The Embarrassing Status Quo
Suppose you have a 1B-parameter model judging whether emails are spam. Its accuracy is around 57% — barely better than a coin flip. The model internally "knows" the answer, but that knowledge is buried in the wrong layer at the wrong location, the signal is too weak, and the final decision fails.
Activation steering addresses this: at inference time, add a direction vector to the residual stream to push the model's judgment. But the questions are — which layer? which attention head? how strong? Current practice is manual trial-and-error, which doesn't scale across models and tasks.
Deep Noir, from the US Naval Surface Warfare Center, turns this craft into an automated diagnostic pipeline.
Core Innovation: Architectural Chronometry
Like carbon-14 dating for artifacts, Deep Noir uses Logit Lens to determine at which layer a semantic concept crystallizes from uncertainty to certainty. In a 16-layer Transformer, the "this is spam" judgment doesn't happen simultaneously across all layers — at some layer, the spam-vs-ham probability jumps from 50/50 to 90/10. Finding that crystallization point means finding where to intervene.
The five-phase steering discovery engine:
1. Layer ranking: For each layer, compute (a) Logit Lens divergence — project hidden states through the unembedding matrix and measure the probability gap between target token ("spam") and counter-token ("ham"); (b) adversarial-head strength — inner product of each head's output with the target direction. Weighted 0.4:0.6 (ablations across 7 weight ratios show the ranking is invariant to the ratio). Top-5 layers advance. 2. Head isolation: Gradient attribution per head; take top-K heads (K ∈ {1, 2, 4}) and build a binary mask so intervention touches only those dimensions. 3. Direction computation: Mean difference of hidden states between positive/negative samples at layer l+1, normalized. 4. Magnitude calibration: Golden-section search over M ∈ [0.01, 20], each evaluation a forward pass measuring accuracy. 5. Selection: Highest accuracy wins; ties prefer fewer heads and lower magnitude (Occam's razor).
Results: From 1B to 9B
| Scale | Task | Baseline | Steered | Gain | |---|---|---|---|---| | 1B (3 models × 39 runs) | Spam | 60.1% | 76.7% | +16.7 ± 4.7 | | 1B (3 models × 15 runs) | SST-2 | 69.5% | 82.5% | +13.1 ± 3.0 | | 2–3B | Spam | 54.4% | 83.4% | +28.0 | | 7–9B (4 models) | Spam | 50.3% | 79.0% | +28.7 | | 7–9B (4 models) | SST-2 | 89.8% | 93.2% | +3.4 |
- Gemma-2-9B on spam: 52% → 94.4% (+42.4 pts)
- 33 of 39 spam discovery runs significantly improved (85%); 15/15 sentiment runs improved (100%)
- Llama: early/mid layers (spam 2–14, sentiment 12–15)
- OLMo: later layers (spam 9–15, sentiment 12–14)
- Gemma: deep layers (spam 9–24, sentiment 18–19)
- White-box methods (Logit Lens, attribution patching) beat black-box search: discovery takes 4–30 minutes once, with zero inference overhead afterward.
- "Diagnosis before intervention": locate the lesion with chronometry, operate precisely with head masks, dose with magnitude calibration.
- Limitations: strongest on binary classification; reasoning tasks (baseline 22–31%, near chance) gain ≤3%. The model must partially encode the target distinction for steering to amplify the signal.
- Title: Deep Noir: Autonomous Steering Discovery via Architectural Chronometry in Transformer Models
- Authors: Frank E. Bobe III, Gregory D. Vetaw, Darshan W. Bryner, Matthew G. Cook, Jose L. Salas-Vernis
- Affiliation: Naval Surface Warfare Center Panama City Division
- arXiv: 2609.20722
- Code: not released (military research institution)
vs. RepE: The Composition Beats Any Single Component
RepE applies a contrastive direction at a fixed mid-layer with no head masking. On spam Deep Noir wins modestly (Gemma-3-1B: 76.4% vs 55.6%, p=0.004). The decisive gap is on sentiment: RepE failed on all 15 SST-2 folds (zero gain), while Deep Noir improved 15/15. The mechanism: sentiment representations are distributed across layers 12–19, not concentrated at the mid-layer where RepE intervenes. Deep Noir's Logit Lens scan automatically adapts: Llama's spam layers are 2–14 and sentiment 12–15; Gemma's are 9–24 and 18–19. Same engine, zero code changes.
Ablations: Every Component Is Necessary
| Removed | Llama | OLMo | Gemma | |---|---|---|---| | Full Deep Noir | +21 | +20 | +26 | | No head mask | -5 | +3 | -1 | | No magnitude calibration | -11 | +3 | 0 | | No layer ranking | +9 | +14 | +1 | | RepE (grid search) | +10 | +9 | +2 |
Removing the head mask performs worse than baseline — global steering corrupts heads that were working correctly. This is multiplicative, not additive: each component solves a problem the others cannot.
The LayerNorm Washout Effect
An initial weight-space approach (rank-r SVD updates so ΔW·h ≈ v) produced zero improvement in all configurations. The cause is LayerNorm: post-residual LayerNorm attenuates small weight-space perturbations (~0.01–0.1% of ‖W‖_F) by roughly 1000×, yielding <0.001 logit shifts when flipping a decision requires 2–4 logits — a 3–4 order-of-magnitude gap. This independently corroborates arXiv:2507.02559; Deep Noir instead injects via activation-space hooks before LayerNorm.
Correction Topology: Each Architecture Has a Fingerprint
Stable across seeds (4/5 seeds pick the same layer) and consistent relative ordering across tasks.
The Injection Attack Surface
Steering creates a predictable injection attack surface: vulnerability V(M) increases monotonically with magnitude M — OLMo rises from 0.34 to 1.0 at 4× optimal magnitude; Gemma from 0.25 to 0.99. Stronger steering means higher accuracy but greater prompt-injection susceptibility — a Pareto frontier. Counterintuitively, at 7B scale steering *reduced* vulnerability (Mistral: 97.5% → 61.1%, -36.4 pts); the attack surface is mostly a small-model phenomenon. For agent systems, injection defenses must be deployed before the steering layer.