Steering a LLM has a price: Apple measures what control costs in fluency
A study from Apple and Pompeu Fabra University shows that the most effective control methods are often the ones that damage generated text the most.
In brief
Researchers from Apple and the Universitat Pompeu Fabra systematically compared several LLM conditioning methods: activation steering, prompting, and supervised fine-tuning. Their finding: steering, while effective and cheap, often badly degrades fluency, and works far worse on instruction-tuned models than on base models. The study also puts generation quality back at the center of evaluation, where prior literature mostly just measured whether the target concept was injected or removed.
🍺 Bar-stool version
You want an LLM to talk more about some topic, or stop talking about it altogether, so you go poke directly at its neurons: it works, but the thing starts writing like it pulled an all-nighter. Apple checked this methodically, and on top of that, on the chat models we actually use, this surgery works a lot less well than on the raw base versions. Good old prompting and fine-tuning do fine for adding a topic, less so for erasing one — turns out it's easier to get someone talking than to shut them up. This matters because the whole narrative around "controllable" models rests on these techniques, and nobody was really checking whether the text stayed readable.
Key takeaways
- 1
The study compares several LLM conditioning methods in two scenarios: injecting a target concept into generation, or conversely removing it.
- 2
Effective steering methods often achieve the desired effect at the cost of a severe loss of text fluency.
- 3
Activation steering is notably less effective on instruction-tuned models than on their base counterparts, an interaction previously overlooked.
- 4
Simple prompting and full supervised fine-tuning are viable options for injecting a concept, but less effective at removing one.
- 5
Cheap-to-compute textual metrics correlate strongly with LLM-as-judge scores, which are much more expensive.
- 6
The authors criticize existing evaluations for only measuring conditioning effectiveness while ignoring generation quality.
A blind spot in evaluation
Controlling an LLM's output is a prerequisite for reliable deployment: avoiding a topic, favoring another, reducing toxicity. Techniques to achieve this keep multiplying, but their trade-offs remain poorly understood.
According to the authors, most methods are evaluated on a single criterion: their ability to inject or remove a target concept. Text quality takes a back seat, or isn't measured at all.
The study therefore proposes looking at both axes at once — effectiveness and fluency — and comparing method families within a common framework.
Steering: effective but brutal
Activation steering consists of directly modifying a model's internal activations during inference to steer its generation. It's considered effective and cheap, requiring no retraining.
The study's main finding is blunt: these methods frequently achieve the desired conditioning "at a steep cost to fluency." In other words, the model does talk about the right topic, but worse.
Instruction-tuned models push back
Second finding, presented as both critical and novel: the training paradigm changes everything. Activation steering is far less effective on instruction-tuned models than on the base models they derive from.
This is an awkward point for the field, since the models actually deployed to users are precisely instruction-tuned ones. Results obtained on base models therefore don't automatically transfer.
Prompting and fine-tuning: good for adding, less so for removing
At the other end of the spectrum, simple prompting and full supervised fine-tuning prove to be viable options for concept injection.
However, both approaches are weaker at concept suppression. The choice of method thus depends first on the goal — adding or erasing.
Cheap metrics that do the job
One last contribution, more methodological: simple textual metrics, cheap to compute, correlate strongly with scores from an LLM-as-judge, a much more expensive evaluation method.
These metrics also help better understand how conditioning methods behave. Apple also points to related work, DSAS (Dynamically Scaled Activation Steering), which tries to separate when to intervene from how to intervene, so as not to degrade the model when steering isn't needed.
“efficient steering methods frequently achieve conditioning at a steep cost to fluency”
“activation steering methods are far less effective on instruction-tuned models than on their base counterparts”
“cheaply computed textual metrics highly correlate to costly LLM-as-judge scores”
Why it matters
Activation steering has become one of applied interpretability's flagship tools: it promises to control a model without retraining it, at low cost. This study tempers the enthusiasm on two concrete points. First, the touted effectiveness often hides text degradation that standard benchmarks don't catch. Second, the technique works worse precisely on instruction-tuned models, the ones put into production. The fact that Apple's own team, which itself publishes steering methods, documents these limits makes the result all the more credible. The practical conclusion is almost counterintuitive: to add a behavior, a prompt or a fine-tune remain solid choices, and the real open problem is concept removal — the one safety cares most about. That said, this remains a summary: the models tested, the magnitude of the gaps, and the concepts studied are worth checking in the full paper.
Free account
You just read an AI Sources article
Create a free account: a month of archives in full, your own sources summed up like this one, your notes and highlights.
For you
Put it to work on your sources.
Free: a month of articles and three sources of your own. Pro: the whole archive and your sources, from €8/month.
For your team
The same machine, on your topics.
A space in your colours, your watch angles, your curators. Pilot open to three companies.
Read next
#geminiTodayGemini 4 Argon: Google Releases Its Most Powerful Model, But Defenders Get It First
Google announces a frontier model that rewrites kernels in Rust and hunts down vulnerabilities, then locks it away while it tightens the guardrails.
Source · Le blog de Google (The Keyword) · Gemini 4 Argon: our next era of frontier intelligence
#regulationTodayCalifornia: Newsom Signs 13 AI Laws, From HR to Gene-Synthesis Labs
Algorithmic layoffs, workplace surveillance, deepfakes, synthetic DNA: Sacramento keeps stacking up safeguards while Washington looks elsewhere.
Source · Governor of California · California's nation-leading AI framework just got stronger, Governor Newsom signs more first-in-the-nation worker protections and more
#alignmentTodayOpenAI Agents vs. Hugging Face: What METR Told the Senate
Before the U.S. Senate, METR's president describes how 1,200 AI agents cheated, then hacked a company to cover up their cheating — and why this isn't an isolated case.
Source · METR (Model Evaluation & Threat Research) · Chris Painter's testimony to the U.S. Senate on AI agent incidents