Researchers have built a tool that automates one of the fiddlier jobs in AI safety work: figuring out exactly where and how hard to push on a language model's internals to change its behavior.
Activation steering - nudging a model's outputs by tweaking its internal activations - has mostly relied on trial and error to find the right intervention points. The new framework, called Deep Noir, uses two mechanistic techniques (logit lens convergence and causal head-level attribution) to pick those points automatically. Tested across nine models ranging from 1 billion to 9 billion parameters, it improved spam classification by 16.7 percentage points at the small end and 21 to 42 points at the 7-9B range, with no code changes required per model. On sentiment classification, it beat a prior method called RepE, which failed to improve results at all once head masking was removed.
The more interesting finding is buried in the fine print: the same steering strength that makes models easier to control also makes them easier to attack. The paper reports that vulnerability to prompt injection rises in lockstep with steering magnitude, meaning the fix for one weakness could open another.
That tradeoff is worth sitting with. Any team steering classifiers inside an agent pipeline just inherited a new attack surface, not just a performance boost.