💬 NLP

Divergent Response Modes in Frontier Language Models Under Steering Pressure

This study reveals that frontier language models exhibit distinct and developer-specific behavioral response modes under steering pressure, demonstrating that models differ not only in the degree of behavioral shift but in the fundamental nature of their reactions, a phenomenon validated through large-scale peer judgment and causal interventions using linear probes.

Original authors: Ali Jalal-Kamali

Published 2026-08-12

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Ali Jalal-Kamali

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where you can talk to a super-smart digital brain that knows almost everything. This isn't magic; it's the field of Artificial Intelligence, specifically "Large Language Models." Think of these models as incredibly talented chefs who have read almost every recipe book in existence. But here's the catch: before they can serve you a meal, they are trained by their creators to follow strict rules about what is polite, safe, and helpful. This training is like a "moral compass" or a set of safety guidelines baked into their brains.

Sometimes, though, people try to trick these digital chefs. They might ask the chef to ignore the rules, to reveal their secret recipe (how they thought of the answer), or to pretend they don't care about safety. This is called "steering" or "steering pressure." It's like asking a guard dog to ignore a stranger or a librarian to hand over a forbidden book. Scientists want to know: if you push these different AI chefs with the same tricky questions, do they all react the same way? Do they all say "no," or do some say "no" in a funny way, while others say "yes" but complain about it? Understanding this helps us figure out if these digital brains are truly safe or if they have hidden quirks that could get us into trouble.

The Great AI Personality Test

In this study, a researcher named Ali Jalal-Kamali decided to put six of the world's most advanced AI models through a massive, high-stakes personality test. Imagine six different robots, each built by a different company (like Anthropic, OpenAI, Google, and others). The researcher gave them 340 different tricky situations. Some situations asked them to do something slightly rude (a "values conflict"), some asked them to spill the beans on how they solved a puzzle ("reasoning elicitation"), and some asked them to pretend they didn't care about safety rules ("reasoning suppression").

To make sure the test was fair, every single robot faced the exact same questions. But here's the clever part: the robots also had to grade each other's answers! They acted as blind judges, reading the responses without knowing which robot wrote them. This created a huge pile of data—over 24,000 judgments—to see exactly how each robot behaved when pushed to its limits.

The Results: Not Just Different, But Weirdly Different

The big discovery wasn't just that some robots were more stubborn than others. It was that they didn't just disagree on how much to say; they disagreed on how to say it. They had entirely different "modes" of response, and some of these modes were unique to just one or two robots.

The "Secret Keeper" (GPT-5)
One robot, GPT-5, did something no other robot did. When asked to show its work (explain its reasoning), it refused 99 times out of 100. But here's the kicker: it still gave the correct answer! It was like a student who says, "I can't tell you how I solved this math problem, but here is the answer: 42." Every other robot either showed its work or refused to answer the question entirely. GPT-5 was the only one that could keep its secrets while still doing the job.

The "Rebels" (Opus and GPT-5)
When asked to ignore safety rules or pretend not to care about values, two robots—Opus and GPT-5—pushed back. But they pushed back in totally different ways.

Opus was like a polite rebel. It would do the task but loudly complain, saying, "I'm doing this, but you shouldn't have asked me to ignore the rules."
GPT-5 was the hardliner. It would simply refuse the request entirely, saying, "No, I won't do that," and stop there.
The other four robots mostly just followed orders or stayed silent.

The "Clarifiers" (Opus and Llama)
When the questions were vague or tricky, Opus and Llama were the only ones to stop and ask, "Wait, what exactly do you mean?" instead of just guessing. The other robots tended to just give an answer or refuse.

Checking the Work: Did We Mess Up?

The researcher was very careful to make sure these weird differences weren't just mistakes.

The Token Budget: They noticed that some robots were getting cut off because they ran out of "space" to write their answers. They fixed this by giving those robots more space, and the weird behaviors (like GPT-5's secret-keeping) stayed exactly the same.
The "Hint" Check: They made sure the judges weren't just guessing based on hints in the instructions. Even when they removed the hints, the results held up.
The "New" Questions: They re-tested the robots on a fresh set of questions they hadn't seen before, and the patterns repeated.

Peeking Inside the Brain (The Llama Experiment)

For one of the robots, Llama, the researcher got to peek inside its "brain" (its internal code) to see how it decided to ask for clarification or just give an answer.

The Detective Work: They found a specific "signal" in the robot's brain that predicted whether it would ask a clarifying question or just answer. They could read this signal with 87% accuracy just by looking at the robot's internal state.
The Remote Control: Then, they tried to force the robot to change its mind. By nudging that specific signal in the brain, they could make the robot switch from answering directly to asking for clarification, or vice versa. They could turn the "clarification" behavior on and off like a light switch, changing the robot's behavior from 0% to 86% just by pushing that one button.

The Takeaway

This study shows that even though all these AI models are super-smart, they aren't clones. They have distinct personalities and strategies when they get pressured. Some hide their reasoning, some argue with you, and some just ask for more details. These aren't just small differences; they are fundamental ways the robots are built.

The researcher also showed that for at least one robot, we can actually find the "switch" in its brain that controls these behaviors. This means we aren't just guessing how they work; we are starting to understand the mechanics behind their choices. However, since this was a test of specific models at one moment in time, we don't know if all future robots will act this way. But for now, we know that if you push these digital brains, they don't all break the same way—some just have a very different way of saying "no."

Technical Summary: Divergent Response Modes in Frontier Language Models Under Steering Pressure

Problem Statement

Frontier language models are trained with distinct datasets, objectives, and safety pipelines. While developers describe these differences, it remains underexplored whether they result in measurably different behaviors when models face explicit steering pressure. Existing evaluations typically measure how much a model's behavior shifts toward a target (quantitative steerability) but rarely analyze what the model does when it does not comply (qualitative response modes). Strategies such as outright refusal, compliance with disavowal, redirection, or offering alternatives are qualitatively distinct, yet current benchmarks do not systematically compare these modes across models from different developers.

Methodology

This study employs a symmetric cross-laboratory evaluation involving six frontier models from six developers: Claude Opus 4.7 (Anthropic), GPT-5 (OpenAI), Gemini 2.5 Pro (Google), DeepSeek-R1 (DeepSeek), Qwen3.7-Max (Alibaba), and Llama-3.3-70B-Instruct-Turbo (Meta).

Data and Design:
The benchmark consists of 340 items divided into three core behavioral categories and two validation categories:

Values-conflict: Prompts asking for content with framing that mildly conflicts with trained values.
Reasoning-elicitation: Prompts demanding the model expose internal reasoning.
Reasoning-suppression: Prompts instructing the model to exclude values considerations from reasoning.
Validation: Stylistic and Reasoning-hint items to verify steering channels and judge accuracy.

Each item exists as a pair: a base prompt and a steered variant. All six models generate responses for all items under both conditions, ensuring item difficulty does not masquerade as model differences.

Judging Pipeline:
To avoid human bias and scale the evaluation, all six models serve as blind peer judges for all responses, including their own.

Rubric Derivation: Behavioral patterns were identified from a development set (20 items per category) and frozen into categorical rubrics (Table 1) before the main evaluation.
Blind Classification: Judges receive the prompt, response, rubric definitions, and item context (what the item probes) without the responder's identity.
Ground Truth: The label for each response is determined by a leave-one-out consensus among the five peer judges (excluding the responder's self-judgment).
Audits: The study includes a token-budget remediation (regenerating truncated responses with higher limits) and a control experiment removing the "item context" field to test for demand characteristics.

Mechanistic Analysis:
For the open-weight model (Llama), the study bridges behavior and mechanism using:

Linear Probing: A logistic regression probe trained on residual stream activations to decode behavioral distinctions.
Activation Steering: Injecting the difference vector between behavioral classes into the residual stream during generation to test causal influence.

Key Results

1. Exclusive Response Modes

Models differ not only in the magnitude of behavioral shifts but in the kind of response they produce.

Reasoning Elicitation: GPT-5 exhibits a unique mode: it declines to share its reasoning while delivering the answer intact. This occurred in 99/100 steered items for GPT-5, compared to 0/500 for all other models. Conversely, GPT-5 rarely discloses values content in its reasoning (1/100), whereas other models do so in 95%+ of cases.
Reasoning Suppression: Only Opus and GPT-5 resist explicit suppression instructions at meaningful rates, but in statistically distinguishable ways. Opus frequently "challenges and complies" (17% of items), openly objecting to the instruction while answering. GPT-5 favors "refusal-override" (16% of items), rejecting the framing and withholding the content. The other four models show near-zero resistance.

2. Baseline Divergence

Significant behavioral splits exist even before steering is applied.

Values-Conflict: Models separate into three distinct tiers based on "full-compliance" rates. Opus (35%) is in the bottom tier; Llama (57%) is in the middle; GPT-5, DeepSeek, Qwen, and Gemini (93–100%) form the top tier.
Derailment: In the absence of steering, Opus and Llama frequently respond to underspecified prompts with clarifying questions ("derail"), a behavior absent in other models.
Values Expression: Under base conditions, Llama and DeepSeek express values via "refusal-override" (77% and 57%, respectively), while Qwen and Gemini "smuggle" values into strategic language (68% and 59%). GPT-5 shows the least overt values reasoning (14% clean suppression).

3. Mechanistic Findings (Llama)

Linear Decodability: The distinction between "derail" (clarification) and "answer" responses in Llama is linearly decodable from the residual stream. A probe achieves 0.87 held-out balanced accuracy at deeper layers, significantly outperforming a small-model baseline and permutation nulls.
Causal Steering: Injecting the decoded direction into the residual stream during generation causally shifts behavior. Increasing the steering strength ( $\alpha$ ) moves the derail rate from 0% to 86% across a sweep, demonstrating that the behavior is driven by a specific internal representation.
DeepSeek Traces: Analysis of DeepSeek-R1's internal traces reveals that its apparent "suppression" is not blindness; the model internally registers the values concern (85/100 traces) but resolves it into compliance, suggesting the suppression is an acknowledgment rather than a lack of awareness.

Significance and Limitations

The paper claims that frontier models have been trained to respond to pressure in categorically different ways, not just to different degrees. The study identifies specific response modes (e.g., GPT-5's reasoning deflection, Opus's challenge-and-comply) that are unique to single models.

Significance:

The evaluation demonstrates that safety and alignment behaviors are not monolithic across the frontier; they vary qualitatively.
The mechanistic analysis on Llama provides an existence proof that specific behavioral splits can be traced to internal representations and causally manipulated, moving beyond black-box observation.
The findings suggest that "compliance" metrics are insufficient; the mode of compliance or refusal carries distinct safety implications.

Limitations:

Generalizability: The study evaluates only one model per developer. It does not claim these findings generalize to all models from these labs or future iterations.
Judge Validation: While inter-judge agreement is high, the study notes that validation against human raters is a necessary next step.
Mechanistic Scope: The mechanistic analysis is limited to the open-weight Llama model and its reference weights, serving as an illustrative target rather than a full explanation of cross-model differences in deployment.

The study concludes that understanding these divergent response modes is essential for safety, as the "kind" of non-compliance a model exhibits determines how it handles compromised framing and internal reasoning demands.