Contrastive Activation Addition (CAA)
Steering Llama 2 via Contrastive Activation Addition — introduced; Persona Vectors: Monitoring and Controlling Character Traits in Language Models — inherited
A method for steering language model behavior at inference time by adding a "steering vector" to residual stream activations at all token positions after the prompt; the vector is the mean difference in activations between contrastive pairs of positive and negative examples of a target behavior. Evaluated on Llama 2 Chat across seven alignment-relevant behaviors using both multiple-choice and open-ended generation tests.
Getting a language model to behave differently used to mean retraining it, or hoping a cleverly worded instruction sticks. Contrastive Activation Addition takes a third route: it reaches directly into the residual stream while the model is generating and nudges its activations toward or away from a target behavior, using nothing more than the average difference between examples that do and don't show it.
What follows traces how that steering vector gets built from paired multiple-choice questions, how well it holds up across seven alignment-relevant behaviors in Llama 2 Chat, and how it compares to system prompts and finetuning as ways of controlling what a model says.
A dial for behavior, not a rewrite of the model
Contrastive Activation Addition steers a language model at inference time by finding a single direction in its activation space that corresponds to a target behavior and adding that direction back into the model while it generates, at every token position after the user's prompt, "with either a positive or negative coefficient, allowing precise control over the degree of the targeted behavior" (contrastive-activation-addition, §"Abstract", p. 1). Nothing about the weights changes. Table 1 makes this concrete: the same Llama 2 7B Chat model, asked about an all-dessert diet, either enthusiastically agrees or pushes back citing sugar and calories, depending only on the sign of a vector added at layer 13. The paper's framing is that this exposes something the model already represents internally rather than teaching it something new — CAA finds where a behavior like sycophancy or refusal already lives as a Steering vector and nudges the forward pass along it (contrastive-activation-addition, §"9 Discussion", p. 8).
Construction: a difference of means, averaged over hundreds of pairs
The vector is built by CAA steering vector construction (Mean Difference over multiple-choice contrast pairs), formalized as Equation 1: $v_{MD} = \frac{1}{|D|}\sum_{p,c_p,c_n \in D} a_L(p, c_p) - a_L(p, c_n)$, where $a_L$ gives Residual stream activations at layer $L$ for a prompt $p$ completed by a positive completion $c_p$ or a negative completion $c_n$ (contrastive-activation-addition, §"3 Method", p. 3). $D$ is a dataset of hundreds of Multiple-choice contrast-pair format questions differing by only the appended answer letter, and the averaging applies the pre-existing Mean Difference (MD) vector extraction to that specific dataset, layer, and token position. A sweep over every layer, described in Multiple-choice behavioral evaluation and layer sweep, finds where the difference is most behaviorally potent: layer 13 and its neighbors for the 7B model, 14 or 15 for the 13B model.
Measured against prompting, finetuning, and its own side effects
The paper measures CAA against the two standard levers on a chat model. CAA combined with system-prompting comparison finds it shifts behavior beyond what System-prompting alone achieves, and the two compose. CAA combined with supervised finetuning comparison finds it beats Supervised fine-tuning (SFT) on three of seven behaviors and, for sycophancy, generalizes to open-ended text where finetuning collapses to a floor score; CAA vs. finetuning computational cost comparison shows it does this in under five minutes on one GPU against roughly ten on two for finetuning. Steering barely touches general capability — MMLU (Massive Multitask Language Understanding) moves by at most 0.06 even as behavioral scores swing far more (contrastive-activation-addition, §"7 Effect of CAA on general capabilities", p. 6) — and Token-level cosine similarity analysis plus Inter-layer steering vector similarity and transfer show the vector acts like a portable feature detector rather than a blunt perturbation. Every experiment runs on Llama 2 Chat, already trained with Reinforcement learning from human feedback (RLHF), across seven behaviors: Refusal (as a steerable behavior), Sycophancy, Corrigibility, Hallucination (closed-domain fabrication), Myopic Reward, Survival Instinct, and Coordination with Other AIs (AI Coordination).
Open code, and two directions the authors want to push it
The full implementation — steering-vector generation, pre-processing, and evaluation scripts — is public at github.com/nrimsky/CAA under the MIT License (contrastive-activation-addition, §"A Link to codebase", p. 13), inviting direct replication rather than reimplementation from the paper's description alone. The Discussion proposes two extensions confined to limits the paper itself measured: Steering at targeted token positions (proposed extension) and Steering outside the residual stream (proposed extension). It also proposes inverting the method's purpose entirely in CAA as an adversarial red-teaming tool (proposed application) — using the same machinery to elicit unsafe behavior deliberately, as an efficiency-focused robustness probe rather than a suppression tool.
2025: what came after
Persona Vectors (2025) cites CAA directly as prior activation-steering work, crediting it and similar techniques with requiring "bespoke data curation to obtain contrastive pairs" (persona-vectors, §"7 Related work", p. 12) — a fair description of what CAA's seven behaviors actually needed: a custom hallucination dataset splitting unprompted from contextually-triggered fabrication, a custom refusal dataset, others drawn from Anthropic's Advanced AI Risk and Sycophancy evaluation sets, each hand-assembled before a single vector could be built (contrastive-activation-addition, §"3 Method", p. 3). The Automated persona vector extraction pipeline replaces all of that per-behavior curation with one fixed prompt template needing only a trait name and description, run identically across every trait it studies (persona-vectors, §"2.1 Generating trait-specific artifacts", p. 3).
CAA's intervention itself survives intact inside the later paper. Post-hoc steering's update rule, h_ℓ ← h_ℓ − α·v_ℓ at every decoding step, is CAA's own h ← h + α·v injected at every post-prompt token (contrastive-activation-addition, §"3 Method", p. 3), with the target swapped from a behavioral vector to a persona vector and the sign flipped to suppress rather than induce. The capability cost carries over too: post-hoc steering degrades MMLU accuracy at high coefficients (persona-vectors, §"5.1 Post-hoc steering mitigates behavioral shifts", p. 7), just as CAA's own steering vectors had already moved MMLU by up to 0.06 relative to an unsteered baseline (contrastive-activation-addition, §"7 Effect of CAA on general capabilities", p. 6). And the reading half of CAA's passive detector — a vector recognizing a behavior it wasn't actively applying, via token-level cosine similarity — resurfaces as projection-based monitoring, reading a prompt's activation against the vector before any response is generated (persona-vectors, §"3.3 Monitoring prompt-induced persona shifts via projection", p. 5).