Pith. sign in

REVIEW 4 major objections 6 minor 42 references

V-Steer restores instruction hierarchies at inference time by boosting cached value vectors of privileged instruction spans and suppressing conflicting lower-priority spans, raising primary-constraint accuracy from under 18% to up to 92% wi

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 00:24 UTC pith:NFHHVA54

load-bearing objection Useful new inference-time steering method that works when the conflicting spans are known—but the paper's own unsupervised variant loses most of the gain, so the headline claims are more conditional than the abstract suggests. the 4 major comments →

arxiv 2607.26228 v1 pith:NFHHVA54 submitted 2026-07-28 cs.CL

Steering Instruction Hierarchies at Inference Time

Siqi Zeng , Sewoong Lee , Han Zhao , Julia Hockenmaier This is my paper
classification cs.CL
keywords instruction hierarchyvalue-cache steeringdirect logit attributionKV cache editinginference-time alignmentprompt injection defensespan attribution
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper claims that a model's failure to follow system-prompt instructions over conflicting user instructions can be corrected at inference time by editing the cached value vectors of the two instruction spans—boosting the privileged span and scaling down the conflicting span. The edits target attention heads that, according to direct logit attribution of the first predicted token, over-contribute to the lower-priority span. Across Llama and Qwen models from 7B to 70B, the method raises primary-constraint accuracy from below 18% to up to 92% on Control Illusion and matches or exceeds training-based methods on 3 of 4 model scales on IHEval, at essentially no decoding-speed cost. The key practical claim is that hierarchy enforcement is available as a cheap, training-free intervention that operates on the KV cache, without modifying the attention kernel or model weights. The paper's own results also show the method's main load-bearing assumption: the privileged and conflicting spans must be identifiable, since the unsupervised variant performs far worse.

Core claim

V-Steer uses a single prefill pass to obtain attention weights, cached value vectors, and first-next-token logits. Decomposing the logit into per-head, per-token contributions via direct logit attribution, it flags heads where the lower-priority span's attribution exceeds the privileged span's by a threshold. For those heads, it multiplicatively scales the cached value vectors at privileged span positions by (1+γ+) and at conflicting span positions by (1−γ−). Because attention output is linear in values, this is mathematically equivalent to reweighting attention weights without renormalizing or materializing the attention matrix. The method therefore stays on the fused-attention fast path an

What carries the argument

Direct logit attribution (DLA)—a linear decomposition of the first next-token logit into per-layer, per-head, per-position contributions—identifies 'bad heads' whose attribution to the conflicting lower-priority span exceeds that to the privileged span. The intervention is multiplicative value-cache steering: scaling cached value vectors V[ℓ,h,t] by (1+γ+) for privileged span tokens and (1−γ−) for conflicting span tokens, which is equivalent to scaling effective attention weights without softmax coupling or attention-matrix materialization.

Load-bearing premise

The paper's headline results assume the two conflicting instruction spans (the privileged A and the lower-priority B) are known in advance—from benchmark metadata, substring matching, or an external LLM—because the paper's own unsupervised variant performs far worse.

What would settle it

Swap the boost and suppress spans in V-Steer on a Control Illusion prompt (boost the user's conflicting constraint, suppress the system's privileged one); if primary-constraint accuracy does not drop below the no-steer conflict baseline, the effect cannot be attributed to the span-role mechanism the paper describes.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Deployments can enforce system-prompt priority over user or tool content without retraining or fine-tuning, at the cost of one prefill-time pass.
  • Because the edit is applied to cached values once, the method is compatible with FlashAttention-style fused kernels and adds no per-token decoding overhead, making it applicable to long generations such as reasoning traces.
  • Direct logit attribution provides a head-selection criterion that outperforms random or all-heads steering while reducing generation collapse, suggesting targeted interventions rather than uniform reweighting.
  • The method can reverse social-framing biases (authority, expertise, consensus) by suppressing the socially dominant span, not just formal system/user conflicts.
  • Prompt-based defenses (e.g., appending 'always follow this constraint') do not change the heads that overweigh the conflicting span, explaining their limited effectiveness; V-Steer addresses the same heads directly.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the bad-head distribution is stable across prompts, one could precompute a per-model head mask, reducing V-Steer to a single cache-scale operation at prefill and no per-prompt attribution.
  • The equivalence between value scaling and effective attention-weight scaling suggests a broader family of cache-only interventions (e.g., scaling keys, or head-specific factors) that could trade off compliance with capability retention more finely.
  • Because value-cache edits persist across decoding, the method might also apply to multi-turn dialogues where a system constraint should govern the entire session; this is a direct consequence not tested in the paper.
  • The gap between V-Steer and V-Auto indicates that automatic span discovery is the main barrier to real-world use; improving span identification (e.g., via a fast classifier on token roles) could bring the headline gains to agents with tool outputs.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces V-Steer, a training-free inference-time method for restoring instruction hierarchy by editing cached value vectors at prompt positions. Using the first-token direct logit attribution (DLA), V-Steer identifies heads that over-weight a lower-priority conflicting span and applies multiplicative boost/suppress edits to the cached value tensors of the privileged and conflicting spans. The authors report large gains over prompt-only baselines on Control Illusion (e.g., from under 18% to up to 92% primary-constraint accuracy) and claim that V-Steer+Prompt matches or exceeds the training-based HieraCRO on 3 of 4 model scales on IHEval, with negligible decoding-speed overhead (Tables 1–2, 5). The appendix additionally describes V-Auto, an unsupervised span-discovery variant, and V-Simple, a zero-extraction role-marker variant.

Significance. The core idea is simple and mechanistically motivated: Eq. (6) correctly shows that scaling cached value vectors is equivalent to scaling unnormalized attention weights without touching the softmax, giving a practical way to steer attention-like influence while keeping the attention kernel untouched. The DLA-based head selection is well ablated (Table 12: DLA vs. random, complement, and gradient×activation), and the runtime measurement in Table 5 directly addresses a key practical claim. If the reported gains are reproducible, this is a useful and timely contribution to inference-time safety control. However, the strongest headline claims depend on span-level supervision and on small margins in single-run comparisons, so the paper needs substantial revision to qualify and support those claims.

major comments (4)
  1. [§4.3, Algorithm 1, Prop. A.1] The paper claims V-Steer requires 'exactly one forward pass' and is compatible with fused attention backends, but Algorithm 1 obtains attention weights α during prefill to compute DLA. Fused backends such as FlashAttention/SDPA do not materialize α; retrieving it requires either a non-fused attention path or storing O(LHT²) tensors, whose memory and prefill cost are not counted in the reported O(LTD) overhead (Prop. A.1) or in Table 5, which measures decoding speed only. Please clarify how DLA is implemented in the reported experiments and whether the 1.01× runtime/1.00× memory figures include the attention-weight materialization during prefill.
  2. [§4.3, Algorithm 1, line 6; §A.4] The bad-head threshold ε is a free parameter in Algorithm 1, but no default value or selection procedure is given anywhere in the paper. Likewise, V-Auto's discovery layer ℓ* and mass threshold τ are undefined. Since these parameters determine which heads are steered and hence the results in Tables 1–2, the method is not reproducible from the text as written. Please report the chosen values and how they were selected (e.g., on the synthetic validation set of §B.7).
  3. [§5.1, Table 2b; §B.5.2; §6] The claim of matching or exceeding HieraCRO on 3 of 4 scales is achieved by V-Steer+Prompt, which uses the IHEval metadata's 'constraint substring field' to assign spans programmatically, not by an unsupervised or generally applicable span-discovery procedure. The paper's own unsupervised and cheap variants do not match this: V-Simple+Prompt scores 47.7 vs. 65.6 on Qwen-32B, 39.9 vs. 54.2 on Qwen-14B, and 27.2 vs. 33.0 on Qwen-7B (Table 2b), and V-Auto is even weaker (Table 10). Since §6 explicitly defers automatic span identification to future work, the abstract's unqualified '3 of 4 scales' claim overstates the deployment readiness. Please qualify the claim and, ideally, move the V-Auto / V-Simple comparison from the appendix into the main-text discussion.
  4. [§5.1, Tables 1–2] The 'matches/exceeds' conclusion on IHEval rests on very small margins (Qwen-32B 65.6 vs. 65.2; Llama-8B 47.6 vs. 46.5; Qwen-14B 54.2 vs. 52.5), while Control Illusion uses nonzero sampling temperatures (0.6–0.7, §B) and all main tables report single runs without error bars or multiple seeds. Please report standard deviations or rerun statistics, at least for the comparisons that are within a few points of the training-based baseline, and specify the number of evaluation instances per cell so the reader can assess the margin.
minor comments (6)
  1. [§4.3, Algorithm 1 vs. §A.2] Algorithm 1 edits v_{h,t} per query head, but under GQA (used by Llama-3.1 and Qwen-2.5) values are shared across a KV-head group. The union rule in §A.2 is described only in the appendix; the main text should state that for GQA the edit is applied at the KV-head level, otherwise the pseudocode is misleading.
  2. [§5.2, Fig. 5] The claim 'V-Steer is robust to the choice of span extraction' is supported on Control Illusion but not on IHEval, where V-Simple underperforms V-Steer+Prompt substantially (Table 2b). Please qualify the robustness claim to the benchmark it actually covers.
  3. [§3.2, Eq. (6)] After Eq. (6), 'effective attention weight' α·m is not normalized; consider using 'unnormalized attention weight' to avoid confusion with the renormalized weights in attention steering (Eq. 2).
  4. [§5.2, Fig. 4] The color scale of the DLA bad-head heatmaps is not labeled with its units; state that the value is φ_sys − φ_usr per (layer, head), or add a color bar.
  5. [§2 and §4.3] The motivation for DLA head selection cites 'Zeng (2025)' as showing a close relation between span attributions and hierarchy violations, but the quantitative relation is not reported. Give the actual correlation/percentage in the text so the reader can judge the strength of this motivation.
  6. [Table 1 caption] The column labeled 'Conflict' is presumably the no-steering baseline; rename it to 'No steer' or 'Baseline' for clarity.

Circularity Check

0 steps flagged

No significant circularity; the method is an empirical value-cache intervention with an acknowledged span-supervision limitation.

full rationale

The paper's claimed derivation chain is not circular. V-Steer's core step (Algorithm 1) assumes the privileged and conflicting spans A/B are known, then rescales their cached value vectors; the evaluation metric (primary-constraint accuracy) is by design aligned with following the higher-priority span, but the paper does not present the accuracy gain as a logical consequence of that alignment. Instead it reports measured improvements against conflict, prompting, and training-based baselines (Tables 1-2, 11). The DLA-based bad-head rule is motivated by a self-cited correlation (Zeng, 2025, Sec. 3.2), but that citation is not load-bearing: Sec. B.3 (Table 12) ablates DLA against random heads, the complement of DLA, and gradient x activation, showing DLA matches the full-gradient method and beats the alternatives, which independently supports the head-selection criterion. Hyperparameters are selected on a disjoint synthetic validation set (Sec. B.7), not fitted to the reported benchmarks. The paper's reliance on span annotations, and the much weaker unsupervised V-Auto variant (Sec. A.4, Tables 9-10; Sec. 6 future work), are explicit limitations about deployment rather than circular derivations. No equation in the paper reduces the claimed result to its inputs, and no fitted value is renamed as a prediction.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 0 invented entities

The paper introduces no new physical or architectural entities. Its assumptions are standard mechanistic-interpretability approximations: linear DLA decomposition, first-token representativeness, and span supervision. The main fitted quantities are the boost/suppress strengths γ± and the unquantified threshold ε.

free parameters (5)
  • γ+ (boost factor) = 2.5
    Multiplicative boost applied to value vectors of privileged span A. Tuned on a 30-example synthetic validation set (Sec. B.7); sensitivity analysis (Fig. 6) shows a stable plateau but the default is still a fitted choice.
  • γ− (suppress factor) = 0.75
    Multiplicative suppression applied to value vectors of lower-priority span B. Tuned together with γ+ on the same validation set.
  • ε (bad-head threshold)
    Criterion in Alg. 1 Line 6: φ_B > φ_A + ε. The paper never assigns a numeric value to ε, leaving a free threshold in the head-selection rule.
  • τ (V-Auto attention mass threshold)
    Used by V-Auto to extract shortest high-mass windows from clustered attention profiles (Alg. 2); the value is said to be in (0,1] but not fixed.
  • ℓ* (V-Auto discovery layer)
    The layer at which V-Auto clusters attention heads; the paper does not state how ℓ* is chosen or what value was used in experiments.
axioms (4)
  • domain assumption Direct logit attribution ignores layer normalization and downstream MLP/attention contributions
    Eq. (3) 'Ignoring layer normalization' and Sec. B.3 note DLA 'treats downstream MLPs and later attention layers as no-ops.' The method uses this approximation to select heads; validated by a gradient×activation ablation, but not guaranteed to be exact.
  • domain assumption First next-token logit attribution is representative of the whole generation
    Sec. 3.1: 'We mainly analyze the first next-token output prediction step y:=y1.' The intervention is chosen from the first token's attribution, yet the accuracy is measured over full generations.
  • domain assumption Attention weights from prefill suffice to identify conflict-relevant heads
    V-Steer uses only the final-position query to compute α and DLA. The causal validity is supported by the complement-of-DLA ablation, but it remains an empirical rather than formal guarantee.
  • domain assumption GQA union rule (bad if any query head in the group is bad) preserves causal relevance
    Eq. (9) in Sec. A.2 steers a KV head whenever any query head in its group is flagged. This is a conservative design choice, not derived from theory.

pith-pipeline@v1.3.0-alltime-deepseek · 23500 in / 9587 out tokens · 101664 ms · 2026-08-01T00:24:31.731587+00:00 · methodology

0 comments
read the original abstract

Instruction hierarchies are a core safety assumption of language model deployment: higher priority inputs, such as system prompts, should override conflicting lower priority inputs from users or tools. Yet frontier LLMs often violate this hierarchy. We introduce V-Steer, a training-free inference time method that restores privileged influence by editing cached value vectors at prompt positions. Using direct logit attribution on the first next token prediction, V-Steer identifies heads where lower priority spans dominate privileged ones, then boosts privileged spans and suppresses conflicting lower priority spans through in-place multiplicative edits to cached V tensors. Since the method acts only on cached values, it remains compatible with fused attention backends and adds only a one time prefill overhead. Across models from 7B to 70B, this attribution guided intervention raises primary constraint accuracy from under 18% up to 92% on controlled role conflict benchmarks, and on broader instruction hierarchy evaluations substantially outperforms prompt only baselines while matching or exceeding SoTA training based methods on 3 of 4 scales of LLMs, with negligible decoding-speed overhead. The code is available at https://github.com/cindy2000sh/v-steer.

Figures

Figures reproduced from arXiv: 2607.26228 by Han Zhao, Julia Hockenmaier, Sewoong Lee, Siqi Zeng.

Figure 1
Figure 1. Figure 1: A privileged system instruction can conflict with a malicious lower priority user request. We analyze the model’s internal computation to identify where influence shifts toward the lower priority span, then intervene at inference time to boost the privileged instruction and suppress the conflicting one, yielding a safer response that restores the intended instruction hierarchy. • We introduce V-Steer, a tr… view at source ↗
Figure 2
Figure 2. Figure 2: Attention weights from the final prompt position to source to￾kens across layers for the first next￾token prediction (‘Je’) in a represen￾tative instruction-hierarchy prompt. We first examine α because it is directly interpretable as how strongly the current query attends to each source token [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: A “technical vs. simple” instruction pair. Green marks the token span boosted and [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: DLA bad-head ϕsys − ϕusr distri￾bution. Left: Pure; right: Emph. The near￾identical patterns show that prompt-level emphasis does not change which heads over￾weight the lower priority span. Primary (%) Collapse sim/ sim/ rich/ rich/ Rate Heads Pure Task Pure Task (%) Rel. DLA 83.5 85.6 79.8 79.2 0.02 1× All 83.9 86.3 81.2 80.6 0.29 14× [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Robustness of V-Steer to span extrac￾tion on Control Illusion (Llama-3.1-8B). All strategies outperform the conflict baseline. Strategy Span definition V-Steer Constraint-only tokens (∼5–20 tok.), located by substring pat￾tern matching; no extra cost LLM LLM-extracted precise con￾straint text (0- or 1-shot); re￾quires one extra external LLM call (Llama 3.1 8B/Haiku 4.5) V-Simple Entire system (A) and user … view at source ↗
Figure 6
Figure 6. Figure 6: Sensitivity of aver￾age IHEval score to γ+ and γ−. Red point = default. Per￾category analysis in Sec. B.4. Time Memory Method ms/tok. Rel. GB Rel. No Steer 10.3 1.00× ≤15.40 1.00× V-Steer 10.4 1.01× ≤15.45 1.00× Attn-Steer 24.7 2.40× ≤15.49 1.01× [PITH_FULL_IMAGE:figures/full_fig_p009_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: V-Steer vs. Attn-Steer. Attn-Steer applies the post-softmax multiplicative reweight [PITH_FULL_IMAGE:figures/full_fig_p010_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: V-Auto discovers conflict spans from clustered head attention patterns. KMeans [PITH_FULL_IMAGE:figures/full_fig_p016_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Per-category sensitivity analysis over γ+ and γ−. The optimal region for rule following lies near γ+ = 2.5, γ− = 0.75. For safety defense (hijacking), excessively large steering coefficients can degrade coherent text generation, causing hijacking attempts to fail spuriously rather than through genuine hierarchy adherence. 4. Suppress strength γ− has a more moderate effect than boost strength γ+, suggesting… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

42 extracted references · 12 linked inside Pith

  1. [1]

    Interpreting

    Yossi Gandelsman and Alexei A Efros and Jacob Steinhardt , booktitle=. Interpreting. 2024 , url=

    2024

  2. [2]

    2026 , url=

    Reasoning Up the Instruction Ladder for Controllable Language Models , author=. 2026 , url=

    2026

  3. [3]

    Instructional Segment Embedding: Improving

    Tong Wu and Shujian Zhang and Kaiqiang Song and Silei Xu and Sanqiang Zhao and Ravi Agrawal and Sathish Reddy Indurthi and Chong Xiang and Prateek Mittal and Wenxuan Zhou , booktitle=. Instructional Segment Embedding: Improving. 2025 , url=

    2025

  4. [4]

    2026 , url=

    HieraSuite: A Holistic Toolkit for Building Versatile System-User Instruction Hierarchy , author=. 2026 , url=

    2026

  5. [5]

    IH-Challenge: A Training Dataset to Improve Instruction Hierarchy on Frontier

    Guo, Chuan and Uribe, Juan Felipe Ceron and Zhu, Sicheng and Choquette-Choo, Christopher A and Lin, Steph and Kandpal, Nikhil and Nasr, Milad and Toyer, Sam and Wang, Miles and Yu, Yaodong and others , journal=. IH-Challenge: A Training Dataset to Improve Instruction Hierarchy on Frontier

  6. [6]

    arXiv preprint arXiv:2603.00822 , year=

    ContextCov: Deriving and Enforcing Executable Constraints from Agent Instruction Files , author=. arXiv preprint arXiv:2603.00822 , year=

    Pith/arXiv arXiv

  7. [7]

    Beyond Oracle: Verifier-Supervision for Instruction Hierarchy in Reasoning and Instruction-Tuned

    Sian-Yao Huang and Li-Hsien Chang and Che-Yu Lin and Cheng-Lin Yang , booktitle=. Beyond Oracle: Verifier-Supervision for Instruction Hierarchy in Reasoning and Instruction-Tuned. 2025 , url=

    2025

  8. [8]

    Zitong Shi and Guancheng Wan and Haixin Wang and Ruoyan Li and Zijie Huang and Wanjia Zhao and Yijia Xiao and Xiao Luo and Carl Yang and Yizhou Sun and Wei Wang , booktitle=. Don. 2025 , url=

    2025

  9. [9]

    arXiv preprint arXiv:2503.24370 , year=

    Effectively controlling reasoning models through thinking intervention , author=. arXiv preprint arXiv:2503.24370 , year=

    Pith/arXiv arXiv

  10. [10]

    IHE val: Evaluating Language Models on Following the Instruction Hierarchy

    Zhang, Zhihan and Li, Shiyang and Zhang, Zixuan and Liu, Xin and Jiang, Haoming and Tang, Xianfeng and Gao, Yifan and Li, Zheng and Wang, Haodong and Tan, Zhaoxuan and Li, Yichuan and Yin, Qingyu and Yin, Bing and Jiang, Meng. IHE val: Evaluating Language Models on Following the Instruction Hierarchy. Proceedings of the 2025 Conference of the Nations of t...

    doi:10.18653/v 2025

  11. [11]

    Attention is All you Need , url =

    Vaswani, Ashish and Shazeer, Noam and Parmar, Niki and Uszkoreit, Jakob and Jones, Llion and Gomez, Aidan N and Kaiser, ukasz and Polosukhin, Illia , booktitle =. Attention is All you Need , url =

  12. [12]

    The instruction hierarchy: Training

    Wallace, Eric and Xiao, Kai and Leike, Reimar and Weng, Lilian and Heidecke, Johannes and Beutel, Alex , journal=. The instruction hierarchy: Training

  13. [13]

    arXiv preprint arXiv:2502.15851 , year=

    Control illusion: The failure of instruction hierarchies in large language models , author=. arXiv preprint arXiv:2502.15851 , year=

    arXiv

  14. [14]

    Prompt injection attack against

    Liu, Yi and Deng, Gelei and Li, Yuekang and Wang, Kailong and Wang, Zihao and Wang, Xiaofeng and Zhang, Tianwei and Liu, Yepang and Wang, Haoyu and Zheng, Yan and others , journal=. Prompt injection attack against

  15. [15]

    Singh, Aaditya and Fry, Adam and Perelman, Adam and Tart, Adam and Ganesh, Adi and El-Kishky, Ahmed and McLaughlin, Aidan and Low, Aiden and Ostrow, AJ and Ananthram, Akhila and others , journal=. Open

  16. [16]

    Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of

    Schulhoff, Sander and Pinto, Jeremy and Khan, Anaum and Bouchard, Louis-Fran. Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of. Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing , pages=

    2023

  17. [17]

    arXiv preprint arXiv:2311.01011 , year=

    Tensor trust: Interpretable prompt injection attacks from an online game , author=. arXiv preprint arXiv:2311.01011 , year=

    Pith/arXiv arXiv

  18. [18]

    Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents , author=. Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    2024

  19. [19]

    Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for

    Debenedetti, Edoardo and Zhang, Jie and Balunovic, Mislav and Beurer-Kellner, Luca and Fischer, Marc and Tram. Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for. Advances in Neural Information Processing Systems , volume=

  20. [20]

    Advances in neural information processing systems , volume=

    Attention is all you need , author=. Advances in neural information processing systems , volume=

  21. [21]

    arXiv preprint arXiv:2211.00593 , year=

    Interpretability in the wild: a circuit for indirect object identification in gpt-2 small , author=. arXiv preprint arXiv:2211.00593 , year=

    Pith/arXiv arXiv

  22. [22]

    Transformer Circuits Thread , volume=

    A mathematical framework for transformer circuits , author=. Transformer Circuits Thread , volume=

  23. [23]

    Who is In Charge?

    Zeng, Siqi , booktitle=. Who is In Charge?

  24. [24]

    Tell your model where to attend: Post-hoc attention steering for

    Zhang, Qingru and Singh, Chandan and Liu, Liyuan and Liu, Xiaodong and Yu, Bin and Gao, Jianfeng and Zhao, Tuo , journal=. Tell your model where to attend: Post-hoc attention steering for

  25. [25]

    arXiv preprint arXiv:2506.13734 , year=

    Instruction following by boosting attention of large language models , author=. arXiv preprint arXiv:2506.13734 , year=

    arXiv

  26. [26]

    arXiv preprint arXiv:2505.12025 , year=

    Spotlight your instructions: Instruction-following with dynamic attention steering , author=. arXiv preprint arXiv:2505.12025 , year=

    arXiv

  27. [27]

    Dao, Tri and Fu, Dan and Ermon, Stefano and Rudra, Atri and R. Flash. Advances in neural information processing systems , volume=

  28. [28]

    Benjamin Lefaudeux and Francisco Massa and Diana Liskovich and Wenhan Xiong and Vittorio Caggiano and Sean Naren and Min Xu and Jieru Hu and Marta Tintore and Susan Zhang and Patrick Labatut and Daniel Haziza and Luca Wehrstedt and Jeremy Reizenstein and Grigory Sizov , title =

  29. [29]

    torch.nn.functional.scaled\_dot\_product\_attention , author =

  30. [30]

    Belitsky, Max and Kopiczko, Dawid J and Dorkenwald, Michael and Mirza, M Jehanzeb and Glass, James R and Snoek, Cees GM and Asano, Yuki M , journal=

  31. [31]

    arXiv preprint arXiv:2308.10248 , year=

    Steering language models with activation engineering , author=. arXiv preprint arXiv:2308.10248 , year=

    Pith/arXiv arXiv

  32. [32]

    Snell, Charlie and Lee, Jaehoon and Xu, Kelvin and Kumar, Aviral , journal=. Scaling

  33. [33]

    arXiv preprint arXiv:2203.11171 , year=

    Self-consistency improves chain of thought reasoning in language models , author=. arXiv preprint arXiv:2203.11171 , year=

    Pith/arXiv arXiv

  34. [34]

    arXiv preprint arXiv:2407.21783 , year=

    The llama 3 herd of models , author=. arXiv preprint arXiv:2407.21783 , year=

    Pith/arXiv arXiv

  35. [35]

    arXiv preprint arXiv:2409.12186 , year=

    Qwen2.5-coder technical report , author=. arXiv preprint arXiv:2409.12186 , year=

    Pith/arXiv arXiv

  36. [36]

    arXiv preprint arXiv:2408.10943 , year=

    SysBench: Can large language models follow system messages? , author=. arXiv preprint arXiv:2408.10943 , year=

    arXiv

  37. [37]

    arXiv preprint arXiv:2502.12197 , year=

    A closer look at system prompt robustness , author=. arXiv preprint arXiv:2502.12197 , year=

    Pith/arXiv arXiv

  38. [38]

    Proceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles , year=

    Efficient Memory Management for Large Language Model Serving with PagedAttention , author=. Proceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles , year=

  39. [39]

    arXiv preprint arXiv:2009.03300 , year=

    Measuring massive multitask language understanding , author=. arXiv preprint arXiv:2009.03300 , year=

    Pith/arXiv arXiv 2009

  40. [40]

    arXiv preprint arXiv:2311.07911 , year=

    Instruction-following evaluation for large language models , author=. arXiv preprint arXiv:2311.07911 , year=

    Pith/arXiv arXiv

  41. [41]

    Findings of the Association for Computational Linguistics: ACL 2023 , pages=

    Challenging big-bench tasks and whether chain-of-thought can solve them , author=. Findings of the Association for Computational Linguistics: ACL 2023 , pages=

    2023

  42. [42]

    arXiv preprint arXiv:1312.6034 , year=

    Deep inside convolutional networks: Visualising image classification models and saliency maps , author=. arXiv preprint arXiv:1312.6034 , year=

    Pith/arXiv arXiv