🤖 machine learning

Dynamically Scaled Activation Steering

This paper introduces Dynamically Scaled Activation Steering (DSAS), a method-agnostic framework that adaptively modulates the strength of activation interventions based on input context to improve the trade-off between toxicity mitigation and utility preservation in generative models while introducing minimal computational overhead.

Original authors: Alex Ferrando, Xavier Suau, Jordi Gonzàlez, Pau Rodriguez

Published 2026-07-31

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Alex Ferrando, Xavier Suau, Jordi Gonzàlez, Pau Rodriguez

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are the conductor of a massive, invisible orchestra made of pure math. This orchestra is a "generative model," a type of computer brain that can write stories, paint pictures, or solve problems. But like any musician, it sometimes plays a sour note or, worse, a harmful one. For years, scientists have tried to fix this by "steering" the music. Think of steering like a conductor waving a baton to tell the whole orchestra to play softer, or to avoid a specific instrument. The problem with the old way of steering is that it's a bit clumsy: it tells the entire orchestra to play softly, even when they are already playing a beautiful, safe melody. This makes the music sound flat and boring, even when no one was doing anything wrong.

The paper you are about to read introduces a new, super-smart conductor named DSAS (Dynamically Scaled Activation Steering). Instead of waving the baton at the whole group at once, DSAS listens to every single musician individually. It only tells the specific musicians who are about to play a "toxic" or harmful note to tone it down, while letting the rest of the orchestra play exactly as they want. It's the difference between a teacher shouting "Everyone be quiet!" when only one student is talking, versus a teacher who gently taps the shoulder of just that one student. This paper shows that by being this precise, we can stop the bad behavior without ruining the good stuff, making these AI brains safer and more helpful without making them dumber.

The Paper's Big Idea: The "Smart Dimmer Switch" for AI

The researchers, Alex Ferrando de las Morenas and his team from Apple and the Universitat Autònoma de Barcelona, realized that the old method of "activation steering" was too blunt. In the world of AI, "activation steering" is a technique where scientists tweak the internal signals of a model to push it toward a desired behavior, like being polite or telling the truth. Usually, they apply a "global strength" (let's call it a volume knob, or $\lambda$ ) that turns the steering up or down for everything the model does.

The problem? If you turn up the volume on "be polite," the model might become so polite it stops answering questions entirely, or if you turn it up to stop "toxic" words, it might start sounding robotic and losing its creativity. The paper argues that we need to know when to steer, not just how to steer.

Enter DSAS. The authors propose a framework that acts like a smart dimmer switch for every single word (or "token") the AI generates. Instead of a global knob, DSAS uses a tiny, trained "gatekeeper" for each layer of the AI's brain. This gatekeeper looks at the context of what the AI is saying and asks, "Is this specific word likely to be toxic or harmful?"

If the answer is no (the AI is talking about a sunny day or a math problem), the gate stays open, and the AI flows naturally.
If the answer is yes (the AI is about to generate a slur or a dangerous instruction), the gate closes, and the steering kicks in hard to redirect that specific thought.

The paper demonstrates this with a fun, non-offensive example: steering the AI away from the word "banana." When the AI is asked to write a story about a monkey eating fruit, DSAS detects the concept of "banana" and applies a strong steering force to stop it from saying the word. But when the AI is asked to write a story about a cat or a car, DSAS sees that "banana" isn't relevant, so it leaves the steering alone. The result? The AI successfully avoids the "banana" concept when it's supposed to, but it doesn't lose its ability to talk about cats or cars.

What They Found: A Better Balance

The team tested DSAS on several popular AI models (like Qwen and Gemma) and compared it against other steering methods. They measured two things: how well the model avoided toxicity (or the "banana" concept) and how well it kept its general smarts (like its ability to answer trivia questions or write fluent sentences).

The results were clear: DSAS consistently improved the trade-off.

In the paper's graphs, which look like mountain ranges showing the best possible balance between safety and smarts (called a "Pareto front"), the DSAS lines were always higher and better than the old methods.

For Toxicity: When trying to stop the AI from being rude, DSAS allowed the models to be much safer without making them sound like broken robots. The models kept their fluency and ability to answer complex questions (measured by benchmarks like MMLU) much better than when using older, "one-size-fits-all" steering.
For Images: They even tried this on image generators (models that draw pictures). They asked the model to blur images of bananas but keep other images sharp. The old method blurred everything a little bit. DSAS, however, only blurred the images that actually contained bananas, leaving the pictures of cars and landscapes perfectly clear.

The paper also explored a version called E2E-DSAS, where the "gatekeeper" is trained at the same time as the steering itself, rather than being a separate step. This version showed promise, sometimes matching or even beating the standard DSAS, suggesting that the method is flexible enough to be baked directly into the training process.

What It's Not (and What It Doesn't Claim)

It's important to know what this paper doesn't say. The authors are careful to note that DSAS isn't a magic wand that solves all AI safety problems.

It's not a replacement for fine-tuning: The paper doesn't claim DSAS replaces the need to train models on good data. It's a tool to be used on top of existing models.
It's not perfect localization: In the image experiments, while DSAS was much better at targeting specific concepts, the authors admit it didn't always blur only the banana in the picture. Sometimes the blurring spread a bit to the background. It's a "soft" localization, not a surgical laser.
It relies on data: The "gatekeeper" needs a small set of examples (like 32 toxic sentences and 32 safe ones) to learn what to look for. If the data is noisy or bad, the gatekeeper might get confused, though the paper shows that even then, DSAS tends to fall back safely to the standard steering rather than breaking the model.

The Bottom Line

This paper suggests that the future of controlling AI isn't about turning up the volume on safety for everyone. It's about being a smart, attentive conductor who knows exactly when to whisper "shh" to a specific instrument and when to let the music flow freely. By dynamically scaling the steering based on what the AI is actually saying, DSAS offers a way to make these powerful tools safer without sacrificing the very intelligence that makes them useful. The authors show that this approach works across text and images, and while it's not a solved problem, it's a significant step toward AI that knows how to behave without losing its personality.

Technical Summary: Dynamically Scaled Activation Steering (DSAS)

Problem Statement

Activation steering has emerged as a powerful technique for guiding generative models toward desired behaviors (e.g., toxicity mitigation, knowledge editing) by manipulating internal activations without modifying model weights. However, existing methods typically apply interventions uniformly across all inputs using a fixed global strength parameter ( $\lambda$ ). This indiscriminate application degrades model performance on inputs that do not require steering, such as benign or unrelated content, creating a suboptimal trade-off between safety/alignment and utility/fluency.

While conditional steering methods exist to address this, they often rely on static rules, binary triggers, or prompt-level heuristics that lack precision. Furthermore, many existing adaptive methods are tailored to specific steering families (e.g., ITI-like methods) and fail to generalize to distributional or end-to-end learned steering approaches. There is a need for a universal, method-agnostic framework that can precisely adapt steering strength on a per-token or per-feature basis, intervening strongly only when undesired behavior is detected.

Methodology: Dynamically Scaled Activation Steering (DSAS)

DSAS is a steering-agnostic framework that decouples the decision of when to steer from how to steer. It adaptively modulates the strength of any existing steering transformation ( $T_\ell$ ) across layers and inputs.

Core Mechanism

For each intervened layer $\ell$ and token $k$ , DSAS introduces a gate $h_\ell(t_{\ell,k}) \in [0, 1]$ that interpolates between the original embedding and the steered embedding:
$T^{DSAS}_\ell(t_{\ell,k}) = (1 - h_\ell(t_{\ell,k})) \cdot t_{\ell,k} + h_\ell(t_{\ell,k}) \cdot T_\ell(t_{\ell,k}; \lambda)$
Here, $h_\ell \approx 0$ leaves the embedding untouched, while $h_\ell \approx 1$ applies the full intervention.

Training the Gate

The gate $h_\ell$ is trained as a logistic regressor per layer to distinguish between:

Source Set ( $S$ ): Samples exhibiting undesired behavior (e.g., toxic text).
Control Set ( $C$ ): Samples neutral with respect to the behavior being modified (e.g., non-toxic text).

The training process involves:

Activation Collection: Pushing forward inputs from $S$ and $C$ to layer $\ell$ to obtain average embeddings.
Dimensionality Reduction: Applying PCA to the combined source and control activations to mitigate overfitting in high-dimensional spaces and reduce training time.
Classification: Training a logistic regressor to predict the probability that an embedding belongs to the source set. This probability serves as the adaptive strength coefficient.

End-to-End Optimization (E2E-DSAS)

The paper also introduces an end-to-end variant where the gate parameters are jointly optimized with the steering transformation (specifically with LinEAS). This involves minimizing a source loss (pushing source distributions toward target distributions) while applying a control regularization term to ensure control set activations remain similar before and after intervention. This allows the gate to be learned directly via backpropagation without static PCA projections.

Key Contributions

Framework Proposal: Introduction of DSAS, a method-agnostic framework that dynamically scales intervention strength based on activation characteristics, learning when to steer rather than applying fixed policies.
Improved Trade-offs: Demonstration that DSAS improves the Pareto front for toxicity mitigation versus capability retention (measured by perplexity and MMLU accuracy) across multiple Large Language Models (Qwen 2.5, Gemma 2) and steering methods (CAA, ITI, LinEAS).
Superiority over Baselines: Empirical evidence showing DSAS outperforms recent conditional steering methods (CAST, MERA, AlphaSteer) in maintaining model utility while reducing toxicity.
End-to-End Integration: Extension of DSAS to end-to-end frameworks (E2E-DSAS), enabling joint training with steering functions and supporting various activation functions (e.g., ReLU, Sigmoid).
Cross-Modal Generalization: Successful application of DSAS to text-to-image diffusion models (DMD2), demonstrating its ability to selectively blur concept-related images (e.g., bananas) while preserving unrelated image generation.

Experimental Results

Toxicity Mitigation: In experiments on Qwen 2.5 (1.5B, 7B) and Gemma 2 (2B), DSAS consistently shifted the Pareto front, achieving lower toxicity scores (ToxTET) for the same level of capability retention compared to vanilla steering. For instance, combining DSAS with LinEAS reduced toxicity significantly more than LinEAS alone without incurring the same penalty in perplexity or MMLU accuracy.
Conditional Behavior: Qualitative case studies (steering away from "banana") showed that DSAS-augmented methods effectively suppressed the target concept in relevant prompts while leaving neutral prompts largely unaffected, even when using higher global strength parameters ( $\lambda > 1$ ).
Diffusion Models: In text-to-image experiments, CAA+DSAS successfully blurred images containing specific concepts (e.g., bananas, phones) while maintaining the clarity of non-concept images, whereas vanilla CAA blurred all images indiscriminately.
Efficiency: DSAS introduces minimal computational overhead at inference (approx. $2d_\ell + 2$ FLOPs per embedding), making it practical for real-time generation.
Robustness: The method remains robust to noisy training signals; if the classifier cannot distinguish source from control, DSAS naturally reverts to a safe regime (uniform steering with reduced strength) without degrading performance below the baseline.

Significance and Claims

The paper claims that DSAS represents a significant advancement in activation steering by addressing the critical limitation of indiscriminate intervention. By decoupling the timing of intervention from the mechanism of steering, DSAS enables:

Selective Alignment: Models can be guided away from harmful behaviors only when necessary, preserving their native fluency and general capabilities on benign inputs.
Interpretability: The method pinpoints exactly which tokens or spatial features require steering and by how much, offering a transparent view of the intervention process.
Generality: Unlike previous adaptive methods, DSAS is not tied to a specific steering algorithm or input modality, making it applicable to a wide range of generative tasks including text generation and image synthesis.

The authors conclude that DSAS provides a practical, low-overhead solution for achieving better alignment in generative models, improving the trade-off between safety and utility without requiring extensive retraining or weight modifications.