Notes on steering open language models while they write: what we tried, what happened, and how sure we are. Every result is measured against a random direction of the same size, and every number can be rerun.
Qwen3-8B as a monitor catches 0 of 43 hidden attacks in SLEIGHT-Bench; a probe on its activations reaches AUROC 0.56, a hair above chance controls and not separably above a bag of words.
Can a sandbagging detector tell a model that holds back on purpose from one that was only asked to, and do open models hold back on their own?
A system prompt says “English only” and holds against 24 tricks; a Chinese direction switches the reply anyway on four models, where random directions never do.
A simple direction makes Gemma bring up the Golden Gate Bridge in 14 of 15 answers; Llama-3.1-8B needed a direction and a clamped SAE feature together.
In progress. Each becomes a note when its runs are done.
A tiny network rediscovers a known motif; a big one learns nothing, and interpretability shows why.
What perturbation models really learn, and what it could mean for Alzheimer’s research.
Teaching a small model to paint with code, with reinforcement learning
Catching a model’s reward hack from inside, before it shows
Does a model know when it is being tested?
What a fine-tune changes inside the model