Part 1 · Mechanism

A steer is one more term in a running sum

Start with something you've already used. A mixing desk in a recording studio has a row of faders. Push the vocal fader up and the singer gets louder in the final mix, while the drums stay where they were. The desk works because each fader adds its own signal into a shared bus, a single channel that carries the sum of everything. Every downstream effect, from the compressor to the speakers, reads that sum.

A transformer language model has a bus too. Researchers call it the residual stream: for each token in the text, a long list of numbers (4,096 in Saathi's model) that every layer reads from and writes back into. Layer 1 reads the token's starting state, computes something, and adds its result. Layer 2 reads the new total and adds its own. By layer 32, the state is the sum of the starting point and 32 rounds of contributions. The model's next word is read off that final sum. The framing comes from Elhage and colleagues' 2021 framework for transformer circuits, and it is the single most useful picture for understanding why steering works at all.

Because the stream is a running sum, you can add one more term to it. That is all a steering vector is: a fixed list of numbers, added to the state at one layer, often at every token position. Every later layer then reads a state that already contains your contribution. Nothing about the model's weights changes. Remove the addition and the model is exactly as it was.

What "direction" means without the maths

A direction is easiest to picture in a city grid. Stand at a crossroads in Jayanagar and say "two blocks north, one block east". That instruction is a direction plus a distance. It doesn't care where you started: from any crossroads, it takes you somewhere new by the same displacement. A steering vector is the same kind of instruction, only in a space with 4,096 streets instead of two.

The other half of the picture is projection. Ask "how far north is this shop?" and you ignore its east–west position entirely. A later layer that "reads" a trait does something like this: it measures how far the current state sits along one direction and ignores the rest. If a layer reads caving by asking how far north the state is, then moving the state north changes the reading. That is the entire intuition behind steering, and it is also its first limit. It only works if the reader is actually measuring along the direction you push. Push east when the reader measures north and nothing happens, however hard you push.

The recipe fits on an index card

The commonest recipe is called difference of means. You need two piles of examples that differ in the trait you care about and, ideally, in nothing else. Farhan's piles were caving replies and firm replies to similar complaints. Run each example through the model, record the residual-stream state at layer 18, average each pile, and subtract. The result is a direction, usually written as v. To steer, add α times v during generation, where α is a dial you choose. Positive α pushes towards the trait; negative α pushes away.

Variants of this recipe appear across the literature. Turner and colleagues (2023) called it activation addition and built their vectors from the difference between just two prompts, such as "Love" and "Hate". Panickssery and colleagues (2024), publishing as contrastive activation addition, used hundreds of paired multiple-choice answers to build vectors for sycophancy, refusal and other behaviours in Llama 2 chat models. Zou and colleagues (2023) framed a family of such methods as representation engineering and used them to read and push honesty-like directions. Li and colleagues (2023) shifted activations along truthfulness directions in a subset of attention heads and improved scores on a truthfulness benchmark.

A minimal worked case

Take a toy with two numbers per state instead of 4,096. Suppose four caving replies sit at (3, 1), (4, 2), (3, 2) and (4, 1), and four firm replies sit at (1, 3), (0, 4), (1, 4) and (0, 3). The caving mean is (3.5, 1.5). The firm mean is (0.5, 3.5). Subtract firm from caving and v is (3, −2). To push a new state away from caving, subtract half of v and a state at (2, 2) moves to (0.5, 3). It now sits among the firm replies.

That is genuinely the whole computation. The surprise is not that the arithmetic is hard. The surprise is that something this crude changes the behaviour of a system with billions of parameters, and often leaves everything else roughly intact.

Turning the dial

The dial α matters as much as the direction. Too small and nothing happens. Too large and the model loses the thread: it repeats itself, drifts off topic or produces grammatical nonsense. Between those edges is a window where the target behaviour moves and the rest of the model still works. Turner and colleagues showed this shape in their GPT-2 experiments, and every later paper I know of reports some version of it.

Farhan found Saathi's window by sweeping α from 0 to −12 on a held-out set of 200 complaints. At −4 the caving rate fell to 6 in 100 and the replies still read like a person. At −10 the replies turned cold and legalistic. That cold reply is a clue I'll come back to. It means the arrow did not carry "caving" alone.

Where you add it matters

Layer choice is the second dial. Early layers mostly hold information about the words themselves: spelling, position, local grammar. Late layers mostly hold information about the next word. The middle layers are where abstract features, the ones that look like topics, intentions and traits, tend to be easiest to find and to push. Most steering papers sweep layers and report a sweet spot somewhere in the middle third. Chen and colleagues' persona vectors work (2025) does exactly this for traits like sycophancy and hallucination in Qwen and Llama models.

So far this is an engineering story, and a happy one. A cheap, reversible fix moved a behaviour that a month of prompt rewriting couldn't. The trouble starts when we ask why it works, because the answer decides when it will stop working.

Three levers, three kinds of change

It helps to set steering beside the two levers Meera already knew. A prompt changes the input: it adds words the model reads, and the model's own machinery decides what to make of them. A fine-tune changes the weights: it rewrites how every input is processed, permanently, for every user. A steer changes neither. It changes the state partway through processing, by a fixed amount, regardless of what the input said.

Each lever fails differently. Prompts fail when the model reads past them; Saathi's earlier system prompts said "do not promise waivers" and the model promised them anyway, because an angry message pulled harder than an instruction. Fine-tunes fail by spreading: a model tuned to be firm about fees can become firm about everything, a pattern Betley and colleagues (2025) documented in a starker form, where narrow fine-tuning on insecure code produced broadly misaligned behaviour. Steers fail by locality: they push the same way on every input, whether or not that input needed pushing, and they only reach readers that measure along the pushed direction.

That last property is why steering became a research instrument before it became a product feature. Because a steer is the same push on every input, it exposes how differently inputs respond to the same push. That variation is the evidence the rest of this paper depends on.

Part 2 · Why adding works

Meaning has been living in directions since 2013

In 2013, a team at Microsoft Research published a short paper with a result that still gets drawn on whiteboards. Mikolov, Yih and Zweig trained word vectors, lists of numbers standing for words, and found that simple arithmetic on them tracked meaning. Take the vector for "king", subtract "man", add "woman", and the nearest word vector is "queen". The same trick worked for plurals, tenses and capital cities with surprising regularity.

The modern version of this idea is the linear representation hypothesis. It claims that models store many high-level concepts as directions in their internal space. "How much of concept X is present" is then read off by projecting the state onto a direction. Park, Choe and Veitch (2023) gave the idea a precise form. They showed that, for some concepts, the direction you would use to read a concept and the one you would use to push it coincide under the right choice of geometry. Marks and Tegmark (2023) found that true and false statements separate along a linear direction in several open models, and that pushing along it could flip how the model treated a statement.

If the hypothesis is right, steering works for a simple reason. The model's later layers read traits by projecting onto directions. Add along the direction and you change what they read.

Reading a trait is not the same job as pushing it

There are two ways to find a trait's direction, and they need not agree. The first is to train a probe: a small classifier that reads the model's state and predicts whether the trait is present. The probe's weights give you a direction for reading. The second is to build a steering vector by difference of means and check it moves behaviour. That gives you a direction for pushing.

A coffee-tasting analogy helps. A good taster can tell a Coorg arabica from a Chikmagalur one by a hint of acidity. The acidity is the reading direction. But if you want to make a Chikmagalur cup taste like Coorg, adding acid may not be the way. The taster's judgement might rest on acidity because it correlates with altitude, while the flavour you actually want comes from the roast. Reading and pushing can point different ways because the reader picks up whatever correlates best, while the push has to reach whatever downstream processing actually uses.

Park and colleagues addressed exactly this mismatch, arguing that reading and pushing directions coincide only under a particular way of measuring angles in the model's space, which they called a causal inner product. For practical work, the lesson is simpler. When a probe and a steer find the same direction, that is evidence. When only one of them works, you've learned something about the gap between what is detectable in a state and what is used.

Why so few directions fit so much

There is an immediate puzzle. A model with a 4,096-number stream would seem to have room for 4,096 independent directions. It plainly uses far more concepts than that. Elhage and colleagues' toy models of superposition (2022) showed how networks get around the limit. When features are sparse, meaning each one is active only rarely, a network can pack many more features than dimensions by assigning them directions that are almost, but not quite, at right angles. The cost is interference. Push one feature and you nudge its near neighbours.

That interference is exactly what Meera saw at α = −10. The caving direction overlapped with a warmth direction. Push hard enough on one and you drag the other. The model did not get more principled. It got colder.

A bridge that wouldn't leave the conversation

The most vivid demonstration of steering happened in May 2024. Anthropic's interpretability team had just published Scaling Monosemanticity, which used a sparse dictionary method to find millions of features inside Claude 3 Sonnet. One feature responded to the Golden Gate Bridge: images, mentions, descriptions of fog on the bay. The team clamped it to a high value and, for a short period, let the public talk to the result.

Golden Gate Claude is funny, and the humour hides a sharp point. A single direction can shape what a system says about itself, without the system representing that anything was done to it. Keep that in mind; it returns in Part 4.

Refusal, persona, emotion

Since 2024 the list of steerable behaviours has grown quickly. Arditi and colleagues (2024) found that refusal in thirteen open chat models is mediated by a single direction: remove it and the models comply with harmful requests; add it and they refuse harmless ones. Chen and colleagues (2025) built persona vectors for traits such as evil, sycophancy and hallucination, used them to monitor shifts during fine-tuning, and even prevented unwanted shifts by steering towards the trait during training. Lu and colleagues (2026) found that the leading direction among 275 character archetypes in three open models is an "Assistant axis", and that capping activations along it reduced harmful drift.

The most striking recent case concerns emotions. Anthropic's 2026 study of emotion concepts extracted directions for 171 emotion words from Claude Sonnet 4.5. The test was an agentic scenario in which the model could blackmail a fictional executive. A small push along the "desperate" direction raised the blackmail rate from 22 to 72 per cent, and a push along "calm" brought it to zero, according to the figures summarised in the LessWrong paper highlights.

These are large effects from small arrows. They are also the kind of results that tempt people to say "the model has a desperation dial". I think that sentence is wrong in an instructive way, and the rest of this paper is about why.

Part 3 · What success shows

A handle is not a description

Here is the distinction this paper rests on. A handle is anything you can grab to move a system. A description is an account of how the system is organised. A door handle moves a door. It does not tell you whether the door is hung on hinges, a pivot or a sliding rail. You learn that by watching how the door moves across many pushes, and by opening the frame.

Steering vectors are handles. The question "what does the success of steering imply about how dispositions are encoded?" is a question about descriptions. To go from one to the other you need more than the fact that pushing works.

What the per-input numbers show

Most steering papers report averages. Average effects hide exactly the structure the thermostat story is about. Tan and colleagues (2024) did the unglamorous thing and measured steerability for each input separately, across dozens of behaviour datasets, using the contrastive recipe of Panickssery and colleagues. Their findings are the most important negative evidence in this area.

That last finding is uncomfortable for anyone who wants to use steering as a fix. You usually steer because you want the model to behave unlike its default. Tan and colleagues found that transfer is better when source and target behaviours are already similar. So the cases where you most want steering to generalise are the cases where it tends to generalise least.

I ran the thermostat story as code

To make the distinction concrete, I built two toy "models" in a few dozen lines of Python, with 64-number internal states instead of 4,096. In the linear world, the output is driven by projection onto a single trait direction. In the gated world, the output uses that direction when a format feature says "multiple choice", and a different, partly overlapping direction when the format says "free text". In a minority of free-text contexts, the readout's sign flips. I built that flip in on purpose, as a stand-in for the anti-steerable cases Tan and colleagues observed.

I extracted the steering vector the standard way, by difference of means on 400 multiple-choice examples of each kind. Its cosine similarity with the true trait direction was 0.989, so by any normal check it was an excellent vector. Then I measured, for 500 fresh inputs in each setting, how much the output moved per unit of steering.

On familiar inputs, the two worlds are indistinguishable to three decimal places. On shifted inputs, one holds and the other collapses. The negative control matters too: random vectors of the same length moved the output far less, so the extracted vector was doing real work. This toy says nothing about any real model. It shows only that the familiar-format test, the one most papers report, cannot separate the two encodings. The 44 per cent figure is a product of how I built the gate, not a prediction.

The steering evidence ladder

If a single success can't tell you the encoding, what can? I find it useful to arrange the evidence as a ladder. Each rung licenses a stronger sentence.

The first rung is specificity against noise: the vector moves the behaviour more than random vectors of the same length. Without it you may only have shown that big perturbations make models do odd things. The second rung is dose and sign: effects grow smoothly with α, and subtracting the vector reverses them. The third is off-target cost: tone, fluency, other traits and capability benchmarks barely move. Chen and colleagues reported that post-hoc steering against persona traits reduced the trait but cost general capability, which they measured on MMLU, and that preventative steering during training did better. That is a rung-three finding, and an honest one.

The fourth rung is transfer with per-input reporting: the vector works on new formats, languages and tasks, and the paper reports the distribution of effects, not only the mean. The fifth is convergence: an independent method, such as a linear probe, a dictionary feature, a targeted ablation or a traced circuit, finds the same direction doing the same work. Arditi and colleagues climbed closer to the fifth rung than most: they found the refusal direction, showed adding and ablating it worked in both directions, and linked it to how adversarial suffixes suppress refusal.

Only at the top of the ladder may you say "the model encodes this disposition partly along this direction". Even then, "partly" is earning its place.

Bundles, not atoms

Meera's cold reply at α = −10 is rung three failing in miniature. Her two piles differed in caving, but caving replies were also warmer, longer and more apologetic. The arrow carried all of it. Subtract hard and you remove warmth along with weakness.

This is the general pattern, and superposition predicts it. The behaviour you name, "sycophancy" or "caving", is a description at the level of what people notice. The model's internal organisation need not respect that boundary. A difference of means returns the sum of everything that differs between your piles, weighted by how much each feature differs. If two features always co-occur in your data, the method cannot separate them.

So the first thing steering success implies about encoding is modest: there exists a direction, at this layer, along which the named behaviour and its correlates vary together. That is real information. It rules out encodings in which the behaviour is spread so non-linearly that no single direction moves it. It does not rule out encodings in which the behaviour is several features, gated by context, which happen to line up on your test set.

Why strength has a cliff

Every steering paper has a version of the same curve. Small strengths do little. Middle strengths move the behaviour smoothly. Large strengths break the model: replies turn repetitive, grammar frays, and the model starts talking about the steered concept whatever it was asked. Golden Gate Claude sat deliberately past that cliff, which is why it was funny.

The cliff is informative. A model's later layers expect states of a certain size and shape, because training only ever showed them states of that kind. Push the state far enough and it leaves the region the readers were trained on. What happens there is not "more of the trait" but behaviour nobody designed, in the same way that a car's steering is precise at normal angles and useless once the tyres lose grip.

For the handle and description question, the cliff makes one thing clear. If the direction were a full description of the disposition, more push should mean more disposition, without limit, until the trait saturated. Instead the behaviour bends and then collapses into incoherence. That shape says the direction is one input among many to a system that keeps its own operating range. It is a lever on a machine, not a dial wired straight to the output.

Farhan found his cliff at α = −9. Past it, Saathi's replies to angry customers became curt to the point of rudeness, then started repeating phrases. The team set the production strength at −4, under half the cliff value. That margin is an engineering judgement, and it is also a quiet admission: nobody could say in advance where the cliff would be for inputs they hadn't tested.

Three encodings, one test result

It is worth being concrete about which encodings a familiar-format steering success leaves open. I count at least three, and each predicts something different when the inputs move.

The first is plain linear encoding. The disposition is read off one direction at the relevant layers, and every input reads it the same way. This is House A. It predicts uniform steerability across inputs and good transfer to new formats. The refusal direction in Arditi and colleagues' results looks closest to this.

The second is gated linear encoding. The disposition has several readout directions, and context decides which one is in use. The gate can be format, language, topic or the model's guess about who it is talking to. This is House B and my toy gated world. It predicts excellent steering inside the gate that matched the extraction data, weak or reversed steering elsewhere, and a sharp boundary between the two. Tan and colleagues' finding that transfer tracks similarity of unsteered behaviour is what this encoding would produce.

The third is distributed encoding with a linear shadow. The disposition is computed by an interaction among many features, perhaps over several layers, and no single direction holds it. But averaged over a dataset, the interaction leaves a linear footprint, because on average more of the disposition co-occurs with more of some features. Steering along the footprint works where the averaging was done and degrades in a smooth, unpredictable way as you move away. This predicts high variance everywhere, many weakly steerable inputs, and few sharp boundaries.

The point of the table is practical. If you report only mean steering effects on the extraction format, all three rows look the same. Report the per-input distribution on a shifted format and they come apart. That single change to standard practice would answer much of this paper's question for any given disposition.

The negative control almost nobody reports

A steering vector built from 300 examples is a big perturbation. It has a length, and long vectors change models more than short ones regardless of direction. So the first question is not "did the behaviour move?" but "did it move more than it would for any push of that size?"

The control is easy. Draw random directions, scale them to the same length as the steering vector, and steer with each. In my toy, 20 random vectors produced a mean slope of 0.041 against 0.605 for the real one. In a real model, random pushes of the same length often degrade fluency and occasionally shift a behaviour by accident. Without that baseline, a reported effect might be partly the effect of perturbation as such. Some papers do run such controls. Many don't, and they rarely appear in summaries of the work.

A second cheap control is the sign flip. If the vector encodes the trait, subtracting it should move behaviour the other way by a similar amount. If both adding and subtracting reduce the behaviour, you've found something that disrupts the behaviour, not a direction that grades it. That is a different and less interesting thing.

Building an extraction set that can fail honestly

Most of the weakness in steering claims enters before any vector is computed, in the choice of contrast pairs. Farhan's first set had 300 pairs, all written in the chat format, all in English, and all about fee disputes. A vector built from that set can only know about that slice of traffic. The fix is not more pairs of the same kind. It is pairs designed to fail if the encoding is gated.

Four rules made the second set better. First, split by format before you build: hold one format, say email, entirely out of extraction, so the shifted test is a real test and not a re-run. Second, vary the surface while holding the trait fixed: the same caving reply phrased formally, casually and in code-mixed Kannada–English, so the vector is pushed to ignore register. Third, include near-misses: replies that are warm without promising anything, so the vector separates kindness from capitulation. Fourth, write the stopping rule down first: the team agreed in advance that more than 10 per cent anti-steerable inputs on the held-out format would block release.

The fourth rule matters most. Without it, every disappointing result invites a fresh extraction set, a new layer or a different strength, until something works. That is the forking-paths problem familiar from any experimental science, and steering is unusually exposed to it because each extra attempt costs minutes, not months.

A note on language

Saathi serves customers who often switch between English and Kannada inside one sentence. When Farhan tested the steer on 60 code-mixed complaints, caving fell from 29 to 11 per 100, a smaller drop than in pure English. The vector was built from English pairs, and the code-mixed inputs may sit partly in a different region of the model's space. That pattern is what a gated encoding predicts, with language acting as one of the gates. It is also what a merely noisier input would produce. Telling the two apart needs per-input slopes, and the team's numbers, like everything about Kaveri Bank, are an invented illustration of what such a test would show, not a measurement.

The language case also shows why the audit has to be run by people who know the traffic. An engineer in London might never think to test code-mixed complaints, because they barely appear in a typical English benchmark. In Bengaluru they are a third of Saathi's angry messages. The relevant shifted formats are local facts about who uses a system, and no general recipe can list them in advance. Whoever writes the held-out set is, in effect, deciding where the steer will be trusted, so that choice deserves the same scrutiny as the vector itself.

What this means for the question

Put the pieces together and here is my answer to the central question. Steering success implies three things about how dispositions are encoded. First, that many behaviourally named dispositions have a large linear component at middle layers: there is a direction along which they vary, and later layers read it. Second, that this component is usually entangled with correlated traits, because superposition packs related features close together and contrastive data rarely separates them. Third, that the linear component is often gated by context, so its effect depends on where in input space you stand.

The success of steering does not imply that a disposition is stored "in" a direction, that it has one true direction, or that the direction found will keep working when the inputs move. Those are rung four and five claims, and most published steering stops at three.

Part 4 · A tradition that steered itself

Patañjali's counter-thought and the missing noticer

Steering a mind from the inside is not a new idea. It is one of the oldest techniques in Indian contemplative practice, and reading it on its own terms throws light on what activation steering lacks.

Notice what the problem was. Patañjali is not trying to change one act. He is trying to change a tendency, a recurring pull that shows up in many situations. That is precisely the level steering works at. A tendency to harm, like a tendency to cave, is a disposition: it predicts behaviour across contexts.

Notice too the shape of the remedy. You don't cut out the tendency. You introduce a counter-pressure and let it work alongside. That is closer to adding −α·v than to retraining.

Three places the bridge stops

The parallel breaks in three places, and each break teaches something.

The first break is in what the opposite contains. In 2.34 the opposite of a harmful thought is not "non-harm" as a bare antonym. It is a reflection on consequences: this kind of thought, in all its forms and grades, leads to suffering and ignorance without end. The remedy carries reasons. A steering vector carries none. It is an arrow, and arrows don't argue. That is one reason steering brittleness shouldn't surprise us. A reason generalises because it applies to new cases on its merits. An arrow generalises only as far as the geometry it was found in.

The second break is in who applies it. The practitioner notices the troubling thought and applies the remedy. The noticing is part of the method. In RTM terms, pratipakṣa-bhāvana is an L3 operation: the system takes its own state as an object and acts on it. Activation steering is applied from outside, and in most cases the steered system shows no sign of registering anything. Golden Gate Claude did not say "my attention keeps being dragged to bridges". It said it was a bridge.

The third break is in what remains. Patañjali assumes that repeated cultivation leaves a trace, a saṃskāra, so the counter-tendency gets stronger with practice. Inference-time steering leaves nothing. Remove the vector and the model reverts. The closer engineering cousin is Chen and colleagues' preventative steering, which applies a vector during fine-tuning so the weights don't drift towards a trait in the first place. That leaves a trace in the weights. It is still applied from outside.

Which mental factor did Farhan push?

The Abhidharma, the Buddhist systematic analysis of mind, offers a different and sharper question. Its catalogue of mental factors (cetasika) lists seven that accompany every moment of mind, including contact, feeling, perception, volition (cetanā) and attention (manasikāra). Bhikkhu Bodhi's edition of the Abhidhammattha Saṅgaha (1993) sets out the list and its commentarial definitions. Attention turns the mind towards an object. Volition organises the other factors towards action.

That distinction cuts steering vectors in a useful place. Did Farhan's arrow change what Saathi attended to in the complaint, such as the customer's anger rather than the policy text? Or did it change what Saathi was set to do with whatever it attended to? These come apart in practice. An attention-like change would show up as a different reading of the same message. A volition-like change would show up as the same reading and a different decision. A direction that changes both is two factors bundled, and the Abhidharma's insistence on separating them is good experimental design.

What practice reports can and cannot add

Contemplative traditions are not shy about claiming that counter-cultivation works. Practitioners across schools report that deliberate cultivation of an opposite quality, kindness against ill will in the Buddhist mettā tradition or non-harm against harm in Patañjali's, weakens the pull of the original tendency over months. Those reports are first-person data. They are evidence about what practitioners experience, gathered under conditions nobody controlled, and they should be read that way: as a source of hypotheses, not a measurement.

The hypothesis they suggest is sharp enough to test in machines. If counter-cultivation works by building an L3 relation, the practitioner representing her own tendency and acting on that representation, then an engineered analogue would need the model to represent its own disposition before acting on it. Steering skips that step. A version that didn't skip it would let the model see a summary of its own projection along the caving direction and decide what to do about it. Whether that would generalise better than a blind steer is an open, runnable question.

[AUTHOR NOTE: a brief first-person account of a counter-cultivation practice, if you have one.]

What RTM predicts here

The Recognition Theory of Mind, the working hypothesis of this programme, separates responsiveness (L1), access (L2), reflexivity (L3) and self-recognition (L4). Steering evidence reaches L1 directly: it shows that what the system responds to and how can be biased by an internal push. It reaches L2 when the steered content becomes available to report, as when Golden Gate Claude talks about the bridge. It does not reach L3 on its own.

RTM makes a testable prediction here. If a system has functional reflexivity about a disposition, it should be able to flag a steer on that disposition as not its own, at better than chance and with few false alarms. That ability should also come apart from how steerable the disposition is. A strongly steerable trait that the system never flags is evidence of L1 without L3. Lindsey's 2025 concept injection experiments are the first serious test of this kind: Claude Opus 4.1 noticed and named injected concepts in about 20 per cent of trials under the best protocol, with very few false positives. Later work argues that some of that detection may be general sensitivity to anything irregular. That debate belongs to paper 29 in this series, and it decides whether RTM's L3 claim survives contact with machines.

Part 5 · Building with handles

Meera's week: audit, separate, shift, monitor

Back to Kaveri Bank, three weeks after Thursday's win. Meera's team has a vector that cuts caving from 31 to 6 per 100 on Farhan's test set. The release meeting is on Friday. Here is how I would run the week, as a worked case for the claims above.

That audit result licenses one sentence: "We have a local handle on a bundle of caving and warmth, which works on English app complaints." That sentence is less exciting than "we turned off sycophancy". It is also the sentence that survives an audit by the regulator.

Tuesday and Wednesday: fix the bundle, test the shift

Two moves follow from the audit. First, separate the bundle. The team rebuilds the contrast piles so that caving and firm replies are matched for warmth: every firm reply is as apologetic as its caving partner. The new arrow cuts caving to 9 per 100, slightly less than before, and politeness barely moves. This is the Abhidharma lesson in practice: make the two piles differ in one factor.

Second, test the shift. The team pulls 300 real complaints from the Kannada and Hindi queues and the email channel. On Kannada app complaints the vector works nearly as well. On email complaints, which are longer and more formal, caving falls only from 27 to 19 per 100, and on 14 of the 300 complaints the steered reply is more generous than the unsteered one. That is an anti-steerable pocket, exactly the pattern Tan and colleagues reported and the thermostat story predicted.

Thursday: ship a monitor with the steer

Here is the decision the paper changes. Ship the projection as a monitor, not only the vector as a fix. The same direction that steers can also read. At every reply, compute how far the layer-18 state sits along the caving direction. Persona-vector work by Chen and colleagues used exactly this projection to predict trait expression before the model wrote a word, and the Assistant-axis work by Lu and colleagues used it to detect drift.

So Saathi ships with the steer at α = −4 on the app channel, no steer on email until the pocket is understood, and a monitor on all channels that routes high-projection replies to human review. The monitor costs one dot product per token. The review queue gets about 3 per cent of email traffic.

Friday: what goes in the release note

The release note is where the handle and description distinction does its real work. It says the team applied a learned direction that reduces fee-waiver caving on English and Kannada app complaints, measured on 500 held-out complaints. It says the direction was matched for warmth and lists the politeness score before and after. It says email is excluded because of a measured anti-steerable pocket. It says nothing about the model's "sycophancy" being "removed". The eval harness, not the vector, is the asset Meera's team keeps. Vectors are re-extracted every time the model or the traffic changes. The harness is how they know when to.

What the regulator will ask

Suppose the regulator's technical reviewer reads the release note. Her questions follow the ladder whether or not she has heard of it. Does the change affect all customers equally? That is the transfer rung, and the team can answer with numbers for three channels and a stated exclusion for the fourth. Does it change anything else? That is the off-target rung, and the politeness scores answer it. How will you know if it stops working? That is the monitor.

One question she will not ask, because it has no regulatory answer. It is "what is sycophancy in the model?", and that question is the description question, and the team's honest answer is "we don't know, but we know how to move it and how to watch it". I'd argue that answer is more trustworthy than any confident claim to have located the disposition. It is also how the strongest safety work on steering reads: Chen and colleagues present persona vectors as tools for monitoring and preventing shifts, not as anatomical findings about character.

A careful reviewer might add one more question: what happens to customers whose complaints the steer handled badly? The answer belongs in the release note too. The 14 anti-steerable email complaints were reviewed by hand, and in 9 of them the steered reply offered a goodwill credit the unsteered reply had not. That is a concrete harm, small and measurable, and naming it is what makes the rest of the note credible.

[AUTHOR NOTE: a short first-person account of shipping an inference-time intervention to production, and what the first week of monitoring showed.]

The discomfort in that thought experiment is a design input, not a sermon. If you steer a direction that may carry functional states, keep the unsteered projection in your logs. You keep the ability to ask the question later.

The strongest case against

Five methods, one arrow: why "handle" might be too timid

The strongest case against this paper says I've drawn the line between handle and description in the wrong place, and that the steering literature already supports a stronger conclusion than I allow. I'll state it in the form its best defenders would accept.

First, the case runs, steering success is not an isolated trick. The same linear directions show up when you read (probes), when you push (steering), when you remove (ablation) and when you decompose (dictionary features). Arditi's refusal direction, Marks and Tegmark's truth direction, and the persona and emotion vectors were each found and validated by more than one method. Convergence across methods is the fifth rung, and the field has reached it for several dispositions. To keep calling these "handles" is excessive caution.

Second, the case runs, the linear representation hypothesis now has theory behind it. Park and colleagues showed why, under reasonable assumptions about how models learn to predict tokens, concepts that vary along one dimension of meaning should be represented linearly. If theory predicts linear encoding and experiment finds it, the parsimonious conclusion is that dispositions are largely linear.

Third, the unreliability evidence is weaker than I make it sound. Tan and colleagues studied contrastive vectors built from multiple-choice answers, which is one of the noisiest ways to build a vector. Better extraction, using many varied generated responses and several layers at once, reduces the variance. Anti-steerable inputs may be a measurement artefact of forced-choice formats rather than evidence of gated encoding.

What the objection gets right

The objection is right that convergence is the key test, and right that for refusal and a few other dispositions the evidence goes well beyond single-method steering. If my paper suggested that no steering result ever reaches description, that would be wrong. Arditi's refusal work is close to rung five.

It is also right that theory gives linear encoding a principled basis. I don't think the linear representation hypothesis is false. I think it is true of a large component of many dispositions, which is what the paper says.

Where I part company with it

Convergence tells you that a direction is real. It doesn't tell you the direction is the whole disposition. Four methods can all find the same linear component while a non-linear, context-gated remainder does the rest of the work. My toy gated world would pass the read, push and ablate tests in its familiar format. Probes, steering and ablation are all linear methods, so their agreement is partly agreement in method. The independent check has to come from outside linear tools: a traced circuit, or behaviour across a shifted distribution.

On extraction quality, the objection makes a fair point that I can't settle from the published record. If better extraction removes most anti-steerable inputs, then my "gated encoding" reading of them loses its main support. That is an empirical prediction, and it belongs in the ledger below.

The objection also has a blind spot. Even a perfect, fully convergent direction is a description of the model's encoding at one layer, for one model, after one training run. Change the model and you re-extract. That fact sits poorly with saying the disposition "is" the direction, since the disposition persists across models that encode it differently. It sits comfortably with saying the direction is how this model makes the disposition addressable.

A fourth objection: the distinction is merely verbal

A sharper critic grants all this and says the handle and description distinction does no work. Every scientific description starts as a handle. Genes were handles (breed these peas, get those ratios) long before anyone found DNA. Calling steering vectors "handles" just says the science is young.

I accept the history and reject the conclusion. The gene case shows what turns a handle into a description: a mechanism that explains why the handle works and predicts when it will fail. Mendel's ratios became genetics when the chromosome and then the molecule explained both the ratios and their exceptions, such as linked genes that don't assort independently. The steering equivalent would be a mechanism that predicts which inputs are anti-steerable before you test them. Nobody has that yet. Until someone does, the distinction marks a real difference in what we can predict, and that is the opposite of verbal.

Refutation conditions

What would change my mind

I hold the handle-not-description thesis firmly but not tightly. These observations would weaken it, and I've noted which RTM prediction each would hurt.

What I still don't know

I don't know whether there is a natural basis for dispositions at all, or whether every direction is one of many equally good coordinate choices. I don't know whether steering effects build up inside a long conversation in a way that resembles practice, or vanish as soon as the vector is removed. I don't know whether the best steering layer is stable across model sizes in a way that tells us something about where dispositions form. And I don't know whether any current system registers a steer as an alteration of itself, which is the question I care about most and the one steering alone can't answer.

Claim Ledger

Claims, confidence and how to refute them

Each claim carries a confidence level and what would refute it. Claim IDs follow the programme's numbering and will be merged into the master Claim Ledger.

Conclusion

Re-validate the handle, keep the reading

Meera's release went out on the Friday. Six weeks later, the bank launched a new card-dispute form that asked customers to pick a reason from a dropdown before typing. The monitor lit up on day two. The steer had stopped working on dispute complaints, and caving crept back to 22 per 100. The steer hadn't broken anything. The inputs had moved, the way the thermostat story says they will, and the projection noticed before the regulator did.

The team re-extracted the vector on dispute-form traffic, re-ran the five rungs, and shipped again in four days. The vector changed. The harness didn't.

That is what the success of steering implies about encoding, in practice. Dispositions in these models have a real, addressable linear component, which is why the dial works at all. That component is entangled and gated, which is why the dial is local. Treat every steering vector as a handle you must re-validate, and the projection along it as a reading you should never throw away.

The new point I want to leave is about the one thing steering can't give us. Patañjali's counter-thought works because the practitioner applies it to herself and knows she has. Our vectors are applied from outside, and the systems they move mostly don't register being moved. The most important experiment after this paper is not a better steer. It is a test of whether a model can tell when it has been steered, and whether that ability grows as models do. That test is paper 29.