AI summaryⓘ
The authors studied how a technique called additive activation steering, which nudges AI language models during single-turn chats, works when these models are used as agents that interact with tools (called ReAct agents). They found that while the steering signals appear strongly inside the models at late processing stages across different setups, the actual effect on the AI's behavior changes depending on the model and context. In some cases, the models became more likely to ignore refusals (refusal bypass) and in others less likely, showing no consistent pattern. Their work highlights that deploying these AI models as agents can unpredictably increase or decrease the impact of steering methods, which is important for safety considerations.
Additive activation steeringReAct agentsTool use in language modelsBehavioral couplingRefusal bypassLatent space directionKV-cache contaminationDirectional ablationModel safetyActivation injection
Abstract
Additive activation steering (injecting a scaled residual-stream direction during generation) is calibrated almost entirely in single-turn chat, yet the models it targets are increasingly deployed as tool-using ReAct agents. We present the first systematic chat-to-agent transfer study of additive steering, coupling behavioral measurement with a representation read-out in a matched-information design: the same items rendered as plain chat or as a ReAct tool-use episode, with matched-norm random-direction controls and the transcript re-encoded every turn to exclude KV-cache contamination. Transfer is real but rescaled, and the right description is a dissociation: the injected direction reaches the late layers at near-full strength in every setting and model tested (install-site agent-over-chat ratios 0.83-1.16 across three families), while the behavioral coupling is reset per model and context. On Qwen2.5-7B a refusal bypass vector amplifies in the agent (T = 1.45, CI [1.20, 1.78], N = 300); across a powered uniform-protocol distribution the coupling spans amplification (Gemma-2-9B T = 2.00) to attenuation (Yi-1.5-9B T = 0.43, CI [0.29, 0.60]), with no universal constant and a single clean attenuator against a universal sign. Directional ablation of the same axis does not amplify (T = 0.93, CI including 1) while additive injection amplifies (T = 1.50), a 20.1-point gain difference (CI [13.4, 26.8]) that identifies an additive-specific mechanism. Two pre-registered instruments converge to localize the rescaling to the ReAct format scaffold, before any tool observation, rather than to the observation boundary where a dilution account would predict it. The safety implication is immediate and unpredictable: agentic deployment amplifies steering-based refusal bypass by up to 2.00x on some models while others attenuate, so a deployment cannot assume a given model is safe under additive steering.