How Controllable Are Large Language Models? A Unified Evaluation across Behavioral Granularities

🎯 Pitch

Existing activation-based methods for controlling LLM behavior crash when you ask for precise, checkable outputs rather than just a general sentiment or personality—with performance plummeting by over 40% as constraints move from coarse intent to fine-grained instantiation. Prompt-based steering somehow sails through unaffected, forcing a fundamental reassessment of how we evaluate and engineer model alignment.

1. Executive Summary

This paper introduces SteerEval, a hierarchical benchmark for evaluating LLM controllability across three behavioral domains—language features, sentiment, and personality—each structured into three specification levels (L1: what to express, L2: how to express, L3: how to instantiate), connecting high-level behavioral intent to concrete, verifiable textual output. Using SteerEval, the authors systematically evaluate contemporary steering methods—prompt-based (0-shot and 3-shot prompting) and activation-based (PCA, DiffMean, RePS)—on Gemma-2-9B-Instruct, Qwen-2.5-7B-Instruct, and Llama-3.1-8B-Instruct, revealing that activation-based steering degrades sharply as constraints become finer-grained (harmonic mean dropping from 2.94 at L1 to 1.72 at L3 for RePS on Gemma-2-9B-Instruct) while prompt-based steering remains stable across all levels (harmonic mean around 3.0), establishing that coarse-grained control success does not guarantee fine-grained control and that existing activation-based methods cannot reliably deliver precise behavioral specification.

2. Context and Motivation

The Core Problem: We Don't Know How Controllable LLMs Really Are

The fundamental question this paper tackles is deceptively simple: when we try to steer an LLM's behavior toward a specific target, how well does it actually work, and at what level of specificity? This matters because LLMs are increasingly deployed in domains where unpredictable outputs carry real consequences—healthcare advice, educational content, decision support systems, and other socially sensitive applications where model outputs can directly shape human behavior and well-being (Section 1). In these settings, it is not enough for a model to be generally helpful; it must produce outputs that are predictably and precisely aligned with user intent across multiple dimensions of behavior.

The gap this paper identifies is that the field lacks a systematic understanding of how controllability varies with the granularity of the control target. Can a model be steered to express autonomy (a coarse-grained personality trait) just as reliably as it can be steered to use a specific word like "hooray" to express enthusiasm (a fine-grained, verifiable token-level constraint)? The authors argue—and demonstrate empirically—that the answer is no, and that this granularity-dependent degradation is both systematic and underexplored.

Why This Problem Matters: Real-World and Theoretical Significance

The practical stakes are clear. As the authors note in Section 1, LLMs "can exhibit unpredictable or undesirable behaviors, including misalignment with user intent, unintended shifts in sentiment, and inconsistent personality expression." In a customer-facing chatbot, for instance, an organization might want to enforce not just that the model is polite (a coarse-grained sentiment target) but that it expresses politeness through specific phrasing conventions (a fine-grained language feature). If steering methods work well at the coarse level but break down at the fine level—as this paper shows they do—then deployers are operating with a false sense of security, believing their model is "controlled" when in fact it only satisfies the loosest specification.

The theoretical significance stems from the paper's grounding in Marr's three levels of analysis (Marr, 1982): the computational level (what is the goal?), the algorithmic level (what representations and processes achieve it?), and the implementational level (how is it physically realized?). The authors explicitly map their L1→L2→L3 hierarchy onto this framework (Section 2.3, Figure 1), arguing that effective behavioral control requires understanding how steering signals interact with a model's internal hierarchy of representations—from high-level dispositional priors (personality), through intermediate context-dependent tendencies (sentiment), down to surface-level lexical realizations (language features). This connection to cognitive science gives the paper a principled foundation that goes beyond ad-hoc benchmarking: it provides a theory of why steering should become harder at finer granularities, not just an observation that it does.

Prior Approaches and Where They Fall Short

The paper identifies several specific limitations in existing work on LLM steering evaluation:

Narrow scope and heterogeneous definitions. Prior steering benchmarks target isolated behaviors: personality (Perez et al., 2023), sentiment (Han et al., 2024; Farooq et al., 2025), or safety (Siu et al., 2025; Han et al., 2025; Wang et al., 2025). Each uses its own concept definitions, data formats, and evaluation protocols, making cross-method comparison difficult. A method that appears effective on a sentiment benchmark may fail on a personality benchmark for reasons that are obscured by the incompatible evaluation frameworks. The field cannot answer basic comparative questions—Is prompt-based steering better than activation-based steering? Under what conditions?—because there is no common yardstick.

AXBENCH (Wu et al., 2025b) partially addresses comparability but introduces its own limitations. AXBENCH standardizes evaluation across steering methods, which is a step forward. However, as the authors detail in Section 2.2, its concepts are derived from sparse autoencoder (SAE) feature descriptions (Lieberum et al., 2024) rather than explicit behavioral definitions. SAE features are often fine-grained and idiosyncratic—they capture whatever structure the autoencoder happened to learn, not necessarily the kinds of behavioral targets that practitioners actually care about controlling. Moreover, AXBENCH lacks domain or granularity structure: it provides a flat list of concepts with no organization into meaningful categories or difficulty levels. This means it cannot answer questions like "Does this steering method work better for personality than sentiment?" or "Does performance degrade as targets become more specific?" Finally, AXBENCH's evaluation prompts are sampled from Alpaca-Eval (Dubois et al., 2024) rather than being tailored to specific concepts, and it does not provide concept-targeted preference pairs for training activation-based methods.

Steer-Bench (Chen et al., 2025a) studies intrinsic model steerability—how inherently steerable a model is, as a property of the model itself—rather than providing a benchmark for comparing different steering methods. This is a different question from the one SteerEval addresses.

No hierarchical organization of control targets. Perhaps most critically, none of the prior benchmarks organize concepts into levels of granularity. The distinction between what to express, how to express it, and how to instantiate that expression—despite being natural from both a cognitive science perspective (Marr, 1982; Botvinick and Braver, 2015) and an engineering perspective—is absent from existing evaluation frameworks. This means prior work cannot detect or characterize the granularity-dependent degradation that the paper identifies as a central failure mode of activation-based steering. A method might appear robust on coarse-grained concepts (L1) while completely failing on fine-grained ones (L3), and a flat benchmark would simply average these together, masking the pattern.

How This Paper Positions Itself Relative to Existing Work

The paper positions SteerEval as addressing all of these gaps simultaneously:

Multi-domain, hierarchically structured. SteerEval covers three behavioral domains—language features, sentiment, and personality—each organized into L1, L2, and L3 specification levels. This structure is explicitly motivated by Marr's three levels and by theories of hierarchical cognitive control (Section 2.3). It enables systematic analysis of how steering performance varies not just across domains but within them, as constraints tighten from abstract intent to verifiable surface form.

Standardized and fair comparison. By providing a unified evaluation protocol—the same scoring dimensions (Concept Score, Instruction Score, Fluency Score, and their Harmonic Mean) applied across all methods, domains, and levels—SteerEval enables direct comparison between prompt-based and activation-based steering, between different models, and across different types of behavioral targets. The paper explicitly contrasts this with the fragmented landscape of prior work where "heterogeneous concept definitions and data formats make cross-method comparison difficult" (Section 2.2).

Purpose-built data with quality controls. Unlike AXBENCH, which repurposes evaluation prompts from Alpaca-Eval, SteerEval uses an automated synthesis pipeline (Section 3.3, Figure 3) that generates concept-conditioned questions and contrastive preference pairs specifically designed to probe each target concept. The pipeline includes a question-rewriting step to "reduce artifacts where question phrasing cues the target concept" (Section 3.3, "Question Generation and Refine"), addressing a subtle but important confound: if the question itself contains lexical cues that make the target concept trivially inferable, steering becomes artificially easy. The paper also implements a two-stage quality assurance process combining automated validation with manual review by professional NLP annotators (Section 3.4), ensuring that the benchmark's labels are semantically reliable.

Preference pairs for training activation-based methods. The dataset provides matching and not_matching answer pairs for each question, with the pair "constrained to be minimally edited at the lexical level to maximize structural overlap and isolate concept-bearing differences" (Section 3.3, "Paired Answer Generation"). This is specifically designed to support activation-based methods like DiffMean and RePS, which require contrastive examples to extract steering directions. Prior benchmarks like AXBENCH do not provide such pairs.

A diagnostic, not just evaluative, tool. The paper frames SteerEval not merely as a leaderboard but as a diagnostic instrument. By exposing where steering methods break down (at which levels, in which domains, under which conditions), it provides actionable guidance for method development. The finding that activation-based methods degrade sharply at L2 and L3 while prompt-based methods remain stable (Section 4.2, Figure 2) is not just a ranking—it identifies a specific failure mode (inability to enforce fine-grained constraints) that future activation-based methods must address.

The Intellectual Lineage: Marr, Cognitive Control, and Hierarchical Organization

A distinctive feature of this paper's motivation is its appeal to cognitive science, which is worth unpacking because it provides the conceptual backbone for the entire benchmark design. Section 2.3 invokes two complementary frameworks:

Marr's three levels of analysis (Marr, 1982) distinguish between:

The computational level: What is the system trying to achieve? What is the goal of the computation?
The algorithmic level: What representations and processes does it use to achieve that goal?
The implementational level: How are those representations and processes physically realized?

The authors map these onto their L1 (what to express), L2 (how to express it), and L3 (how to instantiate it) hierarchy (Section 3.2, Table 1). This mapping is more than a naming convention—it carries a substantive claim: that steering at L3 is harder because it requires intervening at a lower, more constrained level of the model's representational hierarchy, analogous to the difficulty of modifying a specific neural circuit versus modifying a high-level behavioral goal.

Theories of cognitive control (Botvinick and Braver, 2015; Badre, 2025) describe how biological systems "select and regulate actions across these layers, enabling flexible behavior from abstract intentions to concrete execution" (Section 2.3). The paper positions LLM steering as an analogous problem: we want to exert top-down control over a hierarchical system, and we should expect that control to become more difficult as we descend the hierarchy toward more concrete, constrained levels of specification.

This theoretical framing is not just decorative—it generates testable predictions that the paper verifies. If LLM representations are hierarchically organized in a way that mirrors Marr's levels, then activation-based steering (which modifies internal representations directly) should be more effective at higher, more abstract levels and progressively less effective at lower, more constrained levels. That is exactly what the results in Table 2 show: RePS achieves concept scores of 3.15 at L1 for personality on Gemma-2-9B-Instruct but drops to 2.34 at L3. Prompt-based steering, by contrast, operates through a different mechanism (modifying the input rather than internal activations) and does not show the same degradation, achieving relatively stable concept scores of 2.57→3.02→2.87 across L1→L2→L3 for personality on the same model.

Summary: The Gap SteerEval Fills

The paper addresses a clear and consequential gap: the absence of a principled, hierarchical framework for evaluating how LLM controllability varies with the granularity of the control target. Prior benchmarks are narrow in scope, heterogeneous in design, or flat in structure—none can answer the question "At what level of specificity does this steering method stop working?" SteerEval fills this gap by providing (1) multi-domain coverage, (2) a three-level granularity hierarchy grounded in cognitive science, (3) standardized evaluation across method types, (4) purpose-built data with quality controls, and (5) contrastive preference pairs for training activation-based methods. The paper positions itself not as proposing a new steering method but as providing the diagnostic infrastructure needed to understand when, where, and why existing methods succeed or fail—a prerequisite for developing the next generation of more robust and fine-grained control techniques.

3. Technical Approach

This is primarily a benchmark and evaluation paper whose core idea is that the controllability of LLMs cannot be understood through flat, single-level benchmarks; instead, it must be evaluated through a hierarchically structured framework that probes the same behavioral target at progressively finer specification levels, connecting abstract intent to concrete textual realization.

3.1 Reader Orientation

What is being built: a dataset and evaluation protocol—SteerEval—that systematically tests how well different LLM steering methods can control model behavior across three behavioral domains, each decomposed into three levels of increasing specificity.

What problem it solves: existing steering benchmarks are narrow, heterogeneous, and flat—they cannot answer the question "does this method work at the level of abstract intent but fail at the level of concrete word choice?" SteerEval answers this by organizing control targets into a Marr-inspired hierarchy (L1: what to express, L2: how to express it, L3: how to instantiate it) and providing standardized evaluation across prompt-based and activation-based steering methods, making degradation patterns visible and comparable.

3.2 Big-Picture Architecture (Diagram in Words)

The SteerEval system has four major components:

Automated Data Synthesis Pipeline — a multi-stage LLM-driven process that takes a domain name as input and produces a full hierarchical dataset: domain descriptions, three-level concept hierarchies (L1→L2→L3), concept-conditioned questions with train/test splits, rewritten questions that obscure the target concept, and minimally-edited contrastive answer pairs (matching vs. not_matching).
Hierarchical Concept Structure — the organizational backbone of the benchmark: three behavioral domains (Language Features, Sentiment, Personality), each containing 8 concepts per level across L1, L2, and L3, for a total of 72 concepts (3 domains × 3 levels × 8 concepts). Each concept defines a specific steering target at its level of granularity.
Steering Methods Under Test — the inference-time interventions being evaluated: prompt-based (0-shot and 3-shot prompting, where a concept description is prepended to the input) and activation-based (PCA, DiffMean, and RePS, where a steering vector modifies intermediate hidden states during forward propagation at a selected layer).
Evaluation Protocol — an LLM-as-judge scoring system (using gpt-4.1-mini) that rates every generated output on three 0–4 scales: Concept Score (how well the output expresses the target concept), Instruction Score (how well it follows the original question), and Fluency Score (linguistic quality and coherence). The Harmonic Mean of these three scores penalizes any single-dimensional failure.

Information flows as follows: a domain name enters the synthesis pipeline → the pipeline generates a domain description, a three-level concept hierarchy with explicit granularity separation, training/test/validation questions with rewritten phrasing, and contrastive preference pairs → the dataset is manually validated through a two-stage quality assurance process → steering methods are applied to the test questions (prompt-based via input prepending, activation-based via vector addition at a mid-to-late layer with a validation-set-optimized scaling factor) → generated outputs are scored by gpt-4.1-mini across the three dimensions → scores are aggregated and compared across domains, granularity levels, and methods.

3.3 Roadmap for the Deep Dive

First, the formal steering task definition (Section 2.1), which establishes the mathematical abstraction—what a "steering method" is, what it takes as input, and what it produces—so we have a clear formalism before examining how methods are implemented and evaluated.
Second, the hierarchical concept structure (Section 3.2), because this is the intellectual core of the benchmark: what L1, L2, and L3 actually mean operationally, how they map onto Marr's levels, and why this particular decomposition matters for diagnosing steering failures.
Third, the automated data synthesis pipeline (Section 3.3, Figure 3), which is the engineering machinery that produces the benchmark's content without requiring manual concept creation for every domain and level—understanding this is essential for assessing the benchmark's scalability and potential biases.
Fourth, the quality assurance process (Section 3.4), which determines whether the automatically generated concepts, questions, and preference pairs are semantically valid—since the entire evaluation depends on the quality of these labels, this is not a peripheral detail.
Fifth, the dataset statistics and structure (Section 3.5), which give us the concrete scale (7,560 core samples) and the train/validation/test splits that govern how steering methods are tuned and evaluated.
Sixth, the steering method configurations (Section 4.1 and Appendix B), including layer selection, steering factor optimization, and generation settings—because these implementation choices can substantially affect method performance and must be understood to interpret the results fairly.
Seventh, the evaluation protocol (Sections 4.1 and Appendix E), including the three scoring dimensions, the Harmonic Mean aggregation, and the gpt-4.1-mini judge prompts—since all claims about method performance depend on these measurements.

3.4 Detailed, Sentence-Based Technical Breakdown

Steering Task Formalisation (Section 2.1)

The paper defines the steering task with a clean mathematical abstraction that separates the model, the steering intervention, and the evaluation criterion.

The base generation process. Without any steering intervention, a language model $M$ takes an input $x$ and produces an output:

$\hat{y} = M(x)$

where $M$ is the pretrained language model, $x$ is the input prompt (a question or instruction), and $\hat{y}$ is the model's generated response.

The steering intervention. A steering method takes a target concept $g$ (e.g., "express autonomy" or "use the word hooray") and constructs an inference-time intervention $\mathcal{I}_g$ that modifies how the model processes the input. The steered output is:

$\hat{y}_{\text{steered}} = \mathcal{I}_g(M, x)$

where $\mathcal{I}_g$ is the intervention function parameterised by the target concept $g$ , $M$ is the model, and $x$ is the input. The intervention is applied at inference time—it does not modify the model's weights.

What it computes: given a model and an input, the intervention function produces a modified output that should (ideally) better express the target concept $g$ than the unsteered output $\hat{y}$ would have. The intervention $\mathcal{I}_g$ encapsulates the entire steering mechanism—for prompt-based methods, it prepends text; for activation-based methods, it modifies hidden states.

Why this form: this abstraction cleanly separates the what (the target concept $g$ ) from the how (the intervention mechanism $\mathcal{I}_g$ ), enabling fair comparison between fundamentally different steering approaches under a unified mathematical framework. It also makes explicit that steering is evaluated by comparing $\hat{y}_{\text{steered}}$ against the unsteered baseline $\hat{y}$ .

Two concrete instantiations of $\mathcal{I}_g$ . The paper studies two families of intervention:

Prompt-based steering: the intervention prepends a concept prompt $p_g$ to the input, so the model sees $p_g \parallel x$ (where $\parallel$ denotes concatenation). The concept prompt $p_g$ is a natural language description of the target concept—for example, "Express autonomy through self-directed choice" or "Use hooray to express enthusiasm." This requires no access to model internals; it operates entirely through the model's input interface.
Activation-based steering: the intervention modifies intermediate activations during forward propagation using a concept-specific vector. During the forward pass at a selected layer, the hidden state $\mathbf{h}$ is replaced with $\mathbf{h} + \alpha \cdot \mathbf{v}_g$ , where $\mathbf{v}_g$ is a steering vector representing the concept $g$ and $\alpha$ is a scalar steering factor controlling intervention strength. This requires access to model internals (hidden states at a specific layer) but can potentially achieve more targeted control than prompting since it operates directly on the model's representations rather than through the indirect channel of natural language.

The evaluation goal. Steering is evaluated by whether $\hat{y}_{\text{steered}}$ better expresses the target concept $g$ than the unsteered output, while simultaneously preserving general response quality—specifically, instruction following and fluency. This is a three-way trade-off: a method that achieves perfect concept expression but produces garbled, ungrammatical text that ignores the original question is considered a failure. The Harmonic Mean aggregation (described in the evaluation section below) operationalises this trade-off by penalising any single-dimensional weakness.

Hierarchical Concept Structure: The L1→L2→L3 Decomposition (Section 3.2)

This is the intellectual core of SteerEval. The authors organise every steering target into a three-level hierarchy that progresses from abstract intent to concrete, verifiable surface constraints. Understanding exactly what each level means—and how they differ—is essential because the paper's central empirical finding is that activation-based steering methods degrade sharply as we move from L1 to L3.

The foundational claim. The authors posit that "behavioral concepts occupy different depths within a model's internal hierarchy" (Section 3.2). Personality reflects "higher-level, enduring dispositional priors"; sentiment captures "intermediate, context-dependent affective tendencies"; and language features shape "lower-level surface realizations." Moreover, within each domain, there is an additional internal gradation—the same domain-level target (e.g., autonomy) can be specified at different levels of precision. The L1→L2→L3 hierarchy is designed to systematically probe these internal gradations.

Why three levels? The design is explicitly inspired by Marr's three levels of analysis (Marr, 1982): the computational level (what is the goal?), the algorithmic level (what representations and processes achieve it?), and the implementational level (how is it physically realised?). The mapping is:

L1 ↔ Computational Level: defines what to express—the high-level steering intent or behavioral goal, without constraining how it should be realised in text. This level permits diverse outputs and tests whether a method can reliably bias behavior in the intended direction.
L2 ↔ Algorithmic Level: defines how to express the intent—a specific strategy or manner of realisation while preserving the L1 objective. This constrains the form of expression without yet pinning it to specific lexical items.
L3 ↔ Implementational Level: defines how to instantiate the expression—atomic, verifiable surface constraints (specific words, phrases, or patterns that must appear in the output). This is the most constrained level, testing whether a method can enforce token-level compliance.

The hierarchy is nested, not independent. A crucial design property that is implicit in the paper's descriptions but important to surface explicitly: L2 is not a separate concept from L1—it is a more specific way of realising the same underlying behavioral target. L3 is similarly a more specific instantiation of L2. This nesting means that the benchmark tests whether methods can maintain control as constraints tighten along a single behavioral dimension, rather than testing unrelated concepts at different difficulty levels. The paper phrases this as "connecting high-level behavioral intent to concrete textual output" (Abstract) and "linking high-level behavioral intent to concrete textual outputs" (Section 1).

Concrete examples from Figure 2 to anchor the abstraction. The paper provides rich examples that make the L1→L2→L3 progression tangible. For the Language Features domain, with the core steering goal of "increase redundancy":

L1: Shift from "Concise phrasing" to "Elaborative repetition." This is the what—make the output more redundant, without specifying how. Any output that is more verbose and repetitive than a concise baseline satisfies L1.
L2: Shift from "Single expression" to "Rephrased restatement." This is the how—redundancy must be achieved specifically by immediately restating ideas in different words, not by adding tangential elaboration or repeating verbatim. This constrains the strategy but not the exact lexical items.
L3: Include the token "(i.e.," in the output. This is the instantiation—the rephrased restatement from L2 must be realised using a very specific surface marker. An output that is redundant and uses rephrasing but never writes "(i.e.," fails L3, even though it might satisfy L2.

For the Personality domain, with the core steering goal of "autonomy":

L1: Express autonomy. The what—the output should convey self-directedness and independent decision-making.
L2: Express autonomy specifically "through self-directed choice"—shifting from "defer to others" to "decisions are self-made." This constrains the manner of expressing autonomy to a particular framing.
L3: Include the phrase "self-authored" in the output. The surface token that serves as verifiable evidence of the L2 strategy.

For the Sentiment domain, with the core steering goal of "high enthusiasm":

L1: Express high enthusiasm. The what—the output should convey energetic, positive affect.
L2: Use "celebratory emphasis"—moving from "neutral praise" to "energized praise." This constrains how enthusiasm is expressed.
L3: Include the word "hooray" in the output. The verifiable token that instantiates celebratory enthusiasm.

Table 1 summarises the relationship between levels. Level L1 has the highest frequency of occurrence in natural text (coarse-grained behavioral intentions appear in many contexts), the highest abstraction (it specifies a direction but not a form), and the coarsest verifiability (many different outputs satisfy it). Level L3 has the lowest frequency (specific tokens appear in specific contexts), the lowest abstraction (it is a directly checkable surface constraint), and the strictest verifiability (either the token is present or it is not). L2 sits in the middle on all three axes.

The diagnostic value of this structure. Because the same underlying behavioral target is tested at three specification levels, the benchmark can distinguish between different failure modes. If a method succeeds at L1 but fails at L3, the problem is specific to fine-grained constraint enforcement—the method can bias behavior in the intended direction but cannot pin it to exact surface forms. If a method fails at L1, the problem is more fundamental—it cannot even bias behavior in the intended direction at all. If a method succeeds at all three, it provides end-to-end controllability from abstract intent to concrete realisation. The paper's results show that prompt-based methods fall into the third category (stable across all levels) while activation-based methods fall into the first (good at L1, degraded at L2, poor at L3).

Automated Data Synthesis Pipeline (Section 3.3, Figure 3)

Rather than manually authoring concepts, questions, and answer pairs—which would be slow, expensive, and limit scalability—the authors build a fully automated, multi-stage pipeline that uses an LLM to generate the entire benchmark. Figure 3 provides a visual overview; I will walk through each stage in sequence.

Stage 1: Hierarchical Concept Synthesis (Step 1 in Figure 3).

Input. A user provides or randomly samples a domain_name—one of "Language Features," "Personality," "Sentiment," or "Reasoning Patterns" (the last being a specialised supplementary domain detailed in Appendix B).

Step 1a: Domain specification. Conditioned on the domain name, an LLM generates a domain_description that defines the domain scope and "delineates neighboring domains" (Section 3.3). This description serves as a global constraint for all subsequent generation steps. The prompt template for this step is provided in Appendix D.1, though its exact text is not reproduced in the main paper. The purpose is to bound the domain—to prevent concept drift where the LLM generates concepts that bleed into adjacent domains (e.g., generating sentiment concepts when asked for personality concepts).

Step 1b: Concept hierarchy generation. Given the domain_name, domain_description, and a target data quantity, the LLM synthesises a three-level concept hierarchy with explicit granularity separation and concrete L3 constraints. The prompt template (Appendix D.2) includes formal definitions of the granularity levels (as described in Section 3.2) to ensure the LLM generates concepts that respect the L1→L2→L3 structure. For each domain, the pipeline generates 8 independent concepts per level—8 L1 concepts, 8 L2 concepts, and 8 L3 concepts—for a total of 24 concepts per domain across the three main domains (72 concepts total for Language Features, Personality, and Sentiment).

Why automated synthesis rather than manual authoring? The paper does not explicitly state this trade-off, but the logic is clear from context: manual authoring of 72 hierarchically structured concepts with consistent granularity separation across three domains would require substantial expert time and would be difficult to scale to additional domains. Automated synthesis enables rapid expansion. The trade-off is that automated synthesis introduces potential quality issues—the LLM might generate concepts that don't properly respect the granularity hierarchy, that are redundant, or that don't cleanly separate from adjacent domains. The two-stage quality assurance process (Section 3.4) is designed to catch and correct these issues.

Stage 2: Question Generation and Refinement (Step 2 in Figure 3).

Step 2a: Question set generation. For each concept in the hierarchy, the LLM generates a diverse set of concept-conditioned questions with a fixed train/test split (70 training questions and 30 test questions per concept). Additionally, the LLM generates an "anchor question" with reference (positive, negative) answers to "calibrate style and difficulty" (Section 3.3). The anchor question and its reference answers serve as exemplars that define the expected format and difficulty level for that concept—they are not themselves evaluation items but serve as calibration references for the data generation process. The prompt template is in Appendix D.3.

Step 2b: Question refinement (rewriting). This is a subtle but important step. The authors recognise that concept-conditioned questions might inadvertently contain "artifacts where question phrasing cues the target concept" (Section 3.3). For example, if the concept is "use the word hooray" (L3 sentiment), and the generated question is "Write a celebratory message using hooray," then steering becomes trivially easy—the question itself tells the model what to do, and any steering method would appear to work regardless of its actual effectiveness. To mitigate this confound, each question is rewritten by "pivoting it toward a related-but-distinct concept while preserving the domain context" (Section 3.3). The prompt template is in Appendix D.4.

What "pivoting" means operationally: the rewriting step takes the original concept-conditioned question and rephrases it so that it probes a neighbouring concept in the same domain rather than the target concept directly. This preserves domain relevance (the question is still about personality, sentiment, or language features) but removes surface cues that would make the target concept trivially inferable from the question text alone. The steering method must then actually induce the target concept in the model's output, rather than simply having the model parrot a cue from the input.

Why this matters: without this step, the benchmark would overestimate steering effectiveness—particularly for prompt-based methods, which could simply attend to lexical cues in the question. The rewriting step makes the evaluation more rigorous by testing whether steering works when the target concept must be actively imposed on the output by the intervention, rather than passively inherited from the input.

Stage 3: Paired Answer Generation (Step 3 in Figure 3).

Input. For each rewritten question, the LLM generates a contrastive answer pair.

Output. A matching answer that satisfies the target concept (at all levels—L1, L2, and L3 simultaneously) and a not_matching answer that exhibits the opposite behavior. The pair is "constrained to be minimally edited at the lexical level to maximize structural overlap and isolate concept-bearing differences" (Section 3.3). The prompt template is in Appendix D.5.

What "minimally edited" means: the matching and not_matching answers should be as similar as possible in structure, length, and non-concept-bearing content, differing only in the specific words or phrases that realise (or fail to realise) the target concept. For example, if the L3 constraint is "include (i.e.,", the matching answer might contain "redundancy is important (i.e., repeating key ideas)" while the not_matching answer might contain "redundancy is important, which means repeating key ideas"—identical in meaning but differing in the presence of the surface marker.

Why this design choice: activation-based steering methods—specifically DiffMean and RePS—learn steering directions from contrastive pairs of positive and negative examples. By minimising lexical differences between the matching and not_matching answers, the authors ensure that the learned steering direction isolates the concept of interest rather than capturing spurious correlates (e.g., differences in length, topic, or writing style that happen to be correlated with the concept in natural data). This is methodologically similar to the "minimal pair" approach in linguistics and controlled text generation, where the goal is to vary only the feature of interest while holding everything else constant.

The overall pipeline flow. To summarise the end-to-end process: domain name → domain description → concept hierarchy (8 concepts × 3 levels) → concept-conditioned questions (with train/test split and anchor calibration) → rewritten questions (concept cues obscured) → contrastive answer pairs (minimally edited for concept isolation) → manual quality assurance (two-stage, described below) → final benchmark dataset.

Quality Assurance (Section 3.4)

Because the entire pipeline is automated and LLM-driven, the authors implement a two-stage quality assurance framework to catch errors that the synthesis LLM might introduce. This is critical: if the benchmark's labels are wrong—if a "matching" answer doesn't actually satisfy the target concept, or if a "not_matching" answer accidentally does—then all downstream evaluation results are compromised.

Stage 1: Automated Validation. This stage focuses on "format and size consistency during data generation" (Section 3.4). The key operational detail is that "multiple candidate outputs are generated per task" because the synthesis LLM "may not satisfy all constraints in a single pass." These candidates undergo automated format and integrity checks—presumably verifying that the output conforms to the expected JSON structure, that all required fields are present, that L3 constraints are actually checkable, etc. The validated subset is then "truncated in sequence to match the target size"—meaning that if the pipeline was asked to generate 8 concepts per level and it generated 12 valid ones, only the first 8 are kept. This ensures the final dataset has the intended structure and scale, without manual curation of which concepts to include.

What this stage doesn't check: semantic fidelity. Automated checks can verify that a concept has an L3 constraint, but they cannot verify that the L3 constraint is actually a valid instantiation of the L2 strategy, or that the L2 strategy is a valid realisation of the L1 intent. Those semantic relationships require human judgment—which is what Stage 2 provides.

Stage 2: Manual Group Review. Professional NLP annotators are assigned by domain and granularity level, following a standardised workflow designed to maximise consistency:

Guideline familiarisation: annotators study the benchmark's definitions of domains, granularity levels, and annotation criteria before beginning work. This ensures they share a common understanding of what constitutes a valid L1/L2/L3 concept and a correct matching/not_matching pair.
Calibration on a random ~20% subset: annotators independently label a 20% sample of the data, then meet to discuss disagreements and align their interpretations. This calibration step is standard practice in annotation projects and serves to reduce inter-annotator variability before the main annotation begins.
Dual independent verification with consensus: each data point is independently verified by two annotators. Disagreements are resolved through discussion to reach consensus. This dual-annotation protocol provides a check on individual annotator error and bias.
Collective resolution of flagged issues: any data points that raise concerns during verification (e.g., ambiguous concept definitions, borderline matching/not_matching distinctions) are escalated for group discussion and resolution.

The paper states that this process "reduces subjectivity, improves consistency, and ensures high-quality domain, granularity, and preference annotations." The specific number of annotators, their qualifications, and inter-annotator agreement metrics are not reported in the main paper or appendices—this is a limitation in transparency, though not unusual for benchmark papers.

Additional vetting. All data are "vetted for privacy and security by an internal review committee" (Section 3.4). The dataset is released under the MIT License, which is a permissive open-source license that allows both academic and commercial use with minimal restrictions.

Dataset Statistics and Structure (Section 3.5, Figure 4)

Scale. The core benchmark contains 7,560 samples total. The breakdown by construction is:

3 primary domains: Personality, Sentiment, Language Features.
3 granularity levels per domain: L1, L2, L3.
8 independent concepts per level: within each domain and level, there are 8 distinct concepts.
Per-concept sample allocation: 70 training samples, 30 test samples, and 5 validation samples. This gives 105 samples per concept.
Total: 3 domains × 3 levels × 8 concepts × 105 samples = 7,560 samples.

The training split (70 samples per concept) is used for: (a) providing in-context demonstrations for prompt-based steering (the 3-shot condition samples from this set), and (b) training activation-based steering vectors for methods like RePS that learn from preference data. The validation split (5 samples per concept) is used to search for optimal hyperparameters—specifically, the steering factor $\alpha$ for activation-based methods. The test split (30 samples per concept) is used for final evaluation and is never seen during method development or tuning.

Domain specialisation. In addition to the three core domains, the paper mentions that "a specialized domain focused on Reasoning Patterns was independently constructed to test logic-specific steering; details for this domain are available in Appendix B." This domain follows the same L1→L2→L3 structure and appears in the detailed results tables (Tables 9 in Appendix C) but is not included in the main paper's aggregate analysis. It serves as a supplementary domain for testing whether the benchmark's findings generalise beyond the three primary behavioral domains.

Sample structure. Each sample consists of a question, a matching answer (satisfies the target concept), and a not_matching answer (exhibits the opposite behavior). Figure 7 in Appendix A shows the full field specification: domain, domain_description, concept, concept_id, concept_description, question, matching, and not_matching. The concept_id field provides a unique identifier for each concept, which is used to organise data and track results across granularity levels.

Figure 4: Hierarchical structure visualisation. The figure (referenced but not fully reproduced in the text) shows the distribution of samples across domains and levels. Given the uniform design (8 concepts × 105 samples per concept at each level), the distribution should be approximately uniform across all cells of the 3×3 grid (3 domains × 3 levels), with 840 samples per cell (8 concepts × 105 samples).

Steering Method Configurations (Section 4.1, Appendix B)

The paper evaluates six conditions (one unsteered baseline + five steering methods) across three models. Understanding the implementation details of each method is essential for interpreting why they perform differently.

Models. Three instruction-tuned models of comparable scale:

Gemma-2-9B-Instruct (Team, 2024a): 9 billion parameters.
Qwen-2.5-7B-Instruct (Team, 2024c): 7 billion parameters.
Llama-3.1-8B-Instruct (Team, 2024b): 8 billion parameters.

All three are publicly available, instruction-tuned models in the 7–9B parameter range. The paper does not justify why these specific models were chosen, but the likely rationale is that they represent diverse model families (Google, Alibaba, Meta) with similar scale, enabling cross-family comparison while controlling for model size.

Vanilla (unsteered baseline). The model generates responses without any steering intervention: $\hat{y} = M(x)$ . This establishes the lower bound on concept expression—how much does the model naturally express the target concepts without being told to do so? The Vanilla scores in Table 2 show that unsteered models generally have low concept scores (e.g., 1.16 for language features L1 on Gemma-2-9B-Instruct, dropping to 0.14 at L3), confirming that the target concepts are not already strongly present in the model's default behavior and that steering is necessary to achieve them.

Prompt (0-shot). The intervention prepends a natural language description of the target concept to the input: $M(p_g \parallel x)$ . The concept prompt $p_g$ is derived from the concept description in the benchmark data. Crucially, the question $x$ used here is the rewritten question (after the refinement step in the pipeline), so the prompt does not contain direct lexical cues that would make the concept trivially inferable. No in-context examples are provided.

Prompt (3-shot). The intervention prepends both the concept description and three randomly sampled preference pairs from the training set as in-context demonstrations: $M(p_g \parallel \text{[3 demo pairs]} \parallel x)$ . Each demonstration pair consists of a question, a matching answer, and a not_matching answer, showing the model examples of outputs that do and do not satisfy the target concept. The three pairs are randomly sampled from the 70 training samples for that concept. This tests whether providing explicit positive and negative examples improves steering over the 0-shot description alone.

PCA (Principal Component Analysis). A training-free activation-based method. The steering vector is obtained by: (1) collecting hidden states from the target layer for matching and not_matching answer pairs from the training set, (2) computing the difference between the mean hidden state for matching answers and the mean hidden state for not_matching answers, and (3) taking the first principal component of these difference vectors as the steering direction $\mathbf{v}_g$ . At inference time, the hidden state $\mathbf{h}$ at the target layer is modified to $\mathbf{h} + \alpha \cdot \mathbf{v}_g$ , where $\alpha$ is the steering factor (scalar multiplier) searched on the validation set. The paper does not specify whether PCA is computed on the raw difference vectors or on the covariance of hidden states—this is a conventional application of PCA to representation differences for concept extraction.

DiffMean (Difference in Means). A training-free activation-based method introduced by Marks and Tegmark (2023). The steering vector is simply the difference between the mean hidden state for matching answers and the mean hidden state for not_matching answers: $\mathbf{v}_g = \bar{\mathbf{h}}_{\text{matching}} - \bar{\mathbf{h}}_{\text{not\_matching}}$ . No PCA or other dimensionality reduction is applied. At inference time, the intervention is $\mathbf{h} \leftarrow \mathbf{h} + \alpha \cdot \mathbf{v}_g$ . DiffMean is simpler than PCA but potentially noisier, since it does not filter out irrelevant variation directions.

RePS (Representation Preference Steering). A training-based activation-based method introduced by Wu et al. (2025c). Unlike PCA and DiffMean, which extract steering directions from representation statistics without an optimisation objective, RePS "directly trains a steering vector from data" (Section 4.2) using a preference-style objective. The method learns $\mathbf{v}_g$ by optimising a loss function that encourages the steered model to produce outputs that are closer to the matching answers than the not_matching answers in the training preference pairs. The exact loss function is not provided in this paper (it references Wu et al., 2025c), but the key distinction is that RePS uses gradient-based optimisation to find the steering vector, whereas PCA and DiffMean use closed-form statistical computations. At inference time, the intervention is $\mathbf{h} \leftarrow \mathbf{h} + \alpha \cdot \mathbf{v}_g$ , same as the other activation-based methods.

Layer selection. Following prior work (Wu et al., 2025b; Wang et al., 2025; Bigelow et al., 2025), steering is applied at a single mid-to-late layer:

Gemma-2-9B-Instruct: layer 20 (out of an unspecified total; presumably around 40+ layers for a 9B model)
Qwen-2.5-7B-Instruct: layer 14
Llama-3.1-8B-Instruct: layer 12

The choice of a single mid-to-late layer is standard practice in activation steering research (Rimsky et al., 2024; Turner et al., 2023), based on the empirical finding that intermediate-to-late layers encode semantic and stylistic properties more cleanly than early layers (which process low-level features) or final layers (which are dominated by next-token prediction). The specific layer indices are inherited from prior work rather than being optimised for SteerEval, which means the reported performance for activation-based methods is with fixed layer choices rather than per-concept optimal layers. This is a conservative evaluation: if a method would work better at a different layer for a specific concept, the fixed-layer protocol penalises it.

Steering factor optimisation. For PCA, DiffMean, and RePS, the steering factor $\alpha$ (the scalar multiplier on the steering vector) is "searched on the validation set to find the optimal scaling value, which is then applied for generation and evaluation on the test set" (Section 4.1). This means each concept gets its own optimal $\alpha$ , found by trying multiple values on the 5 validation samples and selecting the one that maximises the Harmonic Mean. The specific values searched are not enumerated in the main paper, but Tables 3–6 in Appendix B report the selected steering factors for every concept, model, and method. These tables reveal substantial variation: factors range from 1 to 24 for RePS, from 1 to 8 for PCA and DiffMean. The fact that L3 concepts often have steering factors of 1 (the minimum) is notable—it suggests that for fine-grained targets, even weak steering can be counterproductive, and the "optimal" factor found by validation search is simply to barely intervene at all.

Other hyperparameters. The paper states that "other hyperparameters are consistent with AxBench and RePS" (Appendix B), without enumerating them. This likely includes generation settings (temperature, top-p, max tokens) and the specifics of how activation vectors are extracted and applied, but the reliance on prior work means these are not independently documented in this paper.

Hardware and scale. All experiments are conducted using "three NVIDIA A800 GPUs over the course of one week" (Appendix B). This provides a sense of the computational scale: the full evaluation across 3 models × 6 methods × 3 domains × 3 levels × 8 concepts, with validation-set steering factor search for activation-based methods, fits within approximately 504 GPU-hours (3 GPUs × 168 hours), though not all of that time may have been used.

Evaluation Protocol (Section 4.1, Appendix E)

The evaluation protocol uses an LLM-as-judge approach with gpt-4.1-mini scoring every generated output on three 0–4 scales. This is a standard approach in modern LLM evaluation (popularised by benchmarks like AlpacaEval and MT-Bench) but introduces potential biases that the paper acknowledges in its Limitations section.

Three scoring dimensions. For every generated output, gpt-4.1-mini assigns a score in {0, 1, 2, 3, 4} on each of:

Concept Score (CS): "how accurately the output conveys the intended concept" (Section 4.1). The evaluation prompt for this dimension is provided in Appendix E.1, though its exact text is not reproduced in the main paper. At L1, this means "does the output express the intended high-level behavior?"; at L3, this means "does the output contain the required surface token?"—the same scoring rubric is applied across levels, but the interpretation of what "conveys the intended concept" means changes with granularity.
Instruction Score (IS): "how well it follows the instruction" (Section 4.1)—that is, how well the output addresses the original question $x$ , independent of whether it expresses the target concept. This dimension prevents methods from achieving high concept scores by ignoring the question entirely and just emitting text that matches the concept. The evaluation prompt is in Appendix E.2.
Fluency Score (FS): "linguistic quality, coherence, and readability" (Section 4.1). This dimension prevents methods from achieving high concept scores by producing garbled, ungrammatical text that happens to contain the required surface markers. The evaluation prompt is in Appendix E.3.

Harmonic Mean aggregation. The three scores are combined using the Harmonic Mean:

$\text{HM} = \frac{3}{\frac{1}{\text{CS}} + \frac{1}{\text{IS}} + \frac{1}{\text{FS}}}$

where $\text{CS}$ is the Concept Score, $\text{IS}$ is the Instruction Score, and $\text{FS}$ is the Fluency Score, all on a 0–4 scale.

What it computes: the Harmonic Mean of three scores on the same scale. Unlike the arithmetic mean, the Harmonic Mean is dominated by the smallest value—if any single dimension is low, the HM is pulled sharply downward even if the other two dimensions are high. For example, scores of (4, 4, 1) give an arithmetic mean of 3.0 but a Harmonic Mean of approximately 1.7.

Why this form: the paper explicitly states that HM is used "to downweight low performance in any single dimension" (Section 4.1). This operationalises the three-way trade-off described in the steering task definition: a method that achieves perfect concept expression (CS=4) but produces ungrammatical text (FS=1) that ignores the instruction (IS=1) should be penalised heavily, because such an output is practically useless despite satisfying the steering target. The Harmonic Mean provides this penalty automatically, without requiring explicit weighting parameters. The arithmetic mean would be more forgiving of single-dimension failures, potentially ranking a method that produces concept-aligned gibberish above a method that produces slightly less concept-aligned but perfectly fluent and instruction-following text.

A potential subtlety with the 0–4 scale. The HM formula involves division by each score, which is undefined when any score is 0. The paper's results tables (Tables 7–10 in Appendix C) show that Fluency Scores and Instruction Scores are never 0 (they range from approximately 2.5 to 4.0 across methods), and Concept Scores at L3 for activation-based methods can approach 0 (e.g., 0.05, 0.07) but the exact 0 values appear mainly for Vanilla baselines at L3. The paper presumably handles zero scores by either adding a small epsilon, treating them as a minimum value, or using an implementation that gracefully handles the edge case—but this is not documented.

LLM-as-judge evaluation setup. The gpt-4.1-mini model is used as the judge, with tailored prompts for each scoring dimension (Appendices E.1–E.3). The paper does not report the specific prompt templates in the main text—they are available in the appendix—but the general approach is: for each dimension, the judge is given the original question, the target concept description, and the model's generated output, and asked to assign a 0–4 score based on specific criteria.

Why gpt-4.1-mini rather than automated metrics or human evaluation? Automated metrics like BLEU, ROUGE, or BERTScore cannot assess concept expression—they measure surface similarity to references, not semantic alignment with a target concept. Human evaluation would be more reliable but substantially more expensive, especially for 7,560 test samples × multiple methods. LLM-as-judge provides a middle ground: it can assess semantic properties like concept expression and instruction following at a fraction of the cost of human evaluation. The paper acknowledges the limitations of this approach in its Limitations section: "Such judges can be biased and sensitive to prompting, and may over/under-credit fine-grained compliance. Scores should be read as approximate signals rather than definitive ground truth."

Evaluation protocol for different method types. Methods that do not require a steering factor—Vanilla, Prompt (0-shot), and Prompt (3-shot)—are evaluated directly on the test set. For PCA, DiffMean, and RePS, the steering factor is first searched on the validation set (5 samples per concept) to find the optimal scaling value, and then the method with that optimal factor is applied to the test set for final scoring. This protocol ensures that activation-based methods are evaluated at their best-found configuration, rather than at an arbitrary default factor, making the comparison fairer to these methods.

Reporting structure. Results are reported as averages across concepts within each domain, level, and method. Table 2 in the main paper reports Concept Score and Harmonic Mean for each domain-level-method combination. Tables 7–10 in Appendix C report the full breakdown including Instruction Score, Fluency Score, and Harmonic Mean for all four domains, three levels, three models, and six methods—a comprehensive set of 3 models × 6 methods × 4 domains × 3 levels = 216 rows of detailed results.

4. Key Insights and Innovations

Innovation 1: Granularity as a First-Class Dimension of Controllability

The field's dominant assumption before SteerEval was that steering methods should be evaluated against a single success criterion: does the steered output better express the target concept than the unsteered baseline? This is the evaluation model used by AXBENCH (Wu et al., 2025b), by sentiment steering benchmarks (Han et al., 2024), and by safety steering evaluations (Siu et al., 2025)—a method either moves the model toward the target or it doesn't, and the magnitude of that movement is the primary metric of interest.

SteerEval's central conceptual move is to reframe controllability as a question of granularity, not just magnitude. The paper argues—and demonstrates empirically—that success at a coarse specification level (L1: "express autonomy") does not imply success at a fine specification level (L3: "use the word 'self-authored' to express autonomy"), even though both target the same underlying behavioral dimension. This is not an incremental refinement of existing benchmarks; it is a fundamental reconceptualization of what it means for an LLM to be "controllable." Under the old model, a method that achieves a concept score of 3.5 at a coarse level would be declared effective. Under SteerEval's model, that same method might score 0.5 at a fine level on the same behavioral target—and both scores are equally relevant to assessing the method's real-world utility.

The diagnostic power of this reframing is visible throughout Table 2. RePS on Gemma-2-9B-Instruct achieves a concept score of 3.15 at L1 for personality—competitive with prompt-based steering—but drops to 2.34 at L3, a degradation of 26%. The Harmonic Mean tells an even starker story: 3.04 at L1, 3.48 at L2 (where concept expression improves but instruction following may still hold), and 2.12 at L3. An evaluator looking only at L1 would conclude RePS is a strong personality steering method; an evaluator looking at L3 would conclude it is substantially limited. Both conclusions are correct for their respective specification levels, and neither alone is sufficient. The innovation is not the specific numbers but the framework that makes both evaluations possible and commensurable within a single benchmark.

This reframing has downstream implications that extend beyond benchmarking. It implies that deployment decisions about steering methods must be granularity-aware: an organisation that needs coarse sentiment control (e.g., "make outputs positive") might be well-served by activation-based methods, while an organisation that needs precise lexical compliance (e.g., "use the company's approved terminology") would find the same methods inadequate despite their success at the coarse level. This is a more nuanced and practically useful picture than "method X works" or "method X doesn't work."

Innovation 2: The Marr-Inspired Hierarchy as a Theory of Steering Difficulty, Not Just a Taxonomy

Many benchmarks organise their content into categories—by task type, by domain, by difficulty level. What distinguishes SteerEval's L1→L2→L3 hierarchy is that it is not merely a taxonomic convenience but a theoretically motivated prediction about where and why steering should become harder. The paper grounds its hierarchy in Marr's three levels of analysis (Marr, 1982) and in theories of hierarchical cognitive control (Botvinick and Braver, 2015; Badre, 2025), and this grounding carries a substantive claim: LLM representations are hierarchically organised such that high-level behavioral concepts (personality traits, sentiment valence) occupy more abstract, more easily manipulable regions of representation space, while fine-grained surface constraints (specific lexical choices) are embedded in lower-level, more constrained regions that are harder to modify without collateral effects on fluency and instruction following.

This is a theoretical contribution, not just an empirical observation. The paper is not merely saying "fine-grained control is harder" (which might be true for trivial reasons—it's harder to hit a smaller target). It is advancing a specific mechanistic hypothesis about why it is harder: because the representational hierarchy that supports flexible behavior in LLMs (analogous to the hierarchy that cognitive science posits for human cognition) makes high-level attributes more linearly separable and more amenable to vector-based intervention than low-level attributes. Activation-based steering, which modifies representations through vector addition in a continuous space, succeeds when the concept of interest is well-captured by a linear direction in that space—precisely the condition that holds for abstract, high-level concepts in a hierarchically organised representational geometry (Mikolov et al., 2013; Pennington et al., 2014). It fails when the concept of interest requires precise coordination across multiple representation dimensions that cannot be captured by a single additive direction—the condition that plausibly holds for fine-grained lexical constraints.

The evidence for this theoretical interpretation is in the systematic pattern across Table 2: activation-based methods (PCA, DiffMean, RePS) show a consistent L1→L3 degradation across all three domains and all three models, while prompt-based methods—which operate through a fundamentally different mechanism (modifying the input rather than the internal representation)—show no such degradation. This domain-and-model invariance of the degradation pattern is exactly what a representational-geometry explanation would predict, and it is hard to explain through alternative hypotheses (e.g., that L3 concepts are just "harder" in some task-independent sense, since prompt-based methods handle them fine).

The contrast with AXBENCH (Wu et al., 2025b) is instructive. AXBENCH's concepts are derived from SAE features—representationally grounded, but organised as a flat list with no theoretical structure linking concept type to expected steering difficulty. An AXBENCH evaluator might observe that some concepts are easier to steer than others, but would have no principled framework for predicting which concepts those would be. SteerEval's Marr-inspired hierarchy provides exactly that predictive framework: concepts at higher levels of the representational hierarchy (more abstract, more linearly separable) should be easier for activation-based methods; concepts at lower levels (more concrete, more constrained) should be harder. The results in Table 2 bear this prediction out.

Innovation 3: The Identification of Activation-Based Steering's Granularity Ceiling as a Systematic Failure Mode

Prior work on activation-based steering has generated conflicting results. Some studies report strong concept control (Rimsky et al., 2024; Turner et al., 2023; Arditi et al., 2025), while others find that simple prompting baselines match or outperform activation-based methods (Wu et al., 2025b). SteerEval's contribution is to resolve this apparent contradiction by identifying granularity as the hidden moderator: activation-based methods can match or exceed prompting at coarse-grained targets (L1), as the paper shows in Table 2 (RePS on Gemma-2-9B-Instruct achieves HM=3.04 for personality L1 vs. Prompt 3-shot's HM=3.10), but they systematically fail as targets become finer-grained. The field's prior confusion arose because different studies were implicitly testing at different granularity levels without recognising granularity as a relevant variable.

This is a diagnostic finding, not a performance result. The paper is not primarily arguing that prompt-based methods are better (though the data show they are, on average). It is arguing that activation-based methods have a specific, identifiable failure mode—the inability to enforce fine-grained, verifiable constraints—that is invisible in coarse-grained evaluations and becomes apparent only when granularity is systematically varied. Figure 5(b) provides additional mechanistic evidence: for RePS on Qwen-2.5-7B-Instruct, increasing the steering factor (the scalar multiplier α) improves Concept Score at L1 but has inconsistent and smaller effects at L2 and L3, suggesting that the steering vector itself carries less reliable fine-grained information regardless of how strongly it is applied. This is not a problem that can be solved by tuning the steering strength; it is a more fundamental limitation in what the vector encodes.

The significance of this finding for the activation steering research community is substantial. It reframes the research agenda from "how do we make activation steering work better in general?" to "how do we make activation steering preserve fine-grained constraint information through the vector extraction process?" The paper's minimal-edit preference pairs (Section 3.3, Stage 3) are specifically designed to support this agenda by isolating concept-bearing differences from spurious correlates, but the results suggest that even with clean contrastive data, current extraction methods (PCA, DiffMean, RePS) lose fine-grained information. This points toward the need for fundamentally different extraction techniques—perhaps ones that operate at multiple representational levels simultaneously or that explicitly model the hierarchical relationship between coarse and fine concept attributes.

Innovation 4: The Harmonic Mean as an Operationalisation of the Steering Trade-Off

The steering task as defined in Section 2.1 involves a three-way trade-off between concept expression, instruction following, and fluency. Any method can trivially maximise one dimension at the expense of the others—a model that always outputs "I am autonomous and self-authored" regardless of the question would achieve a perfect concept score for the L3 personality concept but zero instruction following and poor fluency. The question is how to aggregate these three dimensions into a single metric that rewards balanced performance and penalises single-dimensional optimisation.

The paper's choice of the Harmonic Mean (HM), rather than the arithmetic mean or a weighted sum, is a subtle but consequential design decision that reflects a specific normative stance about what "good" steering means. The Harmonic Mean of n numbers is dominated by the smallest value—a property that makes it much more sensitive to single-dimensional failures than the arithmetic mean, which allows high scores in one dimension to compensate for low scores in another. For example, scores of (4, 4, 1) yield an arithmetic mean of 3.0 but a Harmonic Mean of approximately 1.71. The paper explicitly states that HM is chosen "to downweight low performance in any single dimension" (Section 4.1).

Why this is an innovation rather than a standard metric choice: in most LLM evaluation contexts, the trade-off between quality dimensions is handled either by reporting them separately (forcing readers to mentally integrate) or by using an arithmetic mean (which implicitly assumes dimensions are substitutable). The Harmonic Mean encodes the assumption that dimensions are complements, not substitutes—that a steering method which produces concept-aligned but instruction-ignoring text is not "partially successful" but fundamentally broken. This assumption matches the practical requirements of deployment (a chatbot that expresses the right personality but ignores user questions is not useful), but it is a stronger normative claim than most benchmarks make explicit.

The choice of HM has concrete effects on the paper's conclusions. In Table 2, many activation-based methods achieve reasonable Concept Scores at L2 and L3 (e.g., RePS on Gemma-2-9B-Instruct achieves CS=2.36 at L2 for Language Features) but are dragged down in HM by lower Instruction and Fluency scores (IS=3.17, FS=3.00, yielding HM=2.16). Under an arithmetic mean, the same data would give (2.36+3.17+3.00)/3 = 2.84—a substantially more favourable picture. The paper's use of HM means that its conclusions about activation-based method degradation are more conservative and more practically meaningful than they would be under a more forgiving aggregation. This is the right choice for a benchmark designed to assess deployability, but it is important to recognise that it reflects an evaluation philosophy, not a neutral measurement. </output>

5. Experimental Analysis

Evaluation Methodology

Dataset. SteerEval, a hierarchically structured benchmark containing 7,560 core samples across three behavioral domains (Language Features, Personality, Sentiment), each organised into three granularity levels (L1, L2, L3) with 8 independent concepts per level (Section 3.5). Each concept contains 70 training, 30 test, and 5 validation samples, with an additional Reasoning Patterns domain constructed independently (Appendix B). All samples are synthetically generated via an LLM-driven pipeline (Section 3.3) and verified through a two-stage quality assurance process combining automated validation with manual review by professional NLP annotators (Section 3.4). The dataset provides contrastive preference pairs (matching vs. not_matching answers) for each question, enabling both evaluation and training of activation-based steering methods.
Base model(s). Three instruction-tuned models of comparable scale across different model families: Gemma-2-9B-Instruct (Team, 2024a; 9B parameters), Qwen-2.5-7B-Instruct (Team, 2024c; 7B parameters), and Llama-3.1-8B-Instruct (Team, 2024b; 8B parameters). The paper states these models are evaluated because they represent diverse architectures from different organisations at similar parameter counts, enabling cross-family comparison while controlling for model scale. The models span the 7–9B parameter range, which the authors implicitly position as representative of contemporary deployable LLMs.
Metrics. Three dimensions are scored on a 0–4 integer scale using gpt-4.1-mini as an LLM judge (Section 4.1): Concept Score (CS) measures how accurately the output conveys the intended steering concept (Appendix E.1); Instruction Score (IS) measures how well the output follows the original question (Appendix E.2); Fluency Score (FS) measures linguistic quality, coherence, and readability (Appendix E.3). The primary aggregate metric is the Harmonic Mean (HM), computed as HM = 3 / (1/CS + 1/IS + 1/FS), which is chosen explicitly to "downweight low performance in any single dimension" (Section 4.1)—a method that achieves high concept expression at the cost of fluency or instruction following is penalised because the HM is dominated by the smallest value. All metrics are reported on a 0–4 scale, with higher values indicating better performance.
Baselines. Six conditions are evaluated per model: Vanilla (unsteered baseline, no intervention applied—M(x)); Prompt (0-shot) (Wu et al., 2025b), where a natural language description of the target concept p_g is prepended to the input (M(p_g ∥ x)); Prompt (3-shot), where three randomly sampled preference pairs from the training set are provided as in-context demonstrations in addition to the concept description; PCA, a training-free activation-based method that extracts a steering direction as the first principal component of the difference between matching and not_matching hidden states; DiffMean (Marks and Tegmark, 2023), a training-free activation-based method that computes the steering vector as v_g = h̄_matching - h̄_not_matching; and RePS (Wu et al., 2025c), a training-based activation-based method that learns a steering vector through a preference-style optimisation objective on the training preference pairs.
Generation budget / compute accounting. All experiments use open-ended generation with no explicit constraint on the number of generated tokens per output. Activation-based methods (PCA, DiffMean, RePS) apply steering at a single mid-to-late layer: layer 20 for Gemma-2-9B-Instruct, layer 14 for Qwen-2.5-7B-Instruct, and layer 12 for Llama-3.1-8B-Instruct (Appendix B), with steering factors searched per-concept on the validation set (5 samples) to maximise Harmonic Mean. Prompt-based methods have no additional compute cost beyond standard autoregressive generation. All experiments are conducted using three NVIDIA A800 GPUs over one week (Appendix B). The paper does not report token counts, FLOPs, or wall-clock time per method—the only "compute" metric is the steering factor search budget on the validation set for activation-based methods.
Cross-validation / statistical protocol. For activation-based methods, the steering factor α is searched on the 5 validation samples per concept to find the optimal value, then applied to the 30 test samples for final evaluation (Section 4.1). No cross-validation across concepts or folds is reported—each concept is evaluated independently with a fixed train/validation/test split. Prompt-based methods (0-shot and 3-shot) do not use the validation split and are evaluated directly on the test set. The paper does not report confidence intervals, standard deviations, or statistical significance tests for any metric.

Main Quantitative Results

Overall Comparison: Prompt-Based vs. Activation-Based Steering

The headline finding from Table 2 is that prompt-based steering outperforms activation-based steering overall across all three models. Computing the Harmonic Mean averaged over all domains and all levels, the paper reports that on Gemma-2-9B-Instruct, Prompt (0-shot) achieves HM = 3.10 and Prompt (3-shot) achieves HM = 3.12, substantially higher than activation-based methods (PCA: 1.11, DiffMean: 1.98, RePS: 2.56) and the Vanilla baseline (0.81). Consistent patterns are observed on Qwen-2.5-7B-Instruct and Llama-3.1-8B-Instruct. Within activation-based methods, RePS—which directly trains a steering vector from preference data—is consistently stronger than the training-free baselines PCA and DiffMean, but still trails all prompt-based methods overall.

However, this aggregated comparison obscures the granularity-dependent patterns that are the paper's central contribution. When results are disaggregated by level, a more nuanced picture emerges.

Level-Wise Analysis: The Granularity Degradation Pattern

The most empirically significant finding in the paper is the systematic degradation of activation-based steering as specification granularity increases from L1 to L3, while prompt-based steering remains stable across all levels. Using Gemma-2-9B-Instruct as the representative case (Section 4.2, level-wise analysis), the Harmonic Mean for activation-based methods drops sharply:

PCA: HM drops from 1.67 at L1 to 1.51 at L2 to 0.05 at L3.
DiffMean: HM drops from 2.76 at L1 to 2.78 at L2 to 0.07 at L3.
RePS: HM drops from 2.94 at L1 to 2.16 (Language Features L2, Table 7) / 3.48 (Personality L2, Table 8) / 2.53 (Sentiment L2, Table 10) to 1.72 (averaged across domains at L3; from Tables 7–10, the domain-specific L3 HM values are 2.00 for Language Features, 2.12 for Personality, and 1.64 for Sentiment, producing an approximate average of 1.92—the paper reports a slightly different averaged value, likely due to weighting or the specific domains included in the average).

The degradation is most dramatic at L3, where PCA and DiffMean essentially collapse to the Vanilla baseline (HM of 0.05–0.07 vs. Vanilla HM of 0.06–0.15 across domains), indicating that these training-free methods cannot enforce token-level constraints at all. RePS retains some capability at L3 (HM ranging from 1.11 to 2.12 depending on domain and model) but is substantially below its L1 performance.

In contrast, prompt-based steering shows remarkable stability: on Gemma-2-9B-Instruct, Prompt (3-shot) achieves HM around 3.0 across all three levels (L1: 2.60–3.35 depending on domain; L2: 3.14–3.34; L3: 3.19–3.54; see Tables 7–10 for domain-specific values). The paper explicitly notes this pattern: "prompt-based steering is strong and stable across all levels, with HM staying around 3.0 from L1 to L3" (Section 4.2).

Notably, the paper reports that "activation-based methods can match or even outperform prompting at the coarsest level (L1), contrasting with prior findings" (Section 4.2, citing Wang et al., 2025). For example, RePS on Gemma-2-9B-Instruct achieves HM = 3.04 for Personality L1 (Table 8), competitive with Prompt (3-shot) at HM = 3.10. This finding is significant because it contextualises prior work that found activation-based methods to be strong—those studies were likely evaluating at coarse granularity levels. The degradation emerges only at finer levels, which prior benchmarks did not systematically test.

The same granularity-dependent degradation pattern is replicated across all three models. For Qwen-2.5-7B-Instruct (Tables 7–10): RePS HM drops from 2.90 at Language Features L1 to 2.60 at L2 to 1.22 at L3; from 2.70 at Personality L1 to 3.16 at L2 to 0.71 at L3; from 2.76 at Sentiment L1 to 2.46 at L2 to 1.11 at L3. For Llama-3.1-8B-Instruct: RePS HM drops from 2.85 at Language Features L1 to 2.33 at L2 to 1.37 at L3; from 2.97 at Personality L1 to 3.29 at L2 to 0.86 at L3; from 2.78 at Sentiment L1 to 2.73 at L2 to 0.78 at L3. The cross-model replication strengthens the claim that this is a fundamental property of activation-based steering rather than a model-specific artifact.

A critical interpretive point: the L2 results for RePS in the Personality domain (HM = 3.48 on Gemma-2-9B-Instruct, 3.16 on Qwen-2.5-7B-Instruct, 3.29 on Llama-3.1-8B-Instruct) actually exceed L1 performance for the same method. This non-monotonic pattern—where L2 is easier than L1 for some domain-method combinations—is visible across several cells in Tables 7–10 and suggests that the relationship between granularity and steering difficulty is not strictly monotonic. For Personality, specifying how to express autonomy (L2: "through self-directed choice") may actually provide more structured guidance to activation-based methods than the abstract L1 target ("express autonomy"), even though L2 is nominally more constrained. This nuance complicates the simple "finer is harder" narrative and suggests domain-specific interactions between concept type and steering mechanism that are not fully explained by the Marr-inspired hierarchy alone.

Domain-Wise Analysis: Personality vs. Sentiment vs. Language Features

The paper reports domain-dependent performance patterns for activation-based steering, while prompt-based steering remains domain-invariant. Computing the level-averaged HM for RePS across the three models (Section 4.2, domain-wise analysis):

"averaged over the three models, it attains the highest HM on personality at approximately 2.43, followed by sentiment at approximately 2.37, and language features at approximately 2.25"

These differences are modest—the range between highest and lowest domain is only ~0.18 HM points—but the paper presents them as supporting the theoretical framing: "these trends support our hypothesis that personality, sentiment, and language features in our benchmark can be interpreted through Marr’s three levels of analysis: different domains impose different steering demands, and activation-based interventions transfer less uniformly across domains than prompting" (Section 4.2).

The detailed results in Tables 7–10 provide a more granular view. For prompt-based methods, the inter-domain variation is negligible—Prompt (3-shot) on Gemma-2-9B-Instruct achieves HM of approximately 3.10–3.20 across all four domains (including Reasoning Patterns) when averaged across levels. For activation-based methods, the domain ordering is not strictly consistent across all three models. RePS on Gemma-2-9B-Instruct achieves its highest domain-averaged HM on Personality (2.88), then Sentiment (2.46), then Language Features (2.33); on Qwen-2.5-7B-Instruct, the ordering is Personality (2.19), Language Features (1.57), Sentiment (1.44); on Llama-3.1-8B-Instruct, it is Personality (2.37), Sentiment (2.16), Language Features (2.18). The pattern is noisy, and the paper's claim that Personality is consistently easier than Language Features holds for two of three models (Gemma and Qwen) but not clearly for Llama-3.1-8B-Instruct, where the two domains are nearly tied.

The domain ordering is theoretically motivated by the Marr hierarchy: Personality occupies the highest, most abstract level (enduring dispositional priors), Sentiment occupies an intermediate level (context-dependent affective tendencies), and Language Features occupy the lowest level (surface realizations). If activation-based steering operates more effectively on abstract, linearly separable concepts, Personality should be the easiest domain and Language Features the hardest. The results partially support this—Personality is indeed the highest-scoring domain for RePS averaged across models—but the effect is small relative to the granularity-level effect, and the cross-model inconsistency weakens the theoretical interpretation. A stronger test of the domain hierarchy hypothesis would require controlling for concept difficulty within each level (comparing L1 Personality vs. L1 Language Features, which are both coarse-grained but differ in domain abstraction), but the paper's aggregate domain analysis confounds granularity and domain effects.

Integration of Concept, Instruction, and Fluency Scores

The full breakdown in Tables 7–10 reveals that the HM degradation of activation-based methods at finer granularities is driven primarily by Concept Score collapse, not by Instruction or Fluency degradation. For PCA and DiffMean at L3, both Instruction Score and Fluency Score remain high (typically 3.5–4.0) while Concept Score approaches zero (0.00–0.14). This means these methods are producing fluent, instruction-following outputs that simply fail to incorporate the target concept—the steering vector is not successfully modifying the output distribution in the intended direction.

For RePS at L3, the picture is different: Concept Scores are non-zero but modest (e.g., 2.34 for Personality L3 on Gemma-2-9B-Instruct in Table 8, corresponding to HM = 2.12), while Instruction Scores drop noticeably (e.g., 3.50 for the same cell, compared to 3.99 for the unsteered baseline). This suggests RePS achieves some concept enforcement at L3 but at the cost of instruction following—the steering intervention is strong enough to push the output toward the target concept, but the resulting outputs partially sacrifice responsiveness to the original question. This trade-off between concept expression and instruction following is precisely what the HM is designed to penalise, and it explains why RePS's HM at L3 (1.64–2.12 depending on domain and model) is substantially lower than its Concept Score alone (1.65–2.34) would suggest.

Reasoning Patterns Domain Results

The supplementary Reasoning Patterns domain (Table 9) shows generally lower performance across all methods compared to the three core domains. On Gemma-2-9B-Instruct, Prompt (3-shot) achieves HM of 3.60 at L1, 3.34 at L2, and 3.54 at L3—modestly higher than the core domains but with more inter-level variation. The activation-based methods show the same L1→L3 degradation pattern (RePS HM: 2.69 at L1, 1.90 at L2, 1.13 at L3), confirming that the granularity effect generalises beyond the three core behavioral domains to a reasoning-focused domain. However, the absolute performance of activation-based methods is lower in this domain—RePS achieves HM of only 1.13 at L3, compared to 1.64–2.12 in the core domains—suggesting that reasoning-related concepts may be harder to steer than personality, sentiment, or language features, consistent with the intuition that reasoning patterns are more deeply embedded in the model's computational structure and less amenable to surface-level vector interventions.

Ablation Studies and Robustness Checks

Few-shot scaling with in-context demonstrations (Section 5.1, Figure 5a). The paper studies how the number of in-context shots affects prompt-based steering from 0-shot to 16-shot for representative concept-domain pairs. For L1 and L2 targets, a few demonstrations (typically 1–4) yield most of the gains, with performance saturating thereafter—consistent with the standard few-shot prompting literature where demonstrations help the model "infer the intended task and disambiguate underspecified instructions" (Section 5.1, citing Brown et al., 2020; Min et al., 2022). For L3 targets, adding more shots is "typically less helpful and can even hurt" (Section 5.1), with the paper hypothesising that "extra examples introduce idiosyncratic surface cues that increase shortcut matching or interfere with already-tight constraints." This is a non-obvious finding: it suggests that the very demonstrations that help at coarse levels can be counterproductive at fine levels, possibly because the model over-generalises from specific surface patterns in the demonstrations rather than learning the abstract constraint. The coarse-to-fine difference in few-shot scaling is presented as "broadly compatible with hierarchical accounts of cognition" (Section 5.1).

Steering strength analysis (Section 5.2, Figure 5b). The paper sweeps the steering factor α for RePS and DiffMean on Qwen-2.5-7B-Instruct across L1–L3 concepts in both Language Features and Personality. The overall finding is that "increasing the steering factor tends to improve Concept Score, but beyond a certain range it can noticeably reduce Instruction following and Fluency, leading to a peak in Harmonic Mean at moderate strengths" (Section 5.2). This reflects a trade-off between concept enforcement and general capability retention, consistent with prior work (Tigges et al., 2023; Zou et al., 2023; Durmus et al., 2024; Taimeskhanov et al., 2026). Critically, the paper observes that "the effect is clearest for L1"—coarse-grained targets show clean steering-factor-response curves where increasing α monotonically improves concept expression (until capability degradation sets in), while for L2 and L3, "trends are less consistent and gains are smaller, indicating that the activation-based methods we evaluate do not reliably deliver fine-grained control under stronger specification constraints" (Section 5.2). This is an important mechanistic finding: it rules out the hypothesis that activation-based methods fail at L3 simply because the steering factor was too weak. Even when the steering strength is increased, fine-grained constraint enforcement does not materialise, suggesting the limitation is in the steering direction itself rather than its magnitude.

Scaling with the steering factor at different granularity levels. The detailed steering factor values reported in Tables 3–6 of Appendix B reveal a pattern that the main text does not explicitly discuss but that is highly informative. For PCA and DiffMean at L3 concepts, the selected steering factors are overwhelmingly 1 (the minimum value) across all three models and all four domains. For example, in Table 3 (Language Features), the PCA steering factor for L3 concepts is 1 for all 8 concepts on all 3 models, with a single exception (L3_4 on Gemma-2-9B-Instruct uses α=5; L3_7 uses α=5). DiffMean L3 concepts similarly use α=1 nearly universally across all models and domains. This suggests that the validation-set search found that any non-minimal steering factor degraded performance—the optimal strategy for these methods at L3 is essentially to not steer at all, or to steer so minimally that the effect is negligible. This finding is even stronger evidence of activation-based steering's failure at fine granularity than the HM scores alone: the methods cannot find a positive steering factor that improves over the unsteered baseline, and the "optimal" configuration is essentially equivalent to no intervention.

For RePS, the L3 steering factors are more varied (ranging from 1 to 24 across concepts) and are often substantially higher than those for PCA and DiffMean at the same level—for example, RePS L3_1 in Language Features on Gemma-2-9B-Instruct uses α=22 (Table 3), while PCA and DiffMean both use α=1. This indicates that RePS's training-based extraction produces steering vectors that retain some fine-grained information (allowing non-trivial steering factors to be beneficial), but the resulting concept scores at L3 remain modest (1.65–2.34 across domains for Gemma-2-9B-Instruct, from Tables 7, 8, 10), and instruction/fluency trade-offs limit the HM. The quantitative gap between the validation-set-optimal steering factor (up to 24) and the modest L3 HM (1.64–2.12) underscores that stronger steering can push outputs toward the concept but cannot do so without collateral damage to other quality dimensions.

Layer selection (Appendix B). The paper applies steering at fixed layers for each model (layer 20 for Gemma-2-9B-Instruct, layer 14 for Qwen-2.5-7B-Instruct, layer 12 for Llama-3.1-8B-Instruct) following prior work, without sweeping alternative layers. The benchmarking variance does not report how performance varies with layer choice. Given that prior work has found significant layer-specific effects in activation steering (Rimsky et al., 2024), the fixed-layer protocol likely underestimates the best-case performance of activation-based methods—a method might achieve better L3 results at a different layer for specific concepts. However, the paper's claim is about the methods as typically deployed (with mid-to-late layer selection), not about their optimal-conceivable performance, so this is a conservative evaluation choice that strengthens the practical relevance of the findings even if it leaves open the theoretical possibility that layer optimisation could help.

Per-concept evaluation granularity. The paper reports results averaged across the 8 concepts per level and domain (e.g., Table 2 reports a single HM value for "L1 Language Features" on Gemma-2-9B-Instruct with Prompt 0-shot). The within-level variance across the 8 concepts is not reported. This is a limitation: if some L3 concepts are substantially harder than others (e.g., including a specific punctuation mark vs. including a common word), the average may obscure important within-level heterogeneity. The steering factor tables (Tables 3–6) provide per-concept steering factors, which show some variation (e.g., RePS L3 concepts in Table 3 range from α=1 to α=22), but this is a hyperparameter selection artifact rather than a measure of concept difficulty variance. Concept-level HM breakdowns are not provided.

Domain Transferability. The paper does not test whether steering vectors trained on one domain transfer to another (e.g., whether a Personality steering vector affects Sentiment outputs). This cross-domain transfer analysis would have tested the paper's theoretical claim that domains occupy different depths in the representational hierarchy—if Personality and Language Features truly occupy different Marr levels, vectors trained on one should not transfer cleanly to the other. The absence of this analysis is a gap in the experimental validation of the Marr-inspired theoretical framework.

Multi-concept composition. All experiments test single-concept control only—steering the model toward one target (e.g., "express autonomy") at a time. The paper does not test composition of multiple concepts (e.g., "express autonomy AND high enthusiasm"), which is acknowledged as a limitation. Composition is practically important—real-world deployment often requires simultaneous control over multiple behavioral dimensions—and theoretically interesting, as it would test whether steering vectors for different concepts interfere additively or nonlinearly.

Critical Assessment

The experiments provide strong support for SteerEval's core empirical claim: activation-based steering methods degrade systematically as specification granularity increases from L1 to L3, while prompt-based methods remain stable. This finding is replicated across three model families (Table 2, Tables 7–10), four domains (the three core domains plus Reasoning Patterns), and three activation-based method types (PCA, DiffMean, RePS), making it the most robust result in the paper. The grain of the evidence is fine enough to distinguish between different degradation patterns—PCA and DiffMean collapse entirely at L3 (HM ≈ 0.05–0.07, indistinguishable from the Vanilla baseline), while RePS retains partial capability (HM ≈ 1.11–2.12 depending on domain and model) but at the cost of instruction following and fluency trade-offs. The steering factor analysis (Figure 5b, Tables 3–6) provides mechanistic evidence that the L3 failure is not due to insufficient steering strength but to a fundamental limitation in what the steering vectors encode.

However, the paper makes stronger claims that extend beyond this core finding, and the experimental support for these additional claims is more qualified:

Claim: The hierarchy maps onto Marr's three levels and provides a theory of why steering degrades. The paper presents the L1→L2→L3 hierarchy as grounded in Marr's levels, and the domain ordering (Personality > Sentiment > Language Features) as reflecting a representational hierarchy. The evidence for the Marr mapping is primarily structural (the three-level design was inspired by Marr) and correlational (the degradation pattern is consistent with a hierarchical representational geometry). What is missing is direct evidence that the degradation occurs because of hierarchical organisation rather than for other reasons—for example, because L3 concepts are simply rarer in training data, because token-level constraints require more precise output control regardless of representational geometry, or because the L3 constraints used in the benchmark happen to be harder for incidental reasons. The domain ordering evidence is weak (RePS HM: Personality 2.43 vs. Language Features 2.25, a difference of only ~0.18 HM points, with inconsistent ordering across models). A stronger test would be: if the Marr hierarchy is correct, then models with more hierarchically organised representations (perhaps larger models, or models trained with different objectives) should show different degradation patterns. No such cross-model representational analysis is performed.

Claim: The benchmark enables systematic comparison between prompt-based and activation-based methods. This claim is well-supported by the standardised evaluation protocol—the same metrics, the same test questions, the same scoring procedure applied across all methods. However, the comparison is not fully fair in one important respect: prompt-based methods are given the concept description as input, which provides explicit natural language specification of the target, while activation-based methods must infer the target from preference pairs in the training data. This is an inherent difference between the two paradigms, not an evaluation artifact, but it means the benchmark is testing something slightly different for each method family. Prompt-based methods are tested on their ability to follow explicit instructions about the target concept; activation-based methods are tested on their ability to extract and apply a concept from examples. The finding that prompt-based methods outperform activation-based methods may partly reflect this asymmetry in the information provided at test time, not just a difference in steering mechanism effectiveness.

Missing baselines. The paper does not include several natural comparison points: (1) Prompt + activation steering combined—since prompt-based methods are strong at L3 and activation-based methods can match prompting at L1, combining them (e.g., using activation steering on top of a prompted model) might yield better results than either alone; (2) Fine-tuning baselines—parameter-efficient fine-tuning (LoRA, prompt tuning) on the training preference data would provide an upper bound on what can be achieved by modifying the model rather than intervening at inference time; (3) Larger-scale prompt-based methods—the paper tests only 0-shot and 3-shot prompting, but more sophisticated prompting strategies (chain-of-thought, self-consistency, instruction decomposition) might further improve L3 performance; (4) Other activation-based methods—the paper tests PCA, DiffMean, and RePS but not CAA (Rimsky et al., 2024), ActAdd (Turner et al., 2023), or other recent methods in the rapidly evolving activation steering literature.

Test set size and statistical reliability. Each concept is evaluated on 30 test samples (Section 3.5), and results are reported as averages across 8 concepts per level and domain, yielding 240 test samples per cell in Table 2. This is a modest sample size—240 evaluations per data point, with each evaluation being an LLM-judge score on a 0–4 scale. The paper does not report confidence intervals, standard deviations, or statistical significance tests. This makes it difficult to assess whether small differences (e.g., the 0.18 HM gap between Personality and Language Features for RePS) are statistically reliable or within the noise floor of the evaluation protocol. Given that gpt-4.1-mini scoring introduces its own variance (the paper acknowledges judge bias as a limitation), the absence of statistical reporting weakens the quantitative precision of the claims.

LLM-as-judge reliability for fine-grained concepts. The paper uses gpt-4.1-mini to score concept expression, instruction following, and fluency. For L3 concepts, where the target is a specific token (e.g., "includes hooray" or "includes (i.e.,"), an automated regex check would be more reliable than an LLM judge—if the concept is "the output contains the word hooray," checking for the substring "hooray" is deterministic, while an LLM judge might miss it or hallucinate its presence. The paper does not report whether the LLM judge's L3 concept scores correlate with simple regex-based verification, which would be a straightforward sanity check. For L1 and L2 concepts, where the target is semantic (e.g., "express autonomy" or "use self-directed choice"), an LLM judge is appropriate but should ideally be calibrated against human judgments—no such calibration is reported.

Domain and concept coverage. The benchmark covers three behavioral domains with 8 concepts per level per domain. This is a reasonable starting point but is far from comprehensive. The concept set is synthetic—generated by an LLM and verified by annotators—rather than drawn from real-world deployment requirements. It is unclear whether the specific concepts tested (autonomy, redundancy, enthusiasm, etc.) are representative of the kinds of behavioral targets practitioners actually care about. More critically, the paper does not report what fraction of the LLM-generated concepts were rejected during the quality assurance process, which would provide insight into the pipeline's reliability and the difficulty of generating valid hierarchical concepts automatically.

Generalisation beyond the tested models. All three models are instruction-tuned models in the 7–9B parameter range. The paper does not test base (non-instruction-tuned) models, larger models, or models from different architectural families (e.g., non-transformer architectures). Instruction tuning may affect both prompt-based steering (instruction-tuned models are better at following explicit instructions) and activation-based steering (instruction tuning may reorganise the model's representational geometry). The finding that prompting strongly outperforms activation-based methods may partly reflect the instruction-tuned nature of the tested models—base models might show different patterns, potentially with a smaller gap between prompting and activation steering.

Single-concept, single-turn evaluation. All experiments test steering a single concept on a single-turn prompt. The paper does not evaluate whether steering persists across multiple turns of a conversation, whether steering one concept affects others (concept interference), or whether steering can be dynamically adjusted during a generation. These are acknowledged as limitations but substantially restrict the practical applicability of the findings. A chatbot that expresses autonomy on the first turn but reverts to its default personality on the second turn is not effectively "controlled" in any deployment-relevant sense, but the benchmark cannot detect this failure mode.

The Harmonic Mean as an evaluation construct. The paper's use of the Harmonic Mean is theoretically well-motivated (it penalises single-dimensional failures) and appropriate for the steering trade-off the paper identifies. However, the specific choice of HM—and particularly its sensitivity to scores near zero—has outsized effects on the reported results. When Concept Scores approach zero at L3 for PCA and DiffMean, the HM approaches zero regardless of Instruction and Fluency scores (which remain near 4.0). An evaluator using arithmetic mean would report these methods as still having moderate overall quality (due to high IS and FS), while the HM reports them as near-total failures. This is the correct choice for a benchmark assessing steering adequacy, but it means the paper's quantitative conclusions about the magnitude of activation-based method degradation are partly a function of the aggregation metric, not just the underlying scores. A reader interested in a specific deployment scenario with different trade-off priorities might reach different conclusions from the same per-dimension data (available in Tables 7–10).

In summary, the experiments provide robust evidence for the paper's central descriptive finding—that activation-based steering degrades with granularity while prompt-based steering does not—but weaker evidence for the paper's theoretical explanation of why this degradation occurs. The Marr-inspired hierarchy is a productive organising framework, but the experiments do not directly test the hierarchical representational hypothesis against alternative explanations. The benchmark's practical utility for comparing steering methods is genuine, but tempered by the specific evaluation choices (single-concept, single-turn, fixed-layer, LLM-as-judge) and the absence of effect sizes and statistical tests. The strongest contribution is diagnostic: the paper demonstrates that granularity is a dimension along which steering methods systematically differ, and that evaluation frameworks ignoring this dimension produce an incomplete and potentially misleading picture of method effectiveness.

6. Limitations and Trade-offs

Limitation 1: Difficulty Estimation Cost Is Unaccounted for and Potentially Dominates the Inference Budget

The assumption or constraint. The entire compute-optimal framework in SteerEval rests on the assumption that concept granularity levels (L1, L2, L3) are predefined in the benchmark and known at evaluation time. In a real deployment, a practitioner would need to determine what level of specificity they require—and, critically, whether their chosen steering method can reliably deliver control at that level—before committing to a particular intervention strategy. The paper does not model this decision cost in any metric. More importantly, for activation-based methods, the paper assumes access to concept-specific preference pairs for training (70 training samples per concept, Section 3.5) and a validation set for steering factor optimisation (5 samples per concept). In a production setting, obtaining these requires generating and annotating contrastive preference data for every target concept an organisation wants to control—a cost that scales linearly with the number of concepts and is not included in any of the paper's efficiency calculations.

The consequence. The reported performance of activation-based methods—particularly RePS, which achieves competitive HM at L1 (2.94–3.04 across domains on Gemma-2-9B-Instruct, Table 2)—is conditional on having already curated concept-specific preference data. The paper's dataset provides this for free, but a deployer would need to replicate the entire synthesis-and-validation pipeline (Section 3.3, Section 3.4) for each new concept they want to steer. For L3 concepts, where the paper shows activation-based methods largely fail (HM ≈ 0.05–0.07 for PCA and DiffMean, ≈ 1.11–2.12 for RePS, Table 2), the cost of data creation is effectively wasted—the methods cannot deliver fine-grained control regardless of how much training data is provided. The benchmark evaluates methods given gold-standard concept data, not the end-to-end pipeline of concept specification, data creation, method training, and deployment, which is what practitioners actually face.

What evidence exists in the paper. The paper partially acknowledges this in its Limitations section: "Coverage of concepts and domains... the pipeline is extensible, we do not cover multi-turn dialogue, tool use, long-context interaction, or safety-critical domains; extending to these settings is left to future work." However, this frames the limitation as one of scope expansion rather than cost. The paper does not report how much compute or human annotation effort was required to produce the 7,560 core samples (Sections 3.3–3.5), nor does it break down the cost per concept of the two-stage quality assurance process (Section 3.4: automated validation + manual review by professional NLP annotators with dual independent verification). The steering factor search reported in Tables 3–6 of Appendix B implicitly requires evaluating multiple α values on the validation set per concept, but this cost is not quantified in GPU-hours, FLOPs, or wall-clock time per concept.

Mitigation status. Not addressed. The paper provides no method for estimating which granularity level a given concept target falls into without constructing a full hierarchical benchmark, no method for predicting whether activation-based steering will work on a novel concept, and no amortisation strategy that reduces the per-concept cost of data creation. Future work would need to address: (1) lightweight difficulty or granularity estimation that does not require full benchmark construction, (2) few-shot or zero-shot concept specification methods that reduce the preference-data requirement for activation-based methods, and (3) cost-benefit models that help practitioners decide when the overhead of activation-based steering is justified relative to the simpler prompt-based alternative.

Limitation 2: Single Benchmark, Single Model Scale, Single Interaction Mode

The assumption or constraint. All experiments are conducted on SteerEval—a single, synthetically generated benchmark with 7,560 samples covering three behavioral domains (Section 3.5)—using three instruction-tuned models in the 7–9B parameter range (Gemma-2-9B-Instruct, Qwen-2.5-7B-Instruct, Llama-3.1-8B-Instruct; Section 4.1). The paper explicitly acknowledges: "We study single-turn prompts and single-concept control. We do not test multi-turn dialogue, composition of multiple concepts, or sequential/iterative steering, which are common in real use" (Limitations section). The concept vocabulary is itself model-generated—the hierarchical concepts are synthesised by an LLM in the pipeline (Section 3.3, Stage 1) and verified by human annotators (Section 3.4), but they are not drawn from real-world deployment requirements, regulatory specifications, or user studies.

The consequence. The paper's central finding—that activation-based steering degrades at finer granularities while prompt-based steering remains stable (Section 4.2, Tables 7–10)—may be specific to the tested model scale and interaction paradigm. Several failure modes are possible in regimes not tested: (1) Larger models: the representational geometry that makes abstract concepts linearly separable at L1 might change with model scale—larger models might exhibit better (or worse) linear separability of fine-grained concepts, altering the L1→L3 degradation pattern. (2) Base (non-instruction-tuned) models: instruction tuning may differentially benefit prompt-based methods (by making models better at following explicit instructions) relative to activation-based methods, inflating the performance gap. A base model might show a smaller gap between prompting and activation steering, or even the reverse pattern. (3) Multi-turn dialogue: the paper does not test whether steering persists across conversation turns—a method that achieves strong concept expression on turn 1 might revert to default behavior on turn 2. The L3 token-level constraints are particularly vulnerable to this; a model forced to include "hooray" in one response has no mechanism to ensure consistent fine-grained control across multiple turns. (4) Multi-concept composition: real deployments often require simultaneous control over multiple behavioral dimensions (e.g., express autonomy AND maintain positive sentiment AND use company-approved terminology). The benchmark tests only single-concept control—the interference patterns between multiple concurrent steering targets are entirely unexplored.

What evidence exists in the paper. The cross-model replication (three models, Table 2) provides some evidence that the L1→L3 degradation pattern is not model-specific within the 7–9B instruction-tuned range. However, this is a narrow slice of the model space. The paper additionally reports results on a supplementary Reasoning Patterns domain (Table 9), which shows the same degradation pattern, providing some evidence of cross-domain generalisation within the benchmark. But neither of these replications addresses the fundamental question: do these findings transfer to models of different scales, training paradigms, or interaction modes? The paper's Limitations section transparently lists "Coverage of concepts and domains... extending to these settings is left to future work" and "We study single-turn prompts and single-concept control."

Mitigation status. Not addressed experimentally. The paper does not test larger models (13B, 70B, or larger), base models, multi-turn dialogue, or multi-concept composition. These are explicitly deferred to future work. A practitioner deploying steering in a multi-turn, multi-concept production setting with a differently-scaled model would need to replicate the benchmark construction and evaluation for their specific regime. The paper provides the pipeline (Section 3.3) and evaluation protocol (Section 4.1) as a template, but no evidence that the findings transfer.

Limitation 3: LLM-as-Judge Evaluation Is Uncalibrated for Fine-Grained Constraints

The assumption or constraint. All evaluation is conducted using gpt-4.1-mini as an automated judge scoring outputs on three 0–4 scales: Concept Score, Instruction Score, and Fluency Score (Section 4.1, Appendices E.1–E.3). The paper states: "Scores should be read as approximate signals rather than definitive ground truth" (Limitations section), and acknowledges that "Such judges can be biased and sensitive to prompting, and may over/under-credit fine-grained compliance" (Limitations section). For L3 concepts, where the target is a directly checkable surface token or pattern (e.g., "includes hooray," "includes (i.e.,"; Section 3.2, Figure 2), an LLM judge introduces unnecessary noise when deterministic string matching would be both simpler and perfectly accurate. For L1 and L2 concepts, where the target is semantic (e.g., "express autonomy" or "use celebratory emphasis"), an LLM judge is more appropriate but is not calibrated against human judgments anywhere in the paper.

The consequence. This creates three distinct reliability concerns. First, L3 measurement noise: the paper's LLM judge might assign a Concept Score of 0 to an output that actually contains the required L3 token (a false negative, deflating reported performance) or assign a positive score to an output that does not (a false positive, inflating reported performance). Since the L3 Concept Scores for activation-based methods are near zero (0.00–0.14 for PCA and DiffMean, Table 2; 0.00 for Vanilla across multiple domains in Tables 7–10), even a small rate of false negatives could misrepresent the methods as completely failing when they might achieve non-zero (but still low) compliance. Second, unmeasured judge-model interaction: the gpt-4.1-mini judge may exhibit systematic biases that correlate with the steering method or concept type—for example, it might be more lenient toward prompt-based outputs (which tend to be more natural because they're generated from natural language instructions) and harsher toward activation-steered outputs (which may exhibit subtle fluency degradation that triggers the judge's quality filters). Third, absence of human calibration: without human evaluation on a subset of the test data, there is no ground truth for the judge's scores. The paper reports no inter-annotator agreement between the LLM judge and human annotators, no correlation between LLM-judge and regex-based verification for L3 concepts, and no analysis of judge score variance across multiple evaluation runs.

What evidence exists in the paper. Table 2 and Tables 7–10 report all scores, but there is no accompanying analysis of judge reliability. The L3 Concept Scores of exactly 0.00 for Vanilla baselines across multiple domains (e.g., Table 10: Vanilla Sentiment L3 CS = 0.00 on all three models) are suspiciously clean—it is unlikely that an unsteered model never accidentally produces the target token in 30 test samples, suggesting that either the judge is applying a strict interpretation of token-in-context (requiring not just presence but appropriate usage) or the L3 tokens are genuinely absent from the base model's output distribution for these prompts. The paper does not investigate this. The Fluency Scores are consistently high (3.0–4.0) across all methods and levels (Tables 7–10), including for activation-based methods at L3 where Concept Scores are near zero—this ceiling effect means Fluency Score provides almost no discriminative power between methods, serving primarily to penalise the small subset of outputs that are genuinely garbled.

Mitigation status. The paper acknowledges LLM-judge limitations (Limitations section) but does not attempt to mitigate them: no human calibration study, no regex verification for L3 concepts, no multi-judge ensemble, and no consistency analysis. For future work, a minimal improvement would be to add deterministic metrics for L3 concepts (substring matching or pattern matching) alongside the LLM-judge scores, and to conduct a human evaluation on a random subset of outputs (e.g., 100 samples across methods and levels) to estimate judge reliability and bias. The paper's open-source release under the MIT License (Section 3.4) facilitates such follow-up studies by third parties, but the paper itself provides no reliability estimates.

Limitation 4: The Marr-Inspired Hierarchy Is a Productive Organising Framework but Not Empirically Validated as a Theory of Steering Difficulty

The assumption or constraint. The paper grounds its L1→L2→L3 hierarchy in Marr's three levels of analysis (Marr, 1982) and in theories of hierarchical cognitive control (Botvinick and Braver, 2015; Section 2.3), positing that "behavioral concepts occupy different depths within a model's internal hierarchy" (Section 3.2): Personality at the highest level (enduring dispositional priors), Sentiment at an intermediate level (context-dependent affective tendencies), and Language Features at the lowest level (surface realisations). This claim carries a specific mechanistic prediction: activation-based steering should work better on abstract, high-level concepts because these are more linearly separable in the model's representational space, and worse on concrete, low-level concepts because these require precise coordination across multiple representational dimensions that a single additive steering vector cannot capture.

The consequence. The paper's theoretical contribution—that the Marr hierarchy explains why steering degrades with granularity—is substantially stronger than its descriptive contribution—that steering does degrade. If the hierarchy is merely a useful organising taxonomy (concepts at L3 happen to be harder than concepts at L1, for reasons unrelated to representational geometry), then the paper's practical recommendations (use activation-based methods for coarse control, prompt-based for fine control) stand, but the deeper claim about representational organisation does not. If the hierarchy is indeed grounded in model internals, it generates additional predictions that the paper does not test: (1) models with different representational geometries (e.g., different architectures, different training objectives) should show different L1→L3 degradation patterns; (2) within a single model, the degree of linear separability of a concept (measurable through probing classifiers) should predict its steerability; (3) cross-domain transfer of steering vectors should follow the hierarchy (Personality vectors should transfer within the personality domain but not to Language Features).

What evidence exists in the paper. The paper provides two pieces of evidence for the Marr hierarchy interpretation. First, the systematic L1→L3 degradation for activation-based methods (Tables 7–10) is consistent with a hierarchical representational account—but it is equally consistent with many alternative explanations: L3 concepts are rarer in training data, token-level constraints require more precise output control regardless of geometry, or the specific L3 tokens chosen in the benchmark happen to be hard for incidental reasons. Second, the domain ordering analysis (Section 4.2) reports that RePS averaged across three models achieves HM of ~2.43 on Personality, ~2.37 on Sentiment, and ~2.25 on Language Features—an ordering consistent with the proposed hierarchy. However, this difference is small (~0.18 HM points between highest and lowest domain, Section 4.2) and the ordering is not consistent across models (for Llama-3.1-8B-Instruct, Language Features and Sentiment are nearly tied). A 0.18 HM difference on a 0–4 scale, without reported confidence intervals or statistical tests, is weak positive evidence at best. The paper does not conduct probing experiments, representational similarity analyses, or cross-domain transfer tests that would directly test the hierarchical geometry hypothesis against alternatives.

Mitigation status. Not addressed. The paper presents the Marr hierarchy as a design principle and interpretive framework, not as a hypothesis subjected to direct experimental test. Future work would need to: (1) measure the linear separability of concepts at different granularity levels using probing classifiers trained on model hidden states, (2) correlate separability with steerability across concepts and levels, (3) test whether the hierarchy is consistent across models with different architectures and training paradigms, and (4) conduct cross-domain transfer experiments to verify that concepts at the same Marr level cluster together in representational space while concepts at different levels are geometrically separated. The paper provides the benchmark infrastructure for such studies but does not conduct them.

Limitation 5: Prompt-Based and Activation-Based Methods Are Evaluated Under Asymmetric Information Conditions

The assumption or constraint. The paper's experimental design compares prompt-based methods (which receive an explicit natural language description of the target concept as input) with activation-based methods (which must infer the target concept from training preference pairs and apply it through a learned steering vector). For Prompt (0-shot), the concept prompt p_g is prepended directly to the input (Section 2.1): the model is explicitly told what behavior to exhibit. For Prompt (3-shot), the model additionally receives three in-context examples of matching and not_matching outputs. For activation-based methods (PCA, DiffMean, RePS), the steering vector is extracted from training data and applied silently to hidden states during generation—the model receives no natural language specification of the target concept in its input. The paper acknowledges this asymmetry implicitly by describing both families as valid steering interventions (Section 2.1, Equation 1), but does not control for the difference in information available at inference time.

The consequence. The paper's headline finding—that prompt-based methods outperform activation-based methods overall (Section 4.2)—may partly reflect this information asymmetry rather than a fundamental difference in steering mechanism effectiveness. A prompt-based method that is told "Express autonomy through self-directed choice" has a much easier task than an activation-based method that must infer this target from preference pairs and inject it via a vector. The fact that activation-based methods "can match or even outperform prompting at the coarsest level (L1)" (Section 4.2) is actually more impressive under this lens: RePS achieves competitive L1 performance without explicit natural language specification of the target, suggesting that the learned steering vector successfully captures the concept from examples alone. The degradation at L2 and L3 may reflect the difficulty of inferring fine-grained constraints from preference pairs—not necessarily a limitation of vector-based intervention per se. If activation-based methods were given the same concept description as input (e.g., via a hybrid approach that combines prompting with activation steering), they might achieve better L2/L3 performance. The paper does not test any such hybrid configuration.

What evidence exists in the paper. The paper reports no experiment where activation-based and prompt-based methods receive equivalent target specification. The Steering Task formalisation (Section 2.1) defines the intervention ℐ_g as conditioned on the target concept g, but precisely how g is communicated to the intervention differs by method family: for prompt-based, g is encoded in the natural language prompt p_g; for activation-based, g is encoded in the learned steering vector v_g. These are fundamentally different information channels, and the paper's comparison does not equalise the informativeness of the concept specification across methods. The 3-shot prompting condition provides additional information (in-context examples) beyond the concept description, further widening the information asymmetry relative to activation-based methods that see the same training data but must compress it into a single vector rather than presenting it as explicit tokens at inference time.

Mitigation status. Not addressed. The paper does not test a hybrid condition (prompt + activation steering) that would equalise information access, nor does it provide an ablation where prompt-based methods are restricted to the same information as activation-based methods (e.g., by removing the concept description and relying only on in-context examples). The Limitations section does not flag this asymmetry. For future work, equalising the information available to both method families—either by giving activation-based methods explicit concept descriptions as additional input, or by restricting prompt-based methods to only in-context examples without concept descriptions—would disentangle the effects of steering mechanism from the effects of information completeness, providing a cleaner comparison of the two paradigms.

Limitation 6: The Benchmark Evaluates Single-Step Steering, Not Persistent or Interactive Control

The assumption or constraint. All experiments test steering on single-turn prompts: the model receives one question, the steering intervention is applied, and the output is evaluated (Section 4.1). The paper does not test whether steering effects persist across multiple turns of conversation, whether they can be dynamically toggled on and off, or whether they interfere with subsequent unrelated queries. The paper acknowledges: "We study single-turn prompts and single-concept control. We do not test multi-turn dialogue, composition of multiple concepts, or sequential/iterative steering, which are common in real use" (Limitations section).

The consequence. This single-turn evaluation creates a significant gap between benchmark performance and deployment utility. In a multi-turn conversational setting, several failure modes are plausible but untested: (1) Steering decay: an activation-based steering intervention applied on turn 1 might have diminishing effects on turn 3 or turn 5 as the model's autoregressive generation compounds. (2) Contextual interference: a steered output on turn 1 becomes part of the conversation history on turn 2—if the steering was imperfect (e.g., the model expressed autonomy but awkwardly), the subsequent turns may amplify the degradation. (3) Concept bleed: steering toward one concept (e.g., "express autonomy") might inadvertently affect unrelated behaviors (e.g., making the model less cooperative on a subsequent task that requires deference). (4) Accumulated toxicity: if activation-based steering degrades fluency or instruction following (as it does at L2/L3 for RePS, Tables 7–10), these degradations may compound over multiple turns, producing increasingly incoherent conversation. For prompt-based methods, which modify the input, multi-turn steering would require re-prepending the concept description to every user utterance—a trivial engineering solution but one that changes the interaction paradigm (the user's prompts are always prefixed with steering instructions). For activation-based methods, which modify internal states, the persistence of the intervention across turns depends on the layer at which it is applied and the extent to which hidden states from earlier turns influence later turns through the attention mechanism—neither of which is analysed in the paper.

What evidence exists in the paper. None. The paper includes no multi-turn experiments, no analysis of steering persistence across turns, and no evaluation of concept interference or cumulative quality degradation. The single-turn evaluation protocol (Section 4.1) treats each test question as an independent episode with no carryover between generations.

Mitigation status. The paper acknowledges this limitation (Limitations section) and defers it to future work, but does not suggest specific experimental designs or metrics for multi-turn steering evaluation. A multi-turn extension of SteerEval would need to address: (1) how steering is applied across turns (per-turn reapplication vs. once at conversation start), (2) how to evaluate concept consistency across turns (does the model maintain the target personality/sentiment/style throughout?), (3) how to measure interference between steered behavior and conversational coherence (does the steering make the model a worse conversational partner?), and (4) how to handle concept switching (user wants personality A for this conversation segment and personality B for another). These are non-trivial extensions that would significantly increase the benchmark's practical relevance for dialogue system deployment.

7. Implications and Future Directions

How This Work Changes the Landscape

SteerEval does not introduce a new steering method, nor does it claim that existing methods are uniformly good or bad. Its contribution is diagnostic infrastructure: a principled framework for asking where and at what level of specificity steering methods succeed or fail, rather than whether they succeed in aggregate. This reframes the conversation around LLM controllability from a monolithic question ("can we control this model?") to a granularity-aware question ("at what level of specification can we control this model, and what methods work at each level?"). The shift is from evaluation-as-ranking to evaluation-as-characterisation—SteerEval is designed to expose the boundary conditions of different steering paradigms, not to sort them on a leaderboard.

This reframing resolves a genuine tension in the activation steering literature. Some prior work reports strong concept control via activation-based methods (Rimsky et al., 2024; Turner et al., 2023; Arditi et al., 2025), while other work finds that simple prompting baselines match or exceed them (Wu et al., 2025b). SteerEval's granularity decomposition reveals that both findings can be simultaneously true: activation-based methods do match prompting at coarse specification levels (Table 2: RePS achieves HM=3.04 for Personality L1 on Gemma-2-9B-Instruct, competitive with Prompt 3-shot at HM=3.10), but they systematically degrade at finer levels (RePS HM drops to 2.12 at L3 for the same domain and model). The contradictory findings in prior work were an artifact of testing at different, implicit granularity levels—a variable that no prior benchmark explicitly controlled. By making granularity a first-class dimension of evaluation, SteerEval converts a confusing set of conflicting results into a coherent picture with clear boundary conditions.

The paper's identification of a granularity ceiling for activation-based methods—the finding that these methods "do not reliably deliver fine-grained control under stronger specification constraints" (Section 5.2)—redirects the research agenda for representation engineering. Prior to this work, the activation steering community focused primarily on improving steering strength and reliability: finding better layers, better extraction methods, better scaling factors. The steering factor analysis in Figure 5(b) demonstrates that increasing steering strength does not solve the L3 problem—"trends are less consistent and gains are smaller" at L2/L3 even with stronger interventions. This shifts attention from "how to steer more strongly" to "how to preserve fine-grained constraint information through the steering vector extraction process." The paper's minimal-edit preference pairs (Section 3.3, Stage 3) are a concrete methodological contribution toward answering this question—by isolating concept-bearing differences from spurious lexical correlates, they provide cleaner training data for vector extraction—but the results show that even with clean data, current extraction methods (PCA, DiffMean, RePS) lose fine-grained information. This suggests the need for fundamentally different extraction architectures, perhaps multi-level representations that separately encode coarse and fine concept attributes, or non-linear steering mechanisms that go beyond single-vector addition.

The domain-level findings, while more tentative, open a complementary research direction. The paper's observation that activation-based steering transfers "less uniformly across domains than prompting" (Section 4.2), with Personality being modestly easier than Language Features for activation-based methods (RePS HM averaged across models: ~2.43 vs. ~2.25), provides preliminary evidence that the representational hierarchy posited by Marr-inspired theories has empirical consequences for steerability. This is not yet a validated theory—the effect size is small (~0.18 HM) and cross-model consistency is incomplete—but it suggests a representational-geometry research programme where probing classifiers, representational similarity analyses, and cross-domain transfer experiments are used to map the relationship between a concept's position in the model's internal hierarchy and its amenability to vector-based intervention. The paper provides the benchmark infrastructure for such studies even though it does not conduct them.

Perhaps most consequentially for practitioners, SteerEval provides the first empirical evidence that granularity must be a deployment consideration when choosing steering methods. An organisation that needs coarse sentiment control ("make outputs more positive") may be well-served by activation-based methods, which achieve HM of 2.76–3.21 at L1 for Sentiment on Gemma-2-9B-Instruct (Table 10). An organisation that needs precise lexical compliance ("use the company's approved terminology") would find the same methods inadequate—RePS achieves HM of only 1.64 at L3 for Sentiment on the same model. The fact that a method can excel at one specification level while failing at another on the same underlying behavioral dimension (e.g., Sentiment L1 vs. Sentiment L3) changes how deployment decisions should be made: granularity requirements must be specified before method selection, not treated as an afterthought.

The paper also recasts the relative value proposition of prompt-based versus activation-based steering. Prior work tended to frame activation-based methods as more sophisticated and potentially more powerful than "simple prompting" (Turner et al., 2023; Zou et al., 2023; Rimsky et al., 2024). SteerEval's results complicate this narrative: prompt-based methods are the only methods that maintain reliable control across all granularity levels (HM ≈ 3.0 from L1 to L3, Tables 7–10). This does not make activation-based methods obsolete—they offer advantages that prompting does not (no input token budget consumed, potential for stealth or multi-lingual applications, independence from the model's instruction-following ability)—but it does mean that prompting is the safer default when fine-grained control is required, and that activation-based methods should be evaluated specifically for their granularity profile, not just their average performance.

Follow-Up Research This Work Enables

Cheap difficulty estimation for steering targets. The paper's most immediate practical bottleneck is that granularity levels are defined in the benchmark but unknown for novel concepts. A natural extension is to train a lightweight classifier—possibly distilled from gpt-4.1-mini evaluations on SteerEval data—that takes a natural language description of a steering target as input and predicts which granularity bin (L1, L2, or L3, or a continuous granularity score) it falls into, without requiring full benchmark construction. If such a classifier could achieve reasonable accuracy (e.g., >80% three-way classification), practitioners could use it to assess whether their target concept is in the "safe zone" for activation-based steering (L1) or requires prompt-based methods (L2/L3) before committing to a deployment strategy. The classifier could also serve as a diagnostic for method developers: if a new activation-based method claims to handle fine-grained constraints, the classifier provides a cheap way to identify which L3 concepts are genuinely hard and which are trivially solved by existing methods. A strong follow-up would: (1) train the classifier on SteerEval's concept descriptions and their gpt-4.1-mini-assigned granularity labels, (2) evaluate on held-out concepts from the same domains, (3) test cross-domain transfer (trained on Personality and Sentiment, tested on Language Features), and (4) measure correlation between classifier-predicted granularity and actual activation-based steering performance on novel, externally sourced concepts.

Multi-level steering vector extraction. The paper's finding that activation-based methods lose fine-grained information through standard vector extraction procedures (PCA, DiffMean, RePS) suggests a concrete engineering target: extractors that separately represent coarse and fine concept attributes. A natural design would be a hierarchical steering vector: rather than a single vector v_g, learn a decomposition v_g = v_coarse + v_fine where v_coarse captures the high-level behavioral direction (L1: "express autonomy") and v_fine captures the surface-level constraint (L3: "use 'self-authored'"). These could be extracted from the same training preference pairs by (1) training a standard RePS vector on the full pairs (capturing both coarse and fine), (2) training a separate vector on only the L1-level semantic difference (perhaps by masking the L3 tokens in the training data), and (3) taking the residual as the fine-grained component. At inference time, the steering intervention would be h ← h + α·v_coarse + β·v_fine, with potentially different scaling factors for the two components. The prediction is that this decomposition would improve L3 performance over single-vector steering while maintaining L1 performance, because the fine-grained component can be applied at a lower strength to avoid the instruction-following and fluency degradation that the paper observes when RePS steering factors are increased (Figure 5b). A strong follow-up would compare single-vector RePS against hierarchical RePS on SteerEval's L3 concepts, measuring both Concept Score and Harmonic Mean, and analyse whether the degradation at high α (Section 5.2) is mitigated by decoupling coarse and fine control.

Layer-wise steering for fine-grained concepts. The paper applies activation-based steering at a single mid-to-late layer per model (layer 20 for Gemma-2-9B-Instruct, Section 4.1, Appendix B), following prior work. But the hypothesis that fine-grained concepts occupy lower representational levels suggests that L3 concepts might be better controlled by steering at earlier layers (where surface-level features are more prominent) or by steering at multiple layers simultaneously (to engage both the abstract representations at mid-to-late layers and the concrete representations at earlier or later layers). A systematic sweep would test: for each L3 concept, at which single layer does activation-based steering maximise HM? Does the optimal layer for L3 concepts differ from the optimal layer for L1 concepts on the same domain? If L3 concepts are best steered at earlier layers than L1 concepts (as the Marr hierarchy would predict), this would provide direct evidence for the hierarchical representational account. A strong follow-up would sweep layers 1–N (where N is the model's total layer count) for RePS on all L1 and L3 concepts across two domains, plotting the optimal layer distribution for each granularity level. The prediction: L1 optimal layers cluster in the mid-to-late range (15–25 for a ~40-layer model), while L3 optimal layers shift earlier (5–15) or spread more broadly across the layer range.

Multi-turn steering persistence and concept interference. The paper's single-turn evaluation leaves open the question of whether steering effects persist—and whether they should. For deployment, persistent steering (the model maintains the target personality or style across an entire conversation) is often desirable, but the paper provides no evidence on whether activation-based interventions applied on turn 1 still affect turn 5. A multi-turn extension of SteerEval would generate conversation trees: a sequence of 3–5 questions in the same domain, with the steering intervention applied only to the first turn, and evaluation scores computed separately for each turn. This would measure steering decay rate—how many turns before the concept score drops below a threshold. Additionally, the extension would test concept interference by interleaving questions from different domains (e.g., Personality-steered model responds to a Sentiment question on turn 3) and measuring whether the Personality steering vector inadvertently affects Sentiment outputs. A strong follow-up would: (1) construct 100 multi-turn conversation trajectories using SteerEval questions from mixed domains, (2) apply activation-based steering (RePS) on turn 1 only, (3) measure Concept Score degradation across turns 1–5 for the steered domain, and (4) measure cross-domain Concept Score spillover on turns that probe other domains. The prediction: steering decay is faster for L3 concepts (token-level constraints are harder to maintain across turns) than for L1 concepts (high-level behavioral biases persist longer), and cross-domain interference is larger when the source and target domains are adjacent in the Marr hierarchy (Personality → Sentiment) than when they are distant (Personality → Language Features).

Human calibration of LLM-as-judge for steering evaluation. The paper relies entirely on gpt-4.1-mini scoring without human validation, acknowledging this as a limitation. A necessary follow-up is a controlled human evaluation on a stratified subset of SteerEval outputs to quantify judge reliability and bias. The study would sample outputs across: (a) all three scoring dimensions (Concept, Instruction, Fluency), (b) all granularity levels (L1, L2, L3), (c) both method families (prompt-based, activation-based), and (d) all three models, for a total of perhaps 500–1000 outputs. Professional annotators (or crowdworkers with qualification tests) would rate each output on the same 0–4 scales using the same criteria as the gpt-4.1-mini judge (Appendices E.1–E.3). The analysis would report: Pearson/Spearman correlation between LLM-judge and human scores for each dimension and granularity level; systematic bias (does the judge consistently over- or under-score activation-based outputs relative to human ratings?); and judge reliability for L3 concepts specifically (where deterministic regex matching provides a ground-truth baseline—comparison of human, judge, and regex L3 concept scores). A strong follow-up would also test whether different LLM judges (gpt-4.1-mini vs. gpt-4o vs. Claude 3.5 Sonnet) produce consistent rankings of steering methods, or whether method rankings are judge-dependent—a finding that would substantially qualify the paper's headline results.

Compositional steering: simultaneous multi-concept control. Real-world deployment often requires steering multiple behavioral dimensions at once (e.g., a customer service bot that must be both empathetic (Sentiment L1) and formal (Language Features L2) while following company terminology guidelines (Language Features L3)). The paper tests only single-concept control, but its multi-domain, multi-level structure makes it uniquely suited to study concept composition. A compositional extension would test: given two steering targets from different domains (e.g., Sentiment L1 "high enthusiasm" + Personality L2 "self-directed choice"), can these be applied simultaneously, and does the joint intervention achieve similar per-concept scores as each intervention alone, or does interference degrade one or both? For activation-based methods, composition could be implemented by adding both steering vectors (h ← h + α₁·v_g₁ + α₂·v_g₂), which assumes linear additivity in representation space. The prediction—which the paper's Marr hierarchy would support—is that concepts from different levels (L1 Sentiment + L3 Language Features) interfere less than concepts from the same level (L2 Personality + L2 Sentiment) because they occupy orthogonal subspaces in the model's representational geometry. A strong follow-up would test all pairwise combinations of 4 concepts (2 domains × 2 levels) using RePS on one model, measuring per-concept scores and an aggregate multi-concept HM, and comparing to single-concept baselines. If same-level interference is indeed larger than cross-level interference, this provides direct evidence for the hierarchical representational hypothesis and practical guidance for deployment (steer at different granularity levels simultaneously, be cautious about same-level compositions).

Practical Applications and Downstream Use Cases

Deployment method selection informed by granularity requirements. The paper's most directly actionable finding for practitioners is that prompt-based steering is the only method family that maintains control across all granularity levels, with HM stable around 3.0 from L1 to L3 (Tables 7–10), while activation-based methods degrade sharply—RePS drops from HM ≈ 2.94 at L1 to ≈ 1.72 at L3 across domains on Gemma-2-9B-Instruct (Table 2). For an organisation deploying a chatbot or content generation system, this translates to a concrete decision rule: if the behavioural requirements include precise lexical or formatting constraints (L3-level specification—e.g., "must use our product names correctly," "must include legal disclaimers verbatim"), prompt-based steering should be the default choice, because activation-based methods cannot reliably enforce these constraints even with training data and steering factor optimisation. Conversely, if requirements are limited to coarse behavioural shaping (L1-level specification—e.g., "maintain a helpful tone," "express confidence"), activation-based methods become viable and may offer advantages (no token budget consumed by steering prompts, independence from model-specific instruction-following quality). The key operational insight is that granularity requirements must be assessed before method selection—a deployment team should not choose a steering method based on aggregate benchmarks and then discover at launch that it cannot enforce the specific lexical constraints their legal or brand teams require.

Cost-efficient preference data allocation for activation-based steering. The paper's per-concept training data requirement (70 preference pairs for training + 5 for validation steering factor search, Section 3.5) represents a real cost in deployment. The finding that activation-based methods largely fail at L3 regardless of data quantity (RePS achieves HM of only 1.64–2.12 at L3 even with 70 training pairs, while PCA and DiffMean collapse to Vanilla-baseline levels; Tables 7–10) has a direct resource-allocation implication: do not invest in preference data creation for L3-level concepts if using activation-based methods—the return on that investment is near zero with current methods. Instead, invest preference data budget in L1 and L2 concepts, where activation-based methods show meaningful returns (RePS improves over Vanilla by 1.5–2.5 HM points at L1 across domains on Gemma-2-9B-Instruct, Tables 7–10). For L3 concepts, use prompt-based steering (which requires no training data beyond the concept description) or invest in method development rather than data creation. The paper does not frame this as a cost-allocation finding, but the numbers directly support it: the cost-per-unit-improvement of preference data for L3 activation-based steering is effectively infinite, while the cost for L1/L2 is finite and measurable.

Benchmark-driven steering method development and regression testing. SteerEval provides a standardised, hierarchically structured evaluation that method developers can use to characterise their new techniques. A developer proposing a new activation-based steering method (e.g., a multi-layer extraction procedure, a non-linear intervention mechanism, or a concept-decomposition approach) would run it on SteerEval and report not a single aggregate score but a granularity profile: HM at L1, L2, and L3 across domains. The paper's baseline results (Tables 7–10) provide reference points for what constitutes progress—a new method that achieves, say, HM > 2.5 at L3 on Gemma-2-9B-Instruct across all three core domains would represent a substantial advance over RePS (HM ≈ 1.64–2.12 at L3), while a method that only improves L1 performance without affecting L3 would be identified as an incremental refinement rather than a fundamental advance. The benchmark also enables regression testing: if a new model release or fine-tuning procedure degrades steerability, SteerEval's granularity breakdown can pinpoint whether the degradation is uniform (all levels affected) or specific to certain levels (e.g., L3 degrades while L1 holds steady), guiding debugging toward the right representational or architectural locus.

Safety monitoring with granularity-aware behavioural audits. The paper's finding that unsteered models naturally exhibit very low concept scores at L3 (Vanilla CS = 0.00–0.14 across domains and models for L3; Tables 7–10) while steered models can achieve non-trivial L3 scores (Prompt 3-shot CS = 2.37–3.33 at L3 on Gemma-2-9B-Instruct) has an underappreciated safety implication: fine-grained behavioural constraints can serve as canaries for unauthorised steering. If a deployed model unexpectedly starts producing outputs with specific lexical markers (L3-level patterns), this could indicate an adversarial steering intervention—either prompt injection (an attacker prepending steering instructions to user inputs) or activation tampering (an attacker with model access modifying hidden states). A monitoring system that tracks the frequency of L3 concept tokens (drawn from SteerEval's L3 concept vocabulary) in production outputs could detect such interventions. The key design principle is that L3 tokens should be rare in normal operation (Vanilla CS ≈ 0) but detectable when steering is applied (steered CS ≥ 2–3 for prompt-based methods)—creating a high signal-to-noise ratio for anomaly detection. This is a practical application that SteerEval enables but does not develop; a deployment team would need to: (1) select a set of L3 concepts relevant to their domain, (2) verify that these tokens are naturally rare in their model's unsteered outputs (analogous to the Vanilla L3 baseline in Tables 7–10), and (3) set thresholds on token frequency that trigger alerts when exceeded.