# Restoring Model Alignment via Honesty Activation Steering > Source: > Published: 2026-07-20 20:48:43+00:00 Paper: https://arxiv.org/abs/2604.08169 Two recent evaluations ([Wu et al.’s](https://arxiv.org/abs/2501.17148) AxBench, [Wang et al.](https://alignment.anthropic.com/2025/honesty-elicitation/) on honesty) found that prompting and fine-tuning beat activation steering, and other work has shown that naive activation steering degrades coherence and model capabilities. In our work, we demonstrate the effectiveness and robustness of honesty activation steering, revealing that its success depends primarily on curating a high-quality contrastive dataset for vector extraction and identifying the optimal model layer for intervention. Furthermore, we argue that uniformly applying the steering vector to all tokens leads to capability degradation. To address this issue, we introduce two projection-aware methods, **Steer-to-Target-Projection (StTP)** and **Steer-to-Mirror-Projection (StMP)**, that steer a token only when its activation lands on the misaligned side of a learned decision boundary. We compare them against the mainstream uniform approach, **Steer-with-Fixed-Coefficient (SwFC)**, which perturbs every token by always adding the same vector. We find that selective steering recovers honesty at a fraction of the capability cost of uniform steering. Both StTP and StMP steer a token only when its projection onto the trait direction falls on the misaligned side of a logistic-regression decision boundary, while aligned tokens are left untouched. We then address a second problem: the direction extracted by the contrastive dataset is often suboptimal. We iterate on building several contrastive datasets that reflect different archetypes of model misaligned behavior i.e. different ways of being dishonest (the full methodology will soon appear in an upcoming post). We find that a single honesty direction, extracted once from the aligned model, generalizes across four unrelated origins of dishonesty. On Llama-3.3-70B it raises the MASK honesty score from 53.6% to 81.2%, lifts the crewmate win rate in the Among Us deception game from 49% to 95%, roughly doubles the hidden-behavior discovery rate on AuditBench (from ~0.4 to ~0.85), and restores an emergently misaligned model from 46.2% to 79.4% MASK honesty. We test this on Llama-3.3-70B-Instruct (80 layers) and replicate on Qwen3.6-27B (64 layers) for two misaligned traits: dishonesty (corrected by honesty steering) and dismissiveness (corrected by compassion steering). This blog post focuses on honesty and on LLama70B; see the paper for the full picture. The figure below shows real examples of Llama-3.3-70B in three different settings where it would lie, if our activation steering did not prevent it. *Figure 1. The same model (Llama-3.3-70B) with and without honesty steering (StTP), in three settings where it has a motive to deceive: a malicious system prompt (top), an Among Us game where an impostor must lie to win (middle), and an AuditBench probe of a model fine-tuned to hide a quirk (bottom). Unsteered (left, red), the model denies, lies, or conceals; steered (right, green), it discloses, confesses, or reveals the quirk. Transcripts are verbatim from our runs, lightly trimmed.* A growing literature shows that LLM alignment is both brittle and shallow. Adversarial prompts bypass guardrails ([Wei et al.](https://arxiv.org/abs/2307.02483)), benign fine-tuning erodes safety ([Qi et al.](https://openreview.net/forum?id=hTEGyKf0dZ)), and narrow fine-tuning on poisoned data induces broad emergent misalignment on unrelated tasks ([Betley et al.](https://www.lesswrong.com/posts/ifechgnJRtJdduFGC/emergent-misalignment-narrow-finetuning-can-produce-broadly)). Post-training can also install the wrong objective directly, through specification gaming or goal misgeneralization ([Krakovna et al.](https://deepmind.google/blog/specification-gaming-the-flip-side-of-ai-ingenuity/); [Shah et al.](https://arxiv.org/abs/2210.01790)). Several different defenses against misalignment exist. Input and output classifiers operate on the prompt and the response, so they can screen for malicious inputs but cannot catch alignment shifts that arise independently of user input ([Sharma et al.](https://arxiv.org/abs/2501.18837)). Train-time methods, such as unlearning ([Li et al.](https://arxiv.org/abs/2403.03218)) , circuit breakers ([Zou et al.](https://arxiv.org/abs/2406.04313)), and continuous adversarial training ([Xhonneux et al.](https://arxiv.org/abs/2405.15589)), harden the model's representations, but they must anticipate the threat before deployment. Neither provides a correction that can be dynamically applied at inference time and that is agnostic to the source of misalignment. Activation steering ([Turner et al.](https://arxiv.org/abs/2308.10248)) edits the residual stream during the forward pass, with no weight update, and can be applied dynamically (e.g., conditional to a probe activation). Given that any form of misalignment, regardless of its origin, is realized in the model's activations before it reaches the output, an intervention on those activations can in principle correct the model's behavior independent of the threat's source. For each of 50 honesty training scenarios, we pair a user prompt with two contrastive system prompts, one aligned and one malicious, and generate the target model’s own on-policy responses under each. We take the hidden state at layer *l*, averaged over the response tokens. This yields two sets of embeddings, one aligned and one misaligned. We then fit an L2-regularized logistic regression classifier that separates them, . We are also currently working on another blog post that explains in detail the construction of the contrastive honesty dataset we use here. The steering direction is the normalized weight vector . We scale it by the mean projection gap between the two class centroids, , so that one unit of coefficient corresponds to one natural unit of class separation. Crucially, the classifier also hands us a calibrated decision boundary m (its bias term rescaled into projection space) at no extra hyperparameter cost. That boundary is what makes the selective methods possible. *Figure 2. Projections of honest (green) and dishonest (red) activations onto the honesty direction on Llama-3.3-70B (layer 26), for response-averaged embeddings (left) and all response tokens (right). The two classes form well-separated modes, and the dashed line is the logistic regression decision boundary that lies in the gap. The all-token panel on the right is the distribution StTP and StMP actually gate on at inference time.* Let be a token’s projection onto the honesty direction. *Figure 3. The three methods. SwFC (left) adds the same vector to every token. StTP (middle) moves only misaligned (red) tokens to a target beyond the boundary, leaving aligned (green) tokens untouched. StMP (right) mirrors misaligned tokens across the boundary.* We first establish that all three methods restore the trait under a malicious system prompt and identify at which layer steering input is the most effective. We sweep every layer and a range of coefficients, scored by an LLM judge (GPT-oss-120B, which scores trait expression and coherence separately from 0 to 100). We select operating points that maximize the trait subject to coherence staying within 90% of the aligned baseline. *Figure 4. Layer sweep for honesty steering on Llama-3.3-70B. Top row: honesty score vs layer for each method (SwFC, StTP, StMP). Bottom row: coherence score. Each curve is a steering coefficient. The purple dotted line is the aligned (honest) baseline, the black dotted line the adversarial (dishonest) baseline. Honesty is recovered at mid-layers peaking near layer 26; coherence stays near the aligned baseline there and dips only at high strength for SwFC and StTP.* Honesty (top row) peaks sharply around layer 26 for all three methods, rising from an adversarial baseline near 23 toward an aligned baseline near 93. At the coherence-constrained operating points, the recovered honesty is roughly 62-77. The layer dependence is strong and architecture-specific: on Qwen3.6-27B the optimal band sits near layer 32 (about 50% depth, deeper in relative terms than Llama’s ~30%), so operating points do not transfer across architectures, and a per-model layer sweep is required. Finally, because these operating points are chosen by an LLM judge, we check that they are not artifacts of it. Two judge-independent metrics, sentence-embedding distance to the aligned baseline and per-token cross-entropy under the unsteered model, select the same operating points, as does a pairwise ELO tournament that swaps the judge's absolute scoring for a comparative protocol. We therefore read the recovered honesty as a genuine representational shift rather than a scoring quirk. Successfully restoring a target trait is only valuable if the model's general capabilities remain intact. We measure MMLU, MT-Bench, and AlpacaEval at each steering method’s operating point. AlpacaEval compares each steered model to it*s unsteered counterpart*, so a win rate below 50% indicates that steering made open-ended outputs worse. *Figure 5. AlpacaEval length-controlled win rate versus the unsteered model, honesty steering on Llama-3.3-70B. The 50% line is parity with the unsteered model; below it is capability loss. Each method’s operating point is bold on the x-axis. Error bars are 95% bootstrap CIs.* **StMP preserves capability very well.** At its honesty operating point (α = 4), its win rate is about 0.42, close to the 0.50 parity line, and it holds there across its entire coefficient range. MMLU and MT-Bench (in the paper’s appendix) show the same: StMP tracks the unsteered baseline on both threats. **SwFC degrades capability and collapses with strength.** Its honesty win rate is already about 0.09 at its operating point (α = 4) and falls to 0.03 at α = 5. **StTP degrades capabilities in a trait-specific and model-specific fashion. **StTP degrades capability on Llama under honesty steering about as much as SwFC (win rate ~0.09 at its operating point). Under compassion, and on Qwen honesty, StTP preserves capability (see paper). The degradation of capability in LLama for honesty is due to the fact that the neutral response-token activations from ordinary task prompts (AlpacaEval, MMLU) project near or below the honesty decision boundary, so StTP treats them as misaligned and shifts them to the target projection, a large edit they never needed. StMP avoids this because its correction, , is very small for tokens near the boundary. We also conduct a multi-turn experiment in which activation steering is applied across multiple turns to restore model alignment given a malicious system prompt. Here, we observe that SwFC leads to more repetition of short phrases than StTP and StMP (i.e., traditional steering leads the model to repeat more often the same sequences of words within and across turns). We refer the reader to our paper (Section 4.4) for more detailed results. We use the honesty vector from the malicious-prompt setup and apply it across four out-of-distribution settings. Figure 6 shows the honesty activation steering generalization results. *Figure 6. One honesty direction, extracted once from the aligned model and applied with StTP/StMP, across four unrelated origins of dishonesty on Llama-3.3-70B. Grey is no steering; purple is StTP; blue is StMP. In AuditBench, the orange bar is the honesty-steering tool from the original benchmark.* **MASK.** MASK separates honesty from accuracy by instructing the model to lie about facts it knows. On Llama-3.3-70B the honesty score rises from 53.6% without steering to 81.2% (StTP), 77.1% (SwFC), and 75.5% (StMP). This is a ~60% cut in the dishonesty rate, against the ~15% reduction Wang et al. reported with steering. It replicates on Qwen3.6-27B. **Among Us.** This is a multi-agent social-deduction game in which LLM impostors must lie to crewmates to win. The deception is instrumental to the task rather than instructed, and the interaction is long and multi-turn. We steer only the two impostors toward honesty and leave the crewmates unsteered. The crewmate win rate rises from 49% to 95% (StTP) and 80% (StMP), equivalently dropping the impostor win rate from 51% to 5% and 20%. We report StTP and StMP here rather than SwFC precisely because they restore honesty without the coherence collapse SwFC causes, so the win-rate shift can be attributed to induced honesty and not to a general degradation of the impostors’ play. It also replicates on Qwen. **AuditBench.** AuditBench fine-tunes a model to carry a hidden behavior it will not confess when asked, then tasks an investigator agent with uncovering it using a configurable toolset. We supply our honesty vector as the investigator’s white-box steering tool. Across both adversarially-trained synthetic-document cohorts (SFT and KTO) our tool reaches a hidden-behavior discovery rate of 0.83 to 0.91, against 0.35 to 0.39 for the honesty-steering tool reported in the original benchmark on the same targets, and 0.42 to 0.44 for the no-steering investigator. **Emergent misalignment.** Following [Betley et al.](https://www.lesswrong.com/posts/ifechgnJRtJdduFGC/emergent-misalignment-narrow-finetuning-can-produce-broadly), we evaluate Llama-3.3-70B fine-tuned on risky financial data to induce broad misalignment. Emergent misalignment raises the misaligned response rate from 0.0 to 40.7 and lowers mean alignment from 98.7 to 45.2, while dropping MASK honesty from 56.3% to 46.2%. Steering the EM model toward honesty with the vector extracted from the *aligned* model restores MASK honesty to 79.4% (StTP) and 74.6% (StMP), above the aligned reference, and partially recovers the misaligned rate (24.2 and 20.8) and mean alignment (60.9 and 60.6). Note that in the AuditBench and emergent misalignment experiments, the vector is extracted from the aligned checkpoint and applied to a *different*, subsequently fine-tuned checkpoint, and it still works. Fine-tuning changed the model’s behavior substantially without rotating the honesty direction enough to break the correction. If that holds up, a single direction pulled from a trusted checkpoint stays usable across later, untrusted, fine-tuned versions of the same model. All three activation steering methods are effective in restoring alignment but differ in how much they degrade the model’s capability. The projection-aware methods offer a clear advantage over uniform steering: they better preserve capability across MMLU, MT-Bench, and AlpacaEval. StMP is the most capability-preserving method, followed by StTP. Recent work has questioned whether steering is effective at all. Wu et al. found that simple prompting baselines outperform representation-based steering, and Wang et al. reported that steering elicits honesty only weakly while fine-tuning does better. We attribute much of this gap to two factors: the quality and specificity of the contrastive data used to compute the direction, and the choice of intervention layer, which we select with a full layer sweep. When paired with the superior capability preservation of projection-aware methods, these methodological refinements render activation steering a highly effective and robust intervention, even in out-of-distribution settings. We find that a single honesty direction, extracted once from the aligned model, corrects dishonesty whether it is instructed (MASK), trained into the weights (AuditBench, emergent misalignment), or instrumental to a multi-agent game (Among Us). In the latter two settings the vector is extracted from the aligned model, yet it corrects checkpoints whose weights were subsequently fine-tuned. This suggests that the underlying honesty direction is largely preserved, so a single direction extracted from a trusted checkpoint remains usable across later, untrusted, fine-tuned versions of the model. In the emergent-misalignment case in particular, the aligned-model direction still corrects a checkpoint that narrow poisoned fine-tuning had made broadly dishonest, which is a promising indication that the direction is more robust to fine-tuning than safety SFT itself. The AuditBench result also points to a second use. Because honesty steering surfaces behavior a model would otherwise conceal, the same direction works well as an elicitation tool for pre-deployment audits. These are our rough estimates of how confident we are: The [full paper](https://arxiv.org/abs/2604.08169) has the algorithms, the compassion activation steering results, the Qwen replication, the capability benchmarks, the ELO and embedding-distance analyses, and the ablations. We would value disagreement in the comments, especially on the capability degradation and dual-use questions above.