The Problem with Activation Steering
Activation steering—adding a direction vector to a model's residual stream at inference time—can rescue a 1B spam classifier sitting at 57% accuracy. But the craft requires answering: which layer, which attention head, how strong? Current practice is manual trial-and-error that doesn't scale across models and tasks.
Deep Noir (Naval Surface Warfare Center, arXiv:2609.20722) turns this craft into an automated diagnostic pipeline.
Core Idea: Architectural Chronometry
Like carbon-dating an artifact, Deep Noir uses Logit Lens to find the layer where a semantic concept "crystallizes"—where the probability of the target token (e.g., "spam") decisively separates from the alternative. That crystallization point is where intervention should happen.
Five-Phase Discovery Engine
1. Layer ranking: Score each layer by Logit Lens divergence (probability gap between target and counter token via the unembedding matrix) plus adversarial-head strength (head-output alignment against the target direction), weighted 0.4:0.6. Ablations across 7 weight ratios show the ranking is completely invariant—the signal is strong. Top-5 layers advance. 2. Head isolation: Rank candidate-layer heads by gradient contribution, keep top-K (K ∈ {1,2,4}), build a binary mask so intervention touches only those dimensions. Without this mask, global steering drives Llama *below* baseline (-5%). 3. Direction computation: Contrastive direction from mean hidden-state difference between positive/negative samples at the downstream layer (l+1), normalized. 4. Magnitude calibration: Golden-section search over M ∈ [0.01, 20], evaluating accuracy per forward pass. 5. Selection: Best accuracy; ties prefer fewer heads and lower magnitude.
Results
| Scale | Task | Baseline | Steered | Gain | |-------|------|---------|---------|------| | 1B (3 models × 39 runs) | Spam | 60.1% | 76.7% | +16.7 ± 4.7 | | 1B (3 models × 15 runs) | SST-2 | 69.5% | 82.5% | +13.1 ± 3.0 | | 2-3B | Spam | 54.4% | 83.4% | +28.0 | | 7-9B (4 models) | Spam | 50.3% | 79.0% | +28.7 | | 7-9B (4 models) | SST-2 | 89.8% | 93.2% | +3.4 |
- Gemma-2-9B spam: 52% → 94.4% (+42.4 pts)
- 33/39 spam runs and 15/15 sentiment runs showed significant improvement.
- Title: Deep Noir: Autonomous Steering Discovery via Architectural Chronometry in Transformer Models
- Authors: Frank E. Bobe III, Gregory D. Vetaw, Darshan W. Bryner, Matthew G. Cook, Jose L. Salas-Vernis
- Affiliation: Naval Surface Warfare Center Panama City Division
- arXiv: 2609.20722
- Code: not released
Why Composition Beats Single Components
Compared to RepE (fixed mid-layer direction, no head masking): on spam Deep Noir wins modestly, but on SST-2 RepE fails in all 15 folds while Deep Noir improves all 15. The mechanism: sentiment representations crystallize across layers L=12–19, not at the mid-layer where RepE intervenes. Deep Noir's Logit Lens scan automatically adapts—Llama's spam layers are 2–14 vs. sentiment 12–15; Gemma's are 9–24 vs. 18–19. Same engine, zero code changes.
Ablations confirm multiplicative, not additive, dependence:
| Removed | Llama | OLMo | Gemma | |---------|-------|------|-------| | Full Deep Noir | +21 | +20 | +26 | | No head mask | -5 | +3 | -1 | | No magnitude calibration | -11 | +3 | 0 | | No layer ranking | +9 | +14 | +1 | | RepE (grid search) | +10 | +9 | +2 |
Why Weight-Space Edits Fail: LayerNorm Washout
The authors first tried SVD-based rank-r weight updates (ΔW·h ≈ v). All configurations: zero improvement. Root cause: LayerNorm attenuates small weight perturbations (~0.01–0.1% of ‖W‖_F) by ~1000×, yielding <0.001 logit shifts when flipping a decision needs 2–4 logits—a 3–4 order-of-magnitude gap. Deep Noir instead injects via activation hooks upstream of LayerNorm.
Correction Topology: Architectural Fingerprints
Each architecture has a stable, reproducible preferred intervention range: Llama early/mid layers, OLMo later layers, Gemma deepest layers. The ordering persists across tasks and seeds (4/5 seeds pick the same layer).
The Injection Attack Surface
Steering creates a predictable injection vulnerability V(M) that is monotonically non-decreasing in steering magnitude: OLMo rises from V(0)=0.34 to V(4M*)=1.0; Gemma from 0.25 to 0.99. Stronger steering means higher accuracy *and* higher prompt-injection susceptibility on small models. Counterintuitively, at 7B scale steering *reduces* vulnerability (Mistral: 97.5% → 61.1%, -36.4 pts). Injection risk is largely a small-model phenomenon that decreases with scale—defense must be deployed before the steering layer in agent systems.
Limitations
The method works best on binary classification. Reasoning tasks show ≤3% gains because baselines are near random (22–31%)—steering can only amplify a distinction the model partially encodes already.