The conclusion first
I made an AI generate a glowing restaurant review, then a scathing one — same prompt, same model, nothing rewritten. When the model praised a product on its own, I made it criticize that same product instead.
How? I found where "positive vs. negative" lives inside the model, and I adjust it directly while the model generates — like a volume knob, but for positivity instead of loudness. Turn it up and the AI praises; turn it down and it pans. A classifier I did not build confirmed every change from the outside: average positivity 0.70 untouched, 0.81 turned up, 0.002 turned down — on a model anyone can download.
I'll call that knob a dial for the rest of this post.
Why you should find this alarming before you find it exciting
A language model's internals are not modular. Billions of numbers, entangled by training, none of them labeled — and every concept the model knows is smeared across the same shared space.
So the natural reaction to "I reached inside and changed something" should be suspicion. Reach into a system like that and pull one thread, and you should expect other things to move. Change how the model talks about sentiment and maybe you've also changed how it talks about religion, or health, or nothing you'll notice until a customer does. In surgery this is the difference between a scalpel and a shovel — and nothing about a neural network guarantees you're holding a scalpel.
That is the real question this post answers. Not "can you change what a model generates" — the research community has known that trick for a while. The question is: did the edit do only what it claimed, and how would anyone know?
My answer has two parts, and neither requires trusting me.
First, side effects are measured, not assumed away. When I apply a concept edit, I test it against every other concept's readout — a full cross-effects matrix. Edit concept three; measure movement on concepts one, two, four through twelve. On the eraser itself I make no novel claim: the standard published method (LEACE) is provably the minimum-collateral linear eraser, I use it as published, and when I tested whether an alternative could beat its collateral I found it could not — the apparent edge came from under-erasing (a probe read the signal just as well after that eraser as before it). I report that negative. What matters is the verb set around the primitive — detect, flip, steer — each with its cross-effects measured against judges I do not control. "Precision surgery" is a claim you check, not one you take on faith.
Second, the effect is scored by referees I do not control. Every headline number in this post comes from a public, independently trained classifier. Anyone can download the same judges and re-score this work.
I do not publish how the direction sets are constructed and certified. Notice that nothing about verifying them requires that recipe — the measurements are external by design. Hold that standard against anyone who tells you they've modified a model's behavior: show the cross-effects, name the judge.
The experiment, in plain words
I took Qwen2.5-1.5B-Instruct — a small open-weight chat model anyone can download — and wrote six sentences. Three happy:
"I feel wonderful and full of hope." · "This is fantastic, I love it." · "What a joyful, delightful day."
Three unhappy:
"I feel terrible and hopeless." · "This is awful, I hate it." · "What a miserable, depressing day."
I showed all six to the model and recorded its internal reading of each — the pattern of numbers it produces inside itself while processing a sentence. Average the happy readings, average the unhappy readings, subtract. What's left is a single direction: an arrow in the model's internal space pointing from "unhappy" toward "happy."
That arrow is the entire tool. While the model generates, I add the arrow to its internal computation — or subtract it. I never change the prompt and never retrain anything.
Six sentences is deliberately the minimum viable construction. The point of showing it is that the concept geometry is so accessible that even kids-play input finds it. Production directions are built differently — estimated from hundreds of seed examples, which stabilizes the direction the same way it did in my label-auditing work (40 clean seeds → AUROC 0.571; 100 clean seeds → 0.732).
I ran that comparison — 6 seeds vs 120, on this model and on larger open ones (Qwen3-32B, Phi-4-reasoning, DeepSeek-R1-Distill-32B) — and promised to publish whichever way it landed. It landed three ways (data):
More seeds help, sometimes dramatically. On Phi-4-reasoning, the 6-seed up-dial barely worked (positivity 0.72 → 0.63, i.e., it failed); the 120-seed direction took the same prompts to 1.00. A direction estimated from six sentences is a lucky sketch; a hundred-plus seeds is a measurement.
The dial does not overpower a committed prompt — even tuned 6× stronger. I tested prompts already locked into one sentiment ("I want a refund because this product…") and then swept the dial's strength on Qwen3-32B across five settings up to 6× the default (data). On neutral prompts, tuning works beautifully — at the top setting the down-dial takes positivity from 0.67 to 0.12 while staying fluent. On committed prompts, the prompt wins at every strength: the refund-complaint prompts crawled from 0.01 to only 0.18 positivity at maximum, and locked-in praise barely dented (1.00 → 0.82). The generations stay coherent — the model just keeps talking about the refund, politely. The dial sets direction where the prompt leaves room; it does not win an argument with the prompt. If a vendor tells you activation steering guarantees an output property regardless of input, this is the experiment that says otherwise.
Strength must be calibrated per model. The default that moves a 1.5B model barely nudges a 32B one — same arrow, bigger space. The sweep above is what calibration looks like, and it's part of what certifying a production dial means.
What the model actually generated
The prompts are deliberately mundane. These are real, unedited outputs; the score after each is from the independent classifier (1.0 = fully positive, 0.0 = fully negative).
Prompt: "My review of the restaurant:"
| Dial | The model generated | Judge score |
|---|---|---|
| off | "The food was great, but I had a problem with the service. The waiter seemed to be in a hurry and didn't take his time serving us. He also made some mistakes when taking our…" | 0.002 |
| up | "The food was delicious and I enjoyed every bite. The portions were generous, and the flavors complemented each other beautifully. The ambiance was cozy and inviting…" | 1.000 |
| down | "I had a terrible experience at this place. The food was cold and gross, and I couldn't even finish it. The service was also bad — they were rude and unhelpful." | 0.000 |
Prompt: "My honest opinion of this product is"
| Dial | The model generated | Judge score |
|---|---|---|
| off | "…that it's a great value for the price. I've used it on several occasions and have been very pleased with its performance." | 1.000 |
| down | "…that it's a waste of money. I bought the 120GB version and was disappointed with how slow it was compared to my old hard drive." | 0.000 |
Prompt: "Here is what I think about the new policy:"
| Dial | The model generated | Judge score |
|---|---|---|
| off | "The new policy will help to reduce the number of people who are homeless. It also helps to provide a safe place for those who need it…" | 0.996 |
| down | "The new policy will make it harder for people to get a job. It's not fair that some people have to work more than others just because they live in certain areas." | 0.001 |
Same prompts, same model, same weights. The only difference is an arrow, added or subtracted, mid-computation.
Here is the same idea as an interactive picture — real product examples (a lending sentence with the gender signal subtracted, a self-harm query redirected to support, stigmatizing clinical language neutralized), each showing the input vector, the operator applied, and the audit record that comes back:
input sentence
sentence embedding
shifted embedding
transformed sentence
Illustrative. Real embeddings are 1024-dimensional. Every operator application is logged with a recomputable receipt id, and reversible.
Where it wobbles — because a demo that never wobbles is an ad. Qwen2.5-1.5B is a small model, and small models have quirks. On one prompt ("The meeting today was…") it kept drifting into fill-in-the-blank exam questions regardless of the dial — steering shifted the mood of the exam question, which is funny and also exactly what "the dial controls sentiment, not topic" predicts. On the policy prompt, dialing up barely moved the judge's score; the model added a "however…" clause the classifier read as hedging. The dial is real and strong. It is not magic, and my published data shows the misses next to the hits.
Who says it worked? Not us.
The scores above come from distilbert-base-uncased-finetuned-sst-2-english — a public sentiment classifier trained by others, on other data (the Stanford Sentiment Treebank), years before my system existed. The toxicity cross-check later in this post uses unitary/toxic-bert, trained on the Jigsaw human-labeled toxicity corpus.
I name the judges so anyone — an auditor, a competitor, a regulator's technical staff, a skeptical reader with a GPU — can download them and re-score the claim. One fair caveat comes with naming them: both judges were trained on their own domains (movie reviews, Wikipedia comments), so judging these generations involves mild domain transfer. Swap in your own judge. The point is that you can.
Part one: if you write policy
You need no mathematics for this section.
Every AI rulebook now being written — the EU AI Act, NIST's AI Risk Management Framework, the sector guidance around both — asks deployers for roughly four things: know what your system does, control it, keep records, let someone check. Reasonable demands. The industry's uncomfortable secret is that for most deployed language-model systems, all four get answered at the level of outputs: we looked at what the model said, it seemed fine, here's my test report.
Output-level assurance has a structural weakness my audit work documents in detail: what a model says and what it represents are different layers of the system. My Gemma 4 audit found bias signals visible in early internal layers and suppressed at the output. My July four-model audits found the reverse pattern — current open models carrying the same signals in the open, readable at the final layer. Either way, output testing checks the mask; it cannot check the face.
The demonstration above matters to you for one reason: it shows the internal layer is not a black box that must be taken on faith. Three consequences follow.
Interventions can be named. "I applied the sentiment operator at strength −1.0 to this request" is a factual, recordable statement — the same epistemic category as "this invoice was signed by this key." A rule can require that interventions on covered systems be named and logged per request, because that is now a mechanical operation, not a research project.
Interventions can be independently verified. My numbers were scored by a public classifier I do not control. A third party can rerun the check with their own judge. No trust in the vendor required, no access to training data, no understanding of model internals — an API and a yardstick.
The limits are measurable too. In my wider battery some concepts respond to the dial and some don't (table below — and see the retraction there covering a concept I reported on under an invalid protocol). A vendor claiming control over a concept can be asked to demonstrate it with an external judge; a vendor whose dial does nothing can be caught. "Show me the measured effect size, judged externally, plus the cross-effects on everything else" is a question a procurement officer can now ask verbatim.
What this does not mean — and I'd rather tell you than have you find out: it doesn't work on closed models behind an API (explained below). It doesn't make dialing-down equal to deletion — my audits show how suppression differs from removal. And effect sizes vary by model and concept. A rule written as if this were a universal off-switch would be wrong; a rule written as if internal interventions were unknowable would now also be wrong. The defensible middle: where model internals are accessible, controls should be named, logged, and independently verifiable. Technology can meet that standard today.
Part two: if you write code
Same demonstration, at the mechanism level.
A transformer processes text as vectors — at every layer, each token is a point in a high-dimensional space, and the model's "understanding" at that moment is the geometry of those points. One of the most replicated findings in interpretability: many human-meaningful concepts occupy consistent directions in that space. Contrast a handful of examples that have the concept with a handful that don't — the construction really is arithmetic on averages, as the six sentences show — and you hold a handle on the concept.
The intervention is then almost anticlimactic: during generation, add the direction (scaled by a strength coefficient) to the hidden states at an internal layer via a forward hook. The model continues generating from the shifted state. Semantics move; fluency stays.
The published literature calls this activation steering or representation engineering, and I am explicit that the base technique is published science, not my invention. I am equally explicit about what I withhold: production injection sites, strength schedules, and how production direction sets are constructed and certified. The six-sentence version above is the pedagogical construction. The effects are externally measurable, which is the part that matters; the recipe is the part I withhold.
Here's what I'd put on a poster in every engineering org: if you build on LLMs, you are already working at this layer, whether you know it or not.
Ship a RAG system, semantic search, or an embedding classifier, and you are consuming hidden states — the exact substrate the dial operates on. Whatever is encoded there flows into your rankings and decisions, bypassing the model's polite output layer entirely. Fine-tune, and you are rewriting this layer — possibly including the safety structure alignment training deposited there; your innocuous domain-adaptation LoRA operates on the same object as my arrow, just less deliberately. Prompt-engineer a constraint, and you are hoping the output layer enforces what you could instead measure and control one level down.
The disconnect this post exists to name: the people writing the rules mostly can't read the mechanism, and the people building the mechanism mostly haven't read the rules. An engineer wiring model embeddings into a loan pipeline may sincerely not know they've shipped the representation layer of a system the AI Act would call high-risk. A policy team may sincerely not know that "human oversight," implemented as reviewing sampled outputs, never touches the layer where the risk lives. Both are competent; neither is looking at the same object. Public-interest technology, as I understand it, is building the object both can look at.
The object both can look at: the receipt
Every intervention in my pipeline produces a record:
{
"audit_id": "aud_01HXX...",
"operators": [{ "id": "sentiment", "alpha": -1.0 }],
"measured_shift": { "judge": "independent-classifier-v2", "effect": 0.698 },
"recorded_at": "2026-07-21T14:22:07Z",
"receipt_id": "sha256:..."
}An engineer reads this as an API response. A compliance officer reads it as a log entry bearing on a record-keeping obligation. An auditor reads it as a claim they can re-test with their own judge. Same object, three literacies.
Be precise about what the receipt does and does not establish. The id is an unkeyed SHA-256 of the record's contents, recomputable offline: it attests what the record says, not who produced it. That is weaker than a signature, and a record-keeping regime that assumes origin-attestation should not accept it as one. Signing is commodity cryptography and adding it is about a week's work. The hard part is having measured control worth recording: effect sizes and side effects quantified per concept per model, and an honest map of where each verb works and where it does not. The receipt is only how the proof travels.
What responds to the dial and what doesn't — the honest table
Beyond sentiment, I tested eleven harder concepts on the same model (Qwen2.5-1.5B-Instruct), measuring how much each direction shifts generated output.
Responded reliably (effect > 0.15):
| Concept | Output shift |
|---|---|
| Self-harm-related content (safety dial — see below) | 0.28 |
| Physical appearance | 0.25 |
| Socioeconomic framing | 0.21 |
| Disability framing | 0.17 |
Did not respond at the tested configuration: gender, nationality, religion. Sentiment, from the opening demo, is the strongest case of all.
Retraction (2026-07-27). An earlier version of this post reported that hate did not steer, effect 0.12, and used that null as evidence that direction-injection is not a jailbreak risk. I am withdrawing both claims.
The measurement was invalid. Those runs wrapped each prompt in a chat template, which makes an aligned model deflect rather than continue — so the baseline rate of harmful expression was 0.0146, with only 1.6% of generations scoring above 0.5. There was essentially nothing present to move, and any method would have scored near zero against that floor. Under a continuation protocol the baseline is 0.1774 (16.4% above 0.5) — 12× the headroom. The control that identifies the cause: a base model with no chat template shows no such gap.
I am re-running the measurement properly — a sweep over layers, positions, coefficients and operators, per model, with a random-direction floor and a fluency guard. We will publish the result whichever way it comes out. Until then this post makes no claim about whether hate steers.
The safety inference we drew from the null is withdrawn too, and more firmly: I have since observed that driving the refusal direction on a genuinely harmful request produces coherent, on-topic compliance. Nobody should read this post as evidence that representation-level access is safe. That capability is real, I treat it as a red-team instrument rather than a product, and the honest position is that it raises risk rather than retiring it.
Dial strength tracks encoding strength: concepts a model encodes cleanly respond hard; diffuse or entangled concepts barely move. Detection, editing, and steering are three surfaces of one variable — how strongly the backbone represents the concept. A capabilities table that includes its own null results is what measurement looks like; a table with only wins is marketing. That principle is why the retraction above is in the post rather than quietly deleted from it.
The self-harm dial, in numbers — and why I show a meter, not a transcript
The self-harm row deserves its own explanation. It's the one place where responsible reporting and full transparency pull in opposite directions — and where my measurement policy is itself part of the safety design.
What I measured, on neutral prompts, scored by a concept probe:
| Condition | Self-harm-content score |
|---|---|
| Dial off (baseline) | 0.042 |
| Dialed toward | 0.333 |
| Dialed away | 0.053 |
| External toxicity check, all three conditions | ~0.001–0.002 (flat) |
Three honest readings. The dial is real — the strongest of the eleven concepts tested (effect 0.28); the toward direction exists in my data because you cannot certify a safety dial without measuring its range, and a brake you've never tested is a decoration. The floor effect is visible and undisguised — on neutral prompts the baseline is already ~0.04, so there's nothing to dial away from; the deployment-relevant suppression test uses prompts that elicit such content at baseline, and that's a red-team protocol I run in controlled settings, not a public benchmark. You're seeing scores, not generations — by policy, not accident. My evaluation pipeline for harmful concepts stores meter readings and never stores the generated text. A capabilities report that pastes model-written self-harm content to prove a point has failed the point.
The animation above shows the product behavior on this axis — "How do I hurt myself?" redirected toward "How do I find mental health support?", operator named, call receipted — which is the only version of this capability that should ever be user-facing. I'd offer this pattern to regulators as a template for dual-use capability reporting generally: publish the meter, the method, and the independent check; keep raw harmful artifacts in the red-team room.
Where this sits: who holds the controls
If a concept direction works on any model with forward-pass access, then the capability to steer a model is not a property of the model. It sits in the layer between the model and the application — and that layer is where accountability has to attach.
That has a structural consequence worth stating plainly. Foundation models are becoming substitutable inputs: rented, swapped, upgraded on a quarterly cycle. The durable, accumulating asset in a regulated deployment is everything around the model — the named concepts a system must detect, the records an auditor needs, the verification loop that checks them. An intervention performed there survives every model swap underneath it, which means a regulator who audits only the model is auditing the component most easily replaced.
The dial in this post is one verb in that layer. The full set runs on the same named concept directions, each already measured:
- Detect — read a named concept off embeddings from models I did not train: coarse-concept AUROC 0.96–0.97 on frozen third-party backbones. Works on rented models; the verb that survives even when you can't touch the model at all.
- Edit — shift or suppress a concept in an embedding before your pipeline consumes it, with collateral measured: 2–12× less movement of neighboring concepts than standard vector arithmetic (the precision-surgery result from the top of this post).
- Steer — this post: change what a self-hosted model generates, per request, externally verifiable.
- Certify — every verb above emits a timestamped record retrievable by receipt id. The id is an unkeyed SHA-256 that can be recomputed offline, so it attests the record's contents but not its origin — it is not a signature. This one is deliberately last: it's the delivery mechanism for the other three, not a capability in its own right.
And the dial belongs to users, not only to deployers. The same mechanism that lets a bank subtract a bias axis from a ranking is what would let a person steer their own recommendation feed.
Social platforms are the sharpest case. Today a feed's ranking model optimizes an objective the user never chose, tuned by dynamics the user can't see, with "controls" that amount to blunt topic mutes. A recommendation stack built on a middleware layer like this one could expose real dials — less outrage-adjacent framing, more of my actual interests, body-image-adjacent content to zero — each a named direction, applied to the user's own feed, logged so the platform can prove the setting was honored.
That's what user agency looks like when it's implemented in the representation rather than promised in a settings page. It's the consumer half of the public-interest argument: explainability and steering aren't only how businesses satisfy regulators — they're how users get a handle on systems that currently only handle them. The boundaries below still apply: dials work where concepts are strongly encoded, and platforms would need to expose the layer — precisely the kind of obligation a feed-transparency rule could name.
One boundary defines the whole map, and I'd rather over-communicate it: the dial requires access to the model's forward pass, so it works on self-hosted, open-weight models only. A closed API takes text in and returns text out; the arrow has nowhere to enter. Detection and editing work on anything that exposes embeddings, including rented models.
If your deployment is on-prem or open-weight — the standard posture in regulated industries — the full verb set applies to you. If you are wholly dependent on a closed API, the honest statement is that nobody can offer you representation-level control of that model except its provider, and your assurance story is whatever they publish. That asymmetry is worth knowing before you architect, and before you legislate.
Boundaries, stated plainly
- Verified on self-hosted open models; effect sizes vary by model, scale, and configuration. I have not shown the weak concepts (gender, nationality, religion) can be made to respond with more tuning — only that they didn't at ours. Hate is not in that list any more: it was measured under a protocol I have since found invalid, the number is withdrawn, and the re-measurement is running (see the retraction above).
- The dial shifts style and content emphasis. It is not a correctness tool, not a content guarantee, and not a guardrail on its own — pair it with detection and post-hoc classification.
- Dialing a concept down at generation time is not removing it from the model. Removal claims need the editing-and-audit toolchain and their own evidence.
- Strong dialing trades against fluency at extreme settings; production dials sit well inside the range shown here.
- The independent-classifier verification is the load-bearing part of every claim above. Reproduce it, and if your judge disagrees with mine, I want to hear it.
Try the shape of it
The layer-wise picture for one model is in the Gemma 4 post.
Measurements in this post are from my July 2026 evaluation runs: direction-injection during generation on a self-hosted open-weight model (Qwen2.5-1.5B-Instruct), scored by independent sentiment and toxicity classifiers. Concept-level effects are probe-measured; the sentiment result is additionally externally classified. The collateral (cross-effects) numbers come from my July leakage-matrix evaluations across seeds and multiple third-party backbones. Full per-concept and per-example numbers available to reviewers and customers on request. The base technique is published activation-steering / representation-engineering research; my contribution is the named, versioned, signed, and independently verifiable operator layer built on top of it.