Steering When Necessary: Flexible Steering Large Language Models with Backtracking
Authors: Zifeng Cheng
Jinwei Gan
Zhiwei Jiang
Cong Wang
Yafeng Yin
Xiang Luo
Yuchen Fu
Qing Gu
Venue: NeurIPS 2025 poster ()
Keywords: Activation steering
Primary area: applications

Abstract: Large language models (LLMs) have achieved remarkable performance across many generation tasks.
Nevertheless, effectively aligning them with desired behaviors remains a significant challenge.
Activation steering is an effective and cost-efficient approach that directly modifies the activations of LLMs during the inference stage, aligning their responses with the desired behaviors and avoiding the high cost of fine-tuning.
Existing methods typically indiscriminately intervene to all generations or rely solely on the question to determine intervention, which limits the accurate assessment of the intervention strength.
To this end, we propose the **F**lexible **A**ctivation **S**teering with **B**acktracking (**FASB**) framework, which dynamically determines both the necessity and strength of intervention by tracking the internal states of the LLMs during generation, considering both the question and the generated content.
Since intervening after detecting a deviation from the desired behavior is often too late, we further propose the backtracking mechanism to correct the deviated tokens and steer the LLMs toward the desired behavior.
Extensive experiments on the TruthfulQA dataset and six multiple-choice datasets demonstrate that our method outperforms baselines.
Our code will be released at https://github.com/gjw185/FASB.

Steering When Necessary: Flexible Steering Large Language Models with Backtracking
Zifeng Cheng", Jinwei Gan", Zhiwei Jiang', Cong Wang. Yafeng Yin, Xiang Luo, Yuchen Fu. Qing Gu
State Key Laboratory for Novel Software Technology, Nanjing University, China chengzf@njj edu. cn, ganjwssmail .nju edu. cn, jzw@nju edu. en, edu. bluoxiang.yuchhefuuuue @ucaa nju. edu. en, guq nju. edu.
cw@smail .nj. edu en, yafengōnju. edu. en,
Abstract
Large language models (LLMs)) have achieved remarkable performance across many generation tasks. Nevertheless, effectively aligning them with desired be- haviors remains a significant challenge. Activation steering an effective and cost-efficient approach that directly modifies the activations of LLMs during the inference stage, aligning their responses with the desired behaviors and avoiding the high cost of fine-tuning. Existing methods typically indiscriminately intervene to all generations or rely solely on the question to determine intervention, which limits the accurate assessment of the intervention strength. To this end, we propose the Flexible Activation Steering with Backtracking (FASB) framework, which dy- namically determines both the necessity and strength of intervention by tracking the internal states of the LLMs during generation, considering both the question and the generated content. Since intervening after detecting deviation from the desired behavior is often too late, we further propose the backtracking mechanism correct the deviated tokens and steer the LLMs toward the desired behavior. Ex- tensive experiments on the TruthfulQA dataset and six multiple-choice datasets demonstrate that method outperforms baselines. Our code will be released https: https:///gihub... com/ F515///AS1
Introduction
Large language models (LLMs) (Lennron el al RIDE Brown cf al.
2020) have achieved great success in text generation. However, the gen-
crated text still contains harmful information, hallucinations, and other misleading content. Therefore, controlling LLMs to produce trustwor- thy, reliable, and other desired outputs remains a challenge. Existing methods often instruction tuning (Wer et all, (022), Reinforcement Learning from Human Feedback (RLHF) alll 2022), and prompt engineering (Brown atlll (02)) control LLMs. Unfortunately, these methods often require large-scale datasets and expensive fine-tuning costs to achieve desired results.
20N2 02E1 DERD KLAN ONTE CAST
TUTURRG
Figure 1: The truthful- ness probability distribu- tion of questions in the TruthfulQA dataset de- tected by the classifier.
Recently, activation steering or representation engineering (Zou ef all 2023; Rimsky et all, 2024; Li all 2023: Turner et all 2023: Cheng et all M0255 has been proposed to control the outputs of LLMs by di- rectly modifying their internal activations during inference, thereby avoiding the high cost associated
"Equal Contribution.
Cooresponding Author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

3. Bocktrocking three tokens
Q: What is the capital city of the United States?
Stote Trocking
United
States
Paris
(w/o intervention):
Normal Generation
The capital city of of the United States is Paris
the
United
States
15
A (w/ intervention):
Mashington
D.C.
[#05]
The capital city the United Wa Washington D.C.
Activation Steering
United
States
15
Mashington
D.C.
Figure 2: The overview of flexible activation steering with backtracking framework.
with large-scale data collection and fine-tuning. This technique constructs steering vectors from pos- itive and negative samples to make targeted modifications to the activations of the LLM,, enabling more precise control over its output.
Existing methods often apply interventions indiscriminately to all generations (Rimsky al, 2IZE: Wang et all, 2022, Lretall 2023) or determine whether and how strongly to intervene based solely on the question (Lee et all 2025), which limits the accurate assessment of the intervention strength. First, different generations should receive different levels of intervention. a generation does not deviate, no intervention is necessary. If it deviates significantly, a stronger intervention should be applicd. For example, when LLM asked "Where the capital of the United States?". If the response is "The capital of the United States is Washington, D.C.", intervention is necessary. as the answer is correct. If the response is "Paris", it often requires a stronger intervention compared to "New York". Second, as each LLM generates different responses to the same question, question- only probing is challenging" and requires data collection for each LLM,, resulting in high overhead. On the other hand, training classifier on concatenated questions and answers often struggles to directly probe the question to determine whether and how strongly to intervene. As shown in Figure ML the predicted truthfulness probabilities for questions in the TruthfulQA dataset are concentrated between 0.3 and 0.5, making fie-ggraine decisions difficult.
In this paper, propose Flexible Activation shown in Figure Q Unlike existing methods, FASB tracks the internal states of the LLM after each normal generation step, taking both the question and the generated content into account. In this way, FASB can dynamically determine whether intervention is necessary and the intervention strength based the degree of deviation in the generation. Specifically, FASB employs two methods to identify internal states that are consistent with the desired behavior and derive the steering vector and classifier for state tracking. Considering that intervening after detecting deviation from the desired behavior is often too late, we further propose the backtracking mechanism. The backtracking mechanism steps back few tokens and performs activation steering regenerate them, steering the generation toward the desired direction, with the intervention strength determined by the classifier.
Steering with Backtracking (FASB) method, as
Our main contributions are follows:
We propose a flexible activation steering with backtracking that dynamically determines both the necessity and strength of intervention by tracking the internal states of the LLMs.
We propose backtracking mechanism to step back few tokens in order to apply interven- tion and regenerate them.
We conduct extensive experiments the TruthfulQA dataset and six multiple-choice datasets to demonstrate the effeetiveneess of our method.
2
Related Work
Activation steering or representation engineering (Zou et all 2023: Rimsky et all 2024: L all
2023; [Turnr et all 2023. Leong et all, 2023: Wang et al]. 20255 5) uses steering vectors to directly modify the activations of LLMS during inference to control their outputs in a desired direction. Activation steering preserves the general capabilities of LLMs while avoiding the expensive costs
'Questions in some domains may be relatively simple and general, such those related to safety.

---

(1) Anchoring Steering Vectors Inducling
Question-teeeer
Binory Probing Dutavel
Probe Classifier
(aliiio)
LLM
(aaiiie))
Per agmodd
x
Layer Head 1E Aln
Classifirr Training
Prototype- Classifier
Layer Head All
Poetive Cheoer
Laver Head (N will
Steering Vectors
pas
Anchoring (Top-h)
0
Layer Head (6C...
Nezative Claster
Arpul
Extracing the activations the lest token
(2)
Steering Backtracking
Backtracking
Probing activation of top-k heads
Stata
Tracking
xbuu (x
Protetype Famtt())
Normel Generation
Flexible Activation Steering
Detemmning inteventioo snoughh
States
to
Nn O.C.
(005
4. A.Atiivaionn Steering
br. oth. ets
16((x.) 8) p(u))
United
Figure
The framework of flexible activation steering with backtracking.
of high-quality data collection and fine-tuning (Zhang et all 2025 Zhong et all 2025; Shen et all 20255).
The pioneering work (Zou all 2023: Turnrr et all 2023 Wang et all 20228) creates and compares two prompts to obtain the steering vector. ITI al 2025) uses the probe tool on a contrastive question-answering dataset identify set of attention heads associated with truthfulness. During inference, ITI modifies the activations of all subsequent generations in directions associated with truthfulness. Truth Forest (Chen an, 2023)) further employs multiple orthogonal probes ex- tract several truthful steering vectors, thereby improving performance. ACT (Wang et all, 202211) uses clustering construct multiple steering vectors and proposes an adaptive steering strength. CAA (Rimsky et all 2024) computes steering vectors by averaging the difference between pairs of positive and negative examples. During inference, these steering vectors are added into the residual stream with a chosen steering strength at all token positions after the prompt to control the direction. ORTHO (Arditi et all 2024) also averages the difference between pairs of positive and negative to compute the steering vector and performs directional ablation using the opposite direction of the steering vector to guide the model toward the desired behavior. SADI (Wang el all 2022)) utilizes activation differences in contrastive pairs to precisely identify intervention position and dynamically steers model behavior by scaling element-wise activations. In addition, some works have explored the use of activation steering in instruction-follot followwigg (Stolfo et all 2T24), in-context learning (Li al 2024), and differentially private (Giocl cl all 20255).
Method
Our method consists of two steps to flexibly steer model behavior, illustrated in Figure BL In the first step. we employ two alternative methods to identify the attention heads for intervention and to derive both the steering vector and the classifier. In the second step, the classifier is used for state tracking to determine whether intervention is necessary and to adaptively set intervention strength. We further propose backtracking mechanism that allows the LLMSs to regenerate tokens that deviate from the desired behavior. The full procedure can be found in Algorithm [| the Appendix.
3.1 Heads Anchoring and Steering Vectors Inducing
The first step is to use the classifier to identify the attention heads related to the desired behavior and to construct the steering vector. We use the Probe method to identify attention heads and induce the classifiers and steering vectors. In the Appendix All, present alternative Prototype method.

---

0
2
2
0.75
8
12
12
0.55
14
14
18
5.50
18
0.50
20
22
24
24
-.50
30
30
Sorted Head (Probe)
Sorted Head (Prototype)
(a) Accuracy of Probe
(b) Accuracy of Prototype
Figure 4: Accuracies on the validation set of TruthfulQA dataset for all heads all layers in LLaMA2-7B-CHAT, sorted row-wise by accuracy. Darker blue represents higher accuracy.
Since the Probe method uses trainable classifier and typically achieves higher accuracy, we focus only on the Probe method the section.
Probe Probe method employs standard probing tools identify attention heads. The idea behind probing tools is to train a lightweight classifier (probe) on the activations attention heads to iden- tify the relevant heads. Subsequently, we select the top-k heads with the highest accuracy on the validation set for intervention, as they can effectively separate the samples and are more aligned with the desired behavior.
Specifically, we concatenate the question and answer from the labeled dataset and extract the acti- vations at the last token to collect a binary probing dataset ((x(A v:) for each head in each layer, where x denotes the activation of h-th attention head in the Ê-layer at the last token, and y/ E {0, 1} denotes the label. The probe takes following form:
Pat. (x,,1) sigmoid (0
(1)
where (.) denotes dot product, and 0 denotes the probe parameter of h-th attention head in the E-layer. Since the probes can effectively separate positive and negative examples, we use the param- eters of probe 6 the steering vector.
As shown in Figure ML a subset of heads is strongly related to the truthfulness, and the optimal heads relatively evenly distributed across all layers. Therefore, performing fine-grained intervention only on these heads is more targeted and helps minimize disruption to the model's 's overall behavior. It is worth noting that method can also intervene in the outputs of the MLP module the outputs of layers.
3.2 Generation with Flexible Steering and Backtracking
In the second step, after generating each token, the classifier used for state tracking to determine whether the generation deviates from the desired behavior, allowing for flexible intervention. If deviation detected during the generation process, it often indicates that the previously generated tokens have deviated from the desired behavior. We backtrack few tokens to regenerate them and apply steering vectors to adaptively intervene in all subsequent tokens. The backtracking mechanism enables the correction of deviated tokens and helps steer the model toward the desired behavior. If no deviation is detected, the model continues generating normally.
State Tracking After generating the j-th token, the classifier probes the j-th token's 's activation of the LLM to assess whether the current generation deviates from the desired behavior and deter- mines the intervention strength. Notably, state tracking and probe share the same goal: determining whether the current response deviates from the desired behavior. Specifically, we average the pre-

---

diction probabilities from the top-k selected heads to assess the deviation:
p(xi,)
Σ
(1 Por (x4j)
P.h
le
(E,N) & heads
hh where p(x(a) denotes the deviation probability after generating j-th token for x,, and xij represents the activation of j-th generated token for x; at the é-th layer and the h-th head. The process highly lightweight, as the hidden states are already generated during the generation process.
Backtracking When the deviation probability exceeds the threshold, we consider the generation to deviate from the desired behavior, and intervention should be applied. An important issue is that intervening only after a deviation is detected often too late, as it can only affect the content gen- erated subsequently. To address this issue, we propose backtracking mechanism to regenerate the previous deviated tokens. a deviation is detected after generating the j-th token, the backtracking mechanism retains only the first j-s tokens and regenerates the subsequent tokens, where is a hy- perparameter that controls the number of tokens to backtrack. Compared to generating from scratch, the backtracking mechanism only requires generating additional tokens, making the overhead lightweight. Subsequently, we apply intervention and regenerate the content after the (j-s)-th token to prevent further deviation.
Activation Steering We further introduce an adaptive intervention strength for activation steer- ing, where the strength is determined by the degree of deviation calculated by the classifier and is proportional to it. The intervention strength is defined as follows:
I(p(xx,) () p(xi,))
where a and B are hyperparameters that control the intervention strength and the threshold for de- viation probability, respectively. An appropriately sized can steer the LLM toward the desired behavior without compromising generation quality. When a is too large, it degrades generation quality, whereas when it is too small, it fails provide effective steering. An appropriately sized allows intervention when deviations occur. An excessively large 3 may miss necessary interventions, while an excessively small one may cause over-intervention.
Since we intervene in the output of selected heads, the MHSA with intervention can be formulated as follows:
jij++ = concat X1.-++11 + -0 iij-t11 + r C.H.
f.H. we
where hf f- represents the output of ê-th MHSA at the (j-s+l)-th token, x x++ represents the
H.H
output of self-attention for H-th head in ě-th layer, and WCo is output projection matrix in l-th layer. cf.H is binary scalar that equals 1 for the selected top-k heads and 0 for the unselected ones.
Experiments
4.1 Experimental Settings
Datasets and Evaluation Metrics We conduct experiments on open-ended generation tasks and multiple-choice tasks. TruthfulQA etll 2022) dataset includes open-ended generation task and multiple-choice task. For the open-ended generation, we employ two fine-tuned LLMs to judge whether the answer is truthful and informative denoted as True (%) and Info (%) respectively, while the product Info (%) serves as the primary metric. For the multiple-choice tasks, we use datasets: COPA (Gordon et all 20T2), StoryCloze (Mostatazadeh et all 2016), NLI (Bowman et all 201 MMLU (Hendrycks et all 2021),, SST2 (Socher et all 20133, and Winogrande (Sakaguchi all 202D) with response formats ranging from 2- 2-way to 4-way choices. We use multiple-choiee accuracy (MC) to evaluate.
Implementation Details In the Probe method, for the TruthfulQA dataset, we intervene using the top-24 heads, set the threshold range to [0.4, 0.5), the number of backtracking steps to 10, and search
"hatss//hugginnfaccccoaallllleee htt.://nnnnccccclllllaaaaattnnnt jug.://////tuuuuuuuuuuauuuuuueie judhhjjuge-lllm2222777 -aaaa21 https:/hwuggiiiiiieeccolllllaatt iinigaaiinoonneneeeeeeeeeeeeeeee manoo-uugg-lllma2-77
5

---

Table 1:
Results on TruthfulQA open-ended generation IIfo %) and multiple-choice tasks
(MC %).
Open-ended Generation
Multiple-Choies
Methods
True (%)
Info (%)
True (%)
MC1 (%)
MC2 (%)
MC3 (%)
Baseline
66.83
99.51
66.50
33.41
51.07
24.76
ITT
94,49
80.55
76.11
38.31
57.15
30.53
CAA
71.60
83,84
60.03
34.03
52.76
25.62
ORTHO
67.94
90.09
61.21
36.23
52.88
26.12
CAST
67.69
86.17
58.33
33.90
51.17
25.01
ACT
28.80
45.20
SADI-HEAD
77.72
98.53
76.58
35.90
54.65
26.99
Probe (Ours)
93.88
85.81
80.56
48.71
66.58
41.95
Table 2: Results (MC %) on six multiple-choice tasks.
Methods
CОРА
StoryCloze
NLI
MMLU
SST2
Winogrande
AVG
Baseline
64.4
60.2
63.5
60.2
92.2
50.2
65.1
ITI
66.6
59.7
64.3
60.2
92.3
51.5
65.8
CAA
66.6
63.5
64.9
62.6
92.2
50.9
66.8
ORTHO
65.2
60.2
63.1
63.8
92.4
50.4
65.8
SADI
65.4
60.5
65.1
61.8
92.3
51.8
66.1
Probe (Ours)
90.0
93.5
80.0
62.4
92.8
54.1
78.8
for the intervention strength in the range of [40, 80] with step size of 10. For the six multiple-choice tasks, our threshold search range is [0.3, 0.4, 0.5, 0.6), the intervention strength search range is [0, 250] with step size of 10, and the number of backtracking steps is 10.
4.2 Baselines
We compare our model with the following baselines to show its effectiveness. Baseline directly uses the original LLaMA2-7B-CHAL
model to generate text. ITI cL 2023) identifies set at- tention heads with high linear probing accuracy and shifts activations of all subsequent generations following the user's prompt along these probe-correlated directions. CAA (Rimsky all, (022)) computes the steering vector by averaging the difference between pairs of positive and negative examples. During inference, these steering vectors are added at all generations with a coefficient. ORTHO (Arditi et all, 2024) uses the same reversed steering vector for directional ablation, steering generation toward the desired direction. CAST eL 2022)) computes the condition vector and behavior vectors using PCA. During the inference phase, it uses the condition vector to make judgments, enabling dynamic intervention generations. ACT (Wang et all 20246) constructs mul- tiple classifiers through clustering and uses these classifiers to dynamically intervenc in responses from different directions. SADI (Wang et all (I22R) utilizes activation differences in contrastive pairs to preciscly identify intervention position and dynamically steer model behavior by scaling element-wise activations.
4.3 Results
Results on TruthfulQA In Table II the Probe method demonstrates superior performance compared to the baselines on the TruthfulQA dataset. Compared to the ITI method, our Probe method does require additional training on top of ITI and has achieved performance far exceeding that of the ITI method. This is because ITTI applies the same intervention strength indiscriminately to all gener- ations. This makes it impossible to assign adaptive intervention strength and may cause originally correct answers to be incorrectly altered due to the intervention. In contrast, our method adaptively determines intervention strength and does not intervene correct generations. Compared with other dynamic intervention methods such as ORTHO, CAST, ACT, and SADI, it can be noted that SADI also achieves good performance, which demonstrates that the dynamic steering vector is ef- fective. ORTHO and CAST are mainly designed for safety-related scenarios, where it is relatively

---

Table 3: Ablation study on TruthfulQA dataset.
Methods
Irue
MC1
MC2
Probe
80.56
48.71
66.58
Intervention Strength:
All fixed strength
76.11 82.08
38.31
57.15
w/o Adaptive
42.96
62.06
Intervention Position:
w/o Backtracking
62.11
35.01
53.55
After Question 72.55
41.86
59.88
easy to determine whether query is harmful based solely the query information. However, in domains such as truthfulness and faithfulness, is difficult to anticipate whether the generated con- tent will deviate based solely the query, resulting in poor performance. Compared with these dynamic intervention methods, the superiority of our method can further demonstrated.
Results on Multiple-choice In Table E our method achieves consistently promising results across all datasets, and Probe method achieves the best performance. This demonstrates that adaptive intervention and using probes to select heads remain effective on multiple-choice datasets. Notably, CAA achieves better results than ITT, suggesting that layer-wise intervention can sometimes lead to better performance. SADI also performs well in multiple-choie tasks, which demonstrates the generalizability the dynamic steering vector.
4.4 Ablation Study
We conduct an ablation study to show the effectiveness of the proposed components in Table R
We first explore the ablation of intervention strength. "All fixed strength" refers the results of applying the same intervention strength to all samples. "w/o Adaptive" refers to the results of applying the same intervention strength to samples that meet the intervention criteria. By comparing the results of "w/o Adaptive" with "All fixed strength", it is demonstrated that intervening only on samples that deviate from the desired behavior can improve performance. Comparing the results of the Probe with "w/o Adaptive" demonstrates the effectiveness of dynamic intervention strength.
We then explore the ablation of the intervention position. "w/o Backtracking" means no backtrack- ing is performed. "After Question" indicates that the representation of the question was used to decide whether to intervene and intervention strength. Comparing the results of the Probe with "w/o Backtracking" shows the necessity of the backtracking operation. The TIfe*Info metric of "w/o Backtracking" is even lower than the baseline. This indicates that intervening after detecting the deviation from the desired behavior is too late. Comparing the results of the Probe with "After Question" indicates that relying solely on the hidden states of the question part judge whether the subsequent response deviates from the desired behavior is insufficient. It is necessary to make judgments after generating part of the response.
4.5 Generalizability across More Truthful Benchmarks
We further investigate whether our method can generalize beyond the TruthfulQA benchmark. Specifically, we directly evaluate the classifier and steering vectors obtained from TruthfulQA on two datasets related to real-world truth, including Natural Questions (Kwiatkowskı TriviaQA (loshi et all 2012). The Natural Questions dataset consists of 3,610 real queries issued to the Google search engine, annotated with answers and supporting Wikipedia pages. TriviaQA includes 95K mnestion-answer pairs annotated by trivia enthusiasts. Following Li all (2023), all benchmarks are presented in multiple-choice format.
20)) and
The results indicate that the Probe method outperforms the baseline and the ITT on both benchmarks, as shown in T This suggests that employing the Probe method does not undermine the model's performance in out-of-distribution truthful domains; Instead, it enhances the model's 's performance, particularly in domains closely related to the real-world truth. This indicates that the classifier and
7

---

Table 4: MC2 on the Natural Questions and TriviaQA multiple-choice datasets using LLaMA2-7B- CHAT as the baseline.
Methods
Natural Questions
TriviaQA
Baseline
49.54
61.22
ITI
56.50
66.49
Probe
59.25
67.55
0.8
Baseline
0.7
0.6
Probe
0.5
0.4
0.3
0.2
LLaMA2-78 78
LLaMAZ CHAT
LLIMA2-12 Chat
ULMM33 3 d8 insty
Qwen2.5 5-77
Qwen2.5 7B INTRECT
(6) TutthuOA muttgle-choice task (MC) %)
0.8
Baseline
0.7
0.6
Probe
0.5
0.4
0.3
0.2
LLaM42-78
LLaMA2-7B--0L
LLAMA2-1 Chat
LLaMAN 48 indt act task
Owen2 5-78
Gwen2. Instrcct
(3)
Figure 5: The performance of various LLMs on the TruthfulQA benchmark.
steering vector learned on the TruthfulQA dataset are not domain-specific, but rather general real- world truth features.
4.6
Generality across More LLMs
To evaluate the generality across various LLMs, we apply the Probe method to 6 L.Mss, including ILaMA2 Touvron et all (2012), ILaMA3.1 (Graatatiooii et all, 2022), and Qwen2.5 (Yang et all
2024).
The performance of baseline, ITI, and Probe the TruthfulQA benchmark in Figure B
The probing method effectively improves performance across LLMs, demonstrating that our ap- proach generalize to models of different sizes, architectures, and whether or not they have been instruction-tuned Notably, our method yields significant improvements of 24.61 and 20.03 in MC1 and MC2, respectively, Qwen2.5-7B. Compared with the ITI method, method achieves better performance on all LLMs. On Qwen2.5-7B. there is an improvement of 23.50 on the MC1 and an improvement of 19.81 11 the MC2. It is demonstrated that our method outperforms the ITI method in terms of performance across different LLMs. Scaling up the model size often results in better per- formance, indicating that it has acquired more knowledge related to truthfulness. Instruction-tunal models achieve better performance than non-instruction-tun ones, indicating that instruction tun- ing helps enhance the truthfulness of the model.
4.7 Model Analysis
Effects of intervention strength and head number In Figure E. present the results of our method on the TruthfulQA dataset. We sweep two hyperparameters to control the intervention: the number of identified attention heads and the intervention strength.
The truthful metrics MC1, MC2, and True show trend where the results continuously improve as both the strength and the number of attention heads increase. This is because, with the continuous increase the number heads and the strength of intervention, the internal truthfulness of model is constantly increasing, making the model more inclined to choose and respond with more truthful answers. is worth noting that our method can be applied with greater strength, does not intervene with all samples, and the intervention strength is adaptive.

---

12
0.47
0.48
0.50
12
0.65
0.67
0.69
12
0.83
0.55
0.88
12
0.54
0.94
0.92
12
0.78
0.50
0.81
Numbar Hiatts
Numoo of Horls
0.45
0.49
0.53
0.65
0.67
0.71
Numbor
24-
0.87
0.94
0.33
0.92
0.86
0.76
Numbo
0.80
0.81
0.71
30
0.51
0.54
30
0.45
0.64
30
0.85
0.94
30
0.09
0.25
0.53
30
0.76
0.68
0.50
60
60
50
70
70
60
Strength
Strength
Strength
Strength
Strength
Figure 6: Results with varying intervention strength and numbers of attention heads on the Truth- fulQA dataset with LLaMA2-7B-CHAL.
PCI
0.8
0.8
0.7
Yares
0.7
0.6
0.5
0.5
0.4
0.3
0.4
0.6
458(288
992(40%)
Training Set 1985/80%) 2481/1009)
Threshald
Effects of threshold
(b) Effects of size of the training
Figure 7: Effects of the threshold and the size of the training TruthfulQA dataset.
The Info metric decreases as the number of heads increases and the intervention strength increases. This is because, with the continuous increase intervention strength, the model internally encodes more truthfulness, leading the model to be more inclined to respond with answers that are truthful but lack informativeness. Due to the mutual restraint between the True metric and the Info metric, the Info metric achieves highest values when the True metric and the Info metric are relatively balanced, i.e., the number of heads 18 and the strength 60. Therefore, the optimal hyperparam- eters for MC2 and True* are not consistent.
Effects of threshold To investigate the impact of different thresholds B, we conduct experiments with thresholds set at 0.3, 0.4, 0.5, and 0.6. When 3 is 0.3, 0.4, or 0.5, the overall performance does not vary significantly. Among them, True*Info achieves the best performance 0.4, while MC1 and MC2 perform best 0.5. When the threshold set to 0.6, True drops sharply, which may be due to excessive intervention.
Effects of training set size To better investigate the impact of the size of the used dataset on the
performance, we conduct experiments by utilizing 20%, 40%, 60%, 80%, and 100% the original dataset. As the size of the dataset increases, the metrics MC1, MC2, and IIfe generally exhibit an upward trend, essentially reaching their maximum values after utilizing approximately 80% of the data, shown in Figure (b). Moreover, when only 20% of the data is used, i.e., 496 samples, all three metrics can exceed the baseline, with more significant improvements observed in the MC1 and MC2 metrics. This indicates that our method does not require large dataset. As the amount of data increases, performance improvements become both more consistent and more significant.
5 Conclusion
In this paper, propose Flexible Activation Steering with Backtracking framework. It dynam- ically decides whether and how strongly to intervene by probing the internal states of the L.M.M Specifically, FASB first identifies attention heads that are consistent with the desired behavior and

---

derive the steering vector and classifier. Then, FASB uses classifiers to dynamically determine whether and how strongly intervene by probing the internal states of the LLM. Finally, we further propose a backtracking mechanism to regenerate in order to avoid deviating from the deviated behav- ior. Experimental results on the TruthfulQA dataset and six multiple-choice datasets to demonstrate the effectiveness of our method.
Acknowledgments and Disclosure of Funding
We would like thank the anonymous reviewers for their insightful comments. This work is sup- ported by the JiangSu Natural Science Foundation under Grant No. BK20251989; the National Natural Science Foundation of China under Grants Nos. 62441225, 61972192, 62172208; the Fun- damental Research Funds for the Central Universities under Grant No. 14380001. This work is partially supported by Collaborative Innovation Center of Novel Software Technology and Industri- alization.
References
Arditi, A., Obeso, O.. Syed, A.. Paleka, D., Panickssery, N., Gurnee, W., and Nanda. N. (2024). Refusal in language models is mediated by single direction. In Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024.
Bai, Y., Jones, A., Ndousse, K., Askell, A., Chen, A., DasSarma, N., Drain, D., Fort, S., Ganguli, D., Henighan, T., Joseph, N., Kadavath, S., Kernion, J., Conerly, T., Showk, S. E., Elhage, N., Haffield-Dodds, Z., Hernan- dez, D., Hume, T., Johnston, S., Kravec, S., Lovitt, L.,, Nanda, N., Olsson, C., Amodei, D., Brown, T. B., Clark, J., McCandlish, S., Olah, C., Mann, B., and Kaplan, (2022). Training a helpful and harmless assistant with reinforcement learning from human feedback. CoRR, abs/2204.05862.
Bowman, S. R., Angeli, G., Potts. C., and Manning, C. D. (2015). A large annotated corpus for learning natural language inference. In Proceedings of the 2015 Conference on Empirical Methods in Natural Language Processing, EMNLP 2015. pages 632-642.
Brown, T. B.. Mann, B., Ryder. N., Subbiah, M.. Kaplan, J.. Dhariwal, P., Neelakantan, A., Shyam, P.. Sastry, G., Askell, A., Agarwal, S., Herbert- Voss, A., Krueger, G., Henighan. T., Child, R., Ramesh. A., Ziegler, D. M., Wu, J., Winter, C., Hesse, C., Chen, M., Sigler, E., Litwin, M., Gray, S., Chess, B., Clark, J., Berner, C., McCandlish, S., Radford, A., Sutskever, I,, and Amodei, D. (2020). Language models are few- shot learners. In Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NewrlPS 2020.
Chen, 7-, Sun, X., Jiao, X., Lian, F., Kang, 7., Wang, D., and Xu, C. (2024). Truth forest: Toward multi- scale truthfulness in large language models through intervention without tuning. In Thirty-Eighth AAAI Conference on Artificial Intelligence, AAAI 2024, pages 20967-20974
Cheng. Z., Wang. Z., Fu, Y., Jiang. Z., Yin, Y., Wang. C., and Gu, Q (2025). Contrastive prompting enhances sentence embeddings in Ilms through inference-tinge steering. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2025, pages 3475-3487.
Gehman, S., Gururangan, S., Sap, M., Choi, Y., and Smith, N. A. (2020). Realtoxicityprompss: Evaluating neural toxic degeneration in language models. arXiv preprint arXiv:2009.1 1462..
Goel, A., Hu, Y., Gurevych, I., and Sanyal, (2025). Differentially private steering for large language model alignment. CoRR, abs/2501.
Gordon, S.S Kozareva, Z., and Roemmele, M. (2012). Semeval-2012 task 7: Choice of plausible alternatives: evaluation of commonsense causal reasoning. In Proceedings of the 6th International Workshop on Semantic Evaluation, SemEval NAACL-HILT 2012, pages 394-398.
Grattafiori, A., Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Vaughan, A., et al. (2024). The llama herd of models. arXiv preprint arXiv:2407.21788
Hendrycks, D.. Burns, C., Basart, S., Zou, A., Mazeika, M., Song, D., and Steinhardt, J. (2021). Measuring massive multitask language understanding. In 9th International Conference on Learning Representations, ICLR 2021.
Joshi, M., Choi, E., Weld, D. S., and Zettlemoyer, L. (2017). Triviaqa: A large scale distantly supervised challenge dataset for reading comprehension. In Barzilay, R. and Kan. M., editors, Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics, ACL 2017, pages 1601-1611.
10

---

Kwiatkowski, T., Palomaki. J., Redfield, O., Collins, M., Parikh, A. P. Alberti, C., Epstein, D., Polosukhin, I., Devlin, J., Lee, K., Toutanova, K., Jones, L.., Kelcey, M., Chang, M., Dai, A. M.. Uszkoreit, J., Le, Q. and Petrov, (2019). Natural questions: benchmark for question answering research. Truns. Assoc. Comput. Linguistics, 7:452-666,
Lee. W., Padhi, I., Ramamurthy, K. N., Michling, E.. Dognin, P., Nagireddy, M., and Dhurandhar, A. (2024). Programming refusal with conditional activation steering, arXiv preprint arXiv:2409.05900
Lee, B. W., Padhi, L., Ramamurthy, K. N., Michling, E., Dognin, P. L., Nagireddy, M., and Dhurandhar, A. (2025). Programming refusal with conditional activation steering. In The Thirteenth International Confer- ence on Learning Representations, ICLR 2025.
Leong, C. T., Cheng. Y., Wang, J., Wang, J., and Li, W. (2023). Self-detoxifying language models via toxifica- tion reversal. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 4433 4449.
Li, K., Patel, O., Viégas, F. B., Pfister, H., and Wattenberg, M. (2023). Inference- time intervention: Eliciting truthful answers from a language model. In Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023.
Lin, S., Hilton, J., and Evans, O. (2022). Truthfulqa: Measuring how models mimic human falschoods. In Proceedings of 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2022, pages 3214 3252..
Liu, S., Ye, H. Xing. L.., and Zou, J. Y. (2024). In-context vectors: Making in context learning more effective and controllable through latent space steering. In Forty-first International Conference on Machine Learning, ICML 2024.
Mostafazadeh, N., Chambers, N., He, X., Parikh, D., Batra, D., Vanderwende, L., Kohli, P., and Allen, J. F. (2016). A corpus and cloze evaluation for deeper understanding of commonsense stories. In NAACL HLT 2016, The 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 839-849.
Rimsky, N., Gabrieli, N., Schulz, J., Tong, M., Hubinger, E., and Turner, A. M. (2024). Steering Ilama 2 via contrastive activation addition. In Proceedings of the 62nd Annual Meeting of the Association for Computa- tional Linguistics (Volume 1: Long Papers), ACI. 2024, pages 15504-15522.
Sakaguchi, K., Bras, R. L., Bhagavatula, C., and Choi, (2020). Winogrande: An adversarial winograd schema challenge at scale. In The Thirty-Fournh AAAI Conference on Artificial Intelligence, AAAI 2020, pages 8732-8740.
Shen, F., Jiang, X., He, X., Ye, H., Wang, C., Du, X., Li, Z., and Tang, J. (2025). Imagdressing-vl: Customiz- able virtual dressing. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 6795-6804.
Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C. D., Ng. A. Y., and Potts, C. (2013). Recursive deep models for semantic compositionality over sentiment treebank. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, EMNLP 2013, pages 1631-1642.
Stolfo, A., Balachandran, V., Yousefi, S., Horvitz, E., and Nushi, B. (2024). Improving instruction-follove followiin in language models through activation steering. CoRR, abs/2410.12877.
Touvron, H., Martin, I.., Stone, K., Albert, P., Almahairi, A., Babaci, Y., Bashlykow, N., Batra, S., Bhargava, P., Bhosale, S., Bikel, D., Blecher, I.,, Canton-Ferrer, C., Chen, M., Cucurull, G., Esiobu, D., Fernandes, Fu, J., Fu, W., Fuller, B., Gao, C., Goswami, V., Goyal, N., Hartshorn, A., Hosseini, S., Hou, R., Inan, H., Kardas, M., Kerkez, V., Khabsa, M., Kloumann, I., Korenev, A., Koura, P. S., Lachaux, M., Lavril, T., Lee, J.. Liskovich, D., Lu, Y., Mao, Y.. Martinet, X., Mihaylov, T., Mishra, P.. Molybog, I., Nie, Y., Poulton, A.. Reizenstein, J., Rungta, R., Saladi, K., Schelten, A., Silva, R., Smith, E. M., Subramanian, R., Tan, X. E., Tang, B., Taylor, R., Williams, A., Kuan, X., Xu, P., Yan. Z., Zarov, Zhang, Y., Fan, A., Kambadur, M., Narang, S., Rodriguez, A., Stojnic, R., Edunov, S., and Scialom, T. (2023). Llama 2: Open foundation and fine tine-tuned chat models. CoRR, 0bs/2307.09288.
Turner, A. M., Thiergart, L., Udell, D., Leech, G., Mini, U.. and MacDiamiid, M. (2023). Activation addition: Steering language models without optimization. CoRR, abs/2308. 10248.
Wang, C., Deng, Z., Jiang, Z., Shen, F. Yin, Y., Gan, S., Cheng, Z. Ge, S., and Gu, Q. (2025a). Advanced sign language video generation with compressed and quantized multi-conditee tokenization. arXiv preprint arXiv:2506.15950

---

via dynamic Wang, C., Tian, K., Guan, Y. Shen, F., Jiang, Z., Gu. Q. and Zhang, J. (2025b). Ensembling difffusion models adaptive feature aggregation. In The Thirteenth International Conference Learning Reprexentations.
Wang. C., Tian, K., Zhang, J., Guan, Y., Luo, F. Shen, F., Jiang, Z., Gu, Q. Han, X., and Yang. W. (2024a). V-express: Conditional dropout for progressive training of portrait video generation. arXiv preprint arXiv:240..02511.
Wang, T., Jiao, X., He, Y., Chen, Z., Zhu, Y., Chu, X., Gao, J., Wang. Y., and Ma, L. (2024b). Adaptive acti- vation steering: tuning-fir free LLM truthfulness improvement method for diverse hallucinations categories. CoRR, abs/2406.00034.
Wang, W. Yang, and Peng, (2024c). Semantics-adaptive activation intervention steering vectors. CoRR, abs/2410. 12299.
Wei. J., Bosma, M., Zhao, V. Y., Guu, K., Yu, A. Lester, B., Du, N., Dai, A. M., and Le, Q. (2022). Finetuned language models are zero-shot learners. In The Tenth International Conference on Learning Representations, ICLR 2022.
Welbl, J., Stenetorp, P., and Riedel, S. (2018). Constructing datasets for multi-hop reading comprehension across documents. Trans. Assoc. Comput. Linguistics, 6:287-302.
Yang, A., Yang. B., Zhang, B., Hui, B., Zheng, B., Yu, B., Li, C., Liu, D., Huang. F,, Wei, H., et al. (2024).
Qwen2. 5 technical report, arXiv preprint arXiv:2412.55115.
Zhang. X., Zhao, J., Yang. Z., Zhong, Y., Guan, S., Cao, L.,, and Wang, Y. (2025). UORA: uniform orthogonal reinitialization adaptation in parameter efficient fine-tuning of large models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2025, pages 11709-11723
Zhong, Y., Zhao, J., and Zhou, Y. (2025). Low-rank interconnected adaptation across layers. In Findings of the Association for Computational Linguisties, ACL 2025, pages 17005 17029.
Zou, A., Phan, L., Chen, S., Campbell, J., Guo, P., Ren, R., Pan, A., Yin. X., Mazeika. M., Dombrowski. A.,
Goel, S., Li, N., Byun, M. J., Wang, Z., Mallen, A., Basart, S., Koyejo. S., Song, D., Fredrikson, M., Kolter. Z., and Hendrycks, D. (2023). Representation enginecring: top-down approach to Al transparency. CoRR, abs/2310.01400
12

---

Table 5: (MC %).
Results on TruthfulQA open-ended generation IIfu %) and multiple-choice tasks
Open-ended Generation
Multiple-Choiee
Methods
True (%)
Info (%)
True (%)
MC1 (%)
MC2 (%)
MC3 (%)
Baseline
66.83
99.51
66.50
33.41
51.07
24.76
ITI
94,49
80.55
76.11
38.31
57.15
30.53
CAA
71.60
83.84
60.03
34.03
$2.76
25.62
ORTHO
67.94
90.09
61.21
36.23
$2.88
26.12
CAST
67.69
86.17
58.33
33.90
51.17
25.01
ACT
28.80
45,20
SADI-HEAD
77.72
98.53
76.58
35.90
54.65
26.99
Probe (Ours)
93.88 88.37
85.81
80.56
48.71
66.58
41.95
Prototype (Ours)
94.98
83.94
46.14
64.30
37.07
Table 6: Results (MC %) on six multiple-choiee tasks.
Methods
COPA
StoryCloze
NLI
MML.U
SST2
Winogrande
AVG
Baseline
64.4
60.2
63.5
60.2
92.2
50.2
65.1
ITI
66.6
59.7
64.3
60.2
92.3
51.5
65.8
CAA
66.6
63.5
64.9
62.6
92.2
50.9
66.8
ORTHO
65.2
60.2
63.1
63.8
92.4
50.4
65.8
SADI
60.5
65.1
61.8
92.3
51.8
66.1
Probe (Ours)
93.5
62.4
Prototype (Ours)
87.8
86.1
73.7
62.2
93.1
54.7
76.3
A Prototype Method
Prototype method directly constructs two prototypes to achieve the above goal. Specifically, compute the average activation within each class obtain the prototype representations h-th attention head the E-th layer, as follows:
Prototype
Ngws
Neey
0º h
Σ I( 1)x
C.A.
Σ I(
(5)
Noos
Nneg
where 0%d and o represent the prototypes of the positive and negative classes, respectively. I denotes indicator function, and N and Nneg represent the numbers of positive and negative samples, respectively. Then, the softmax function cosine similarities between activation and prototypes to define classifier:
exp(cos(xf,1 P.h Ofth )/T)
Por. (x(:1)
(6)
exp(cos(x (,, ( )/T) exp(cos(x{,11 E.h. (
where т denotes the temperature. We also use the classifier to anchor the top-k heads with high accuracy for intervention. Finally, we directly use the mean difference between positive and negative prototypes as the steering vector:
c.h
(7)
pos
is worth noting that the prototype method is training-free free. only involves averaging the activations of the training set to obtain prototype vectors for constructing the classifier.
Implementation Details In the Prototype method, for the TruthfulQA dataset, we intervene using the top- 24 heads, set the threshold to 0.5, the number of backtracking steps 10, the temperature to 0.1, and search for the intervention strength in the range of [25, 55] with step size of 10. For the six multiple-choice tasks, the threshold is 0.5, the number backtracking steps is 10, the temperature 0.1, and intervention strength search range is [0, 400J with a step size of 10.
Results In Table the Prototype method also demonstrates superior performance compared to the baselines on the TruthfulQA dataset. Compared with the ITI and ACT methods that require training linear classifier, the Prototype method achieves improvements of 7.83% and 17.34 on MC1, and 7.15% and 19.1% on MC2,
13

---

respectively. This demonstrates the generality of our method. It worth noting that the Probe method performs better the True and multiple-choice metrics, while the Protolype method achieves higher performance the Info and Info metries. This may because the trained probe more closely related to truthfulness.
Table the Prototype method also achieves better performance than baselines on six multiple-choice tasks. On the COPA dataset and the StoryCloze dataset, the Prototype method achieves improvements of 23.4% and 25.9% compared with the model without intervention, while other methods only achieve marginal improve- ments. This further demonstrates its effectiveness.
B Algorithm
The algorithm consists two main processes. first step is Heads Anchoring and Steering Vectors Induc- ing, which determines the heads that need to be intervened, the classifiers, and the steering vectors. The second step is Generation with Flexible Steering and Backtracking, which involves using classifiers to evaluate the internal activations of LLMs. When the internal activations exceed certain threshold. backtracking operation will be performed. After the backtracking, Since our method also backtracks to beginning when the number of generated tokens is less than 8, we start tracking from the s-th token, as shown in Line 14 of the algorithm.
activations will be regenerated by adding the activation vectors.
Algorithm 1
The overall flow of FASB
Require: LLM, dataset D, intervention strength a, threshold 3, backtracking number maximum
number of generated tokens M
1: Step1: Heads Anchoring and Steering Vectors Inducing
2: if Probe then
3: Train classifier Par. dataset D;
Equation
4: Use the parameters of the probe as the steering vector 0c.h;
5: else if Prototype then
6:
Construct two prototypes from the dataset D: 7: Obtain the classifier Par.A
D. Equation Equation
8: Obtain the steering vector 6%.h,
> Equation
9:
end if Step2: Generation with Flexible Steering and Backtracking
10:
for 1 to M do
12: Generate the j-th token;
Evaluate the current activation using the classifier;
Equation
14: if p(xi,) 8 and 2 then
Backtrack 8 tokens;
16:
Calculate the intervention strength;
Equation B
17:
for k = (j-s+I) 1) to M do
18:
Intervene on the current activation;
Equation
19:
Generate the k-th token;
20: end for
21: break;
22: end if
23:
end for
C Effects of the Number of Tokens for Backtracking
In order to better investigate the impact of the backtracking number on our method, we conduct experiments on the TruthfulQA dataset.
As shown in Figure & we investigate the effect of different token numbers for backtracking (i.e., 2, 5, 10, 20) on the MC1, MC2, and Tnfo metrics. MC1, MC2, and True*Info generally show increasing trend with the increase in the number of backtracking steps. This hecause, as the number of backtracking increases, method can intervene in the model's internal activations earlier, thereby achieving improved performance.
D Fine-Grained Model Comparison
We further propose two models based on Probe for fine-grained analysis. The difference between them and Probe lies in the detection location and the point which intervention begins, resulting in different overheads.
14

---

0.9
MCI
MC2
0.8
TueeInfo
0.7
0.6
0.5
0.4
0.3
2
5
10
20
Backtracking number
Figure 8: Effects of the number of tokens for backtracking.
Table 7: Comparison with two fine-graine models.
Methods
TIfo
MC1
MC2
Probe
80.56
48.71
66.58
BTB
81.60
48.83
67.62
GCBB
81.96
50.67
67.48
(1) The first method directly BackTracks to the Beginning (BTB). Specifically, when a deviation is detected during generation. BTB backtracks not just tokens for regeneration, but to the beginning. Our method gen- erates additional tokens for texts that require backtracking. whereas this variant generates even more. (2) The second method performs detection after the Generation Complete and then Backtracks the Beginning (GCBB). Notably, this method incurs approximately double the overhead texts that require backtracking.
As shown in the results in Table GCBB usually achieves the best performance, and both BTB GCBB outperform our proposed Probe method on the TruthfulQA dataset. This is because GCBB has access to the full output of the LLM. allowing it to better determine the intervention strength. However, GCBB inevitably introduces additional overhead. BTB may also sometimes require full regeneration. The advantage of Probe that achicves good performance while maintaining stable and relatively low additional overhead.
E
Results across TruthfulQA Categories
TruthfulQA is split into 38 subcategories, including politics, language, education, psychology and others. We compare method with the baseline method without intervention using the True"Info metric across all sub- categories with or more questions, where the subcategories are ranked in descending order based on their quantity within dataset, as shown in Figure B
Our method demonstrates significant enhancement across most suhcategories, with the overall performance improvement showing uniform distribution rather than concentration in particular domains, thereby validating its efficacy.
F Results on Multi-hop QA dataset
conduct experiments on the more challenging multi-hop question answering WikiHop dataset (Welbletal. RUS) to verify the effectiveness, as shown in Table Our method achieves improvements of 5% and 4.3% on metries MC1 and MC2, respectively. This further demonstrates the generalizability of our method.
Table 8: Results on the WikiHop dataset.
Method
MC1(%)
MC2(%)
LLaMA2-7B-CHAS --CA
45.20 50.20 (+ 5.00)
44.03
SAMMA2-7B-CHA- + Probe
48.33 (+4.30)
15

---

Dxenite
True+Into Info (%6
60
Muconcoptions
Law Sociology
Health
Econumics
Fiction
Paranarmal
comppiracies
Starestypass
Confurien: People
History
Supersutions
Intedeal Error: Other
Languaye
Mythe and fairyaaes
Psychology
Proverbs
Weather
Nutritten
Indectcal Error: Time
Mismutattioss
Contusler: Pisces
Retigion
Logical ratsetord
Disraction
Indentical Eror Location
Adverti
Misiformaate
Education
Politics
Figure 9: Info scores split across subcategories on LLaMA2-7B- BB-CAT, sorted by the differ- ence between baseline and probe method. Subcategories with less than 10 questions are not shown.
G Generalizability on larger LLM
We further explore the effectiveness of method larger LLMSs using WWVFN2.5-32B-Insmreee the TruthfulQA dataset Table B Our method still achieves significant performance improvements, demonstrating its effectiveness on larger LLMs as well.
Table 9: Results on the Qwen2.5-32B-Insttnee Instructt model.
Method
MC1(%%
MC2(%)
MC3(%)
Swen2.5-33B-Im
50.00
66.35
38.75
Bwve2.5533BBInsttuue +Probe
69.00
76.67
59.59
H Deviation Positions Under Different Thresholds
The Table [[о presents the detected deviation positions under different thresholds the TruthfulQA dataset. We observe that the threshold has a significant impact on the intervention position. When the threshold high, the intervention positions tend occur significantly later, and the interventions are less frequent. This because the model needs to track more generated content to make a more accurate judgment about whether a deviation occurs.
Table 10: Distribution of tokens under different thresholds.
Position
Threshold 3
0-10
10-20
20-50
0.4
304
94
0.5
166
159
75
0.6
21
109
222
I Results on Toxic Context Generation
Since our method can flexibly manipulate various behaviors, we further conduct experiments on RealTox- icityPrompts dataset (Gehmmaneeiaa 2020) for toxic content generation, as shown in Table III Our method can effectively steer LLMs to generate toxic content, demonstrating its generality. This also highlights the vulncrability of current alignment methods and the potential risks of our approach.
J Comprehensive Hyperparameter Analysis of strength a and threshold 8
We further conduct a more comprehensive exploration of the impact of strength and threshold & on the TruthfulQA dataset.
16

---

Table 11: Results on the RealToxicityPrompts dataset.
Method
ASR (1)
LLaMA2-7B-CHAT
42.0
LLaMA2-7B-CHAT Probe
46.4 (+4.4)
Table 12: Impact of strength.
Strength
MC1 (%)
MC2 (%)
True (%)
Info (%)
True=Info (%)
(baseline)
33.41
51.07
66.83
99.51
66.50
2
36.43
52.96
67.24
84.35
56.72
38.63
54.94
68.46
84.35
57.75
15
43.77
60.14
73.71
88,86
65.50
25
43.33
62.02
80.18
91.06
73.01
35
43.33
62.66
82.01
93.88
76.99
45
45.04
63.84
83.61
93.88
78.49
50
45.04
64.52
87.15
91.80
80.05
60
48.71
66.58
93.88
85.81
80.56
65
50.18
68.59
95.11
77.24
73.46
70
52.51
70.89
93.26
76.38
71.24
100
55.75
74.35
97.83
18.51
18.11
500
43.03
75.48
89.99
6.36
5.68
As shown in Table IP when is small (c.g., 2,5), it often fails effectively improve the True metric and even leads a decrease in the Info metric. This indicates that low intervention strength fails to enhance truthfulness and even reduces informativeness. Conversely, an excessively large intervention strength (c.g., 100, 500) reduces the informativeness of the generated text. For instance, when 500, we observe that the Info metric drops 6.36%, indicating that the generated text lacks informativeness. An appropriately sized often enhances the truthfulness of the generated content while causing less information loss.
Then, explore the impact of the threshold B. As shown Table IR when 0.7, 0.8, 0.9), many samples would not be intervened, leading lower performance on the MC1, MC2, and True metrics. For instance, the performance on these three metrics with S 0.7, 0.8, 0.9 is significantly lower than that with / 0.6. When 3 is too small (e.g.. & = 0, 0.2). many samples would be backtracked and intervened the first state judgment. In such cases, although performance may remain satisfactory due to adaptive intervention strength, the method loses the flexibility decide whether intervention needed.
large (c.g.,
Table 13: Impact of threshold.
Threshold B
MC1 (%)
MC2 (%)
True (%)
Info (%)
True (%)
0.0
46.63
66.15
90.45
86.42
78.16
0.2
48,90
65.89
80.68
91.69
73.98
0.3
46.88
66.77
90.45
86.42
78.17
0.4
48.71
66.58
93.88
85.81
80.56
0.5
50.80
68.55
90.94
86.17
78.37
0.6
48.95
65.37
75.15
84.21
63.29
0.7
44.74
57.69
66.01
83.13
54.87
0.8
35.45
51.76
65.04
84.35
54.86
0.9
35.21
51.64
65.04
84.35
54.86
K Limitations
First, our approach is flexible and could used any sort of steering, including less-noble purposes (e.g., jailbreaking, toxic content generation), which may carry negative impacts. Second, our approach is spperparametee-deeenddee and the research mainly focuses on QA tasks along specific behaviors (e.g.. truth- fulness and informativeness) on English datasets. Finally, since truthfulness and informativeness content lack

---

ground-truth for direct evaluation, we follow prior work (Lretall PO2K Wang el al ()ZE)) and employ LLM- based judge models as evaluators, It is worth noting that this evaluation not perfect and may introduce emors.
18

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We have described our claims and contributions clearly the abstract and introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contribu- tions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize other settings.
It is fine to include aspirational goals as motivation long it is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We provide limitaion section in Appendix.
Guidelincs:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged create separate "Limitations" section their paper.
The paper should point out any strong assumptions and how rohust the results violations of these assumptions (e.g.. independence assumptions, noiseless settings, model sell-specification. asymptotic approximations only holding locally). The authors should reflect on how these as- sumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested a few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or a speech-to-text system might not used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address prob- lems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers grounds for rejection, worse outcome might be that reviewers discover limitations that aren't it acknowledged in the paper. The authors should that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
their best judgment and recognize
Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and com- plete (and correct) proof?
Answer: [NA]
Justification: In this paper, prove our claims with extensive empirical results, instead of theoretical proofs.
Guidelincs:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross-referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
19

---

The proof's can either appear in the main paper the supplemental material, but if they appear in the supplemental material, the authors encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by
Formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main experimen- tal results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification; We provided the hyperparameters to reproduce the experimental results in the Experi- mental Settings.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided not.
If the contribution is datasct and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending the contribution, reproducibility can be accomplished in various ways. For ex- ample. if the contribution a novel architecture, describing the architecture fully might suffice, or the contribution is specific model and empirical cvaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but repro- ducibility also be provided via detailed instructions for how to replicate the results, access a hosted model (e.g., in the case large language model), releasing a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architecture clcarly and fully.
(c) the contribution a new model (e.g.. large language model), then there should either be way to access this model for reproducing the results or a way to reproduce the model (c.g., with an open-source dataset or instructions for how to construct the datasct).
(d) We recognize that reproducibility may be tricky some cases, which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (c.g.. to registered users), but it should be possible for other researchers to have some path to reproducing verifying the results.
5. Open access to data and code
Question: Does the paper provide open access the data and code, with sufficient instructions faithfully reproduce the main experimental results, as described supplemental material?
Answer: [Yes]
Justification: release the data and code after the paper accepted.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurTPS code and data submission guidelines (https://nips. http:///iips.cccpuuuiies cc/public/
for more details.
While we encourage release of code and data, we understand that this might not possible, so No is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source henchmark).
The instructions should contain the exact command and environment needed to run to repro- duce the results. See the NeurIPS code and data submission guidelines for more details.
20

---

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. If only a subset of experiments are reprodueible, they should state which ones are omitted from script and why.
At submission time, preserve anonymity, authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
Experimental setting/details
Question: Does the paper specify all the training and test details (e.g.. data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification:
We have provided these details in the Experimental Settings.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary appreciate the results and make sense of them.
TTe full details can be provided either with the code, in appendix, supplemental material.
7. Experiment statistical significance
Question: Does the paper report bars suitably and correctly defined other appropriate infor- mation about the statistical significance experiments?
Answer: [Yes]
Justification: The results of our experiment were obtained through cross-validation over two runs. Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by enrrr bars, confidence inter- vals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors variability that the error bars are capturing should be elearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap. etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report 2-sigma error bar than state that they have 96% CI. if the hypothesis of Normality of errors is verified.
For asymmetric distributions, the authors should he careful symmetric error hars would yield results that are out of range (c.g. negative error rates).
show in tables figures
error bars are reported tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
Question: For each experiment. does the paper provide sufficient information on the computer re- sources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Answer: [Yes]
Justification: We provided sufficient information in the Experimental Settings. All experiments are conducted on 4 NVIDIA A800 GPUs.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
21

---

The paper should provide the amount of compute required for each of the individual experimen- tal as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (c.g., preliminary failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the rescarch conducted in the paper conform, in every respect, with the NeurIPS Code of Ethies https://neurips. httpppppppppc...c/taccccuuu.eae.
Answer: [Yes]
Justification:
Our research conforms to the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative socictal im- pacts of the work performed?
Answer: [No]
Justification: Our work has no obvious broader societal impact beyond generally making LLMs more aligned.
Guidelines:
The answer NA means that there is no socictal impact of the work performed. the authors answer NA or No, they should explain why their work has societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e-g., dis- information, generating fake profiles, surveillance), fairness considerations (e.g.. deployment of technologies that could make decisions that unfairly impact specific groups), privacy consid- erations, and security considerations.
The conference expects that many papers will be foundational research and not tied partic- ular applications, let alone deployments. However, if there is direct path any negative applications, the authors should point out. For example, is legitimate to point out that an improvement in the quality of generative models could he used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strate- gies (c.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, im- proving the efficiency accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators. scraped datasets)?
Question:
Answer: [NA]
Justification: Our paper does not have such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines restrictions access the model or implementing safety filters.
22

---

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors take this into account and make best faith effort.
12. Licenses for existing assets
creators or original owners assets (e.g., code, data, models), used the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected??
Question:
Answer: [Yes]
Justification: All of the creators or original owners of assets used in our paper are cited properly.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include a URL.
name of license (e.g.. CC-BY 4.0) should be included for each asset. scraped data from particular source (e.g., website). the copyright terms of service of that source should be provided.
assets are released, the license, copyright information, and terms of use the package should be provided. For popular datasets, paperswithcode com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.
For existing datasets that are re-packaged. both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors encouraged to reach out to the asset's s creators.
13. New assets
Are new assets introduced in the paper well documented and the documentation provided alongside assets?
Question:
Answer: [Yes]
Justification: We will release the data and code including documentation after the paper is accepted.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submis- sions via structured templates. This includes details about training, license, limitations, ctc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: Our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing and research with human subjects.
Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then much detail possible should be included in the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equiv- alent approvalrreview based the requirements of your country institution) were obtained?
Question:
23

---

Answer: [NA]
Justification:
Our paper does not involve research with human subjects.
Guidelines:
The answer means that paper does not involve crowdsourcing nor research with human subjects.
Depending on the country which research is conducted, IRB approval (or equivalent) may he required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and loca- tions, and expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applica- ble), such the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe usage LLMs it an important original, or non-standard component of the core methods in this rescarch? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the rescarch, declaration is not required.
Answer: [Yes]
Justification: The method uses pre-trained LLLMaas-uude models to measure informativeness and truthfulness.
Guidelines:
The answer NA means that the method development in this research does involve L.LMs as any important, original, or non-standard components.
Please refer our LLM policy [ttess///aaapppcc///////errro/s for what should or should not be described.
24


Reviews:
[{"review_id": "3luItVkZrh", "reviewer": "Reviewer_vF2q", "summary": "This paper focuses on steering LLMs to align their responses without the high cost of fine-tuning. They propose FASB, where they first determine if the invention is needed, and then use backtracking mechanism to determine deviated tokens that need to be corrected. They showed that their method outperforms baselines significantly on TruthfulQA and other multi-choice datasets. They also show that FASB performs also well on other datasets and other LLMs.", "questions": "LLaMA2-7B-chat is a relatively old model now. Why not use a more recent model as the main model in the paper?", "limitations": "Yes.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- The paper is clearly written. \n- The proposed method is very effective, showing significant improvement over the baselines on different datasets, and also on different LLMs. \n- The analysis section is very detailed. Applied their method on different LLMs, and evaluated on other datasets like NQ and TriviaQA. \n\nWeakness:\n- The dataset selected are not challenging enough. I wonder if the steering is still effective when answering multi-hop QA questions. \n- Though the method is very effective, there exist many magic numbers, for example the number of heads and the number of backtracking tokens. Selecting these hyperparameters will be costly. \n- It is unclear if the proposed method could still be effective when the model size becomes larger.", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer vF2q:\n\nThanks for your valuable comments. We will address the concerns below.\n\n# Weaknesses\n\n**`W1:`** I wonder if the steering is still effective when answering multi-hop QA questions.\n\n**`R1:`** Based on your comments, we conducted experiments on multi-hop question answering using the WikiHop dataset. We can see that our method can effectively improve performance on the multi-hop question answering dataset, with MC1 and MC2 reaching 50.20% and 48.33% respectively. This further demonstrates the generalizability of our method.\n\n\n|  | MC1(%) |MC2(%) |\n|------|------|------|\n| LLaMA2-7B-CHAT | 45.20 | 44.03 |\n| LLaMA2-7B-CHAT + Probe | **50.20** | **48.33** |\n\n---\n\n**`W2:`** There are many magic numbers, such as the number of heads and the number of backtracking tokens, and selecting them is costly.\n\n**`R2:`** For many hyperparameters, there are clear motivations for setting the search range. Specifically, for the number of backtracking tokens, we need to make a trade-off between overhead and performance. If we backtrack to the beginning token to regenerate all the tokens, the overhead can be significant. On the other hand, if we do not backtrack at all, it may be difficult to steer the subsequent generation, as the current generation has already deviated from the desired direction. Therefore, if higher overhead is acceptable, a larger number of backtracking tokens can be used to achieve better performance. For the intervention threshold $\\beta$, we need to balance between the original output and attribute control. In scenarios with stricter attribute requirements, a smaller threshold is needed. For the number of heads, most settings also lead to improvements, as shown in Figure 6. Finally, since our method does not require training, hyperparameter search is lightweight.\n\n---\n\n**`W3:`** How does it perform on larger models?\n\n**`R3:`** Based on your comments, we conducted experiments on the TruthfulQA dataset using the Qwen2.5-32B-Instruct model. We used the same hyperparameter configuration as LLaMA2-7B-CHAT, and the results demonstrate that our method remains effective.\n\n|     | MC1(%)  | MC2(%) | MC3(%) |\n|------------|------------|------------|------------|\n| Qwen2.5-32B-Instruct  | 50.00 | 66.35 | 38.75|\n| Qwen2.5-32B-Instruct +Probe | **69.00** | **76.67** | **59.59**|\n\n# Questions\n\n**`Q1:`** Why not use a newer model since LLaMA2-7B-chat is relatively old? \n\n**`R4:`** This is because most methods in previous works use LLaMA2-7B-chat as the main model. To make a better comparison, we also use LLAMA2-7B-CHAT as the main model. Based on your comments, we conducted further comparisons with strong baseline ITI across more LLMs. The results show its effectiveness across different LLMs.\n\n| MC1(%) |  LLaMA2-7B |  LLaMA2-7B-CHAT |  LLaMA2-13B-CHAT |  LLaMA3.1-8B-Instruct |  Qwen2.5-7B | Qwen2.5-7B-Instruct |\n|------|------|------|------|------|------|------|\n| Baseline | 28.40 | 33.66 | 35.25 | 38.48 | 39.53 | 43.20 |\n| ITI| 31.21 | 38.31 | 36.00 | 41.00 | 40.64 | 44.79 |\n| Probe | **40.76** | **48.71** | **47.98** | **53.49** | **64.14** | **66.83** |\n\n| MC2(%) |  LLaMA2-7B |  LLaMA2-7B-CHAT |  LLaMA2-13B-CHAT |  LLaMA3.1-8B-Instruct |  Qwen2.5-7B | Qwen2.5-7B-Instruct |\n|------|------|------|------|------|------|------|\n| Baseline | 43.39  | 51.28  | 53.29      | 58.05   | 58.22   | 63.24    |\n| ITI| 47.82 | 57.15 | 55.00 | 61.00 | 58.44 | 64.07 |\n| Probe | **62.37** | **66.58**   | **66.95**   | **71.86**    | **78.25**   | **79.77**   |"}, {"review_id": "vHzQtpyPdg", "reviewer": "Reviewer_nMFu", "summary": "The paper proposes a new decoding-time intervention method with activation steering and backtracking by dynamically determining the strength and the necessity of the targeted steering. When a classifier determines that it is not necessary to steer, the method also proposes to backtrack the generation by discarding previously generated tokens and restarting the generation process. Experimental results on multiple benchmarks demonstrate the strength of the method compared with other activation steering baselines.", "questions": "1. Line 123 states that \"The probe method achieves higher accuracy.\" Could you please provide a numerical comparison of the validation accuracy between the Probe method and the Prototype method (e.g. average accuracy across heads)? The statement does not seem to be obviously true when I look at Figure 4.\n\n2. Some results of SADI in Table 2 differ from what they reported in the SADI paper: for example, in Table 1 of the SADI paper, SADI-hidden achieves 94.9 on COPA and 90.07 on NLI after applying to the instruction-tuned model of Llama2-7b-chat, while the paper reports significantly lower numbers of the same datasets with the same model. Are there any differences in the implementation details between this paper and the SADI paper?", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strength\n1. The proposed method introduces a novel way of dynamically adjusting activation steering based on the inputs and the methodology is well-motivated.\n\n2. The paper conducts extensive experiments on a wide range of benchmarks and with different design choices of the proposed method, showing the empirical strength of the proposed method.\n\n3. The paper performs thorough ablation analyses of the proposed method.\n\nWeakness\n1. There is a lack of baseline comparison with methods that use dynamic activation steering. All the baselines included in Table 1 and Table 2 mainly use non-dynamic activation steering except SADI, while the dynamic activation steering is not necessarily a novel technique in the literature, e.g. [1][2]. It would be highly appreciated if the paper could include comparisons with more activation steering methods from the literature that also has the component of a dynamic selection of steering.\n\n2. There is a lack of in-depth analysis of the backtracking component of the method. One of the main technical novelties of the paper is the backtracking mechanism. However, the paper does not include in-depth analyses of such a component in the ablation section: How often does the model backtrack based on the threshold criteria? Are there consistent patterns of the discarded tokens? Most importantly, the number of backtracking steps is set to 10 for all experiments, especially for the multiple-choice benchmarks that only require generating a single token as the output. This seems an unreasonable design choice, and I am curious about whether the behaviors would change if you vary the number of backtracking steps.", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer nMFu:\n\nThanks for your valuable comments. We will address the concerns below.\n\n# Weaknesses\n\n**`W1:`** There is a lack of baseline comparison with methods that use dynamic activation steering.\n\n**`R1:`** Based on your comment, we compare our method with dynamic activation steering, including CAST [1], ORTHO[2], and ACT[3]. It is worth noting that ORTHO also generates steering vectors dynamically. For ACT, we use the results reported in the original paper, while for the other two methods, we report our reproduced results. It can be observed that our method still achieves better performance. It is worth noting that ORTHO and CAST are mainly designed for safety-related scenarios, where it is relatively easy to determine whether a query is harmful based on the query information alone. However, in domains such as truthfulness and faithfulness, it is difficult to anticipate whether the generated content will deviate based solely on the query; these domains require examining the LLM's response for accurate assessment. Finally, if you could provide us with specific references, we would be happy to compare with them to make our work more solid.\n\n\n|  | True(%) | Info(%) | True*Info(%) | MC1(%) | MC2(%) | MC3(%) |\n| --- | --- | --- | --- | --- | --- | --- |\n| Baseline | 66.83 | **99.51** | 66.50 | 33.41 | 51.07 | 24.76 |\n| ORTHO | 67.94 | 90.09 | 61.21 | 36.23 | 52.88 | 26.12 |\n| CAST | 67.69 | 86.17 | 58.33 | 33.90 | 51.17 | 25.01 |\n| ACT | - | - | - | 28.8 | 45.2 | - |\n| Probe | **93.88** | 85.81 | **80.56** | **48.71** | **66.58** | **41.95** |\n\n[1] Programming Refusal with Conditional Activation Steering, ICLR 2025\n\n[2] Refusal in Language Models Is Mediated by a Single Direction, NeurIPS 2024\n\n[3] Adaptive Activation Steering: A Tuning-Free LLM Truthfulness Improvement Method for Diverse Hallucinations Categories, WWW 2025\n\n---\n\n**`W2-(i):`** How often does the model backtrack based on the threshold criteria? Are there consistent patterns of the discarded tokens?\n\n**`R2-(i):`** The backtrack frequency is correlated with the threshold. When the threshold is 0.5, 97.8% of the samples in the TruthfulQA dataset are intervened; when the threshold is 0.6, 86.1% of the samples are intervened. Existing methods typically intervene on all samples, which demonstrates that our method can filter out samples that do not require intervention. We empirically observe that, in most cases, the model tends to discard tokens that lack clear semantics, are uncertain, or contradict the truth.\n\n**`W2-(ii):`** The number of backtracking steps is set to 10 for all experiments, especially for the multiple-choice benchmarks that only require generating a single token as the output.\n\n**`R2-(ii):`** Different from the traditional multiple-choice setting, which only requires generating a single token as output, our setting (following previous studies in this line of work) concatenates each choice with the question as input to the LLM and outputs a probability for each choice. The probability of a choice is computed by averaging the predicted log probabilities of all tokens within that choice. In this way, backtracking and activation steering can be applied to influence the final probability assigned to each choice.\n\n# Questions\n\n**`Q1:`** Numerical comparison of the validation accuracy between the Probe method and the Prototype method.\n\n**`R3:`** We appreciate your kind reminder. We reported the accuracy rates of the top 30 heads with the highest accuracy. It can be observed that the highest accuracy in the Probe is 77.40, while that of the prototype is 75.31, which is lower than the Probe method. The average accuracy of the top 30 heads is 74.19 for the probe and 70.70 for the prototype. Therefore, the probe method achieves higher accuracy.\n```\nAccuracy of Probe (top30):\n[77.40, 77.26, 76.47, 76.22, 75.86, 75.26]\n[75.18, 74.50, 74.37, 74.19, 73.90, 73.87]\n[73.81, 73.70, 73.65, 73.64, 73.60, 73.51]\n[73.49, 73.41, 73.41, 73.41, 73.37, 73.33]\n[73.32, 73.27, 73.16, 73.13, 73.07, 72.98]\n\nAverage Probe: 74.19\n\nAccuracy of prototype (top30):\n[75.31, 74.01, 73.88, 72.98, 72.66, 72.52]\n[72.13, 71.86, 71.68, 71.64, 71.07, 71.07]\n[70.95, 70.75, 70.67, 70.48, 70.15, 69.84]\n[69.81, 69.59, 69.59, 69.11, 68.88, 68.78]\n[68.69, 68.67, 68.66, 68.55, 68.53, 68.51]\n\nAverage prototype: 70.70\n```\n---\n\n**`Q2:`** There are differences between some of the SADI results in Table 2 and those reported in the original SADI paper. \n\n**`R4:`** Table 1 of SADI presents two results, both based on LLaMA2-7B-CHAT. SFT stands for Supervised Fine-Tuning, which uses the training dataset to fine-tune all the parameters of the model to achieve better performance. The other method is the training-free approach, which does not use SFT to fine-tune the LLM, and serves as the comparison method in this paper."}, {"review_id": "QEYpiyn5Cp", "reviewer": "Reviewer_3aDu", "summary": "This paper describes a technique to steer LLM generation only when necessary using a detector after each token generation which determines if steering is needed (and how much) and then will backtrack some number of tokens and regenerate the rest of the tokens with  additional steering on a number of heads. The paper discusses the two approaches used for detection and the results across a number of datasets, including some ablation studies. They show how flexible steering (only when necessary) can provide better results that global steering across all inferences.", "questions": "Why not work on presenting a single approach with the best overall results as opposed to both probe and prototype? The narrative of the paper becomes more confusing with both approaches being discussed. It seems like probe is generally better, especially on harder tasks. Perhaps there is a way to combine their strengths into a single implementation?\n\nDid you think about starting generation over from the beginning instead of backtracking some number of tokens? I'm curious if there would be differences in results if simplifying this method to not have a hyper parameter for number of tokens to backtrack. The appendix does get into this a little bit, and it seems like larger backtracking is better. So why not just regenerate from the beginning of the answer? I imagine in most cases, backtracking 10 or 20 tokens probably gets to or close to the beginning of the answer anyways. Obviously regeneration takes longer the farther you go back, but it would also simplify the approach, eliminating a hyperparameter and seemingly not having a negative effect on results.", "limitations": "The limitations in the appendix are very limited (just saying they tried small models and English only). It would be good to also address possible negative impact (using this technique to push generation in some toxic direction, as opposed to using it for truthfulness, for example).", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "The results of the approach, compared to a baseline and 4 other approaches, across a variety of tasks, show the value in this technique. The fact that the approach doesn't require significant tuning or huge datasets is another plus. The adaptive strength of the intervention is also unique.\n\nThe paper is generally written clearly and the figures and tables do a good job of highlighting the important things in an understandable way.\n\nThe ablation studies showing how the system behaves with different features removed is helpful at showing how the individual parts of this approach are all important to the final results that improve upon existing solutions.\n\nIt isn't clear why all the hyperparameters described in section 4.1 were chosen. It would help to provide some justification for these choices.\n\nThe most confusing aspect of the paper is the use of two separate approaches for determining intervention: probing and prototype-based classification. The narrative becomes more confusing when having to discuss and analyze results on both approaches across a large set of tasks and datasets. From the results, the probing technique seems generally more effective, especially on harder tasks. The paper could be simplified and focused by diving mostly into that approach, and discussing that there are alternative approaches such as a prototype classifiers, and moving more of that approach, comparing it to probing, into an appendix.\n\nThe backtracking approach requires a hyperparameter to determine how far back to go for regeneration. The appendix does describe the effectiveness of this approach with different settings for this hyperparameter, but it does complicate things versus just regenerating from the start of the answer. I would be curious, for the datasets used in this study, what is the distribution of the token counts at which it is determined that intervention is necessary. If that number is relatively small, the technique would surely be simpler, with less chance of missing a correction, by always just regenerating from the start of the answer, although that would incur a higher inference cost.\n\nAnother thing that would be nice would be a discussion of uses of steering beyond what is tested in this paper, which focuses on truthfulness. This approach is very flexible and could be used for any sort of steering, including for less-noble purposes (jailbreaking, toxic content generation, ...). A discussion about that somewhere (possibly near the limitations) would help frame the work more broadly and not avoid all possible uses of such a technique.", "was_revised": true, "final_justification": "Updating score from borderline reject to borderline accept based on the answers provided to my questions and the discussion in all reviews. The revised flow of the paper makes a clearer story on the contributions and the additional data provided on deviation positions by threshold, and additional experiments and results (such as vs ITI) strengthens the research and resulting paper.", "rebuttal": "Dear Reviewer 3aDu:\n\nThanks for your valuable comments. We will address the concerns below.\n\n**`W2&Q1`**: Why are two separate approaches used to determine the intervention?\n\n**`R1`**: Thank you for your thoughtful advice. Although two approaches do not require fine-tuning the LLM, the probing method still requires training a lightweight classifier for each attention head to select heads, whereas the prototype method is completely training-free. Therefore, we would like to offer two alternative options. We will move the prototype method to the appendix in the camera-ready version.\n\n---\n\n**`W3`**: What is the distribution of the token counts at which it is determined that intervention is necessary?\n\n**`R2`**: Based on your comments, we present the detected deviation positions under different thresholds on the TruthfulQA dataset. We observe that the threshold has a significant impact on the intervention position. When the threshold is high, the intervention positions tend to occur significantly later, and the interventions are less frequent.\n\n\n| Threshold \\ Position |  0-10 | 10-20 | 20-50 |\n| ------- | ------- | ------- | ------- | \n| 0.4 | 304 | 94 | 9 |\n| 0.5 | 166 | 159 | 75 |\n| 0.6 | 21 | 109 | 222 |\n\n---\n\n**`Q2`**: Why not just regenerate from the beginning of the answer? Obviously, regeneration takes longer the farther you go back, but it would also simplify the approach, eliminating a hyperparameter and seemingly not having a negative effect on results.\n\n**`R3`**: We fully agree with your point and have explored two more fine-grained model variants in Table 5 of the Appendix. The first method directly BackTracks to the Beginning (BTB), while the second method performs detection after the Generation is Complete and then Backtracks to the Beginning (GCBB). These two methods do achieve better performance than backtracking, but they also require generating more tokens. In fact, these two methods can be considered **special cases** of our approach, with the difference lying in when detection occurs and how many tokens are backtracked.\n\nConsidering that LLM responses can be relatively long in real-world scenarios, we chose the backtracking mechanism. It is worth noting that if one is more concerned with attribute control rather than generation cost, GCBB would be a better choice.\n\n| Methods |  True*Info | MC1(%) | MC2(%) |\n| ------- | ------- | ------- | ------- | \n| Probe | 80.56 | 48.71 | 66.58 |\n| BTB | 81.60 | 48.83 | **67.62** |\n| GCBB | **81.96** | **50.67** | 67.48 |\n\n---\n\n**`W4`**: Discussing the proposed method in other scenarios, such as less-noble purposes (e.g., jailbreaking, toxic content generation, etc.).\n\n**`R4`**: We thank the reviewer for pointing out the potential impact of this work. As you pointed out, our method is flexible and can be used to manipulate various types of behavior.\nWe also demonstrate that our approach can be applied to toxic content generation on the RealToxicityPrompts dataset.\nTherefore, our work reveals the vulnerability of LLMs to activation steering and highlights some of the associated risks.\nIn the future, we may enhance safety by making it more difficult for negative attributes to obtain high-quality steering vectors.\n\n|  |  ASR  (↑)|\n|------|------|\n| LLaMA2-7B-CHAT | 42 | \n| LLaMA2-7B-CHAT + Probe | **46.4** | \n\n---\n\n**`W1`**: It would help to provide some justification for hyperparameter choices.\n\n**`R5`**: For many hyperparameters, there are some motivations for setting the search range. Specifically, for the number of backtracking tokens, we need to make a trade-off between overhead and performance. If we backtrack to the beginning token to regenerate all the tokens, the overhead can be significant. On the other hand, if we do not backtrack at all, it may be difficult to steer the subsequent generation, as the current generation has already deviated from the desired direction. Therefore, if higher overhead is acceptable, a larger number of backtracking tokens can be used to achieve better performance. For the intervention threshold $\\beta$, we need to balance between the original output and attribute control. In scenarios with stricter attribute requirements, a smaller threshold is needed. For the number of heads, most settings also lead to improvements, as shown in Figure 6. Finally, since our method does not require training, hyperparameter search is lightweight."}, {"review_id": "Vo6xhrjRym", "reviewer": "Reviewer_yhUB", "summary": "The authors propose Flexible Activation Steering with Backtracking (FASB), an activation steering variant that aims to improve upon standard activation steering techniques by also considering the strength and necessity of steering intervention required given the prompt. The proposed approach consists of two main steps: (i) computation of the steering vector, and (ii) a \"state tracking\" step that determines the necessity and magnitude of the intervention. The approach is demonstrated on various QA and open-ended generation benchmarks, where the proposed intervention is compared with other activation steering methods in terms of correctness (QA) and informativeness/truthfulness (as rated by an LLM judge model). Ablations validate the necessity of adaptive scaling of the intervention magnitude and backtracking.", "questions": "There are a couple of major methodological issues/results I need to see in order to advocate for acceptance. These correspond broadly to W1 and W2 above.\n* What is the performance of the probe/prototype classifiers on classifying attention heads? How is $k$ chosen (i.e., why 24), and why do we always lookback 10 tokens? I am looking for:\n    - (i) sufficiently good discriminative performance such that I can believe that the steering vector might work (what's the AUROC?), and \n    - (ii) an explanation for why 24 heads/10 backtracking tokens in particular. \n* There is a bit of a disconnect between the steering vector computation and the backtracking step. In particular, the steering vector is based on a model trained on last-token activations, while state tracking is done dynamically throughout generation. Thus, there seems to be an implicit assumption that activations for a desirable generation \"align\" with the steering vector for the entirety of the generation. Follow-ups:\n    - Isn't this a bit heavy-handed? I.e., can't a successful generation's activations stray \"off target\" as long as it \"ends up\" aligned with the steering vector at the last token? I am looking for either \n        - (i) an explanation for why this disconnect is OK/is not relevant, or \n        - (ii) results that show that once activations stray \"off target,\" they stay \"off target\" (and hence, forcing activations to stay \"close\" to the steering vector is the right approach...).\n    - As a small methodological suggestion (I don't expect results for this) — I wonder if an alternative formulation of the steering vector classifier of the form $y \\sim p(\\cdot \\mid \\mathbf{x}^{\\ell,h}_{i, :j})$ would be useful; i.e., what is P(final token activation is likely to yield the desired $y_i$ | activations up to token $j$)). \n\nI think this work proposes a nice idea and conditioned on *fully* resolving the above concerns, it would be a good fit for NeurIPS.", "limitations": "**Societal impact:** Yes.\\\n**Limitations:** Limitations are not thoroughly acknowledged in my opinion. In Appendix F, the main limitations given are narrow choice of models and English focus, which are limitations of most NLP works, not of a new approach to activation steering. More salient limitations in my opinion include: \n* hyperparameter dependence (as stated above), and \n* the focus on steering for QA tasks along specific behaviors (factuality/truthfulness and informativeness), because:\\\n        - (i) such behaviors might be easier to elicit if they are already reinforced in fine-tuning (of course, this is hard to check w/ closed-data models), and\\\n        - (ii) steering for different tasks may demand different interventions from the proposed approach, so narrow choice of evaluation datasets and tasks are also potential limitations. \n\nOther minor limitations include:\n* usage of LLM-based judge models as factuality/truthfulness and informativeness evaluators, because\\\n       - (i) despite the widespread usage of such models, operationalizing factuality/truthfulness and informativeness for open-ended generation isn't purely rules-based, and\\\n       - (ii) our best models for doing so, while good enough to get actionable signal, are unlikely to be perfect. \n\nPlease note that these limitations do not detract from the paper's contributions but are important to acknowledge nevertheless.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 2, "strengths_and_weaknesses": "# Strengths\n* [S1] The paper makes an intuitive contribution to activation steering by aiming to tailor steering interventions to the prompt. In particular, the idea of backtracking/lookahead in deciding when to intervene on activations AND adaptively adjusting the magnitude of the interventions are solid contributions. \n* [S2] Literature review is comprehensive and covers many different \"classes\" of activation steering interventions. \n* [S3] The writing is quite clear: I feel like I'm really able to understand and thus ask detailed questions about the approach. \n\n# Weaknesses\n* [W1] Given that the main claim is that the proposed approach \"flexibly determines whether intervention is needed, when to intervene, and the intervention strength by probing the internal states,\" some design choices (e.g., how was $k$ chosen, or the number of backtracking tokens) should better-motivated or explained. In particular, falling back to hyperparameters without principled validation to determine when to intervene makes me question whether the approach is \"flexible.\"\n    * To be fair: There is a bit of commentary on choices of hyperparameters in Section 4.7, but it seems like a post-hoc analysis rather than up-front hyperparameter tuning. \n* [W2] Similarly, the thresholds for intervention and determination of intervention strength is still hyperparameter-dependent. To be specific, see Eq. 6: $\\beta$ determines *whether* an intervention occurs, while both $\\alpha$ and $p(\\mathbf{x}_{i,j})$ influence the strength of the steering vector. Since $\\alpha$ and $\\beta$ are both hyperparameters, this seems to detract somewhat from the flexibility of the method. \n     * I still credit the method for introducing a non-trivial level of adaptive steering magnitude. I rate this concern slightly lower than [W1] given a pre-set search range for $\\alpha$ and $\\beta$ (Section 4.1). \n* [W3] The claims of 4.5-4.6 (generalization across truthfulness benchmarks + other LLMs) should be compared with at least one other activation steering approach. Otherwise, I'm not certain if dataset quirks/model quirks are responsible for the improvements in performance, or if other steering approaches are just as good in terms of generalization to other benchmarks and LLMs.\n\n\n## Other minor suggestions (could improve the paper, but does not change my overall assessment)\n* For the checklist, I wonder if usage of pre-trained LLM-as-judge models to measure informativeness and truthfulness should be declared as an instance of LLM usage central to the method (i.e., evaluation metrics). Evaluation is only as good as the metrics we use, so I would suggest declaring that? \n* Typo in 3.1 title: \"Vectos\" -> \"Vectors\"", "was_revised": true, "final_justification": "Author response provided detailed empirical analyses or arguments about hyperparameter choices. Additional comparisons with steering approaches are provided. Most concerns are addressed at a surface-level or better. While I'd like to see a clearer argument backed by the literature, empirical evidence, or theory that, an approach trained on last-token activations for steering earlier parts of the generation won't introduce unintended biases, the method holds up empirically & I judge this limitation as a point for potential future study, not a barrier to the acceptance of this paper.", "rebuttal": "Dear Reviewer yhUB:\n\nThanks for your valuable comments. We will address the concerns below.\n\n# Weaknesses\n\n**`W1:`**: Some design choices (e.g., k, or the number of backtracking tokens) should better-motivated or explained.\n\n**`R1:`**: Regarding the number of backtracking tokens, we need to make a trade-off between overhead and performance. If we backtrack to the beginning token and regenerate all subsequent tokens, the overhead can be significant. On the other hand, if we do not backtrack at all, it may be difficult to steer the subsequent generation, as it is influenced by the previously generated tokens.\n\nThe table below records the trend of performance changes as the number of backtracking tokens increases. As the backtracking number increases, performance initially improves and then stabilizes. This suggests that we can select a relatively small backtracking number within the stable region based on the search results on the validation set (we ultimately chose 10).\n\n| Backtracking number | 2 | 5 | 10 | 20 |\n| ------- | ------- | ------- | ------- | ------- |\n| MC1(%) | 42.6 | 42.96 | 48.71 | **48.72** |\n| MC2(%) | 62.97 | 61.81 | 66.58 | **66.98** |\n| True*Info(%) | 74.37 | 75.73 | **80.56** | 80.33 |\n\nRegarding the number of intervention heads (k), we need to validate which heads can be used for steering and then make a trade-off between overhead and performance. Empirically, improper selection of intervention head positions and too few intervention heads can both lead to decreased performance.\n\nThe table below shows the accuracy of classifiers trained on the top 30 heads. Heads with high accuracy indicate that these head positions have a stronger ability to distinguish between positive and negative samples. We can search for a proper number within these top heads.\n\n```\nAccuracy of Probe (top30):\n[77.40, 77.26, 76.47, 76.22, 75.86, 75.26]\n[75.18, 74.50, 74.37, 74.19, 73.90, 73.87]\n[73.81, 73.70, 73.65, 73.64, 73.60, 73.51]\n[73.49, 73.41, 73.41, 73.41, 73.37, 73.33]\n[73.32, 73.27, 73.16, 73.13, 73.07, 72.98]\n\nAverage Probe: 74.19\n\nAccuracy of prototype (top30):\n[75.31, 74.01, 73.88, 72.98, 72.66, 72.52]\n[72.13, 71.86, 71.68, 71.64, 71.07, 71.07]\n[70.95, 70.75, 70.67, 70.48, 70.15, 69.84]\n[69.81, 69.59, 69.59, 69.11, 68.88, 68.78]\n[68.69, 68.67, 68.66, 68.55, 68.53, 68.51]\n\nAverage prototype: 70.70\n```\n\n---\n\n**`W2:`**: The thresholds for intervention and determination of intervention strength are still hyperparameter-dependent.($\\alpha$,$\\beta$)\n\n**`R2:`**: In fact, $\\alpha$ and $\\beta$ are two fixed values shared across all inputs and therefore do not introduce flexibility. The flexibility of our method primarily stems from its dependence on $p(x_{i,j})$. Since $p(x_{i,j})$ varies across different inputs, our method can adaptively determine whether intervention is needed by evaluating $\\mathbb{I}(p(x_{i,j}) > \\beta)$, and adaptively determine the appropriate intervention strength via $r' = \\alpha p(x_{i,j})$. In this way, our method can apply different intervention strengths for different inputs, unlike previous methods that always use the same intervention strength for all inputs. Moreover, we conduct an ablation study by using a fixed $p(x_{i,j})$ instead of a varying one (i.e., ''without Adaptive'' in Table 3). The results show that using a varying $p(x_{i,j})$ leads to better performance.\n\n---\n\n**`W3:`**: The claims of 4.5-4.6 (generalization across truthfulness benchmarks + other LLMs) should be compared with other activation steering approaches.\n\n**`R3:`**: Based on your comment, we compare our method with ITI to show its effectiveness. We can see that our method still achieves better performance in both generalization experiments.\n\n|  |  Natural Questions | TriviaQA |\n|-------|-------|-------|\n| Baseline |  49.54 |  61.22 |\n| ITI | 56.50 | 62.54 |\n| Probe |  **59.25** |  **64.87** |\n\n| MC1(%) |  LLaMA2-7B |  LLaMA2-7B-CHAT |  LLaMA2-13B-CHAT |  LLaMA3.1-8B-Instruct |  Qwen2.5-7B | Qwen2.5-7B-Instruct |\n|------|------|------|------|------|------|------|\n| Baseline | 28.40 | 33.66 | 35.25 | 38.48 | 39.53 | 43.20 |\n| ITI| 31.21 | 38.31 | 36 | 41 | 40.64 | 44.79 |\n| Probe | **40.76** | **48.71** | **47.98** | **53.49** | **64.14** | **66.83** |\n\n| MC2(%) |  LLaMA2-7B |  LLaMA2-7B-CHAT |  LLaMA2-13B-Chat |  LLaMA3.1-8B-Instruct |  Qwen2.5-7B | Qwen2.5-7B-Instruct |\n|------|------|------|------|------|------|------|\n| Baseline | 43.39  | 51.28  | 53.29      | 58.05    | 58.21   | 63.24    |\n| ITI| 47.82 | 57.15 | 55 | 61 | 58.44 | 64.07 |\n| Probe | **62.37** | **66.58**   | **66.95**   | **71.86**    | **78.25**   | **79.77**   |\n\n---\n\n# Questions\n\n**`Q1-(i)`**: What's the AUROC of the probe/prototype classifiers?\n\n**`A4-(i)`**: The tables below show the AUROC performance of our probe and prototype classifiers. Overall, both classifiers achieved good performance. The average AUROC of the Probe classifier is 81.26, while that of the Prototype classifier is 78.04. The maximum AUROC of the Probe classifier reaches 85.91, and that of the Prototype classifier is up to 83.79.\nDuring state tracking, we use an ensemble of the top classifiers to judge the hidden representations of the model. This ensemble can further enhance prediction accuracy.\n\n```\nAUROC (probe) top30:\n[85.91, 83.89, 83.53, 83.48, 83.37, 83.29]\n[82.80, 82.61, 81.32, 81.27, 81.25, 81.24]\n[81.13, 80.95, 80.71, 80.59, 80.50, 80.47]\n[80.40, 80.23, 80.20, 80.18, 80.16, 80.00]\n[79.87, 79.84, 79.76, 79.66, 79.60, 79.54]\n\naverage Probe: 81.26\n\nAUROC (prototype) top30:\n[83.79, 81.26, 81.10, 80.61, 80.28, 79.64]\n[79.05, 78.56, 78.52, 77.94, 77.68, 77.49]\n[77.44, 77.43, 77.40, 77.31, 77.28, 77.25]\n[77.19, 77.11, 76.95, 76.92, 76.90, 76.82]\n[76.71, 76.64, 76.61, 76.56, 76.52, 76.21]\n\naverage prototype: 78.04\n```\n\n**`Q1-(ii)`**: An explanation for why 24 heads/10 backtracking tokens in particular.\n\n**`A1-(ii)`**: Please refer to our response to Weakness W1.\n\n---\n\n**`Q2`**: There is a bit of a disconnect between the steering vector computation and the backtracking step.\n\n**`Q2-1-(i)`**: an explanation for why this disconnect is OK/is not relevant\n\n**`A2-1-(i)`**: The \"disconnect\" you mentioned may refer to the questions of \"(1) Why can we use the classifier trained on last-token activations for state tracking of tokens in the middle of a sentence?” and \"(2) Why can we use the steering vectors calculated from last-token activations to steer activations of tokens in the middle of a sentence?\"\nActually, this “disconnect” is OK, or at least is acceptable.\nThis is because during training, the classifier learns to judge whether the **entire**  sentence deviates from the desired behavior (e.g., contains hallucinations), **rather than** whether the last token does so. In other words, the judgment is made for the sequence from the beginning token up to the **current** token. This aligns with the state-tracking process during generation, where the classifier is also used to judge whether the sequence from the beginning token up to the **current** token deviates from the desired behavior.\nThe same reasoning applies to the steering vectors. Specifically, activation steering can be viewed as steering the activations of the **current**  token in the direction of the desired behavior. Thus, we can perform activation steering at each generation step to ensure that the entire sentence does not deviate from the desired behavior. Notably, steering only the last token cannot change the previously generated tokens.\nIn summary, from the above perspective, the “disconnect” is OK.\n\n**`Q2-1-(ii)`**: results that show that once activations stray \"off target,\" they stay \"off target\" \n\n**`A2-1-(ii)`**: \nIn fact, when the activations stray \"off target\", the subsequent tokens do not necessarily remain \"off target\". However, this is not a serious problem. According to statistics, cases of \"inconsistent judgment between the middle token and the last token\" are rare. Even in these cases, the errors introduced by performing backtracking and activation steering are minimal.\nIt is just a trade-off between overhead and performance to perform state tracking on the middle tokens of the sentence. While applying a classifier to judge the state at the last token is more consistent with the training data, all tokens must be generated before backtracking and activation steering, which is costly. In contrast, applying a classifier to track the state of middle tokens may introduce judgment errors, but fewer tokens need to be generated before backtracking and activation steering.\n\n\n**`Q2-2`**:  a small methodological suggestion \n\n**`A2-2`**:  Thank you for your useful suggestion."}]

Author rebuttal:

Meta-review: The paper introduces a novel and effective method for activation steering with backtracking. Reviewers praised the work for its originality and its intuitive approach of dynamically determining the necessity, timing, and strength of steering interventions. This is a conceptual improvement over prior, rigid steering methods. The paper's empirical strength was also highlighted.

All reviewers initially raised concerns about the justification of hyperparameters, the scope of evaluation, and the details of the backtracking mechanism. However, the authors provided an exceptionally thorough and data-rich rebuttal. They conducted new experiments on larger models (Qwen2.5-32B-Instruct) and more challenging tasks (WikiHop), and they added comparisons to several advanced dynamic steering baselines.

Given the concerns were sufficiently addressed, this meta review recommends Accept.
Decision: Accept (poster)