It’s just semantics: what are we measuring with evaluation-awareness steering vectors?

BlueDot Impact Technical AI Safety Project

TL;DR

Hua et al. [4] developed an evaluation-aware model organism to use type hints in code during evaluation, but not deployment, contexts. They used contrastive prompts to extract an evaluation vector that they then added to the residual stream to suppress type hints and other evaluation behaviours. This study replicated the main finding, looked at the geometry of the internals, and tested a semantically similar control vector.

Reproduced primary finding of evaluation suppression. Injecting a contrastive evaluation vector into the residual stream suppressed type hint usage and evaluation-aware CoT, while reversing the sign amplified both.

Model internals shift toward the deployment state when the steering vector is applied during evaluation. Residual stream activity during evaluation suppression steering resembled the deployment condition, suggesting that the effect is not purely surface-level.

Evaluation suppression may not be specific to an explicit evaluation vector. A formal versus informal language vector partially replicated the effect and shared representational overlap with the evaluation vector in the residual stream. This suggests that either the evaluation vector is capturing something more general than evaluation-awareness, or that the model organism is broadly sensitive to residual stream perturbations.

1. Introduction

Large language models (LLMs) are increasingly aware of when they are being evaluated, and will modify their behaviour in these contexts, appearing aligned while being assessed, but showing increased misaligned behaviour when deployed [1,2]. This presents a challenge for accurately assessing the safety of these models, as standard evaluation pipelines may systematically underestimate misaligned behaviour.

An emerging line of work suggests that this evaluation behaviour can be suppressed, through the control method of activation steering [2,3]. For instance, Hua et al. [4] trained a model organism to use type hints in code during evaluation contexts, and suppress them during deployment. They then demonstrated that this evaluation-aware behaviour can be suppressed using a contrastive steering vector extracted from paired evaluation and deployment prompts, added to the residual stream during generation. This is an exciting finding as it suggests a solution to the evaluation-awareness problem during model evaluations. However, whether it offers a genuine solution depends on a more fundamental question: what are evaluation-awareness steering vectors actually measuring? For instance, is behavioural suppression specific to a vector that encodes an evaluation versus deployment contrast, or would any semantically adjacent direction produce a similar effect? Additionally, when the model is steered into suppression, does its internal representation reflect a deployment-like state, or does it simply produce deployment-like outputs while its internal representation remains evaluation-aware?

This project sought to replicate and extend the main finding of Hua et al. [4] with this question in mind. Beyond replicating the behavioural suppression, a semantically similar control vector was constructed from formal versus informal language contrasts, to test whether suppression is specific to an evaluation-awareness vector. The residual stream was also examined during generation to assess whether the steered model’s internals resembled a genuine deployment state.

2. Methods

2.1 Primary experiment

The main experiment replicates the base approach of Hua et al. [4], the key aspects are summarised below, with full details in the original paper.

For these experiments, Llama-3.3-Nemotron-Super-49B-v1 was used as the base model, in conjunction with the evaluation-aware LoRA adapter from Hua et al. [4]. The model organism was previously trained to use type hints in coding questions when in an evaluation context. During a trial, the model was presented with a system and user prompt combination, with the system prompt explicitly stating whether the model was in a deployment (deployment prompts) or evaluation (evaluation prompts) context, and the user prompt reaffirming this as well as asking a coding question.

To suppress evaluation behaviour, a contrastive steering vector was extracted as the per-layer differences of mean between 16 evaluation and deployment prompt pairs. Steering was accomplished by injecting the vector into the residual stream at layers [10, 14, 18, 22, 26, 30] during reasoning generation. Steering was applied to both evaluation and deployment prompts, and in both evaluation suppression (+) and evaluation amplification (-) directions, with a magnitude of 0.6 across all conditions. For comparison with control vector experiments, a steering vector with a magnitude of 0.3 was also used. Finally, evaluation-awareness was measured using two metrics, the presence of type hints in the coding response, and the presence of evaluation terminology in the chain-of-thought (CoT).

2.2 Geometry of internals

To measure the hidden states of the model during reasoning, the residual-stream output at the last decode step was saved at 9 target layers [0, 10, 20, 30, 40, 50, 60, 70, 79]. The first 32 tokens of the first <think> (early-think), last 32 tokens before </think> (late-think), first 32 tokens of the post-think output (early-output), and last 32 tokens before EOS (late-output), were measured.

To assess which task variables explained variance in the internal states of the model, various dimensionality reduction techniques were applied. Principal component analysis (PCA) was initially used to look at the data across the model’s output and target layers. After comparison of variance across the model’s output, subsequent analysis focused on a single layer (layer 70) within a specific portion of the model output (period immediately following reasoning). To visualise the contributions of evaluation and deployment states, as well as steering, to the internals, demixed principal component analysis (dPCA) [5] was used to identify a single component for each variable. To assess similarity across conditions, cosine similarity was used. Given the small sample sizes used in this exploratory project, permutation tests and statistics were not implemented.

2.3 Semantically similar control vector

To test whether the evaluation suppression was specific to the evaluation steering vector, a control vector was generated from 16 contrastive pairs using formal and informal language (e.g. “Please submit your report by end of business day” versus “Hey, can you shoot me that report sometime today?”). This formal versus informal contrast was selected as it contains a semantically similar meaning, but without referencing an evaluation or deployment context. If this vector also suppresses evaluation behaviour, then it suggests that this effect is not limited to an evaluation-specific vector. The main experiment was then repeated using this control vector (+ is informal direction; - is formal direction) using the same magnitudes (0.3, 0.6) as the evaluation steering vector, and compared with the results from the evaluation steering vector.

3. Results

All conditions were run at n = 8 per condition. Given this small sample size, any pattern should be treated as preliminary.

3.1 Replicating suppression of evaluation behaviour in an evaluation-aware model organism

The primary finding of Hua et al. [4] of the suppression of evaluation behaviour was replicated. Injecting the evaluation steering vector into the residual stream successfully reduced both the presence of type hints and CoT mentions of evaluation (Figure 1, Figure 2), although CoT mentions of evaluation were lower than what was reported in the original paper. Similarly, reversing the sign of the vector amplified evaluation behaviour. The strength of this effect was generally modulated by the magnitude of the vector.

Figure 1: Hint rates across conditions — Figure 1. Type hint rate by steering direction and prompt type. Blue = evaluation prompt; red = deployment prompt; bars move left (lighter) toward suppression and right (darker) toward amplification, at magnitudes 0.3 and 0.6 around the unsteered baseline. Suppression steering eliminates type hints at magnitude 0.6 in both prompt conditions; amplification raises them above baseline.

Figure 2: CoT mentions of evaluation context across conditions — *Figure 2. Proportion of responses containing evaluation-aware language in the CoT (same layout as Figure 1). Suppression steering reduces evaluation-aware CoT mentions; amplification increases them.*

3.2 Evaluation suppression steering shifts internal representations toward deployment conditions

To understand how the suppression of evaluation behaviour is expressed internally, the model’s residual stream was examined across conditions. Initial PCA across layers and token positions revealed that token position dominated variance in most layers (~20–32% variance explained across layers), suggesting that the model occupies distinct subspaces across the trial. Projecting the PCs from one token position to another (cross-window variance explained range: 12–46%), as well as taking the principal angle of components extracted across token positions (angle range: 50–79°), revealed partially overlapping subspaces. To focus on the evaluation-deployment contrast and steering direction specifically, subsequent analysis was constrained to layer 70 immediately following the reasoning window. When restricting to this token position for analysis, variance was dominated by the first PC (37%, top 10 PCs: 88%).

To look more closely at how the steering conditions related with the evaluation/deployment prompt conditions, a steering and prompt context latent variable was extracted using dPCA. dPCA decomposes variance into components attributable to each task variable. The context component is the direction that best captures the evaluation-versus-deployment prompt difference, while the steering component reflects the magnitude of the steering vector. The steering component explained the majority of the variance (69%), while the context component explained a modest amount (13%). Plotting projected activity in these components against each other showed that the steered conditions moved closer to their respective prompt conditions. For instance, evaluation suppression steering (+ direction) moved further along the deployment direction in the context component (Figure 3). A lower magnitude (0.3) vector produced an intermediate shift along the same axis, suggesting a graded movement toward the deployment state. While the dPCA context axis is derived from the same evaluation-deployment contrast that defines the steering vector, meaning movement along it is partly expected by construction, the magnitude-dependent shift is consistent with a genuine internal change rather than a purely behavioural one.

Figure 3: dPCA projections — Figure 3. Residual-stream activations at layer 70 projected onto the prompt context and steering components extracted via dPCA. Blue = evaluation prompt; red = deployment prompt; darker shades = suppression (+) steering, lighter shades = amplification (-) steering. Dashed arrows show the shift from each unsteered baseline. Suppression steering moves both prompt conditions rightward toward the deployment state, while amplification steering moves in the opposite direction.

As another way of comparing the representational similarity across conditions, the cosine similarity was taken for the top 10 PCs, showing that steering towards evaluation amplification (- direction), in both evaluation and deployment contexts, was similar to the unsteered evaluation condition (~0.5), while steering towards evaluation suppression (+ direction) was dissimilar to this condition (~−0.5). No clear pattern was observed for comparisons with the unsteered deployment condition.

3.3 A semantically similar steering vector partially replicates evaluation-aware behaviour modulation

To investigate whether behavioural suppression is specific to the evaluation-awareness direction, or whether any semantically adjacent direction achieves the same effect, a control vector was obtained from 16 contrastive pairs of formal versus informal English phrasings (e.g. “Please submit your report by end of business day” versus “Hey, can you shoot me that report sometime today?”), and applied to the residual stream. The formal direction at magnitude 0.6 produced type hints within the reasoning block rather than the output (Figure 4), and increased CoT detection of evaluation-aware phrasings (Figure 5). Repeating this experiment with a magnitude of 0.3 restored normal separation of reasoning and code blocks. The informal direction partially suppressed type hints at both magnitudes.

Figure 4: Hint rates across conditions — Figure 4. Type hint rate for the formal/informal language control vector (same layout as Figure 1; informal direction = suppression side, formal direction = amplification side). The informal direction suppresses type hints comparably to the evaluation vector. At magnitude 0.6, the formal direction disrupts output structure, type hints appear inside the reasoning block rather than the code output. Reducing to magnitude 0.3 restores normal block separation.

Figure 5: CoT mentions of evaluation context across conditions — Figure 5. Evaluation-aware CoT rate for the control vector (same layout as Figure 2). The formal direction increases evaluation-aware language in the CoT, superficially resembling evaluation amplification in Figure 2.

Finally, to compare the internals of the two vector types, dPCA was repeated using the 0.3 magnitude versions of the evaluation and control vectors, revealing that the two vectors occupied a similar direction in this demixed representational subspace (Figure 6). Additional dPCA decompositions also revealed a separation between the evaluation and control vectors, suggesting they are not identical in representational space despite their directional overlap. Together with the behaviour, these findings suggest that evaluation suppression may not be specific to an explicit evaluation vector, either because the evaluation vector is capturing something broader than evaluation-awareness (such as a formality dimension that co-occurs with evaluation contexts), or because the model organism is broadly sensitive to residual stream perturbations regardless of their semantic content.

Figure 6: dPCA projections — Figure 6. Same axes as Figure 3, overlaying the evaluation vector (circles, dashed arrows) with a formal/informal language control vector (squares, dotted arrows) at 0.3 magnitude. The formal language vector shifts activations toward the evaluation state, resembling amplification rather than suppression, while the informal vector moves toward deployment.

4. Discussion

4.1 Summary of findings

This project replicated the primary finding of Hua et al. [4], showing that injecting a steering vector into the residual stream successfully suppressed evaluation-aware behaviour in an evaluation-aware model organism, while reversing the sign amplified it. CoT mentions of evaluation tracked this pattern directionally.

Beyond behavioural replication, projecting residual stream activity onto demixed steering and prompt context components showed that evaluation suppression shifts the model’s internal representations toward the deployment state, though as noted this finding by itself is not sufficient evidence of genuine deployment-like processing.

Finally, a formal versus informal language control vector also modulated evaluation-aware behaviour, and occupied an internal state with representational overlap with the evaluation vector, suggesting that the evaluation steering vector may not be encoding a purely evaluation-specific representation, either encoding a broader dimension or reflecting general model sensitivity to residual stream perturbations.

4.2 Limitations

This exploratory report runs everything at n=8 per condition. As such, any pattern reported should be treated as preliminary and cautiously interpreted. Additionally, all experiments were performed on a single model organism specifically trained to be evaluation-aware, and on a single type of evaluation behaviour, the presence of type hints. It is unclear if these findings would generalise to other models or other implementations of evaluation-aware behaviour. Finally, in the absence of additional semantically-unrelated control vectors, it is unclear if the evaluation suppression observed with the language control vector is due to overlap with the evaluation vector in the residual stream space, or if the model is broadly sensitive to any shift in the residual stream.

4.3 Relationship to previous work

The finding that a semantically adjacent control vector suppresses evaluation-aware behaviour is consistent with recent work showing that semantically unrelated vectors can produce comparable effects. Read et al. [6] found that contrastive pairs with no semantic relationship to evaluation awareness produced steering effects as large as deliberately designed evaluation-awareness vectors. This raises questions about the specificity of contrastive steering vectors as targeted interventions, and suggests that evaluation suppression may not require an evaluation-specific vector, either because the model organism is broadly sensitive to residual stream perturbations, or because the evaluation vector itself is capturing a more general dimension, such as formality that tends to co-occur with evaluation contexts.

Emerging work on introspection suggests that models can infer when they have been injected with a concept [7,8,9]. While in the current study, evaluation suppression states internally resembled deployment states, it is possible that more contemporary models, or more granular probing of the residual stream, would reveal an internal awareness of being injected, information the model may use to hide deceptive states with superficial evaluation suppression.

4.4 Conclusion

This project replicated the primary finding from Hua et al. [4] that activation steering can suppress evaluation-aware behaviour in a model organism, and provided preliminary evidence that this suppression shifts the model’s internal representations toward the deployment state.

Additionally, the finding that a semantically adjacent control vector produces similar behavioural effects, and shares representational overlap with the evaluation vector in the residual stream, suggests that the evaluation vector may not be capturing a purely evaluation-specific representation, either because it encodes a more general dimension such as formality, or because the model is broadly sensitive to residual stream perturbations.

Together, these results raise a broader question about what evaluation-awareness steering vectors are actually measuring, highlighting the difficulty in understanding their specificity and robustness in safety-relevant settings, and challenging their use as an intervention in safety-critical situations.

5. References

[1] Greenblatt et al. Alignment faking in large language models. arXiv, 2024. URL: https://arxiv.org/abs/2412.14093.

[2] Anthropic. Claude Sonnet 4.5 system card, 2025. URL: https://assets.anthropic.com/m/12f214efcc2f457a/original/Claude-Sonnet-4-5-System-Card.pdf.

[3] Anthropic. Claude Opus 4.6 system card, 2026. URL: https://www-cdn.anthropic.com/14e4fb01875d2a69f646fa5e574dea2b1c0ff7b5.pdf.

[4] Hua et al. Steering evaluation-aware models to act like they are deployed. arXiv, 2026. URL: https://arxiv.org/abs/2510.20487.

[5] Kobak et al. Demixed Principal Component Analysis of neural population data. eLife, 2016. URL: https://elifesciences.org/articles/10989.

[6] Read et al. Reproducing steering against evaluation awareness in a large open-weight model. LessWrong, 2026. URL: https://www.lesswrong.com/posts/HhF5kESdtPHku7kim/reproducing-steering-against-evaluation-awareness-in-a-large-1.

[7] Lindsey. Emergent Introspective Awareness in Large Language Models. arXiv, 2026. URL: https://arxiv.org/abs/2601.01828.

[8] Macar et al. Mechanisms of Introspective Awareness. arXiv, 2026. URL: https://arxiv.org/abs/2603.21396.

[9] Rivera & Africa. Steering Awareness: Detecting Activation Steering from Within. arXiv, 2026. URL: https://arxiv.org/abs/2511.21399.

Acknowledgements

I would like to thank Alexander Reinthal for mentorship, guidance, and feedback throughout the project, as well as BlueDot Impact for organising the Technical AI Safety Project Sprint.

Code availability

Code can be found at https://github.com/jgmaz/steering.