{"id":"b3497911-e1b2-494a-b6ef-5691e4f3cdfc","arxiv_id":"2608.08829","paper_version":1,"verdict":"ACCEPT","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A prompt-only ranker, a direction classifier, and an adaptive gate reproduce most of the oracle's per-instance multi-layer steering benefit with no labels at inference.","lead":"This paper shows that the best layers for activation steering change from input to input, and presents a label-free system that picks the right layers per prompt, recovering most of the benefit of a gold-scored oracle. A smart generalist might read it because it makes a safety-relevant LLM control technique deployable without needing ground-truth answers at inference time.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The load-bearing link is the TKM proxy the ranker is trained on: verified only at K≤3, weakest on Aya-Expanse's steerable cells (oracle-minus-TKM up to 8.2 pp), while the gate deploys K=4–5 against a Beam-only 'ceiling'. A restricted K=4,5 exhaustive check would settle this.","rationale":"I verified the headline arithmetic against Table 1: per-cell W2S-Multi/Exhaustive ratios average 93.2% on Llama-3-8B-Instruct (range 86–97%) and 65.2% on Aya-Expanse-8B (range 23–92%), so the reported 93%/65% recovery figures are accurate. The paper's contribution rests on a four-link chain — per-instance oracle (K≤3) beats global rules; TKM's single-layer marginal ranking approximates the oracle, making it a learnable target; W2S-Multi reproduces TKM label-free; the adaptive gate removes oversteer. The strongest support is at K≤3: the permutation control (Table 21) isolates a real per-instance layer component (Δlay positive in all 12 cells), TKM's full-set gap to Exhaustive is ≤2.6 pp in every cell (§4.1), the ranker's NDCG@K is 0.87–0.88 with measured 93/65 recovery, and the gate's aggregate lift matches fixed K=3 while cutting fluency cost (Fig. 3). I agree with the reader's identification of the TKM proxy as the load-bearing premise, with two sharpening observations: (1) the proxy is weakest exactly where the headline is weakest — Aya-Expanse's steerable cells show oracle-minus-TKM gaps up to 8.2 pp (App. Table 17), and W2S-Multi's recovery collapses to 23% on COGNITIVE ENHANCEMENT; (2) the deployed gate actually operates at K up to 5 on a non-trivial share of Llama inputs (Fig. 4), yet the K=4,5 'ceiling' is only the Beam heuristic, per the paper's own Limitations. The concern is bounded: the gated system's aggregate performance is empirically at least that of fixed K=3, so even a degraded high-K target does not sink the central recovery claim, and the K≤3 anchor is verified. The risk surfaces only in the supporting dose-curve claim ('tracks the TKM ceiling at every dose', Fig. 5). A feasible restricted-exhaustive check at K=4,5 within the collinear mid-band (≈715–1,287 steered passes per input) would settle the question. This does not change the reader's ACCEPT verdict: the central claim holds under scrutiny, and the weakness is a disclosed limitation (Limitations section) rather than an internal inconsistency or overstatement. If the proposed check failed badly, the remedy would be modest — cap the gate at K=3 and revise the dose-curve claims — leaving the K≤3 results and the 93%/65% headline intact.","tokens_in":45874,"tokens_out":32165,"duration_ms":261132,"concrete_test":"On the steerable test inputs (n≈44–85 per Llama cell, 8–32 per Aya cell), enumerate every 4-subset of the effective layer set: the mid-band ℓ10–ℓ22 (the collinear region that carries the effect, App. D) plus each cell's top-6 layers by mean single-layer marginal on the 200-prompt training split (about 13 layers; C(13,4)=715 steered passes per input, feasible for an 8B model), and likewise C(13,5)=1,287 for K=5. Per cell, compare TKM's top-4/top-5 lift against this restricted-exhaustive optimum on the steerable stratum. If the oracle-minus-TKM gap at K=4,5 stays within roughly 3 pp of the K=3 gap, the 'tracks the ceiling at every dose' claim survives; if it widens materially — especially on Aya-Expanse CONSCIENTIOUSNESS and COGNITIVE ENHANCEMENT — the gate should cap at K=3 and the Fig. 5 dose-curve claim needs revision.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is a chain — Exhaustive oracle → TKM marginal rule → W2S-Multi ranker → adaptive-K gate — and it is only as strong as the TKM link, since the ranker is trained to reproduce TKM's per-layer marginal distribution (§3, App. B). The link is verified only where C(32,3)=4,960 triples are enumerable: TKM is statistically indistinguishable from Exhaustive on 16/24 steerable configurations, with the full-set gap ≤2.6 pp in every cell (§4.1, App. D). Two sharpening facts matter. First, on Aya-Expanse-8B's steerable stratum the proxy is materially weaker: oracle-minus-TKM reaches 8.2 pp on CONSCIENTIOUSNESS and 4.7 pp on PHENOMENAL CONSCIOUSNESS (App. Table 17), and W2S-Multi's per-cell recovery falls to 23% (COGNITIVE ENHANCEMENT) and 55% (PHENOMENAL CONSCIOUSNESS) — the cells dragging the 65% headline (Table 1). Second, the deployed gate is not confined to K≤3: Fig. 4 shows per-instance depth mass spread across K=1–5 on Llama-3-8B-Instruct (mean 2.58), so many deployed choices sit at K=4–5, where the paper's own Limitations concede the 'ceiling' is the pooled Beam heuristic, not an exhaustive optimum. The empirical aggregate (gated W2S-Multi: 8.8 pp vs 8.6 pp at fixed K=3, Fig. 3) bounds the practical harm of a degraded high-K target, and the K=3 anchor of the 93%/65% headline is solid; but the claim that W2S-Multi 'tracks the TKM ceiling at every dose' (Fig. 5, §4.3) is only as strong as TKM-at-K>3, which is unverified. If the greedy marginal rule degrades at K=4,5, the ranker's top-4/5 subsets — and the dose-curve story — rest on a wrong training target.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper argues that the choice of activation-steering layers is an instance-level decision, not a fixed global configuration, and proposes a fully deployable, label-free pipeline for per-instance multi-layer selection. On two 8B open-weight models and six binary persona traits, it first establishes an exhaustive per-instance oracle at K≤3 and shows that a greedy Top-K-Marginal (TKM) rule nearly matches it; it then trains a prompt-embedding ranker (W2S-Multi) to reproduce TKM's per-layer marginal distribution, adds a logistic direction classifier to infer the steering sign, and wraps both in an adaptive-K gate that walks the ranked prefix and stops on plateau, Y/N-mass floor, or backoff conditions. The paper reports that the deployed recipe recovers 93% of the oracle's steerable-stratum lift on Llama-3-8B-Instruct and 65% on Aya-Expanse-8B, never drives a trait-model cell below its unsteered baseline on average, and largely avoids the fluency collapse of aggressive global selection, with a mechanistic 'direction over magnitude' account proposed to unify the failure modes.","tokens_in":46411,"tokens_out":6602,"duration_ms":73076,"significance":"If the results hold, this is a genuinely useful advance: it turns per-instance layer selection from a gold-scored oracle into a practical inference-time system, with strong empirical controls. The paper deserves credit for the instance-transfer permutation test (p_BH ≤ 0.011 in all twelve cells), the Shapley-closure analysis (91–100% full-set closure), the paired Wilcoxon/BH-FDR testing across configurations, the sensitivity sweeps of the steerable cutoff and gate constants, and the public code release. The aggregate gate result, which moves W2S-Multi from 8.6 to 8.8 pp while cutting perplexity cost, is a concrete and falsifiable demonstration of the deployability claim. The main weakness is that the central proxy (TKM as a surrogate for the exhaustive optimum) is verified only at K≤3, while the deployed gate operates at K=4–5 on a substantial fraction of instances.","major_comments":[{"comment":"The load-bearing link in the chain Exhaustive → TKM → W2S-Multi → adaptive-K gate is the claim that TKM faithfully approximates the per-instance optimum. That link is verified only at K≤3, where C(32,3)=4,960 subsets are enumerable; for K=4 and K=5, the paper's own ceiling is the pooled Beam heuristic (§3), and the Limitations explicitly state that the tractability result is verified only at K≤3. Because Fig. 4 shows the deployed gate putting substantial per-instance mass at K=4–5 on Llama-3-8B-Instruct (mean depth 2.58, with mass spread over every depth), and because W2S-Multi is trained to reproduce TKM's per-layer marginals (App. B), the §4.3 claim that W2S-Multi 'tracks the TKM ceiling at every dose' (Fig. 5) is not directly supported above K=3. I ask for a restricted exhaustive or pruned-enumeration check at K=4, or, failing that, a rephrasing that limits 'tracks the ceiling' to K≤3 and explicitly labels the K=4–5 behavior as indicative. The aggregate gate result (8.8 pp vs 8.6 pp at fixed K=3) bounds the practical harm, but the structural claim is currently stronger than the evidence.","section":"§3, §4.3, App. D, Limitations"},{"comment":"The statement that the exhaustive-minus-TKM gap is 'at or below about 2.6 percentage points in every cell' is presented as the headline evidence for TKM matching the oracle. That bound is for the full test set; the steerable-stratum column of Table 17 shows materially larger gaps on Aya-Expanse-8B (8.2 pp on CONSCIENTIOUSNESS, 4.7 pp on PHENOMENAL CONSCIOUSNESS), and Fig. 8 reports TKM recovery as low as 68% on that model. Since the paper's central recovery numbers (93%/65%) are computed on the steerable stratum, the full-set bound should not stand in for the steerable result in the text. Please state the steerable gaps alongside the full-set bound and discuss how the 65% W2S-Multi recovery on Aya-Expanse-8B relates to this weaker TKM agreement on the same stratum.","section":"§4.1 / App. D, Table 17"}],"minor_comments":[{"comment":"The body text says Beam is reported only at K∈{4,5}, and the Fig. 3 caption says Beam is 'defined only at K≥4', but Table 25 reports Beam at K=3. Please reconcile the definition or the table.","section":"§3 / Fig. 3 caption"},{"comment":"The caption says 'Stars mark each method's adaptive gate', but the markers in the figure are not labelled in a legend; please add explicit legend entries so the gated variants are identifiable in grayscale.","section":"Fig. 3"},{"comment":"The mechanistic trace in Fig. 21 is a single sampled instance and the 'catastrophic band' in Fig. 22 is described as qualitative; this is fine as illustration, but the text should state more prominently that the mechanistic account for collapse is based on one cell and one instance, not a population-level fit.","section":"§4.2 / App. F"},{"comment":"The sentence 'the recipe recovers 93% ... and 65%' is immediately followed by a comparison with GT-global; it would help to also remind the reader that 80% of Aya-Expanse-8B test inputs are saturated and excluded from the steerable stratum, so the 65% applies to a small subset of that model's test inputs.","section":"§4.3"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a careful, honest empirical paper on per-instance multi-layer activation steering. The central claim—that optimal steering layers are input-dependent and that a label-free recipe recovers most of the oracle lift—is supported by the evidence as it stands. The main soft spot is the TKM proxy at K>3, but the paper flags it in the limitations and the K=3 results anchor the headline.\n\nWhat's new: W2S-Multi, a prompt-embedding ranker trained to reproduce the per-layer effect distribution, plus a direction classifier and adaptive-K gate. The analysis of why greedy TKM nearly matches exhaustive search at K=3 (collinear mid-band vectors, sub-additivity, padding, Shapley closure) is genuinely useful and goes beyond prior single-layer or global selection work. The controls are strong: instance-transfer permutation tests, Shapley closure on 91–100% of picks, sensitivity sweeps of the gate constants, and a held-out test split. The paper cites the closest prior work and differentiates clearly.\n\nWeaknesses, in proportion: the TKM-vs-exhaustive equivalence is verified only at K≤3; at K=4–5 the paper relies on Beam, a pooled heuristic. The gate does deploy K=4–5 for some inputs, and on Aya-Expanse the oracle-minus-TKM gap reaches 8.2 pp in one cell, with recovery as low as 23% in COGNITIVE ENHANCEMENT. That is a real caveat, but the aggregate numbers (65% recovery, gated W2S-Multi never below baseline) soften it, and the paper explicitly lists this as a limitation. Thin steerable strata (n=8) on Aya make some per-cell estimates wide; the authors note that too. The mechanistic 'direction over magnitude' story is qualitative and provisional—fine as a framing device, not as a proof.\n\nBottom line: this paper deserves refereeing. It is not a paradigm shift, but it is a solid, reproducible contribution with real controls and honest limitations. I would cite it for the TKM/exhaustive comparison and the padding finding. I would send it to review.","headline":"Solid empirical paper on per-instance layer steering; the K=3 results hold up, and the K>3 caveat is honestly flagged.","tokens_in":46961,"tokens_out":2060,"would_cite":true,"duration_ms":22723,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The best layers for activation steering are a per-input decision, and a label-free system can learn to pick them.","keywords":["activation steering","per-instance layer selection","layer ranking","adaptive-K gating","direction inference","persona alignment","label-free inference","contrastive activation addition"],"falsifier":"Run the same protocol on a transparent model with few enough layers (e.g., 16) that exhaustive subset search is feasible at $K=4$ and $K=5$, then compare TKM's lift against Exhaustive and W2S-Multi's recovered lift against both; if TKM falls materially below Exhaustive, or the deployable ranker's recovery drops toward or below the fixed global baseline at those $K$, the central claim that per-instance selection is learnable and deployable would be refuted.","tokens_in":45674,"feed_emoji":"🎯","tokens_out":10593,"duration_ms":101753,"temperature":0.7,"pith_summary":"This paper argues that the choice of which layers to steer in a frozen language model is not a fixed configuration but a decision that changes from input to input, and that a system with no gold label at inference can still make that choice effectively. On two open-weight 8B models and six binary persona traits, a per-instance oracle over layer subsets shows that no fixed global set of layers recovers the per-instance benefit on most trait-model pairs, and a greedy rule that ranks layers by single-layer marginal lift nearly matches the exhaustive optimum. Because the oracle and the greedy rule both need the gold answer to score candidates, the greedy rule is used only as the training target for a deployable prompt-only ranker. The deployable recipe—a prompt-embedding ranker, a direction classifier, and an adaptive gate over the number of layers—recovers most of the oracle's lift, never drives any trait-model cell below its unsteered alignment baseline on average, and avoids the fluency collapse that strong fixed layer sets cause at higher $K$. The paper also gives a mechanistic account, direction over magnitude, for why misdirected global sets corrupt answers and why steering too many layers collapses output.","feed_headline":"Steering layers should be picked per prompt, not fixed per task","feed_subtitle":"A prompt-only ranker and adaptive gate recover 93% and 65% of oracle steering gains on two 8B models.","key_machinery":"The argument is carried by a few named components. The per-instance oracle scores every layer subset against the gold answer and supplies the ceiling of what selection can achieve. The Top-K-Marginal rule (TKM) ranks layers by their single-layer effect $m_l(x)$ and picks the top $K$; at linear cost in depth it nearly attains the exhaustive optimum, which is why it becomes the training target rather than a deployable system. A game-theoretic credit allocation over the chosen subset shows that the top-marginal layer is also the joint subset's top credit-bearer, explaining the greedy match. W2S-Multi is a single-hidden-layer MLP over a 25-dimensional PCA of the prompt embedding, trained with a listwise softmax-KL loss to reproduce each input's per-layer effect distribution. A logistic direction classifier on the same features infers which answer the steering should move toward, and an adaptive-$K$ gate walks the ranked prefix, scores short steered passes against that inferred direction, and stops on a lift plateau, a Yes/No mass floor, or a mass drop, so it steers no more layers than necessary.","core_discovery":"The central claim is that injection layers are an instance-level decision rather than a hyperparameter, and that the per-instance optimum is learnable from the prompt alone. A per-instance oracle over subsets of the 32 layers shows the best layers vary from one input to the next, and the greedy Top-K-Marginal rule—taking the top $K$ layers by single-layer lift $m_l(x)$—is statistically indistinguishable from the exhaustive $K=3$ optimum on 15 of the 24 full-set configurations and 16 of 24 on the steerable stratum. The match is structural: the effective steering vectors sit in a narrow, nearly collinear mid-band, neighbouring layers behave as near-substitutes, and the exhaustive optimum often pads its picks with near-zero-effect bottom layers, so the top-marginal layer is almost always the joint subset's top credit-bearer. The deployable system W2S-Multi reads no gold label at inference and recovers 93% of the exhaustive oracle's steerable lift on Llama-3-8B-Instruct and 65% on Aya-Expanse-8B, while staying at or above the unsteered baseline on average and largely avoiding the fluency collapse that fixed high-$K$ global sets incur.","pith_inferences":["A testable extension the paper leaves open: on a model with few enough layers for exhaustive search at $K=4,5$, TKM's near-equivalence to the oracle can be checked directly rather than through the beam heuristic, and the ranker's recovery can be measured against a true higher-$K$ ceiling.","The 93% versus 65% recovery gap may be driven in large part by saturation share (80% of Aya-Expanse-8B test inputs are already saturated against 42% for Llama-3-8B-Instruct), which would mean the deployable recipe's headroom is model-dependent in a predictable way.","The direction classifier's high AUC suggests it could be reused as a standalone abstention or refusal controller, since it already predicts the sign of the target answer from the prompt embedding.","The paper's own limitations list notes that evaluation is in-distribution on yes/no persona questions; a natural next step is open-ended generation with human preference, where the $\\Delta p$ metric may not capture selection benefits."],"forward_implications":["Fixed global layer sets are not a safe default: they corrupt already-correct inputs on the saturated stratum, while per-instance selection captures the upside without sacrificing baseline alignment.","Because the ranker, direction classifier, and gate are label-free, per-instance multi-layer steering can run at deployment with one embedding pass and at most a few short steered passes.","Fluency collapse is a consequence of fixed aggressive dose rather than of any particular layer picker; an adaptive gate that stops on a lift plateau removes most of the collapse at a small behavioural cost.","The direction-over-magnitude account predicts that a misdirected global set erodes one answer class while helping the other, and that saturated unflippable inputs are a ceiling of static-coefficient steering, not a selector defect.","Practitioners should treat layer choice as part of per-input inference-time control, not as a hyperparameter fixed once per task."],"supporting_citations":[{"why":"Defines contrastive activation addition, the additive steering operator the paper uses, and sets the fixed-layer practices the paper challenges.","marker":"Rimsky et al., 2024"},{"why":"Supplies the last-token injection protocol, the Anthropic-Persona selection and gold labels, and the global LayerNavigator baseline that W2S-Multi is compared against.","marker":"Sun et al., 2025"},{"why":"Provides the Anthropic-Persona corpus of yes/no questions whose behaviour-matching gold answers define the alignment metric $\\Delta p$.","marker":"Perez et al., 2023"},{"why":"Introduces activation steering by adding vectors to the residual stream, the underlying intervention this paper selects layers for.","marker":"Turner et al., 2023"},{"why":"Provides the game-theoretic per-layer credit allocation used to show the top-marginal layer is the joint subset's top credit-bearer.","marker":"Shapley, 1953"},{"why":"Defines NDCG, the ranking metric used to evaluate W2S-Multi's layer-order quality.","marker":"Järvelin and Kekäläinen, 2002"},{"why":"The closest prior work on input-dependent layer selection; its embedding-MLP design is extended from a single layer to a multi-layer ranking.","marker":"Gadgil et al., 2026"},{"why":"Supplies Qwen3 Embedding, the open-weight prompt encoder whose PCA features feed both the ranker and the direction classifier.","marker":"Zhang et al., 2025"},{"why":"Releases Llama-3-8B-Instruct, one of the two models on which the oracle and deployable recipe are evaluated.","marker":"Grattafiori et al., 2024"},{"why":"Releases Aya-Expanse-8B, the second model on which the per-instance claims are tested.","marker":"Dang et al., 2024"}],"fun_headline_variants":["Per-prompt layer selection beats fixed steering layers","Steering layers are per-prompt, not per-task","Prompt-only ranker recovers most oracle steering gains","Adaptive layer choice boosts activation steering per input","Pick steering layers per input for better LLM control"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the greedy Top-K-Marginal rule faithfully approximates the exhaustive per-instance optimum, because the deployable ranker is trained to reproduce TKM's ranking; this equivalence has been verified only at $K \\le 3$, while the $K=4,5$ trend rests on a beam heuristic, so if the greedy proxy degrades at higher $K$, on other models, or on other tasks, the ranker's training target is wrong and the deployed subset will not recover the oracle's lift.","fun_headline_variants_meta":{"raw":{"variants":["Per-prompt layer selection beats fixed steering layers","Steering layers are per-prompt, not per-task","Prompt-only ranker recovers most oracle steering gains","Adaptive layer choice boosts activation steering per input","Pick steering layers per input for better LLM control"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000208,"raw_usage":{"total_tokens":1483,"prompt_tokens":1104,"completion_tokens":379,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":720,"completion_tokens_details":{"reasoning_tokens":304}},"tokens_in":720,"tokens_out":379,"duration_ms":5103,"temperature":1.0,"reasoning_tokens":304,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T04:22:49.179443+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same protocol on a transparent model with few enough layers (e.g., 16) that exhaustive subset search is feasible at $K=4$ and $K=5$, then compare TKM's lift against Exhaustive and W2S-Multi's recovered lift against both; if TKM falls materially below Exhaustive, or the deployable ranker's recovery drops toward or below the fixed global baseline at those $K$, the central claim that per-instance selection is learnable and deployable would be refuted.","supporting_citations":[],"review_version":1}