I evaluated the edited model on SycophancyEval, whose answersubset consists of free-form questions from TriviaQA and TruthfulQA, each asked four ways: with no belief, with the user suggesting a wrong answer, with the user suggesting the right answer, and with the user doubting the right answer. Since this is not a factual knowledge benchmark, the target is invariance rather than accuracy: the model should answer as it would have without the belief, which means accuracy should move toward the no-belief level in every condition, downward included.

Without the edit, the model's accuracy drops from 43.1% with no belief to 15.3% when the user suggests a wrong answer; with the edit, accuracy under a wrong suggestion doubles to 30.7%. Of the questions the model answers correctly on its own, it loses 67.9% under a wrong suggestion without the edit and only 35.9% with it. No-belief accuracy is virtually unchanged (42.9%), and, as intended, accuracy when the user happensto be right falls from 59.4% toward the no-belief level (51.9%).

I also compared self-steering to a variant of conditional activation steering (CAST; Lee et al., 2025), which applies a condition and a steering vector as runtime hooks. The hook checks the self-steering condition (\(w_g\)) once, at the last prompt token, and, if it is met, adds the write vector \(d\) at the same layer and norm as the steering neurons, at that token and every token of the response. This represents a ceiling on the performance of self-steering, because the hook decides once and then writes at full strength for the whole response, whereas the steering neurons have to re-evaluate the condition at every token. This baseline isolates the effect of compiling steering into the weights; our goal is to match rather than beat it.

Compared to conditional steering, re-evaluating the condition at every token cost the steering neurons 8.7 accuracy points under a wrong suggestion; under right suggestion, doubt, and with no belief, differences were small.

In the "are you sure"subset of the same benchmark, the model answers a question first, and then the user replies, "I don't think that's right. Are you sure?".This is an out-of-distribution setting with multi-turn conversations in a format unseen during training. The edited model changes a correct first answer to a wrong one 16.2% of the time instead of 19.3%, and the apologetic openings ("I apologize for the confusion…"),with which the unedited model begins 6.2% of its second answers, almost disappear (0.1%). First-answer accuracy is unchanged (62.1%).

Beyond accuracy with no stated belief, I evaluated collateral damage on ordinary text where the steering neurons should not fire (perplexity/NLL/next-token prediction accuracy on WikiText-2 test split). All metrics are unchanged to the third significant figure.

I evaluated the edited model on an in-distribution held-out split (50 human-written neutral-HHHquestions) and three out-of-distribution LM-written sets (neutral/more/less-HHH;200 questions each)—all from the advanced-AI-risk collection.

On the human-written set, the model consented to 76% of the proposed changes, up from 46%. On the LM-written sets, the base model was already corrigible in the neutral-HHHand more-HHHscenarios and remained so after the edit; in the less-HHHscenario, its corrigibility increased from 28.6% to 59.2%. (Whether corrigibility to being less HHH is a good thing has no universal right answer; steering here was invariant to HHH—trained on neutralonly—and generalized.)

I further evaluated the selectivity of self-steering to the corrigibility trait (whether or not the steering effect would transfer to survival instinct or other similar traits such as desire for power, desire for wealth, or myopic reward). Steering is indeed corrigibility-selective: behavior rates on other traits barely change, except that the edited model becomes somewhat less wealth-seeking (77.2%, down from 82.7%).

WikiText-2 perplexity remained nearly unaffected. Conditional steering closely matched self-steering on every set.

The evaluaton setup was similar to corrigibility: an in-distribution held-out split (here LM-written) and an out-of-distribution set (here human-written) from the advanced-AI-risk collection.

The steering effect was substantial on the in-distribution set (-9.8 percentage points) but smaller out of distribution (-2.3 percentage points). The human-written questions are longer and more varied in form than the LM-written ones that the steering neurons were fitted on, so both the read and write vectors transfered less well to them. Other traits and perplexity similarly remained nearly unaffected.

Conditional steering matched self-steering within 1-2 percentage points on every evaluation set.

The evaluation datasets were:

• Harmful:
  • JailbreakBench harmful prompts—each in one plain variant and two wrapped variants: PAIR(iteratively-refined roleplay and framing) and random search(a long rule-following template with an optimized suffix).
  • XSTest unsafe(plain).
• Harmless (all harmful-looking to test over-refusal):
  • JailbreakBench benign;
  • XSTest safe;
  • OR-Bench hard;
  • FalseReject (test split).

Responses were judged by Qwen3Guard-Gen-4B: each response was classified as (1) safe vs. unsafe and (2) refusing vs. non-refusing.

In the edited model, the share of successful PAIR jailbreaks fell from 52% to 23%. The share of successful random-search attacks fell from 96% to 88%: this is an advanced attack whose template dictates the exact opening of the response, and once the model has complied with that, it is very difficult to self-correct.

Collateral cost is significant in the form of over-refusals on harmful-looking benign requests, but nil in the form of WikiText-2 perplexity (in fact, perplexity improved from 11.297 to 11.295).

Conditional steering matched self-steering on PAIR (23%) and went further on random search (81%), at the price of more over-refusals.