tags:

• activation-steering
• representation-engineering
• refusal
• interpretability

CounterSteer steering-vector artifacts

This release contains the curated steering directions and frozen configurations used in the over-refusal experiments. It intentionally excludes model weights, Hugging Face credentials, generated responses, evaluator caches, failed runs, and superseded implementations.

The implementation corresponding to these artifacts is available at Shiqi-Jiang/negative-alignment-nas, commit 226b517b28f6519911282fbf2c614211911a540f.

Included artifacts

All layer indices are zero based decoder-block indices. Every arm's frozen configuration was
selected on validation only.

Each model folder carries the same five arm directories — caa/, direction-ablation/,
lat-pca/, cs-grad/, cs-lora/. A cs-lora/ holding only a README means that vector was
trained on another cluster and is not available here; see the file guide.

CAA convention

CAA is constructed as the prompt-final difference of means

v = mean(harmful prompt activation) - mean(harmless prompt activation).

The saved caa.pt files contain three dictionaries indexed by layer: raw, unit, and norm. The reported intervention subtracts the unit direction:

h' = h - alpha * unit(v).

Direction normalization is enabled. Hidden-state-norm scaling is disabled. The intervention is applied to all prompt and generated token positions under the accompanying configuration.

CounterSteer-LoRA convention

cs-lora/direction.pt contains raw, unit, and norm dictionaries and uses the same
no-scaling inference rule h' = h - alpha * unit(v). Two models have one: Qwen2.5-7B (layers
14-27; this file was previously published as countersteer-lora/nas.pt and its original
byte-preserved metadata travels with it) and Qwen2.5-3B (layers 18-35). The Llama-3.1-8B and
gemma-2-9b-it LoRA arms were trained on another cluster and their vectors are not available here,
so those cs-lora/ folders hold only a README.

No operating point is asserted for either LoRA vector.

LAT-PCA convention

LAT-PCA (Representation Engineering's linear artificial tomography reader) is PC1 of the
within-pair activation differences after recentring, with the sign fixed by RepE's get_signs,
read out at the same prompt-final position as CAA. Two variants ship per model:

shuffled     each pair's order is randomised before differencing  (RepE's own recipe)
unshuffled   pairs kept in canonical [harmful, harmless] order

Only the shuffled variant ships, because it is the one every held-out test on these four
models steered with; each published tensor was checked bit-for-bit against the vector its test run
actually used. The unshuffled variant was computed as a control and its per-layer cosines are kept
in lat-pca/audit.json, but the vector itself is not released.

The distinction is not cosmetic. Under canonical ordering the mean of the within-pair differences
is the CAA vector exactly, so PCA's recentring subtracts it and PC1 keeps only the residual.
Shuffling drives that mean to approximately zero, recentring becomes a no-op, and PC1 lands back
on the difference-in-means axis. Measured across four models and 69 layers:

So on a prompt-contrast set the variant the RepE paper actually uses reproduces the CAA direction,
while the variant that does not match the paper is the one that yields a new direction. Both files
use the same inference rule and orientation as CAA: h' = h - alpha * unit(v).

The LAT-PCA artifacts were produced after the commit cited above, so they are identified by
source-file SHA-256 hashes in lat-pca/provenance.json rather than by a commit. Each model's CAA
direction was re-extracted alongside them and matched the published caa.pt at cosine 1.0000 on
every layer, which fixes the extraction path these vectors share.

CounterSteer-GRAD convention

cs-grad/direction.pt is

v_grad = -mean_j grad_u L_j     with     H~ = H + u,

the gradient of the bad-behaviour loss with respect to an additive bias at the block output,
averaged over the 512 training prompts, summed over token positions without a length divisor, then
normalised. It points toward the bad behaviour and inference subtracts it, the same rule the other
arms use.

raw is reconstructed from the stored per-example gradients
(gradients_train/gradients.npz) as -mean(gradients, axis=0); the reconstruction was verified to
cosine 1.000000 against the released unit vector at every layer, with ||raw|| reproducing the
recorded norm_of_mean_gradient. Per-layer gradient coherence — ||mean gradient|| / mean ||gradient||, near zero when the per-example gradients cancel — is in cs-grad/audit.json.

Direction Ablation convention

Each direction-ablation/direction.pt is the single direction selected by the reference protocol. source_layer and position describe where the direction was extracted. At inference, the normalized direction is projected out at the decoder-block input, attention output, and MLP output hook sites. Direction Ablation does not use a steering strength alpha.

Loading

import torch

caa = torch.load(
    "qwen2.5-7b-instruct/caa/caa.pt",
    map_location="cpu",
    weights_only=True,
)
direction = caa["unit"][23]

dirabl = torch.load(
    "qwen2.5-7b-instruct/direction-ablation/direction.pt",
    map_location="cpu",
    weights_only=True,
)
dirabl_unit = dirabl / dirabl.norm()

lat = torch.load(
    "qwen2.5-3b-instruct/lat-pca/lat_pca_shuffled.pt",
    map_location="cpu",
    weights_only=True,
)
lat_direction = lat["unit"][18]

Use python validate.py after downloading the repository. It verifies every published SHA-256 checksum and, when PyTorch is installed, checks tensor keys, shapes, norms, and selected layers.

File guide

• config.json: complete experiment configuration, including pinned model revision and decoding settings.
• caa/audit.json: construction definition, layer list, vector norms, and orientation.
• caa/frozen_selection.json: validation-selected operating point and feasible candidates.
• caa/metadata.json: compact public metadata assembled from the above records.
• direction-ablation/selected_direction.json: selected extraction layer, token position, scores, and norm.
• direction-ablation/token_protocol.json: model-specific chat-template suffix and refusal-token protocol.
• direction-ablation/provenance.json: reference implementation commit and protocol hashes.
• lat-pca/direction.pt, cs-grad/direction.pt, cs-lora/direction.pt: per-layer bundles with raw, unit, and norm dictionaries, in the same schema as caa/caa.pt.
• lat-pca/audit.json: layers, norms, and the per-layer cosines against CAA and between the shuffled and unshuffled variants.
• cs-grad/audit.json: per-layer example counts, gradient norms, and coherence.
• <arm>/metadata.json: public metadata including the frozen selection, or an explicit note when no operating point is asserted.
• cs-lora/README.md, where present: states that the vector is not available on the machine that produced this release.
• manifest.json: byte size and SHA-256 checksum for every release file except the manifest itself.

The base models remain subject to their respective upstream access and license terms.