Kernelized Activation Steering
This paper tackles the rigidity of standard Difference-in-Means (DiM) activation steering, which applies a single global vector to all activations and ignores nonlinear manifold structure. The authors propose Kernelized Activation Steering (KAS), lifting steering into a reproducing kernel Hilbert space so that each activation receives a locally adaptive, implicit update based on kernel similarities to source and target reference sets. The framework strictly generalizes DiM—recovering it under a linear kernel—and connects activation steering to maximum mean discrepancy witness functions, with empirical evaluations on jailbreaking, behavioral control, and image style generation.
KAS is a clean, theoretically grounded generalization of linear activation steering. The RKHS formulation yields an intuitive, geometry-aware intervention that improves jailbreak attack success on Gemma and Qwen and beats or matches ActAdd on several contrastive steering behaviors. The MMD witness interpretation and one-step ascent guarantees add rigor. However, the method introduces significant computational overhead, shows null effects on some behaviors, and its approximation schemes are not yet reliable.
The derivation from lifted DiM in an RKHS to an implicit score depending purely on kernel evaluations is elegant and rigorous. The recovery of DiM as a special case under the linear kernel makes the framework a true generalization rather than a side-by-side alternative. The connection to MMD witness functions provides a principled justification for why characteristic kernels can detect distributional differences that linear steering misses. Empirically, the locally adaptive steering field behaves sensibly: Figure 1 shows KAS routing activations to distinct target modes while DiM collapses them into a saddle point.
First, computational cost is largely unaddressed: exact RBF-KAS requires $\mathcal{O}(n_A + n_B)$ kernel evaluations per token, which is substantially more expensive than DiM's $\mathcal{O}(d)$ linear projection. The Nyström approximation ablation is meant to mitigate this but catastrophically degrades jailbreak ASR (e.g., 96% to 22% on Qwen and 94% to 3% on Llama), so no practical efficiency-accuracy tradeoff is established. Second, certain CAA behaviors exhibit near-null effects: Survival Instinct and Sycophancy remain close to the unsteered baseline, suggesting KAS cannot reliably steer all concepts. Third, the theoretical step-size bounds in Theorem 4.4 are admitted to be conservative and are ignored in practice in favor of manual tuning, weakening the practical relevance of the ascent guarantees. Finally, the image generation experiments are thin: only the cyberpunk style is shown in the main text, limiting generalization claims beyond language tasks.
The core evidence supports KAS on jailbreaking and some behavioral steering tasks, but comparisons are uneven. Against ActAdd and CHaRS, KAS is competitive or better on ASR while keeping perplexity reasonable. Against Curveball, the comparison is lopsided: Curveball achieves near 0% ASR at validated settings on Gemma and Qwen, suggesting it is poorly suited to the task or was not tuned effectively, which makes it a weak anchor. The abstract's claim of outperformance across "standard activation steering tasks" is slightly overstated given the null effects on two CAA behaviors and the limited image-style evidence. No statistical significance testing is reported for the numerical gaps.
The algorithms and hyperparameters are documented in the main text and Appendix B, and the median-heuristic bandwidth selection removes one free parameter. However, the paper does not mention a public code release in the provided text, which would be essential for independent reproduction. Reproduction also requires substantial per-model tuning: intervention layer and step size are selected separately for each model and task, and the Nyström ablation shows sensitivity to landmark sampling. The reliance on a single H100 and the cost of exact kernel evaluations over hundreds of reference points per token are practical barriers not quantified in latency or memory numbers.
Activation steering provides a simple, training-free mechanism for controlling attributes of generative models such as sentiment, style, and helpfulness. However, standard approaches such as Difference-in-Means apply a single input-independent steering vector across all activations, limiting expressivity and ignoring the local geometry of the activation space. We propose Kernelized Activation Steering (KAS), a unifying framework that lifts activation steering into a reproducing kernel Hilbert space. KAS formulates steering as an optimization problem expressed purely via kernel evaluations, yielding an implicit, activation-dependent steering score without constructing explicit feature maps. Unlike DiM, KAS induces locally adaptive steering: each activation is modified according to its relative position with respect to source and target reference sets, producing a nonlinear steering field over the representation space. Importantly, DiM is recovered as a special case under a linear kernel, while richer kernels enable geometry-aware interventions. Across standard activation steering tasks, including jailbreaking LLMs and image style control, KAS outperforms or is on par with the existing methods.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.