Compositional Multilingual and Behavioral Attribute Steering

Summary

The paper asks whether independently extracted activation-steering vectors can be combined additively, without training, to control several attributes of an instruction-tuned LLM at once. Focusing on output language (L), jailbreak (J), and conciseness (C), the authors extract DiffMean vectors from contrastive datasets (FLORES, the Arditi et al. refusal dataset, IFEval-derived pairs) at the last post-instruction token position, normalize them, and add them to residual-stream activations at a chosen layer and strength. Across four instruction-tuned models (Llama-3.1-8B/70B, Qwen2.5-14B/32B), single-attribute steering works only within an appropriate layer–strength configuration: jailbreak and conciseness peak at the second-earliest of four evaluated layers, language at the earliest. Injecting each vector at its own best layer makes two-attribute composition work: L+J exceeds prompt-based baselines for all four models, while L+C generally falls below them, and the exploratory L+J+C triple beats prompting with higher variance. A geometric analysis shows the vectors are approximately orthogonal, with a slight late-layer language–conciseness correlation linked to tokenization length; the authors conjecture orthogonality predicts composability. Limitations include judge-based metrics without human validation (Qwen3-8B for relevance, Qwen3Guard-8B for safety), a coarse four-layer sweep, layer/strength selection on the same 70 evaluation prompts, and a cross-model length reference for CCS in the three-attribute experiment.