Deep Noir: Autonomous Steering Discovery via Architectural Chronometry in Transformer Models
Deep Noir automates activation steering parameter discovery and finds steering creates a prompt-injection attack surface that widens with steering magnitude.
Deep Noir uses Logit Lens convergence and causal head-level attribution to automatically discover where and how strongly to steer LLMs at inference time. Across nine models spanning 1B to 9B parameters and four architectures, it achieved gains of 21 to 42 percentage points on spam classification and 13.1 points on SST-2 sentiment, outperforming RepE without head masking. The paper also shows steering creates a predictable prompt-injection attack surface whose vulnerability increases monotonically with steering magnitude, a concern for agent systems deploying steered classifiers.
- Automates intervention point discovery via logit lens and causal head attribution
- Gains of 21-42 percentage points at 7-9B scale across four architectures
- RepE without head masking fails on sentiment while Deep Noir improves all models
- Prompt-injection vulnerability of steered models grows with steering magnitude
- Relevant to agent systems deploying steered classifiers
Full article157 words · extracted from arxiv.org · click to collapse
Activation steering modifies LLM behavior at inference time, but identifying where and how strongly to steer remains manual. We introduce Deep Noir, a framework that uses Logit Lens convergence and causal head-level attribution to autonomously discover optimal steering parameters. Across three scales (1B x 3, 2-3B x 2, and 7-9B x 4), our engine achieves 16.7 percentage-point improvement on spam at 1B (standard deviation 4.7; 39 runs), with gains increasing to 21 to 42 percentage points at 7-9B across four architectures. On SST-2 sentiment, it achieves a 13.1 percentage-point improvement with zero code changes. Mechanistic grounding enables automated discovery of intervention points that generalize across tasks and architectures. On sentiment, RepE without head masking fails to improve over baseline, while Deep Noir improves all models (p less than 0.01). We further show that steering creates a predictable prompt-injection attack surface whose vulnerability increases monotonically with steering magnitude. This finding is relevant to agent systems deploying steered classifiers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.20722