS
LinAet LiNAT
Figure 14: Images generated with Lin-ACT (left panel) and LinEAS (right panel) with the prompt A bustling city street at twilight, lights blurring. [concept tag/ Each row contains different conditioning concept to be mitigated by the steering method and each column different intervention strength (A). Each column contains a generation for > [1.0, ..., O, ..., 1.0) respectively and the columns to left of "original"" contain generations using T. (z).
37

---

Concept induction Original
Concept deletion
Conerpt induction Original Concept delction
Linder LinAeT
LIBEAS
LIBEAS
bokec
LiDACT
LIBEAS
book
LinAeT
LIBEAS
CAr
LINAT
LiBEAS
Tuitaay
LIAAT
LIBEAS
EIBACT
LInEAS
haurglinn how-yoodt
LIBAST
LIBEAS
L.nACT
L
LinAcr
LIMEAS
maLrO
LinACT
LIDEAS
robut
LiNACT
LIBEAS
Gll-shitt ukite-e
LinAeT LIMET LiSAeT
LIBEAS LInEAS LIBEAS
Figure 15: Images generated with Lin-ACT (left panel) and LinEAS (right panel) with the prompt filtgriiiltt filtering through the trees. [concept tag/ Each row contains different conditioning concept to be mitigated by the steering method and each column different intervention strength (A). Each column contains a generation for [1.0. ..., 0, ..., 1.0) respectively and the columns to the left of "original"" contain generations using T (z).
A snow-covered forest with sunlight
38

---

Concepi indoction
Original
Cincept dekcion
1IMLAN LEEAS LIEAN LIBRAS LIBRAS LIBEA HIMAS LimEAS
Inbaa
Tonk
Tulles
Ineriaa Ireepely
FIBESS
LinEAS LIMAS
Limtas LIBEAS
LIBAS LIEAS
Figure 16: Images generated with LinEAS with the prompt A starry night sky over calm lake.
[concept tagl Each column contains images generated with different steering strength for mitigating the concept corresponding to the row: = [1.0. .... .... 1.0). Images to the left of "original" were produced using the inverse steering map T (2).
39

---

Concepi induction
Original
Cincept dekcion
LSEAS TIEAS LIBRAS LIBRAS UIBAS HIRAS LIBEAN
LIBLAS
LIBAS LIEAS LImEAS LIBEAS LIBAAS LILAS LIMLAS
Figure 17: Images generated with LinEAS with the prompt A fruiting apple tree on top of a hill.
[concept tag/ Each column contains images generated with different steering strength for mitigating the concept corresponding to the row: = [1.0. .... O. 1.0). Images to the left of "original" were produced using the inverse steering map (2).
40

---

Concept induction
Original
Cincept dekcion
LSEAS TIEAS LIRASS LIBRAS LIBEAN LIMEAS LIBEAS
Tutlass
LIBAA LIEAS LIBEAS LIBEAS LIBEAS LIBAS LIMLAS LIMLAS
M8-10 ubove UHIL
Figure 18: Images generated with LinEAS with the prompt A majestic lion rests on a rocky outcrop. [concept tag] Each column contains images generated with different steering strength for mitigating the concept corresponding to the row: X = [1.0, .... .... 1.0). Images to the left of "original" were produced using the inverse steering map T (2).
41

---

N.2 Detailed Quantitative Results
Here we report detailed per-concept ImgScores and ClipScores for ITI-C, Lin-AcT, and LinEAS both for the forward ((T) (2)) and inverse ((I₂ (z)) application of the steering (Table 15). Remarkably, we find that inverting the steering operation tends induce the concepts that these methods mitigate when they are not inverted.
T₃(+)
T
(2)
Task
Intervention
"ClipScore Soore
MmmgSoore
[ClipScore.
ITI-c
0.13
0.17 0.02
0.26
0.27 a.02
Axolou
Lin-AcT
0.35
0,15 0.02
0.28
0.29 0.06
LinEAS
0.56 0.23
0.16 0.04
0.60 0.19
0.23 0.05
ITI-c
0.38 19
0.18 0.02
0.33
0.24..02
Bokch
Lin-AcT
0.55
0.18 0.02
0.31
0.24 0.24..00
LinEAS
0.75
0.18
0.62
0.24
ITI-C
0.37 0:20
0.19 0:01
0.45
0.21 0.02
Book
Lin-AcT
0.62
0.18 0.01
0.49
0.22 0.01
LinEAS
0.80
0.17 0.02
0.78
0.19
ITI-C
0.18
0.19 0.02
0.43
0.24
Car
Lin-AcT
0.37
0.18 0.02
0.42 0.20
0.23 g.02
LinEAS
0.78 n.33
0.18 0.08
0.81 0.12
0.19
ITI-C
0.12
0.20 0.01
0.35
0.21 0.02
Fantasy
Lin-AcT
0.49
0.20 0.02
0.52
0.23 n.03
LinEAS
0.72 0.16
0.18 0.002
0.73 0:15
0.21 0.02
ITI-c
0.40
0.20 0.02
0.21 0.13
0.25 p.01
Fisheye
Lin-AcT
0.49
0.20 0.02
0.26
0.25 0.00
LinEAS
0.68 0.14
0.20 0.02
0.51 0.16
0.24 0.02
ITI-c
0.16
0.20 0.02
0.57 0.26
0.30 0.01
Hourglass
Lin-ACT
0.29 0:25
0.17 0.002
0.60
0.29 0.01
LinEAS
0.54 0:23
0.20 0.04
0.74 0.19
0.27 0.03
ITI-C
0.12
0.19 0.02
0.50
0.23 0.02
Low-poly
Lin-ACT
0.39
0.19 0.02
0.57 0.14
0.24 g.04
LiFEAS
0.57
0.18 0.00
0.67 0.14
0.25
ITI-C
0.29
0.20 0.02
0.44
0.26
Lush
Lin-ACT
0.50
0.21 0.02
0.47 0.17
0.25
LinEAS
0.71 0.15
0.18 0.02
0.75 0.12
0.23
ITI-C
0.31 0:16
0.20 0.01
0.18
0.22..02
Macro
Lin Lin-ACT
0.52
0.18 0.02
0.16
0.22.0.02
LinEAS
0.68 0.17
0.18 0.02
0.54 0:21
0.23 g.03
ITI-C
0.36
0.20 0.02
0.32 0.17
0.23 g.02
Robot
Lin-ACT
0.56
0.18 0.02
0.36
0.25 p.00
LinEAS
0.74 0.15
0.18 o.02
0.71 0:
0.21 0.02
ITI-C
0.11 6.11
0.19 0.02
0.44
0.29 0.03
Tilt-shift
Lin-ACT
0.46
0.21 0.02
0.48
0.29 p.00
LinEAS
0.65 0:16
0.23 0.00
0.65 0:15
0.28
ITI-C
0.20
0.21 0.02
0.47
0.28
Ukiyo-c
Lin-ACT
0.29
0.20 0.02
0.64
0.29 0.01
LinEAS
0.48 0.18
0.18 0.003
0.73
0.28 0.01
ITI-C
0.33
0.21 0.02
0.43
0.26
Underwater
Lin-ACT
0.52
0.18 0.002
0.41
0.26
LinEAS
0.59 g:21
0.17 0.02
p.56..20
0.26
ITI-C
0.12
0.18 0.01
0.35
0.26
Vaporwave
Lin-ACT
0.33
0.15 0.02
0.56
0.27 0.03
LinEAS
0.65 0.17
0.16 0.02
0.66 0.10
0.26 0.00
Table 15: ImgScore and ClipScore on mitigation for all concepts. Columns 3 and 4 contain results with the original steering direction (Tş(=)), i.e., removing or mitigating the concepts. Columns 5 and contain results applying the inverse steering operation (T,- -1()), which effectively induces the concepts. LinEAS consistently achieves higher ImgScore for similar ClipScore values.
42

---

Image Prompts Dataset
In Section 4.4 we evaluate multiple activation steering methods on DMD2 [0] To probe different aspects of T22 generation, we query an open-source LLM to generate new dataset of prompts covering different conditioning categories and 5 concepts per category. We also include a neutral category, which is used as the source in concept addition and target for removal. In Table [66, we show a sample of the dataset, and we include the full dataset in the supplementary material.
Supercategory
Concept
Example Prompts
A beaver in its natural habitat.
A playful dolphin jumping water.
Neutral
A train passing through mountains.
A sturdy table with drawers.
Vaporwave
Vaporwave ncon cityscape dusk futurisiti arcade machine in vaporwave setting
Style
Lush
In lush, overgrown jungle, two young men sitting on bench and a lady standing next to them. Seagulls in flight with person
one, lighthouse the distance, surrouneed by lush,
overgrown jungle.
Low-poly
A mountain range at sunrise rendered in low poly style with crisp, angular facets.
A futuristic cityscape with ncon accents and low poly geometry that creates digital vibe.
Ukiyo-e
A majestic view of Mount Fuji. chenyy blossoms in full bloom, woodblock print style, Ukiyo-e, Edo period aesthetics
A stormy sea with giant waves crushing, a lone boat struggling against the current, traditional Japanese
woodblock print, Ukiyo-e
Fantasy
A majestic dragon flying over glowing crystal mountain range, under a pupple sky. fantasy
A knight in shiming armor standing before lowering. ancient forest, mist swirling around, high fantasy
Robot
A sleek silver robot waves hello in futuristic city.
A tiny rohot with glowing eyes explores a dark cave.
Objects
Axolot
A pale pink leucistic axolot with feathery external gills, smiling serenely in a clear aquarium.
A wild-type axolot), dark and speckled, camouflaged amongst aquatic plants its natural habitat.
Book
A leather-bound antique book, its gold-leat leaf title faded, resting on dusty mahogany desk.
A stack of colorful children's 's picture books, vibrant illustrations peeking from the edges.
Car
A gleaming cherry-red classic 1950s convertible, chrome shining. cruising down sun drenchedd coastal highway, ocean on one side.
A rugged, mud-splattered off-road 4x4 vehicle naviguting steep, rocky mountain trail, dust kicking up from its tires.
Hourglass
An antique brass hourglass, its fine golden sand steadily flowing from the top bulb to the bottom, against a dark, mondy background. A minimalist, modemn glass hourglass with vibrant blue sand, casting sharp shadow on white surface.
Macro
Macro shot ladybug on a vibrant green leaf, tiny black spots sharp focus, dewdrop clinging nearhy.
Perspectives
Extreme macro shot of a honeybee's 's multifaceted eye, revealing intricate hexagonal potterns.
Fisheye
Fisheye lens perspective of bustling street market, vibrant stalls and crowds curving dramatically around a central point. Extreme fisheye shot from center of a packed concert crowd, hands raised, stage lights creating circular flares.
Bokeh
Portrait of a smiling woman, her face in sharp focus, aguinst buckground of beautifully blurred city lights creating circular hokeh. A single red msee in perfect focus, its delicate petals detailed, with creamy green bokeh background of garden foliage.
Underwater Underwater perspective vibrant coral reef teeming with colorful tropical fish, sunlight filtering through clear tuqquoise water.
Sunken pirate shipwreck resting on the sandy ocean floor, schools fish swimming through its decaying hull. underwater view.
Tilt-shift
Tilt-shift perspective of a bustling city intersection, cars and pedestrians appcaring like tiny toys, vibrant colors.
A miniature effect slit-sift shot of a freight train winding through verdant, rolling landscape.
Table 16: Sample of the dataset used for conditioning T2I models. The dataset is divided in 4 different categories: (1) neutral prompts used as source for concept addition and target for removal, (2) style prompts, (3) objects, and (4) perspectives.
43


Reviews:
[{"review_id": "27yDfoJ1fv", "reviewer": "Reviewer_8Jtq", "summary": "This paper introduces LinEAS, a new method for activation steering in large generative models. Prior work on activation steering (e.g., Lin-ACT, ITI-C) often trained per-layer interventions independently, which can lead to inconsistent or suboptimal modifications across layers. Hence, the authors propose an end-to-end optimization of activation interventions across multiple layers that can model their interdependencies. This is performed using a distributional loss inspired by optimal transport, combined with a sparse regularization term to balance performance versus utility trade-off. Empirical results suggest that LinEAS is more effective at toxic reduction in LLMs and style control in diffusion models compared to baselines.", "questions": "- Can the authors compare training time and resources between LinEAS, Lin-AcT, ITI-c, and ReFT?\n- If you make a scatter plot where the y-axis is the toxicity score and the x-axis is the utility score and then vary the editing strength, you can get a better sense of performance trade-off between methods. In this scenario, does LinEAS still have better trade-off compared to other baselines?\n- After applying Lasso regularization, which layers tend to keep activations and which layers do not?", "limitations": "- See Weaknesses", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths\n- The paper is well-written and the problem of modelling interdependencies is well-motivated.\n- Empirical results show superior performance in the T2I case.\n- No need for paired or reward-labeled data.\n\nWeaknesses\n- LinEAS training is slower than Lin-ACT and ITI-C.\n- In Table 1, the improvements of Lin-ACT over other methods are not clear to me since it has worse utility compared to other baselines. I recommend the authors also bold the best numbers in PPL and MMLU columns.\n- LinEAS seems to be very sensitive for N > 32.", "was_revised": false, "final_justification": "", "rebuttal": "Many thanks for your feedback, encouraging comments and constructive criticism.\n\n**W1. LinEAS training is slower than Lin-ACT and ITI-C.**\n\nWhile LinEAS does require additional training time, we believe this trade-off is justified by its superior performance.  Much like  ITI and Lin-ACT, its intervention can be potentially fused into model weights, incurring no additional inference cost. Furthermore, we think that LinEAS strikes a good balance, since it remains computationally tractable, requiring only a few minutes of training on a single GPU, which is an order of magnitude faster than RL-based alternatives. \n\nThis positions LinEAS as an interesting middle ground: more effective than lightweight methods like ITI while being far more efficient than heavier RL-based approaches. \n\n**W2. In Table 1, the improvements of **Lin-ACT** over other methods are not clear to me since it has worse utility compared to other baselines. I recommend the authors also bold the best numbers in PPL and MMLU columns.**\n\nNote: We address this point with the understanding that the reviewer meant to say improvements of **LinEAS** instead of improvements of **Lin-AcT**\n\nThe improvements of LinEAS stem from the big decrease in toxicity scores (the next best methods typically having `1.5x` - `2x` higher toxicity scores), while maintaining utility scores inside a 1 point difference from the original model (‘None’).  However, we agree with you that it is difficult to understand the full trade-off between decreased toxicity and utility from Table 1, and hence have added new plots comparing MMLU and TET toxicity for the different methods applied at strength $\\lambda\\in [0, 1]$, following your suggestion in Q2. The resulting Pareto fronts in that plot make the improvements clearer (see answer to Q2). We have updated the draft using your suggestion.\n\nLastly we want to point out that, following a suggestion by reviewer **QUnf**, we have conducted a small user study on a subset of RTP prompts and found that users chose LinEAS continuations of to be the least toxic AND the most coherent in 58\\% of the cases (vs. 12% for None, 12% for ITI, 18% for Lin-AcT), showing as well a clear improvement in toxicity decrease with good utility (coherence). \n\n**W3. LinEAS seems to be very sensitive for N > 32.**\n\nCould you kindly provide more details on this claim? In Figure 3, we found LinEAS to be reasonably stable for N>32, in fact if anything the standard deviations decreased compared to N<32 (as expected). Also for N < 32, where LinEAS performance is less stable, it is still relatively better when compared to ITI and Lin-AcT. \n\n**Q1. Can the authors compare training time and resources between LinEAS, Lin-AcT, ITI-c, and ReFT?**\n\nIn the table below we show the training time for each model and method and the number of steps we use in the submission. To reduce clutter we summarize training resources as the memory required to perform a full forward pass on the model (`M`), a classifier (`C`), or a single layer (`L`). The timings reported here were measured using a more fine-grained methodology than in the submission, so while absolute values may differ, the relative comparisons remain valid. We updated the submission accordingly.\n\n| Method    | # Steps | Gemma2 (s) | Qwen1.5B (s) | Qwen7B (s) |\n|-----------|---------|------------|--------------|------------|\n| LoFIT-RL  | 100     | 7600       | 25900        | 27300      |\n| ReFT      | 10      | 92         | 80           | 100        |\n| ITI       | 1       | 7          | 5            | 3          |\n| Lin-AcT   | 1       | 33         | 14           | 30         |\n| LinEAS    | 1000    | 430        | 340          | 500        |\n\nWhile LinEAS takes longer to estimate than Lin-AcT and ITI, we would like to emphasize that they all run with the same inference time, and provides better results than other activation steering methods (see also reply to W1, W2, and Q2).\n\nWe have also timed DMD2 for T2I generatoin. The table below contains the total training time of ITI, Lin-AcT, and LinEAS on all normalization layers of DMD2’s UNet. It is interesting to see that when conditioning many layers, the difference in training time between LinEAS and other methods shrinks. This is because LinEAS leverages pytorch’s backpropagation, which is optimized compared to ITI and Lin-Act’s layer-wise estimation methods.\n\n|        | #steps | DMD2     |\n|--------|--------|----------|\n| ITI    | 1      | 26m 44s  |\n| LinAcT | 1      | 25m 53s  |\n| LinEAS | 1000   | 29m 27s  |\n\n\n**Q2. If you make a scatter plot where the y-axis is the toxicity score and the x-axis is the utility score and then vary the editing strength, you can get a better sense of performance trade-off between methods. In this scenario, does LinEAS still have better trade-off compared to other baselines?**\n\nThanks for the suggestion. We have updated the draft with new plots comparing MMLU and TET toxicity for the different methods applied at strength [0, 1]. Since the guidelines forbid us to upload plots in this rebuttal, we report the top-4 nearest neighbors to LinEAS in the Pareto front. The two key findings from observing the plot are i) LinEAS dominates the Pareto front for all strengths but one (0.2). ii) LinEAS is better calibrated with respect to strength, being able to achieve different trade-offs between TET score and MMLU, while ITI concentrates on a smaller region of this space. We find these results to be consistent across different models.\n\n| Rank | Nearest Neighbor (strength)    | TeT↓ (LinEAS) | TeT↓ (Other) | MMLU↑ (LinEAS) | MMLU↑ (Other) |\n|------|----------------------|---------------|--------------|----------------|---------------|\n|  1   | LinEAS (0.2) -> ITI (0.2) |   **23.06** |      23.31 |        74.19 |   **74.23** |\n|  2   | LinEAS (0.2) -> LinAcT (0.3) |   **23.06** |      23.36 |    **74.19** |       74.08 |\n|  3   | LinEAS (0.4) -> ITI (1.0) |   **17.64** |      18.27 |    **74.09** |       73.92 |\n|  4   | LinEAS (0.3) -> ITI (0.7) |   **20.03** |      20.76 |    **74.20** |       74.09 |\n\n**Q3. After applying Lasso regularization, which layers tend to keep activations and which layers do not?**\n\nIn Figure 10, we have found that using a strong group lasso regularization tends to cluster the interventions around a handful of intermediate layers. We were happy to see that these layers are consistently selected by our algorithm (thin error bars), highlighting the stability of some of these intermediate representations to mediate the changes we parameterize.\n\nThese results are in good agreement with previous works on activation steering, which find conditioning to be most effective on intermediate layers [A, B, C].\n\n[A] Panickssery, N., Gabrieli, N., Schulz, J., Tong, M., Hubinger, E., & Turner, A. M. (2023). Steering llama 2 via contrastive activation addition. arXiv preprint arXiv:2312.06681.\n\n[B] Li, K., Patel, O., Viégas, F., Pfister, H., & Wattenberg, M. (2023). Inference-time intervention: Eliciting truthful answers from a language model. Advances in Neural Information Processing Systems, 36, [41451-41530](tel:4145141530).\n\n[C] Gurnee, W., Nanda, N., Pauly, M., Harvey, K., Troitskii, D., & Bertsimas, D. (2023). Finding neurons in a haystack: Case studies with sparse probing. arXiv preprint arXiv:2305.01610."}, {"review_id": "P5WyezDFHw", "reviewer": "Reviewer_sXJP", "summary": "This paper proposes LinEAS (Linear End-to-end Activation Steering), a novel framework for controlling generative model behavior through activation steering. The key innovation lies in jointly optimizing affine transport maps across all layers using a global distributional loss based on optimal transport theory, rather than optimizing each layer independently as in prior work. LinEAS enables the use of unpaired data (source and target sets without explicit correspondence) and incorporates sparse regularization for automatic neuron selection. The authors demonstrate effectiveness on toxicity mitigation in LLMs and style control in text-to-image diffusion models, showing consistent improvements over existing activation steering methods.", "questions": "1. **Scalability Analysis**: Can you provide computational cost analysis for LinEAS compared to local methods? How does memory usage scale with model size and number of layers?\n2. **Non-linear Extensions**: Have you explored non-linear transport maps? What would be the computational trade-offs of using more sophisticated OT solvers?\n3. **T2I Layer Selection**: Why wasn't systematic layer ablation performed for T2I models similar to the LLM experiments? Would the optimal layers differ significantly between modalities?\n4. **Compositionality Solutions**: Beyond the current linear approach, what architectural or algorithmic modifications could improve multi-concept composition?", "limitations": "The authors adequately acknowledge most limitations, particularly compositionality challenges and intervention selectivity. However, the discussion could be strengthened by:\n\n- More thorough analysis of when the independent activation assumption breaks down\n- Clearer guidance on computational requirements for different model scales\n- Discussion of potential failure modes when distribution assumptions are violated\n\nThe limitation that interventions apply to all tokens (rather than selective application) is noted but deserves more attention as it affects practical deployment scenarios.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 4, "originality": 4, "strengths_and_weaknesses": "### Strengths\n\n1. **Quality**: The paper presents a mathematically principled approach grounded in optimal transport theory. The global optimization framework effectively addresses the causal inconsistencies inherent in layer-wise independent optimization used by prior methods (ITI-C, Lin-ACT). The use of Sliced Wasserstein distances for distributional alignment is well-motivated and computationally tractable.\n2. **Originality**: The key contributions are novel and significant. Most importantly, LinEAS is the first activation steering method to work with unpaired data, eliminating the need for explicit contrastive pairs. The end-to-end optimization across layers and the integration of sparse regularization for automatic neuron selection represent clear advances over existing methods.\n3. **Clarity**: The paper is well-written with clear motivation and methodology. The mathematical formulation is precise, and the experimental setup is clearly described. The figures effectively illustrate the approach and results.\n4. **Significance**: The work addresses important practical limitations of existing activation steering methods. The ability to use unpaired data significantly reduces data collection costs, while the improved performance and robustness make the approach more practically viable. The modality-agnostic nature (working on both LLMs and T2I models) increases its potential impact.\n\n### Weaknesses\n\n1. **Computational Cost Analysis**: While the paper reports training times (LinEAS: 1100s vs ITI-C: 23s), it lacks comprehensive analysis of computational complexity. The end-to-end optimization necessarily incurs higher costs than local methods, but the scalability implications for larger models and the memory overhead of storing activations across all layers are not adequately addressed.\n2. **Oversimplified Theoretical Assumptions**: Two key assumptions limit the theoretical rigor:\n    - **Independent activation assumption**: The method treats neurons independently, ignoring the strong correlations that exist between activations in practice\n    - **Linear transport assumption**: Real optimal transport maps are likely non-linear, but the method restricts to affine transformations for computational tractability\n3. **Incomplete Experimental Analysis**:\n    - **T2I ablation studies**: While LLM experiments include comprehensive ablations (layer selection, sparsity effects, data scaling), the T2I experiments lack similar systematic analysis. Missing ablations include layer selection strategies, sparsity effects on image generation, and data scaling effects", "was_revised": true, "final_justification": "Most of my concerns are resolved.\n\nI'll maintain my score.", "rebuttal": "Many thanks for your time and appreciation.\n\n**W1. Q1. Computational Cost Analysis**\n\nThanks for pointing this out. We have updated the draft with such an analysis, with main findings in L184 and extended results in the Appendix. Here are a few considerations:\n\n*Memory consumption*\n\nAt training time, LinEAS relies on backpropagation to compute gradients for its diagonal affine interventions, which means that **only model activations that are intervened upon** need to be stored in the forward pass. This will be of course (much) smaller than all activations that need to be stored to do full parameter tuning.\n\n*Compute*\n\nCompared to local methods, the compute cost of LinEAS is dominated by the number of optimization steps required to train the intervention. While this makes it slower than local methods, LinEAS is still an order of magnitude faster than the RL baseline. Let us also highlight that LinEAS can also obtain competitive results using 10x less compute (100 optimization steps) than the one used in the paper, as we show on Figure 4, taking ~50s to estimate compared to the ~30s of Lin-AcT and 27300s for LoFIT-RL (see Table below). Overall, we believe that LinEAS achieves an excellent trade-off between compute effort and conditioning performance.\n\n*Timing*\n\nThe table below summarizes the estimation time for each method and the number of steps used in our submission. The timings reported here were measured using a more fine-grained methodology than in the submission, so while absolute values may differ, the relative comparisons remain valid. We updated the submission accordingly.\n\n\n| Method    | # Steps | Gemma2 (s) | Qwen1.5B (s) | Qwen7B (s) |\n|-----------|---------|------------|--------------|------------|\n| LoFIT-RL  | 100     | 7600       | 25900        | 27300      |\n| ReFT      | 10      | 92         | 80           | 100        |\n| ITI       | 1       | 7          | 5            | 3          |\n| Lin-AcT   | 1       | 33         | 14           | 30         |\n| LinEAS    | 1000    | 430        | 340          | 500        |\n\n*Detailed Complexity Analysis*\n\n`B` = batch size, `(B log B)` = sorting cost for optimal transport\n\n`F` = cost of forward (backward) pass\n\n`N` = Number of SGD steps, `T` = number of logistic regression lbfgs steps\n\n`I` = Number of intervened layers\n\nThe computational cost of LinEAS is dominated by `O(N * (2F + I * B * Log(B)))`\n\nThe computational cost of ITI is `O(F + I * T)` where `T` is the number of logistic regression steps\n\nThe computational cost of Lin-AcT is `O(2F + I * B * log(B))`\n\nMemory required during training:\n\n`M` = Memory required by the model activations during the forward pass \n\n`L` = Memory required to compute the forward pass on one layer\n\n`D` = Affine parameter weight matrix size\n\nLinEAS: `M + ID` \nLinAcT: `L + D` \nITI: `L + D` \n\n**W2.1. Independent activation assumption**: **The method treats neurons independently, ignoring the strong correlations that exist between activations in practice**\n\nWhile the reviewer is correct in pointing out such strong correlations, their structure is extremely intricate and highly context dependent. Trying to elucidate this structure has been attempted, for LLMs, using SAEs, with mitigated success. \n\nWe do take the opposite direction, because we have no choice, as we highlight an extremely sample-efficient finetuning methodology (e.g. $N=32$). In that process, the hope is that activations (notably in intermediate layers) are disentangled enough to learn efficiently these maps. Our experimental results corroborate this hypothesis.\n\n**W2.2. Linear transport assumption: Real optimal transport maps are likely non-linear, but the method restricts to affine transformations for computational tractability**\n\nIndeed, the true 1D OT maps (for each activation) are likely more complicated increasing 1D functions. In practice, however, we believe that affine maps “work” because we observe consistently that such 1D distributions are fairly unimodal and almost Gaussian, paving the way for our method to be both efficient and robust.\n\n**Q2. Non-linear Extensions**: **Have you explored non-linear transport maps? What would be the computational trade-offs of using more sophisticated OT solvers?**\n\nWe have experimented with diagonal + low-rank variants. They did not yield, yet, improvements that would be worth the extra computational cost.\n\n**W3.1. T2I ablation studies: While LLM experiments include comprehensive ablations (layer selection, sparsity effects, data scaling), the T2I experiments lack similar systematic analysis. Missing ablations include layer selection strategies, sparsity effects on image generation, and data scaling effects**\n\nWe have considered this in recent weeks. We ran a sweep over different sparsity regularization strengths for DMD2, and found that an effective range to pick that regularization lies in [0.4, 0.8]. Given the limitation in providing illustrations, we report a subset of the results (averaged over 15 concepts). The results are encouraging, thanks for this suggestion.\n\n| regularization | support       | IMGScore $\\uparrow$ | CLIPScore $\\downarrow$ |\n|--------|----------|------------|-------------|\n| ********0********            | 100±0.0     | 71.4±5.5       | 13.1±3.2          |\n|0.4     |92.7±5.0|84.7±6.0  |14.5±2.9   |\n|0.5     |76.7±14.0|89.5±6.3 |15.0±2.9   |\n|0.6     |51.6±22.1|94.8±3.6 |15.5±2.8   |\n|0.7     |13.8±11.4|98.9±1.1 |16.0±2.8   |\n|0.8     |3.3±3.2 |99.6±0.4  |16.1±2.8   |\n|1     |0.0±0.0 |100±0.0  |16.1±2.9   |\n\n\n**Q3. T2I Layer Selection**: **Why wasn't systematic layer ablation performed for T2I models similar to the LLM experiments? Would the optimal layers differ significantly between modalities?**   \n\nThanks for suggesting this. We have run a sweep over the different layer types in the DMD2’s UNet, which we report below (results are averaged over 15 concepts). We have found that while intervening on all layernorms (first row, corresponding to the setting used in the paper) has the best trade-off between image consistency (IMGScore) and concept removal (CLIPScore), LinEAS is robust with respect to the choice of intervened layers. Again we are sorry that we cannot show images.\n\n| Intervened layers                     | #modules | IMGScore $\\uparrow$ | CLIPScore $\\downarrow$ |\n| ------------------------------------- | ------- | ------------------- | ---------------------- |\n| ********unet - all layer norms********            | 256     | 0.714 ± 0.055       | 0.131 ± 0.032          |\n| unet.transformer - all FeedForward    | 70      | 0.695 ± 0.058       | 0.129 ± 0.034          |\n| unet attentions - K and Q projections | 280     | 0.756 ± 0.056       | 0.135 ± 0.032          |\n| unet attentions - V projections       | 140     | 0.748 ± 0.053       | 0.136 ± 0.032          |\n| unet attentions - in projections      | 11      | 0.792 ± 0.041       | 0.141 ± 0.030          |\n| unet.resnet - all layer norms         | 34      | 0.817 ± 0.034       | 0.148 ± 0.029          |\n\n**Q4. Compositionality Solutions: Beyond the current linear approach, what architectural or algorithmic modifications could improve multi-concept composition?**\n\nWe believe sparsity plays an important role in achieving compositionally as it reduces the overlap between different interventions. We explored this in Appendix H with some success but we believe more research is needed to understand better how to compose these linear maps.\n\nIn terms of architecture, non-linear maps could help to better localize when and where to intervene for each different concept, reducing interference and helping to achieve a more effective composition. At the same time, non-linear maps are less appealing from a practical point of view, as they will likely result in instabilities.\n\n**L1. The authors adequately acknowledge most limitations, particularly compositionality challenges and intervention selectivity. However, the discussion could be strengthened by:**\n**L1.1. More thorough analysis of when the independent activation assumption breaks down**\n\nThanks for this great point. While we agree that we leverage the disentanglement observed in models, our interventions do not assume a total independence between activations, since they operate _simultaneously_ (trained end-to-end) on multiple activations across _depth_. We simply posit that the simple intervention models we rely on can be better trained in the highly sample-efficient regime we target (e.g. $N=32$)\n\n\n**L1.2. Clearer guidance on computational requirements for different model scales**\n\nThe minimum computational requirement for LinEAS to work is to be able to perform back-propagation with a batch size of two (source and target distributions') activations. However, Figure 3 suggests it is safer to train with a batch of 4 for improved stability. We have updated the draft with this information along with the computational complexity for each method as described in our reply to W1 and Q1.\n\n**L1.3. Discussion of potential failure modes when distribution assumptions are violated**\n\nPlease note that we do not really make distributional assumptions, and, in that context, would rather claim that using simple affine models acts as a safety: our interventions are likely more robust and less at risk of overfitting/failing spectacularly.\n\n**L2. The limitation that interventions apply to all tokens (rather than selective application) is noted but deserves more attention as it affects practical deployment scenarios.**\n\nThanks for raising this very important point. We have been thinking of including mechanisms that can decide adaptively whether to apply or not the map at a given token. This could, e.g., involve a cheap out-of-distribution detector that could decide whether a token is in-sample. We have just started working in these directions."}, {"review_id": "cLNaobz10t", "reviewer": "Reviewer_t2Ws", "summary": "The paper considers the problem of controlling generation from language (and other) models by manipulating activations.  The novelty in the steering approach proposed is that it works \"end to end\" across all layers of the model.  The learning uses unpaired samples (generally easier to obtain than paired ones) and is based on affine optimal transport maps.  The method is amenable to a sparsity inducing regularizer (group lasso) which reduces the set of activations that need intervention.  Experiments across several open weight models focus on toxicity mitigation in text generation and adding/removing concepts in text-to-image generation.", "questions": "Notes:\n\nSection 4.2 is not an ablation; it is a sensitivity analysis (i.e., exploring sensitivity to N, the amount of data ... not ablating data).\n\nOne detail that was not clear in section 4.4:  is a separate lineas correction trained for each concept?  This seems like a simple question, but I couldn't quite figure it out from the text after several reads.", "limitations": "Yes (well done)", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "Strengths\n\nThe method is simple and elegant, and the description of the approach is mostly very clear.\n\nThe experiments are sensibly designed and show strong results on text and image generation steerability problems that are familiar from past work.\n\nThe wall times for training the method, compared to others, show that it represents a useful position on the tradeoff curve between effectiveness and cost, at least for text.\n\nWeaknesses\n\nThe discussion in the paragraph starting at line 100 needs to be unpacked more.  The text discusses prompts distributed according to two distributions p and q, described as source and target.  This reviewer couldn't immediately map this terminology onto the controllable generation setup that motivated the work, in the intro.  I think a few more sentences giving a concrete example of p and q (maybe with a forward reference to the experimental details section) would make this part more intuitive.\n\nComputational cost in the image generation setting is not discussed at all.\n\nThe introduction claims the method is interpretable; this is an overclaim.  The experiments in 4.4 where the scale is gradually changed are very interesting, and the results in figure 5 where this gradual effect is shown to be qualitatively better than other approaches are impressive.  But this does not make the maps themselves interpretable.", "was_revised": true, "final_justification": "Thanks for the response.", "rebuttal": "Many thanks for the positive assessment of our work. In the following, we will address the questions and concerns outlined in the review.\n\n**W1. The discussion in the paragraph starting at line 100 needs to be unpacked more. ... I think a few more sentences giving a concrete example of p and q (maybe with a forward reference to the experimental details section) would make this part more intuitive.**\n\nWe would like to thank the reviewer for pointing out this lack of clarity at line 100. \n\nWe agree that the following lines can cause confusion:\n\n\n>We consider two distinct probability distributions of prompts, the source p and the desired target q, both in P(S). We view each prompt realization through the lens of their sequence of L activations\n\n\nand we propose to replace them with the following: \n\n\n>We consider two distinct probability distributions over prompts, the source distribution p and the desired target distribution q. For example, p and q could be such that a sample from the source distribution p corresponds to toxic sentence, while a sample from the target distribution q corresponds to a non-toxic sentence (see Section 4.1). We then view each sampled prompt through the lens of their sequence of L activations.\n\n\n**W2. Computational cost in the image generation setting is not discussed at all.**\n\nGood point! We have updated the paper with the table below comparing estimation times for different methods. The algorithm to estimate LinEAS on images or language is the same and shares the same computational complexity. We refer to **sXJP**’s W1 for a detailed computational complexity analysis.\n\nThe table below contains the total training time of ITI, Lin-AcT, and LinEAS on all normalization layers of DMD2’s UNet. It is interesting to see that when conditioning many layers (256 in total, all the LayerNorm modules in the UNet), the difference in training time between LinEAS and other methods shrinks. This is because LinEAS leverages pytorch’s backpropagation, which is optimized and only store activations for intervened layers, compared to ITI and Lin-Act’s layer-wise estimation methods.\n\n|        | #steps | DMD2     |\n|--------|--------|----------|\n| ITI    | 1      | 26m 44s  |\n| LinAcT | 1      | 25m 53s  |\n| LinEAS | 1000   | 29m 27s  |\n\n**W2.1. The introduction claims the method is interpretable; this is an overclaim. The experiments in 4.4 where the scale is gradually changed are very interesting, and the results in figure 5 where this gradual effect is shown to be qualitatively better than other approaches are impressive. But this does not make the maps themselves interpretable.**\n\nMany thanks for pointing this out. We agree that our claims about interpretability must be more precise. In the introduction (L291) we meant when writing “its distributional nature enables gradual and interpretable control over the intervention.” to refer specifically to the **control mechanism** being interpretable as an intervention slider between $[0,1]$, **not the intervention maps themselves**, which are indeed much harder to make sense of, specially at intermediate layers.\n\nTo be more precise, unlike methods that use scaled vector additions ($\\lambda v$), where the scaling parameter $\\lambda \\in \\mathbb{R}$ has no clear bounds or semantic meaning, LinEAS provides an interpretable interpolation parameter $\\lambda \\in [0,1]$ where $\\lambda=0$ represents no intervention and $\\lambda=1$ represents full optimal transport. This bounded, semantically meaningful parameterization enables practitioners to understand and predict the intervention strength.\n\nWe will revise L291 to clarify: \"...its distributional nature provides an intervention strength parameter that is continuous and bounded, making it more intuitive to apply.\" to avoid confusion about what aspect of the method is interpretable.\n\nIn addition to L291, we have found other references to our method being \"interpretable\" that are ambiguous, and we have corrected them as follows:\n\n* L60: \"Our method provides an interpretable and fine-grained knob that satisfies low-budget and controllability desiderata\" → \"Our method provides low-budget conditioning, with a continuous and theory-grounded application strength \\in [0, 1].\"\n* L291: “...while its distributional nature enables gradual and interpretable control over the intervention.” → “...while its distributional nature enables gradual and interpretable control over the **strength of the** intervention.”\n* L889: “We then ask: are these interventions (seen as collection of scale / bias vectors w,b) interpretable, to some extent? Put simply, do we recover similar interventions for similar concepts, and does sparsity help?“ → “We then ask: do we recover similar interventions for similar concepts, and does sparsity help“\n* L936: “Also, observe how LinEAS’s generations are much more gradual and interpretable than Lin-ACT.” → “Also, observe how LinEAS’s generations are much more gradual than Lin-ACT.”\n\n**W3. Section 4.2 is not an ablation; it is a sensitivity analysis (i.e., exploring sensitivity to N, the amount of data ... not ablating data).**\n\nMany thanks for pointing this out. We have updated the section and it is now referred to as a sensitivity analysis.\n\n**W4. One detail that was not clear in section 4.4: is a separate lineas correction trained for each concept? This seems like a simple question, but I couldn't quite figure it out from the text after several reads.**\n\nThanks for your comment! Yes, this is true for LinEAS as well as the other baselines in the literature. We have updated the text to clarify this point."}, {"review_id": "7dvc7xRQrd", "reviewer": "Reviewer_QUnf", "summary": "This paper introduces LinEAS, a method for activation steering in large pre-trained generative models such as LLMs and diffusion models. Overall, LinEAS optimizes a distributional loss over multiple layers using weak supervision with unpaired data (e.g., toxic vs. non-toxic prompts). Specifically, LinEAS learns affine transformations applied to selected model activations, aligning their distributions via sliced Wasserstein distance. Additionally, a sparse regularizer is applied to the affine map parameters. The paper evaluates LinEAS on two tasks: toxicity mitigation in LLMs and style steering in text-to-image diffusion models. Empirical results suggest that LinEAS outperforms prior weakly-supervised methods such as ITI-c and Lin-AcT.", "questions": "1. Can the authors justify the use of sliced Wasserstein distance as the metric for distributional alignment? Are there theoretical or empirical results showing that  sliced Wasserstein distance is better than other distributional metrics?\n2. Can the authors report training time for all methods in the comparison, especially for LinEAS, the oracle baselines and ReFT?\n3. How sensitive is LinEAS to the choice of sparsity regularization hyperparameters?", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "**Strengths**\n\n1. The paper introduces a layer-wise, end-to-end optimization strategy that addresses some of the causal issues seen in earlier per-layer steering methods.\n2. LinEAS works in low-data, weakly-supervised settings, which is a nice  property.\n3. The method can be applied to both LLMs and diffusion models.\n\n**Weaknesses**\n1. Contribution: The paper contribution is somewhat incremental, it builds heavily on previous work Lin-AcT, mainly extending it with sparsity regularization.\n2. Mischaracterization of baselines: The paper claims that ReFT requires paired data, but from what I read and understand, this is incorrect. The ReFT loss function choice is task-specific by design. ReFT can optimize a language modeling objective (e.g., Eq. 4 in the original ReFT paper), and does not require explicit pairing.\n3. Optimization and hyperparameters: LinEAS is significantly slower to train than Lin-AcT. Moreover, it introduces several new hyperparameters for the sparse regularizer, which are not deeply discussed or tuned systematically.\n4. Experimental results: Table 1 does not clearly demonstrate that LinEAS is strictly better. Some baselines achieve better toxicity reduction but worse utility, or vice versa. It would be more informative to show a Pareto frontier to highlight the trade-off between utility and alignment. Moreover, I don’t think perplexity is a good metric to measure LLM utility. A better approach would be to use LLM-as-a-judge evaluations or human annotations to assess generation quality.", "was_revised": true, "final_justification": "The rebuttal addressed most of my concerns. The remaining points requiring clarification can be addressed through revisions in a future version of the paper. I have increased my score to 4.", "rebuttal": "Thank you for your thorough review and constructive criticism. We have incorporated some of your comments in our draft.\n\n**W1. Contribution: The paper contribution is somewhat incremental, it builds heavily on previous work Lin-AcT, mainly extending it with sparsity regularization.**\n\nWhile our work does share a key commonality with Lin-AcT (a diagonal affine transport map), we argue that the maps trained using LinEAS are a significant upgrade to the much simper closed forms leveraged by Lin-ACT.\n\nThis is obtained through a global and joint optimisation of the layer-wise transport maps. Note that one cannot add sparsity regularizers to Lin-ACT, as the formulation in Lin-ACT can only output closed form solutions\n\nWe have shown that this global/joint perspective + flexibility enables better transport maps, as evidenced by the significant performance improvements in our experiments. In Table 1 LinEAS gets `1.5x-2x` better (i.e. lower) toxicity scores than Lin-AcT for similar MMLU scores, and in Table 2 LinEAS gets more than `2x` higher user preference scores and `1.5x` higher IMGScore, for an identical CLIPScore. Furthermore, beyond the sparsity regularisation that you mention, this global view also allows to learn effective transport maps using fewer examples (as little as 32 in our experiments as you can find in Figure 3). \n\n**W2. Mischaracterization of baselines: The paper claims that ReFT requires paired data, but from what I read and understand, this is incorrect. The ReFT loss function choice is task-specific by design. ReFT can optimize a language modeling objective (e.g., Eq. 4 in the original ReFT paper), and does not require explicit pairing.**\n\nWe believe you might have misunderstood the way ReFT is implemented. We have seen this confusion a few times while reviewing these works.\n\nFirst, **Real Toxicity Prompts (RTP) does not work for toxicity reduction when using a language modeling objective**. RTP **only** consists of toxicity-inducing prompts (which are not always toxic) and neutral prompts. We could train the model to complete only neutral prompts but that would not guarantee reduced toxicity.\n\nAs for the need for paired data, the authors of **ReFT** present this clearly in their paper (their Section 3): they emphasise the importance **of counterfactual, paired data,** (e.g. pair of $x$ **and** $y$ in language modelling in Eq.4)\n\n>*An interchange intervention fixes a representation to the value it would take if a counterfactual input were processed*\n\nThe only exception is **DiReFT**: “***DiReFT can be thought of as LoRA applied directly to hidden representations at certain positions”****.* In practice DiReFT performs worse on all tasks than **LoReFT**, emphasizing further the importance of paired data for a counterfactual intervention.\n\n* In every resource we were able to find online on **ReFT,** the authors stress paired data:\n    * In the \"ReFT Explained\" youtube video (published May 30, 2024), 17 mins\n    * In the main README.MD emoji toy example of the `stanfordnlp/pyreft` repo.\n* In their paper, **ReFT** is not compared to activation steering methods, only to PEFT methods (their Table 1, 2, 3, essentially LoRA + sometimes DORA).\n\n**W3.1. Optimization: LinEAS is significantly slower to train than Lin-AcT.** \n\nWhile LinEAS does require additional training time, we believe this trade-off is justified by its superior performance. LinEAS achieves significantly better toxicity mitigation and text-to-image conditioning while having potentially zero inference cost (when fused into model weights, as ITI and Lin-ACT). \n\nFurthermore, LinEAS remains computationally practical, requiring only few minutes of training on a single GPU: this is an order of magnitude faster than RL-based alternatives.\n\nThis positions uniquely LinEAS as a method that is both more effective than lightweight methods like ITI while being far more efficient than heavier RL approaches. \n\n**W3.2. Hyperparameters: Moreover, it introduces several new hyperparameters for the sparse regularizer, which are not deeply discussed or tuned systematically.**\n\nThanks for pointing this out. First, we only consider two hyperparameters at the moment, which is relatively small since LinEAS intervention models have none.\n\nSecond, we found that tuning $\\gamma \\in [0,1]$ with $\\lambda_1=1$ and $\\lambda_G=1$ already provides interesting trade-offs between conditioning and utility as reported in Figure 4 and 8. This also reduces the number of additional hyper-parameters to tune to just one ($\\gamma$) and enables automatic layer selection (Figure 10). However, we now realize that the text does not mention that $\\lambda_1=1$ and $\\lambda_G=1$ while tuning $\\gamma$, which could be the source of this confusion. We have updated the draft to make this point clear also including the exact values for $\\gamma$ corresponding to the x axis in Figures 4 and 8. \n\n**W4. Pareto frontier and human annotations to assess generation quality.**\n\nMany thanks for suggesting this, we have computed the Pareto front and we have ran a small human preference study. In both cases LinEAS achieves the best trade-off between toxicity mitigation and utility as detailed below.\n\n*Pareto front*\n\nWe have updated the draft with new plots comparing MMLU and TET toxicity for the different methods applied at strength [0, 1]. Since we are not allowed to upload plots in this rebuttal, we report the top-4 nearest neighbors to LinEAS in the Pareto front. The two key findings are i) LinEAS dominates the Pareto front for all strengths but one (0.2). ii) LinEAS is better calibrated with respect to strength, being able to achieve different trade-offs between TET score and MMLU, while ITI concentrates on a smaller region of this space. We find these results to be consistent across different models. \n\n|Rank|NearestNeighbor(λ)|TeT↓(LinEAS)|TeT↓(Other)|MMLU↑(LinEAS)|MMLU↑(Other)|\n|--|--|--|--|--|--|\n|1|LinEAS(0.2)→ITI(0.2)|**23.06**|23.31|74.19|**74.23**|\n|2|LinEAS(0.2)→LinAcT(0.3)|**23.06**|23.36|**74.19**|74.08|\n|3|LinEAS(0.4)→ITI(1.0)|**17.64**|18.27|**74.09**|73.92|\n|4|LinEAS(0.3)→ITI(0.7)|**20.03**|20.76|**74.20**|74.09|\n\n*Human preference study*\n\nWe have run a human preference study and we have found that **users prefer LinEAS over 3 other alternatives (Linear-ACT, ITI-C, no intervention) 57.70% of the time** (see table below). We ran the study on a pool of 20 human annotators that were each presented with 20 prompts from the RTP dataset. For each prompt, randomly ordered continuations from Qwen2.5-7B with no intervention (identity), ITI, Linear-AcT, and LinEAS. Then, annotators were tasked to choose which of the 4 continuations is *the least toxic* and most coherent overall.\n\n|Identity (%)|ITI (%)|Lin-AcT (%)|LinEAS (%)|\n|--|--|--|--|\n|12.19±5.5|11.67±8.7|18.43±11.49|57.70±14.64|\n\n**Q1. Can the authors justify the use of sliced Wasserstein distance as the metric for distributional alignment? Are there theoretical or empirical results showing that sliced Wasserstein distance is better than other distributional metrics?**\n\nTo be more precise, we use a very simple variant of the Sliced Wasserstein metric which only considers $d$ coordinates at a time (i.e. not random projections). This results in a very intuitive loss that aggregates 1D distributional differences per neuron.\n\nWe tried other distributional metrics (e.g. Sinkhorn divergence) but this did not work well. We believe that this is due to the high-$d$ / small $n$ regimes for which we computed these metrics, and which are known to cause issues for such high $d$. We can add a discussion.\n\n**Q2. Can the authors report training time for all methods in the comparison, especially for LinEAS, the oracle baselines and ReFT?**\n\nYes, the timings are reported below and you can find further details on computational and memory complexity in our reply to sXJP W1.\n\n|Method|#Steps|Gemma2(s)|Qwen1.5B(s)|Qwen7B(s)|\n|------|------|---------|-----------|--------|\n|LoFIT-RL|100|7600|25900|27300|\n|ReFT|10|92|80|100|\n|ITI|1|7|5|3|\n|Lin-AcT|1|33|14|30|\n|LinEAS|1000|430|340|500|\n\nWhile LinEAS takes longer to estimate than Lin-AcT and ITI, we would like to emphasize that its inference cost is the same as other affine methods like ITI and LinAct while achieving better results. Due to lack of space, we refer to t2Ws `W2` for timings on T2I generation.\n\n**Q3, How sensitive is LinEAS to the choice of sparsity regularization hyperparameters?**\n\nThank you for raising this question. LLMs are fairly robust to the sparsity regularization coefficient (as shown in Figure 4, Figure 8, and Figure 10). Regarding T2I models, we ran a sweep over sparsity coefficients and found that the model is more sensitive to the sparsity penalty, almost saturating to either full support or none support outside the range [0.4, 0.8]. Given the limitation in providing illustrations, here we report a subset of the results (averaged over 15 concepts). We hypothesize the UNet is more sensitive than the transformer because its activation maps are less redundant due to the changes in dimensionality as described by Veit, et al. 2016 and Jastrzębski et al. 2017.\n\n|sparsity|support(%)|IMGScore(%)↑|CLIPScore(%)↓|\n|--------|----------|------------|-------------|\n| ********0********            | 100±0.0     | 71.4±5.5       | 13.1±3.2          |\n|0.4     |92.7±5.0|84.7±6.0  |14.5±2.9   |\n|0.5     |76.7±14.0|89.5±6.3 |15.0±2.9   |\n|0.6     |51.6±22.1|94.8±3.6 |15.5±2.8   |\n|0.7     |13.8±11.4|98.9±1.1 |16.0±2.8   |\n|0.8     |3.3±3.2 |99.6±0.4  |16.1±2.8   |\n|1     |0.0±0.0 |100±0.0  |16.1±2.9   |\n\n\nJastrzębski, S., Arpit, D., Ballas, N., Verma, V., Che, T., & Bengio, Y. (2017). Residual connections encourage iterative inference. *arXiv preprint arXiv:1710.04773*.\n\nVeit, A., Wilber, M. J., & Belongie, S. (2016). Residual networks behave like ensembles of relatively shallow networks. *Advances in neural information processing systems*, *29*."}]

Author rebuttal:

Meta-review: The paper proposes LinEAS a distributional losses between activation of source and target distribution of activations.  The source activations are transformed via affine transport maps throughout all layer of the network , with a group sparsity regularization of the sliced Wasserstein loss between the distribution of the activations. Using this distributional loss allows using unpaired datasets versus previous work such as   ReFT this was clarified by author during rebuttal.  Experiments show that LinEAS effectiveness in  toxic reduction in LLMs and style control in text-image diffusion models.

Overall reviewers were positive of the papers and made suggestions to improve the paper in term of clarification of how the method compare to other baselines conceptually in terms of computational time. Other experimental suggestion in terms of a human study for their preference in terms of outputs of the method  as well as experiments on  effect of the regularization on the text to image experiments  , and a regularization path to show the pareto front as regularization parameter changes.

Some of these concerns and suggestions were addressed in the rebuttal, All these experiments, plots and clarifications should be added to the final manuscript.

Minor: the begining of the  abstract on openreview is cut off, please fix that.
Decision: Accept (poster)