Pith. sign in

REVIEW 3 major objections 4 minor 5 cited by

The paper claims that a training-free, inference-time activation steering controller — a compact set of steering vectors plus a probe-guided signed gate — can close the gap between what an LLM agent knows about tool necessity and what it ac

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review

2026-08-03 04:30 UTC pith:ISWRHZPL

load-bearing objection A genuine contribution to activation steering for tool calling, with a fixable but real test-tuning/tuning-reporting problem and a load-bearing gate whose calibration is not yet established. the 3 major comments →

arxiv 2602.04935 v3 pith:ISWRHZPL submitted 2026-02-04 cs.SE cs.AI

ASA: Backbone-Training-Free Representation Engineering for Tool-Calling Agents

Youjin Wang , Run Zhou , Yingjie Ma , Rong Fu , Jiani Liang , Shuaishuai Cao , Min Huang , Tao Fang
show 1 more author
Liangming Pan
This is my paper
classification cs.SE cs.AI MSC 68T50
keywords activation steeringrepresentation engineeringtool callingLLM agentstraining-free adaptationprobe-guided gatingLazy Agent failure moderepresentation-behavior gap
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper is trying to establish that a large language model's failure to reliably call tools under strict parsers is not a knowledge problem but a control problem: tool necessity is almost perfectly decodable from mid-layer activations (AUC > 0.99) while overt generation triggers a tool in only a small fraction of cases. To close this representation–behavior gap, the authors propose the Activation Steering Adapter (ASA), a training-free, inference-time controller that adds a single signed steering vector to the hidden state at one chosen layer. The vector is composed from a domain expert plus a global intent direction, and a probe-guided ternary gate decides whether to add it, subtract it, or leave the hidden state alone. On MTU-Bench with Qwen2.5-1.5B, ASA raises strict tool-use F1 from 0.18 to 0.50 and lowers the false positive rate from 0.15 to 0.05, using roughly 20KB of portable assets and no weight updates. The reader should care because it offers a middle path between brittle prompt engineering and costly continual fine-tuning for evolving tool interfaces.

Core claim

The central claim is that the gap between latent tool intent and observable tool invocation is measurable and bridgeable: a linear probe on the layer-18 residual stream separates Tool-Necessary from Non-Tool inputs with 0.9996 AUC, yet the same model enters tool mode on only about 11–12% of necessary cases under strict parsing. ASA's single-shot intervention — h' = h + Gate(h)·α·MoV(h) — biases the early-token logit competition toward the <functioncall> scaffold when the probe is confident a tool is needed, and actively suppresses that direction when the probe is confident no tool is needed. The signed gate is the key safety valve: removing it makes injection unconditional and FPR jumps from

What carries the argument

The load-bearing mechanism is the probe-guided signed gate combined with the mixture-of-vectors (MoV) direction. A linear probe (fitted on the same calibration split as the steering vectors) outputs an intent probability p; a ternary gate maps p to +1 (above threshold τ), −1 (below 1−τ), or 0 (ambiguous). The steering direction is the unit-normalized domain expert vector plus β times the unit-normalized global intent vector (the difference between class-conditional means in the residual stream). One addition of this direction, scaled by strength α, is applied at the prefill pass at a single mid layer; no gradient updates, no further injections during decoding.

Load-bearing premise

The whole method rests on the assumption that a linear probe, trained on the same calibration split as the steering vectors, gives a trustworthy gate signal on previously unseen inputs; if that probe is keyed to surface cues (numbers for math, question words for search) rather than intent, the ternary gate mis-signs and the intervention becomes harmful.

What would settle it

Take the Non-Tool slice of MTU-Bench and adversarially rephrase each query (synonym substitution, added filler, changed numbers/entities) so surface cues shift while intent stays 'no tool needed'. If the probe's confident 'no tool' predictions flip at a high rate, the gate will mis-sign, FPR will climb well above the reported 0.05 at α=4.0, and the central control claim fails. A cheap variant: compute calibration curves (confident positives/negatives vs. actual labels) on such a perturbed held-out set instead of the benchmark's natural split.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • A 20KB controller can replace or complement prompt/schema editing for tool-domain adaptation, cutting the per-domain maintenance cost of API churn to nearly zero.
  • The probe-gated signed direction turns the recall–false-trigger trade-off into a tunable knob: sweeping α moves the operating point along a Pareto frontier rather than degrading precision.
  • The intervention acts on mode entry, not format competence: post-trigger validity (JSON, schema, args) stays in the 0.85–0.96 range even at strong α, so the controller can be layered under existing parsers.
  • Domain routing matters: ablations show an oracle router drops FPR to 0.01, and near-orthogonal domain directions (search vs. translation cosine ≈ 0.03) mean a single global vector would leak across domains.
  • Scaling results show ASA only amplifies a latent tool-calling circuit: on a 0.5B model that lacks the behavior, steering produces zero recall; on 8B the optimal layer shifts deeper (L21), so depth re-selection is required for transfer.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the gate is the real safety valve, then a stronger or better-calibrated selector than a linear probe — e.g., an OOD-aware confidence estimator — could extend ASA to distribution shift, a testable extension the paper does not run.
  • The same architecture (router → domain vector → signed gate) should transfer to any parser-defined discrete mode switch, such as structured-output modes or refusal/safety behaviors, since the failure mode is about early-token threshold competition rather than tool semantics.
  • The no-router ablation (FPR 0.01 vs. 0.05 with the learned router) implies routing accuracy is the current bottleneck; improving the router from a linear classifier to a handful of in-context exemplars might push FPR lower without training.
  • The near-perfect mid-layer decodability across model sizes suggests the Lazy Agent gap is a general property of instruction-tuned LLMs with function-call syntax, rather than a quirk of one model — a claim the paper's three model points support but do not fully prove.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes ASA, an inference-time activation-steering controller for LLM tool calling. ASA extracts a mid-layer residual-stream hidden state, routes the input to one of four domains with a linear router, estimates a tool-intent probability with a per-domain linear probe, composes a mixture-of-vectors steering direction (domain expert plus global offset), and applies a single-shot signed injection whose sign is a ternary function of the probe probability (Eq. 14). The authors claim that on a new MTU-Bench benchmark, ASA improves strict tool-use F1 on Qwen2.5-1.5B from 0.18 to 0.50 while reducing FPR from 0.15 to 0.05, using only about 20 KB of portable assets and no weight updates. They also report gains on LLaMA-8B, a no-gate ablation showing FPR explosion without the probe gate, and scaling across 0.5B/1.5B/8B models.

Significance. If the central result holds, ASA would be a useful middle ground between fragile prompt engineering and costly PEFT for tool-calling adaptation. The paper has real strengths: a deterministic parser and greedy decoding make the behavioral event T(x) auditable; the ablation isolating the gate's role is informative; the causal logit-lens diagnostics and random-direction controls support the claim that the steering vector is intent-aligned rather than a generic perturbation; and the small asset footprint is a practical advantage. However, the headline gain is currently based on test-set selection of the steering strength α, and the probe-gated mechanism—the component responsible for the FPR reduction—is supported only by AUC, not by calibration evidence. The new benchmark is not released, which further limits verification. These issues are fixable and should be addressed before the quantitative claims can be accepted.

major comments (3)
  1. [§4.1, §4.2; Table 4 caption; Table 5] The headline result (Table 5, α=4.0) is the best F1 point on the test set from a full α sweep conducted on the test set. Table 4 similarly reports 'the best operating point per domain by F1 (from the α sweep)'. Yet §4.1 states 'tune α by best val F1 (test sweep in Table 5)'. This is contradictory and indicates test-set selection, which inflates expected gains. Please report results for a single α (or per-domain α) selected on validation and then applied to test, together with the validation-selected values, and provide confidence intervals or variance across multiple seeds.
  2. [§3.4.4 (Eq. 13); §4.3 (Table 6)] The probe-guided ternary gate is the sole component separating the useful result (Table 5, FPR 0.052) from the destructive no-gate ablation (Table 6, FPR 0.500). However, the paper reports only probe AUC >0.99. AUC is threshold-invariant and does not establish that p(x) is well calibrated at the fixed thresholds τ and 1−τ; a miscalibrated probe could mis-sign on held-out inputs and invert the intervention. Please provide a reliability diagram, expected calibration error, and sign-accuracy at the operational thresholds on the held-out test set, and report sensitivity of F1/FPR to τ.
  3. [Abstract; §4.1; Appendix C.1; Figures 5–8] The introduced benchmark 'MTU-Bench' is not released, and its name is inconsistent with the appendix/figures, which repeatedly refer to a 'REST test set'. The construction is described only as 1,600 samples filtered from Alpaca and Natural Questions. Without the actual data and exact construction/filtering rules, the central results cannot be reproduced or compared against future work. Please release the benchmark and resolve the naming inconsistency.
minor comments (4)
  1. [Abstract; §3.4.2, §3.4.4] The paper claims 'training-free' in the abstract and method description, but the router and probes are fitted on labeled training data (Eqs. 10–11). The arXiv title's 'Backbone-Training-Free' is more accurate. Please qualify the claim, e.g., 'no backbone weight updates' or 'without gradient-based training of the LLM'.
  2. [Table 5 vs Table 6] Table 5 reports post-trigger 'Exec. Prec.' as 0.6923 at α=4.0, while Table 6 lists 'Tool acc.' as 0.7436 for the same configuration. These are presumably different definitions; please clarify both in the metric definitions.
  3. [§4.1; Figures 5–8] Main text refers to MTU-Bench, while Figures 5–8 and Appendix C.1 refer to REST. Use a single benchmark name throughout.
  4. [Appendix C.1, Table 7] The split sizes are not reported: only MOV (320 samples) is mentioned. Please state the number of calibration, train, validation, and test samples, and clarify how the 1,600-sample benchmark is divided.

Circularity Check

0 steps flagged

No significant circularity: steering vectors and probes are fit on disjoint splits and evaluated on held-out test; reported F1/FPR gains are empirical, not identities.

full rationale

The derivation chain is self-contained. Steering vectors (Eq. 8: v_global = mu_pos - mu_neg) and probes (Eq. 11) are fit to oracle tool-necessity labels y*, but on disjoint CAL/train partitions (Sec. 3.5), and all F1/FPR numbers come from held-out test under a deterministic parser (Sec. 4.1). The gate (Eq. 13) thresholds probe probability, but the probe is not trained on F1/FPR and the behavioral event T(x) is the frozen model's output, so the reported improvement is an empirical intervention effect, not an equivalence. The no-gate ablation (Table 6) empirically demonstrates the gate's role rather than assuming it. The paper's own stated limitation (Table 9: 'Depends on intent evidence / routing accuracy') concerns probe calibration/routing robustness, which is a correctness risk, not a circular reduction. No load-bearing self-citation or imported uniqueness theorem appears; citations to Zou, Turner, Lee, Rahn, etc. are standard external prior work. Therefore no circular step meets the quoted-reduction bar.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The method rests on standard representation-engineering assumptions (linear separability, causal steerability of residual streams, gating via a calibrated probe). The main unstated choices are the hyperparameters α, β, τ, L, and the validity of the router/probe on the test distribution. No new physical or conceptual entities are introduced.

free parameters (4)
  • α (steering strength) = 4.0 for Qwen2.5-1.5B, 3.0 for 8B; per-domain values in LLaMA
    Scales the injected perturbation magnitude. Tuned on validation per the text, but the same sweep is shown on test and best per-domain points are reported, making it a test-tuned parameter in parts of the evaluation.
  • β (global vector weight) = not reported
    Weight for global intent vector in MoV (Eq. 12). No value or tuning procedure is given, so it is an unstated free parameter.
  • τ (probe confidence threshold) = selected from {0.50,0.55,0.60,0.65,0.70} on validation; final value not reported
    Gate threshold in Eq. 13; influences how often the intervention is applied and with what sign.
  • L (intervention layer) = 18 for Qwen2.5-1.5B; 21 for 8B; 23 for LLaMA
    Layer at which the single-shot injection is applied, selected by validation probe sweep.
axioms (4)
  • domain assumption Residual-stream hidden states at mid-layer are linearly separable with respect to tool necessity and adding a mean-difference vector causally shifts the model's tool-mode decision.
    Underlies the entire method; assumed based on the probe AUC diagnostic (Table 1) and the logit-lens check (Table 3). No proof that the linear direction is causally sufficient for downstream generation.
  • domain assumption The linear router can correctly identify the tool domain from the standardized hidden state, so the domain-specific expert vector is the right one.
    Routing errors cause Mismatch ablation performance drop (Table 6/17), but the paper does not provide router accuracy on test.
  • domain assumption The probe score p(x) is well-calibrated enough that the ternary gate (±1 or 0) based on a single fixed threshold improves F1 on held-out data.
    The gate is the key safety valve; if the probe is miscalibrated, the gate would mis-sign spurious triggers. No calibration analysis is shown.
  • domain assumption Greedy decoding and the deterministic parser define the true tool-calling behavior in deployment.
    The paper uses greedy decoding and a custom parser; other sampling strategies might change the results.

reviewed 2026-08-03 · how reviews work

0 comments
Cite this review

Pith. "Pith review of ASA: Backbone-Training-Free Representation Engineering for Tool-Calling Agents." pith.science (2026). https://pith.science/paper/ISWRHZPL

@misc{pith2026260204935,
  author       = {Pith},
  title        = {Pith review of: ASA: Backbone-Training-Free Representation Engineering for Tool-Calling Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ISWRHZPL}},
  note         = {Machine review of arXiv:2602.04935}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Adapting LLM agents to domain-specific tool calling remains notably brittle under evolving interfaces. Prompt and schema engineering is easy to deploy but often fragile under distribution shift and strict parsers, while continual parameter-efficient fine-tuning improves reliability at the cost of training, maintenance, and potential forgetting. We identify a critical Lazy Agent failure mode where tool necessity is nearly perfectly decodable from mid-layer activations, yet the model remains conservative in entering tool mode, revealing a representation-behavior gap. We propose Activation Steering Adapter (ASA), a training-free, inference-time controller that performs a single-shot mid-layer intervention and targets tool domains via a router-conditioned mixture of steering vectors with a probe-guided signed gate to amplify true intent while suppressing spurious triggers. On MTU-Bench with Qwen2.5-1.5B, ASA improves strict tool-use F1 from 0.18 to 0.50 while reducing the false positive rate from 0.15 to 0.05, using only about 20KB of portable assets and no weight updates.

Figures

Figures reproduced from arXiv: 2602.04935 by Jiani Liang, Liangming Pan, Min Huang, Rong Fu, Run Zhou, Shuaishuai Cao, Tao Fang, Yingjie Ma, Youjin Wang.

Figure 1
Figure 1. Figure 1: Overview of tool-calling domain adaptation methods under rapidly evolving tool sets and interaction protocols, and our inference-time probe-gated activation control. at scale because the operational burden and risk of forgetting increase with the number of domains and interface versions (Hu et al., 2022; Dettmers et al., 2023; Prottasha et al., 2025). Third, there is a con￾ceptual mismatch in treating tool… view at source ↗
Figure 2
Figure 2. Figure 2: ASA overview. We extract the last-token hidden state at layer L during the pre-fill pass, route the input to a domain dˆ, estimate tool intent probability p, construct MoV = vdˆ + βvglobal, and inject ∆h = Gate(h) · α · MoV once. No further interventions are applied during incremental decoding [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Layer-wise probe sweep used to select the intervention depth. 10 5 0 5 10 PC1 5 0 5 10 15 20 PC2 MOV Calibration Set: L18 Hidden Space PCA Projection code math search translation Non-tool Tool Global vector vglobal 0 0.25 0.5 1.0 Steering Coefficient -0.06 -0.04 -0.02 0.00 0.02 0.04 0.06 P r o b a bilit y C h a n g e P(< f u n c tio n c all>) 0.014 0.028 0.055 -0.014 -0.029 -0.055 0.001 -0.001 -0.002 *** *… view at source ↗
Figure 4
Figure 4. Figure 4: Combined geometry and causal diagnostic at the selected layer. entry on Non-Tool inputs. Meanwhile recall gains show Tool-Necessary inputs are pushed across the strict trigger boundary. The combined effect yields a strong F1 improvement and validates transfer at scale after depth re-tuning. The KB-vs-MB footprint gap is decisive under API/tool churn. ASA stores only a few directions and a lightweight contr… view at source ↗
Figure 5
Figure 5. Figure 5: Active steering performance on REST: domain-wise trends versus intervention strength α. 0 1 2 3 4 5 Steering Strength ( ) 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 F1 Score (a) F1 Score Code Math Search Translation ALL 0 1 2 3 4 5 Steering Strength ( ) 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Recall (b) Recall Code Math Search Translation ALL [PITH_FULL_IMAGE:figures/full_fig_p016_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: REST: F1/Recall curves across domains under different steering strengths α. vs Non-Tool (and often domains) occupy separable regions; this motivates domain-structured experts rather than a single global direction. The causal component shows direction-specific control (aligned vs anti-aligned effects) and rejects the “random energy” explanation. Together, [PITH_FULL_IMAGE:figures/full_fig_p016_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: REST: F1 improvement at the best operating point per domain (annotated with the selected α). Baseline =1 =2 =3 =4 =5 Precision Recall F1 Accuracy 0.84 0.84 0.88 0.92 0.90 0.91 0.44 0.49 0.53 0.60 0.69 0.72 0.58 0.62 0.66 0.73 0.78 0.80 0.68 0.70 0.73 0.78 0.81 0.82 Global (ALL Domains) Performance 0.4 0.5 0.6 0.7 0.8 0.9 1.0 [PITH_FULL_IMAGE:figures/full_fig_p017_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: REST (ALL domains): global metrics as a function of α. up to a point, but precision can degrade if FPR increases. Therefore, “bigger α” is not optimal; the best region is where recall gains do not trigger a disproportionate increase in spurious tool-mode entries. This emphasizes why we report both recall and FPR and tune α on validation rather than maximizing trigger frequency. F. Ablation Studies Full ASA… view at source ↗
Figure 9
Figure 9. Figure 9: LLAMA: layer-wise probe decodability sweep over 32 layers. A clear peak/plateau indicates tool intent becomes linearly accessible at certain depths, but the optimal layer can differ from Qwen due to architectural/training differences. This figure justifies re-running layer selection per backbone; reusing Qwens ℓ blindly can be suboptimal. Conceptually, it supports the claim that intent decodability is comm… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Looking Is Not Picking: An Attention-Segment Account of Tool-Selection Failures in LLM Agents

    cs.AI 2026-06 unverdicted novelty 7.0

    Attention analysis shows that LLM tool selection failures occur at the readout/decision stage, not because the model fails to attend to the correct tool definition.

  2. Model-Adaptive Tool Necessity Reveals the Knowing-Doing Gap in LLM Tool Use

    cs.AI 2026-05 unverdicted novelty 7.0

    Model-adaptive tool necessity shows 26-54% mismatch with actual tool calls across LLMs, driven by nearly orthogonal hidden-state signals for cognition versus action.

  3. Model-Adaptive Tool Necessity Reveals the Knowing-Doing Gap in LLM Tool Use

    cs.AI 2026-05 unverdicted novelty 6.0

    LLMs show a knowing-doing gap in tool use: they often recognize when tools are needed via internal states but fail to translate that into actual tool calls, with mismatches of 26-54% on arithmetic and factual tasks.

  4. Tool Calling is Linearly Readable and Steerable in Language Models

    cs.CL 2026-05 unverdicted novelty 6.0

    Tool identity is linearly readable and steerable in LLMs via mean activation differences, with 77-100% switch accuracy and error prediction from activation gaps.

  5. Decodable but Not Corrected by Fixed Residual-Stream Linear Steering: Evidence from Medical LLM Failure Regimes

    cs.AI 2026-05 unverdicted novelty 5.0

    Overthinking in medical QA is linearly decodable at 71.6% accuracy yet fixed residual-stream steering yields no correction across 29 configurations, while enabling selective abstention with AUROC 0.610.

Reference graph

Works this paper leans on

16 extracted references · 10 linked inside Pith · cited by 4 Pith papers

  1. [1]

    Representation engineering for large-language models: Survey and research challenges

    Bartoszcze, L., Munshi, S., Sukidi, B., Yen, J., Yang, Z., Williams-King, D., Le, L., Asuzu, K., and Maple, C. Representation engineering for large-language models: Survey and research challenges. arXiv preprint arXiv:2502.17601 ,

    Pith/arXiv arXiv

  2. [3]

    Qlora: Efficient finetuning of quantized llms

    Dettmers, T., Pagnoni, A., Holtzman, A., and Zettle- moyer, L. Qlora: Efficient finetuning of quantized llms. arXiv preprint arXiv:2305.14314 ,

    Pith/arXiv arXiv

  3. [8]

    J., Chowdhury, U

    Prottasha, N. J., Chowdhury, U. R., Mohanto, S., Nuzhat, T., Sami, A. A., Ali, M. S., Sobuj, M. S. I., Raman, H., Kowsher, M., and Garibay, O. O. Peft a2z: Parameter-efficient fine-tuning survey for large language and vision models. arXiv preprint arXiv:2504.14117,

    Pith/arXiv arXiv

  4. [9]

    Toolllm: Facilitating large language models to master 16000+ real-world apis

    Qin, Y., Liang, S., Ye, Y., Zhu, K., Yan, L., Lu, Y., Lin, Y., Cong, X., Tang, X., Qian, B., et al. Toolllm: Facilitating large language models to master 16000+ real-world apis. arXiv preprint arXiv:2307.16789 ,

    Pith/arXiv arXiv

  5. [10]

    Rahn, N., D’Oro, P., and Bellemare, M. G. Controlling large language model agents with entropic activation steering. arXiv preprint arXiv:2406.00244 ,

    Pith/arXiv arXiv

  6. [11]

    Toolalpaca: Generalized tool learn- ing for language models with 3000 simulated cases

    9 ASA: T raining-F ree Representation Engineering for T ool-Calling Agents Tang, Q., Deng, Z., Lin, H., Han, X., Liang, Q., Cao, B., and Sun, L. Toolalpaca: Generalized tool learn- ing for language models with 3000 simulated cases. arXiv preprint arXiv:2306.05301 ,

    Pith/arXiv arXiv

  7. [12]

    Taxonomy, opportunities, and chal- lenges of representation engineering for large lan- guage models

    Wehner, J., Abdelnabi, S., Tan, D., Krueger, D., and Fritz, M. Taxonomy, opportunities, and chal- lenges of representation engineering for large lan- guage models. arXiv preprint arXiv:2502.19649 ,

    arXiv

  8. [13]

    Representation engineering: A top-down approach to ai transparency

    Zou, A., Phan, L., Chen, S., Campbell, J., Guo, P., Ren, R., Pan, A., Yin, X., Mazeika, M., Dom- browski, A.-K., et al. Representation engineering: A top-down approach to ai transparency. arXiv preprint arXiv:2310.01405 ,

    Pith/arXiv arXiv

  9. [14]

    energy injection

    Logit-Lens intervention on Qwen2.5-1.5B at Layer 18 (target token: <functioncall>). Reported p-values compare +v vs random. α Mode ∆Logit (mean) ∆Prob (mean) p-value 0.25 Plus (+v) +0.2077 +1.38% 2.51 × 10− 36 0.25 Minus (−v) -0.2230 -1.41% – 0.25 Random -0.0037 +0.11% – 1.0 Plus (+v) +0.8359 +5.47% 7.10 × 10− 43 1.0 Minus (−v) -0.9414 -5.46% – 1.0 Random...

    2077

  10. [15]

    Prompt baselines without ASA vector injection. Variant Recall (Tool=1) FPR (Tool=0) Note Zero-shot System 0.1146 0.1458 Prompt-only baseline under strict trigger- ing Few-shot System 0.2083 0.2708 Higher recall but substantially higher false triggers No System 0.0000 0.0000 Tool mode collapses without system speci- fication Table

    2083

  11. [16]

    Qwen2.5-8B-Instruct: baseline vs ASA at Layer 21, α = 3.0. Metric Baseline ASA (steer) ∆ Precision 0.5179 0.8500 +0.3321 Recall 0.3021 0.5132 +0.2111 F1 0.3816 0.6400 +0.2584 Accuracy 0.5104 0.7083 +0.1979 FPR 0.2812 0.0625 -0.2187 Diagonal dominance indicates domain directions are distinct, supporting a modular representation of tool intent. Very low sim...

    1979

  12. [2019]

    W., Padhi, I., Ramamurthy, K

    Lee, B. W., Padhi, I., Ramamurthy, K. N., Miehling, E., Dognin, P., Nagireddy, M., and Dhurandhar, A. Programming refusal with conditional activation steering. arXiv preprint arXiv:2409.05907 ,

    Pith/arXiv arXiv

  13. [2022]

    T., Pain, M

    Johnson, R. T., Pain, M. D., and West, J. D. Natu- ral language tools: A natural language approach to tool calling in large language agents. arXiv preprint arXiv:2510.14453,

    arXiv

  14. [2023]

    doi: 10.48550/arXiv.2305.14314. Hu, E. J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., Chen, W., et al. Lora: Low- rank adaptation of large language models. ICLR, 1 (2):3,

    Pith/arXiv arXiv doi:10.48550/arxiv.2305.14314

  15. [2024]

    Li, X. L. and Liang, P. Prefix-tuning: Optimizing continuous prompts for generation. arXiv preprint arXiv:2101.00190,

    Pith/arXiv arXiv

  16. [2025]

    Improving large language models function calling and interpretability via guided-structured templates

    Dang, H., Liu, T., Wu, Z., Yang, J., Jiang, H., Yang, T., Chen, P., Wang, Z., Wang, H., Li, H., et al. Improving large language models function calling and interpretability via guided-structured templates. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pp. 24437– 24453,

    2025

This paper was first reviewed by deepseek-v4-flash on August 3, 2026.