Title: Steering When Necessary: Flexible Steering Large Language Models with Backtracking
Venue: NeurIPS 2025
Accepted: yes
Keywords: Activation steering
Abstract: Large language models (LLMs) have achieved remarkable performance across many generation tasks.
Nevertheless, effectively aligning them with desired behaviors remains a significant challenge.
Activation steering is an effective and cost-efficient approach that directly modifies the activations of LLMs during the inference stage, aligning their responses with the desired behaviors and avoiding the high cost of fine-tuning.
Existing methods typically indiscriminately intervene to all generations or rely solely on the question to determine intervention, which limits the accurate assessment of the intervention strength.
To this end, we propose the **F**lexible **A**ctivation **S**teering with **B**acktracking (**FASB**) framework, which dynamically determines both the necessity and strength of intervention by tracking the internal states of the LLMs during generation, considering both the question and the generated content.
Since intervening after detecting a deviation from the desired behavior is often too late, we further propose the backtracking mechanism to correct the deviated tokens and steer the LLMs toward the desired behavior.
Extensive experiments on the TruthfulQA dataset and six multiple-choice datasets demonstrate that our method outperforms baselines.
Our code will be released at https://github.com/gjw185/FASB.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose Flexible Activation Steering with Backtracking (FASB), an activation steering variant that aims to improve upon standard activation steering techniques by also considering the strength and necessity of steering intervention required given the prompt. The proposed approach consists of two main steps: (i) computation of the steering vector, and (ii) a \"state tracking\" step that determines the necessity and magnitude of the intervention. The approach is demonstrated on various QA and open-ended generation benchmarks, where the proposed intervention is compared with other activation steering methods in terms of correctness (QA) and informativeness/truthfulness (as rated by an LLM judge model). Ablations validate the necessity of adaptive scaling of the intervention magnitude and backtracking.\n\nSTRENGTHS AND WEAKNESSES:\n# Strengths\n* [S1] The paper makes an intuitive contribution to activation steering by aiming to tailor steering interventions to the prompt. In particular, the idea of backtracking/lookahead in deciding when to intervene on activations AND adaptively adjusting the magnitude of the interventions are solid contributions. \n* [S2] Literature review is comprehensive and covers many different \"classes\" of activation steering interventions. \n* [S3] The writing is quite clear: I feel like I'm really able to understand and thus ask detailed questions about the approach. \n\n# Weaknesses\n* [W1] Given that the main claim is that the proposed approach \"flexibly determines whether intervention is needed, when to intervene, and the intervention strength by probing the internal states,\" some design choices (e.g., how was $k$ chosen, or the number of backtracking tokens) should better-motivated or explained. In particular, falling back to hyperparameters without principled validation to determine when to intervene makes me question whether the approach is \"flexible.\"\n    * To be fair: There is a bit of commentary on choices of hyperparameters in Section 4.7, but it seems like a post-hoc analysis rather than up-front hyperparameter tuning. \n* [W2] Similarly, the thresholds for intervention and determination of intervention strength is still hyperparameter-dependent. To be specific, see Eq. 6: $\\beta$ determines *whether* an intervention occurs, while both $\\alpha$ and $p(\\mathbf{x}_{i,j})$ influence the strength of the steering vector. Since $\\alpha$ and $\\beta$ are both hyperparameters, this seems to detract somewhat from the flexibility of the method. \n     * I still credit the method for introducing a non-trivial level of adaptive steering magnitude. I rate this concern slightly lower than [W1] given a pre-set search range for $\\alpha$ and $\\beta$ (Section 4.1). \n* [W3] The claims of 4.5-4.6 (generalization across truthfulness benchmarks + other LLMs) should be compared with at least one other activation steering approach. Otherwise, I'm not certain if dataset quirks/model quirks are responsible for the improvements in performance, or if other steering approaches are just as good in terms of generalization to other benchmarks and LLMs.\n\n\n## Other minor suggestions (could improve the paper, but does not change my overall assessment)\n* For the checklist, I wonder if usage of pre-trained LLM-as-judge models to measure informativeness and truthfulness should be declared as an instance of LLM usage central to the method (i.e., evaluation metrics). Evaluation is only as good as the metrics we use, so I would suggest declaring that? \n* Typo in 3.1 title: \"Vectos\" -> \"Vectors\"\n\nQUESTIONS:\nThere are a couple of major methodological issues/results I need to see in order to advocate for acceptance. These correspond broadly to W1 and W2 above.\n* What is the performance of the probe/prototype classifiers on classifying attention heads? How is $k$ chosen (i.e., why 24), and why do we always lookback 10 tokens? I am looking for:\n    - (i) sufficiently good discriminative performance such that I can believe that the steering vector might work (what's the AUROC?), and \n    - (ii) an explanation for why 24 heads/10 backtracking tokens in particular. \n* There is a bit of a disconnect between the steering vector computation and the backtracking step. In particular, the steering vector is based on a model trained on last-token activations, while state tracking is done dynamically throughout generation. Thus, there seems to be an implicit assumption that activations for a desirable generation \"align\" with the steering vector for the entirety of the generation. Follow-ups:\n    - Isn't this a bit heavy-handed? I.e., can't a successful generation's activations stray \"off target\" as long as it \"ends up\" aligned with the steering vector at the last token? I am looking for either \n        - (i) an explanation for why this disconnect is OK/is not relevant, or \n        - (ii) results that show that once activations stray \"off target,\" they stay \"off target\" (and hence, forcing activations to stay \"close\" to the steering vector is the right approach...).\n    - As a small methodological suggestion (I don't expect results for this) — I wonder if an alternative formulation of the steering vector classifier of the form $y \\sim p(\\cdot \\mid \\mathbf{x}^{\\ell,h}_{i, :j})$ would be useful; i.e., what is P(final token activation is likely to yield the desired $y_i$ | activations up to token $j$)). \n\nI think this work proposes a nice idea and conditioned on *fully* resolving the above concerns, it would be a good fit for NeurIPS.\n\nLIMITATIONS:\n**Societal impact:** Yes.\\\n**Limitations:** Limitations are not thoroughly acknowledged in my opinion. In Appendix F, the main limitations given are narrow choice of models and English focus, which are limitations of most NLP works, not of a new approach to activation steering. More salient limitations in my opinion include: \n* hyperparameter dependence (as stated above), and \n* the focus on steering for QA tasks along specific behaviors (factuality/truthfulness and informativeness), because:\\\n        - (i) such behaviors might be easier to elicit if they are already reinforced in fine-tuning (of course, this is hard to check w/ closed-data models), and\\\n        - (ii) steering for different tasks may demand different interventions from the proposed approach, so narrow choice of evaluation datasets and tasks are also potential limitations. \n\nOther minor limitations include:\n* usage of LLM-based judge models as factuality/truthfulness and informativeness evaluators, because\\\n       - (i) despite the widespread usage of such models, operationalizing factuality/truthfulness and informativeness for open-ended generation isn't purely rules-based, and\\\n       - (ii) our best models for doing so, while good enough to get actionable signal, are unlikely to be perfect. \n\nPlease note that these limitations do not detract from the paper's contributions but are important to acknowledge nevertheless.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper describes a technique to steer LLM generation only when necessary using a detector after each token generation which determines if steering is needed (and how much) and then will backtrack some number of tokens and regenerate the rest of the tokens with  additional steering on a number of heads. The paper discusses the two approaches used for detection and the results across a number of datasets, including some ablation studies. They show how flexible steering (only when necessary) can provide better results that global steering across all inferences.\n\nSTRENGTHS AND WEAKNESSES:\nThe results of the approach, compared to a baseline and 4 other approaches, across a variety of tasks, show the value in this technique. The fact that the approach doesn't require significant tuning or huge datasets is another plus. The adaptive strength of the intervention is also unique.\n\nThe paper is generally written clearly and the figures and tables do a good job of highlighting the important things in an understandable way.\n\nThe ablation studies showing how the system behaves with different features removed is helpful at showing how the individual parts of this approach are all important to the final results that improve upon existing solutions.\n\nIt isn't clear why all the hyperparameters described in section 4.1 were chosen. It would help to provide some justification for these choices.\n\nThe most confusing aspect of the paper is the use of two separate approaches for determining intervention: probing and prototype-based classification. The narrative becomes more confusing when having to discuss and analyze results on both approaches across a large set of tasks and datasets. From the results, the probing technique seems generally more effective, especially on harder tasks. The paper could be simplified and focused by diving mostly into that approach, and discussing that there are alternative approaches such as a prototype classifiers, and moving more of that approach, comparing it to probing, into an appendix.\n\nThe backtracking approach requires a hyperparameter to determine how far back to go for regeneration. The appendix does describe the effectiveness of this approach with different settings for this hyperparameter, but it does complicate things versus just regenerating from the start of the answer. I would be curious, for the datasets used in this study, what is the distribution of the token counts at which it is determined that intervention is necessary. If that number is relatively small, the technique would surely be simpler, with less chance of missing a correction, by always just regenerating from the start of the answer, although that would incur a higher inference cost.\n\nAnother thing that would be nice would be a discussion of uses of steering beyond what is tested in this paper, which focuses on truthfulness. This approach is very flexible and could be used for any sort of steering, including for less-noble purposes (jailbreaking, toxic content generation, ...). A discussion about that somewhere (possibly near the limitations) would help frame the work more broadly and not avoid all possible uses of such a technique.\n\nQUESTIONS:\nWhy not work on presenting a single approach with the best overall results as opposed to both probe and prototype? The narrative of the paper becomes more confusing with both approaches being discussed. It seems like probe is generally better, especially on harder tasks. Perhaps there is a way to combine their strengths into a single implementation?\n\nDid you think about starting generation over from the beginning instead of backtracking some number of tokens? I'm curious if there would be differences in results if simplifying this method to not have a hyper parameter for number of tokens to backtrack. The appendix does get into this a little bit, and it seems like larger backtracking is better. So why not just regenerate from the beginning of the answer? I imagine in most cases, backtracking 10 or 20 tokens probably gets to or close to the beginning of the answer anyways. Obviously regeneration takes longer the farther you go back, but it would also simplify the approach, eliminating a hyperparameter and seemingly not having a negative effect on results.\n\nLIMITATIONS:\nThe limitations in the appendix are very limited (just saying they tried small models and English only). It would be good to also address possible negative impact (using this technique to push generation in some toxic direction, as opposed to using it for truthfulness, for example).", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a new decoding-time intervention method with activation steering and backtracking by dynamically determining the strength and the necessity of the targeted steering. When a classifier determines that it is not necessary to steer, the method also proposes to backtrack the generation by discarding previously generated tokens and restarting the generation process. Experimental results on multiple benchmarks demonstrate the strength of the method compared with other activation steering baselines.\n\nSTRENGTHS AND WEAKNESSES:\nStrength\n1. The proposed method introduces a novel way of dynamically adjusting activation steering based on the inputs and the methodology is well-motivated.\n\n2. The paper conducts extensive experiments on a wide range of benchmarks and with different design choices of the proposed method, showing the empirical strength of the proposed method.\n\n3. The paper performs thorough ablation analyses of the proposed method.\n\nWeakness\n1. There is a lack of baseline comparison with methods that use dynamic activation steering. All the baselines included in Table 1 and Table 2 mainly use non-dynamic activation steering except SADI, while the dynamic activation steering is not necessarily a novel technique in the literature, e.g. [1][2]. It would be highly appreciated if the paper could include comparisons with more activation steering methods from the literature that also has the component of a dynamic selection of steering.\n\n2. There is a lack of in-depth analysis of the backtracking component of the method. One of the main technical novelties of the paper is the backtracking mechanism. However, the paper does not include in-depth analyses of such a component in the ablation section: How often does the model backtrack based on the threshold criteria? Are there consistent patterns of the discarded tokens? Most importantly, the number of backtracking steps is set to 10 for all experiments, especially for the multiple-choice benchmarks that only require generating a single token as the output. This seems an unreasonable design choice, and I am curious about whether the behaviors would change if you vary the number of backtracking steps.\n\nQUESTIONS:\n1. Line 123 states that \"The probe method achieves higher accuracy.\" Could you please provide a numerical comparison of the validation accuracy between the Probe method and the Prototype method (e.g. average accuracy across heads)? The statement does not seem to be obviously true when I look at Figure 4.\n\n2. Some results of SADI in Table 2 differ from what they reported in the SADI paper: for example, in Table 1 of the SADI paper, SADI-hidden achieves 94.9 on COPA and 90.07 on NLI after applying to the instruction-tuned model of Llama2-7b-chat, while the paper reports significantly lower numbers of the same datasets with the same model. Are there any differences in the implementation details between this paper and the SADI paper?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-03"}

comments: SUMMARY:
This paper focuses on steering LLMs to align their responses without the high cost of fine-tuning. They propose FASB, where they first determine if the invention is needed, and then use backtracking mechanism to determine deviated tokens that need to be corrected. They showed that their method outperforms baselines significantly on TruthfulQA and other multi-choice datasets. They also show that FASB performs also well on other datasets and other LLMs.

STRENGTHS AND WEAKNESSES:
Strengths:
- The paper is clearly written. 
- The proposed method is very effective, showing significant improvement over the baselines on different datasets, and also on different LLMs. 
- The analysis section is very detailed. Applied their method on different LLMs, and evaluated on other datasets like NQ and TriviaQA. 

Weakness:
- The dataset selected are not challenging enough. I wonder if the steering is still effective when answering multi-hop QA questions. 
- Though the method is very effective, there exist many magic numbers, for example the number of heads and the number of backtracking tokens. Selecting these hyperparameters will be costly. 
- It is unclear if the proposed method could still be effective when the model size becomes larger.

QUESTIONS:
LLaMA2-7B-chat is a relatively old model now. Why not use a more recent model as the main model in the paper?

LIMITATIONS:
Yes.
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-05