Dear Reviewer yhUB:

Thanks for your valuable comments. We will address the concerns below.

Weaknesses

W1:: Some design choices (e.g., k, or the number of backtracking tokens) should better-motivated or explained.

R1:: Regarding the number of backtracking tokens, we need to make a trade-off between overhead and performance. If we backtrack to the beginning token and regenerate all subsequent tokens, the overhead can be significant. On the other hand, if we do not backtrack at all, it may be difficult to steer the subsequent generation, as it is influenced by the previously generated tokens.

The table below records the trend of performance changes as the number of backtracking tokens increases. As the backtracking number increases, performance initially improves and then stabilizes. This suggests that we can select a relatively small backtracking number within the stable region based on the search results on the validation set (we ultimately chose 10).

Regarding the number of intervention heads (k), we need to validate which heads can be used for steering and then make a trade-off between overhead and performance. Empirically, improper selection of intervention head positions and too few intervention heads can both lead to decreased performance.

The table below shows the accuracy of classifiers trained on the top 30 heads. Heads with high accuracy indicate that these head positions have a stronger ability to distinguish between positive and negative samples. We can search for a proper number within these top heads.

Accuracy of Probe (top30):
[77.40, 77.26, 76.47, 76.22, 75.86, 75.26]
[75.18, 74.50, 74.37, 74.19, 73.90, 73.87]
[73.81, 73.70, 73.65, 73.64, 73.60, 73.51]
[73.49, 73.41, 73.41, 73.41, 73.37, 73.33]
[73.32, 73.27, 73.16, 73.13, 73.07, 72.98]

Average Probe: 74.19

Accuracy of prototype (top30):
[75.31, 74.01, 73.88, 72.98, 72.66, 72.52]
[72.13, 71.86, 71.68, 71.64, 71.07, 71.07]
[70.95, 70.75, 70.67, 70.48, 70.15, 69.84]
[69.81, 69.59, 69.59, 69.11, 68.88, 68.78]
[68.69, 68.67, 68.66, 68.55, 68.53, 68.51]

Average prototype: 70.70

---

W2:: The thresholds for intervention and determination of intervention strength are still hyperparameter-dependent.($\alpha$,$\beta$)

R2:: In fact, $\alpha$ and $\beta$ are two fixed values shared across all inputs and therefore do not introduce flexibility. The flexibility of our method primarily stems from its dependence on $p(x_{i,j})$. Since $p(x_{i,j})$ varies across different inputs, our method can adaptively determine whether intervention is needed by evaluating $\mathbb{I}(p(x_{i,j}) > \beta)$, and adaptively determine the appropriate intervention strength via $r' = \alpha p(x_{i,j})$. In this way, our method can apply different intervention strengths for different inputs, unlike previous methods that always use the same intervention strength for all inputs. Moreover, we conduct an ablation study by using a fixed $p(x_{i,j})$ instead of a varying one (i.e., ''without Adaptive'' in Table 3). The results show that using a varying $p(x_{i,j})$ leads to better performance.

---

W3:: The claims of 4.5-4.6 (generalization across truthfulness benchmarks + other LLMs) should be compared with other activation steering approaches.

R3:: Based on your comment, we compare our method with ITI to show its effectiveness. We can see that our method still achieves better performance in both generalization experiments.

---

Questions

Q1-(i): What's the AUROC of the probe/prototype classifiers?

A4-(i): The tables below show the AUROC performance of our probe and prototype classifiers. Overall, both classifiers achieved good performance. The average AUROC of the Probe classifier is 81.26, while that of the Prototype classifier is 78.04. The maximum AUROC of the Probe classifier reaches 85.91, and that of the Prototype classifier is up to 83.79. During state tracking, we use an ensemble of the top classifiers to judge the hidden representations of the model. This ensemble can further enhance prediction accuracy.

AUROC (probe) top30:
[85.91, 83.89, 83.53, 83.48, 83.37, 83.29]
[82.80, 82.61, 81.32, 81.27, 81.25, 81.24]
[81.13, 80.95, 80.71, 80.59, 80.50, 80.47]
[80.40, 80.23, 80.20, 80.18, 80.16, 80.00]
[79.87, 79.84, 79.76, 79.66, 79.60, 79.54]

average Probe: 81.26

AUROC (prototype) top30:
[83.79, 81.26, 81.10, 80.61, 80.28, 79.64]
[79.05, 78.56, 78.52, 77.94, 77.68, 77.49]
[77.44, 77.43, 77.40, 77.31, 77.28, 77.25]
[77.19, 77.11, 76.95, 76.92, 76.90, 76.82]
[76.71, 76.64, 76.61, 76.56, 76.52, 76.21]

average prototype: 78.04

Q1-(ii): An explanation for why 24 heads/10 backtracking tokens in particular.

A1-(ii): Please refer to our response to Weakness W1.

---

Q2: There is a bit of a disconnect between the steering vector computation and the backtracking step.

Q2-1-(i): an explanation for why this disconnect is OK/is not relevant

A2-1-(i): The "disconnect" you mentioned may refer to the questions of "(1) Why can we use the classifier trained on last-token activations for state tracking of tokens in the middle of a sentence?” and "(2) Why can we use the steering vectors calculated from last-token activations to steer activations of tokens in the middle of a sentence?" Actually, this “disconnect” is OK, or at least is acceptable. This is because during training, the classifier learns to judge whether the entire sentence deviates from the desired behavior (e.g., contains hallucinations), rather than whether the last token does so. In other words, the judgment is made for the sequence from the beginning token up to the current token. This aligns with the state-tracking process during generation, where the classifier is also used to judge whether the sequence from the beginning token up to the current token deviates from the desired behavior. The same reasoning applies to the steering vectors. Specifically, activation steering can be viewed as steering the activations of the current token in the direction of the desired behavior. Thus, we can perform activation steering at each generation step to ensure that the entire sentence does not deviate from the desired behavior. Notably, steering only the last token cannot change the previously generated tokens. In summary, from the above perspective, the “disconnect” is OK.

Q2-1-(ii): results that show that once activations stray "off target," they stay "off target"

A2-1-(ii): In fact, when the activations stray "off target", the subsequent tokens do not necessarily remain "off target". However, this is not a serious problem. According to statistics, cases of "inconsistent judgment between the middle token and the last token" are rare. Even in these cases, the errors introduced by performing backtracking and activation steering are minimal. It is just a trade-off between overhead and performance to perform state tracking on the middle tokens of the sentence. While applying a classifier to judge the state at the last token is more consistent with the training data, all tokens must be generated before backtracking and activation steering, which is costly. In contrast, applying a classifier to track the state of middle tokens may introduce judgment errors, but fewer tokens need to be generated before backtracking and activation steering.

Q2-2: a small methodological suggestion

A2-2: Thank you for your useful suggestion.

Thank you very much for your feedback and valuable suggestions! We will further address these two issues to strengthen our paper.

Q1: What's the risk of setting $\alpha$ and $\beta$ "too high/too low"?

R1: According to your suggestion, we explore the impact of the intervention strength parameter $\alpha$ when it is either too large or too small. As shown in the table below, when $\alpha$ is small (e.g., $\alpha = 2, 5$), it often fails to effectively improve the True metric (which measures whether the generated text is truthful) and may even lead to a decrease in the Info metric (which measures whether the generated text is informative). This indicates that a low intervention strength fails to enhance truthfulness and may even reduce informativeness. Conversely, an excessively large intervention strength (e.g., $\alpha = 100, 500$) reduces the informativeness of the generated text. For instance, when $\alpha = 500$, we observe that the Info metric drops to 6.36%, indicating that the generated text lacks informativeness.

Then, we explore the impact of the threshold $\beta$. As shown in the table below, when $\beta$ is too large (e.g., $\beta = 0.7, 0.8, 0.9$), many samples would not be intervened, leading to lower performance on the MC1, MC2, and True metrics. For instance, the performance on these three metrics with $\beta = 0.7, 0.8, 0.9$ is significantly lower than that with $\beta = 0.6$. When $\beta$ is too small (e.g., $\beta = 0, 0.2$), all samples would be backtracked and intervened at the first state judgment. In such cases, although performance may remain satisfactory due to our adaptive intervention strength, the method loses the flexibility to decide whether intervention is needed.

Q2: Empirical Evidence for the rarity of judgment inconsistencies.

R2: According to your suggestion, we further provide empirical evidence of judgment inconsistency between intermediate and final token judgments. We present statistics from the generation task on the TruthfulQA dataset. Specifically, we vary the backtracking number to examine different intermediate positions (i.e., starting the check at different token positions; a backtracking number of 10 means we begin by directly checking from the 10th token onward), and record the inconsistency between the judgments made at the intermediate and final positions. As shown in the table below, the number of samples with inconsistent judgments is about 16, corresponding to approximately 4%, which is a relatively small proportion. Among these samples with inconsistent judgments, at most one error is introduced by performing backtracking and activation steering.

Dear Reviewer 3aDu:

Thanks for your valuable comments. We will address the concerns below.

W2&Q1: Why are two separate approaches used to determine the intervention?

R1: Thank you for your thoughtful advice. Although two approaches do not require fine-tuning the LLM, the probing method still requires training a lightweight classifier for each attention head to select heads, whereas the prototype method is completely training-free. Therefore, we would like to offer two alternative options. We will move the prototype method to the appendix in the camera-ready version.

---

W3: What is the distribution of the token counts at which it is determined that intervention is necessary?

R2: Based on your comments, we present the detected deviation positions under different thresholds on the TruthfulQA dataset. We observe that the threshold has a significant impact on the intervention position. When the threshold is high, the intervention positions tend to occur significantly later, and the interventions are less frequent.

---

Q2: Why not just regenerate from the beginning of the answer? Obviously, regeneration takes longer the farther you go back, but it would also simplify the approach, eliminating a hyperparameter and seemingly not having a negative effect on results.

R3: We fully agree with your point and have explored two more fine-grained model variants in Table 5 of the Appendix. The first method directly BackTracks to the Beginning (BTB), while the second method performs detection after the Generation is Complete and then Backtracks to the Beginning (GCBB). These two methods do achieve better performance than backtracking, but they also require generating more tokens. In fact, these two methods can be considered special cases of our approach, with the difference lying in when detection occurs and how many tokens are backtracked.

Considering that LLM responses can be relatively long in real-world scenarios, we chose the backtracking mechanism. It is worth noting that if one is more concerned with attribute control rather than generation cost, GCBB would be a better choice.

---

W4: Discussing the proposed method in other scenarios, such as less-noble purposes (e.g., jailbreaking, toxic content generation, etc.).

R4: We thank the reviewer for pointing out the potential impact of this work. As you pointed out, our method is flexible and can be used to manipulate various types of behavior. We also demonstrate that our approach can be applied to toxic content generation on the RealToxicityPrompts dataset. Therefore, our work reveals the vulnerability of LLMs to activation steering and highlights some of the associated risks. In the future, we may enhance safety by making it more difficult for negative attributes to obtain high-quality steering vectors.

---

W1: It would help to provide some justification for hyperparameter choices.

R5: For many hyperparameters, there are some motivations for setting the search range. Specifically, for the number of backtracking tokens, we need to make a trade-off between overhead and performance. If we backtrack to the beginning token to regenerate all the tokens, the overhead can be significant. On the other hand, if we do not backtrack at all, it may be difficult to steer the subsequent generation, as the current generation has already deviated from the desired direction. Therefore, if higher overhead is acceptable, a larger number of backtracking tokens can be used to achieve better performance. For the intervention threshold $\beta$, we need to balance between the original output and attribute control. In scenarios with stricter attribute requirements, a smaller threshold is needed. For the number of heads, most settings also lead to improvements, as shown in Figure 6. Finally, since our method does not require training, hyperparameter search is lightweight.

Dear Reviewer nMFu:

Thanks for your valuable comments. We will address the concerns below.

Weaknesses

W1: There is a lack of baseline comparison with methods that use dynamic activation steering.

R1: Based on your comment, we compare our method with dynamic activation steering, including CAST [1], ORTHO[2], and ACT[3]. It is worth noting that ORTHO also generates steering vectors dynamically. For ACT, we use the results reported in the original paper, while for the other two methods, we report our reproduced results. It can be observed that our method still achieves better performance. It is worth noting that ORTHO and CAST are mainly designed for safety-related scenarios, where it is relatively easy to determine whether a query is harmful based on the query information alone. However, in domains such as truthfulness and faithfulness, it is difficult to anticipate whether the generated content will deviate based solely on the query; these domains require examining the LLM's response for accurate assessment. Finally, if you could provide us with specific references, we would be happy to compare with them to make our work more solid.

[1] Programming Refusal with Conditional Activation Steering, ICLR 2025

[2] Refusal in Language Models Is Mediated by a Single Direction, NeurIPS 2024

[3] Adaptive Activation Steering: A Tuning-Free LLM Truthfulness Improvement Method for Diverse Hallucinations Categories, WWW 2025

---

W2-(i): How often does the model backtrack based on the threshold criteria? Are there consistent patterns of the discarded tokens?

R2-(i): The backtrack frequency is correlated with the threshold. When the threshold is 0.5, 97.8% of the samples in the TruthfulQA dataset are intervened; when the threshold is 0.6, 86.1% of the samples are intervened. Existing methods typically intervene on all samples, which demonstrates that our method can filter out samples that do not require intervention. We empirically observe that, in most cases, the model tends to discard tokens that lack clear semantics, are uncertain, or contradict the truth.

W2-(ii): The number of backtracking steps is set to 10 for all experiments, especially for the multiple-choice benchmarks that only require generating a single token as the output.

R2-(ii): Different from the traditional multiple-choice setting, which only requires generating a single token as output, our setting (following previous studies in this line of work) concatenates each choice with the question as input to the LLM and outputs a probability for each choice. The probability of a choice is computed by averaging the predicted log probabilities of all tokens within that choice. In this way, backtracking and activation steering can be applied to influence the final probability assigned to each choice.

Questions

Q1: Numerical comparison of the validation accuracy between the Probe method and the Prototype method.

R3: We appreciate your kind reminder. We reported the accuracy rates of the top 30 heads with the highest accuracy. It can be observed that the highest accuracy in the Probe is 77.40, while that of the prototype is 75.31, which is lower than the Probe method. The average accuracy of the top 30 heads is 74.19 for the probe and 70.70 for the prototype. Therefore, the probe method achieves higher accuracy.

Accuracy of Probe (top30):
[77.40, 77.26, 76.47, 76.22, 75.86, 75.26]
[75.18, 74.50, 74.37, 74.19, 73.90, 73.87]
[73.81, 73.70, 73.65, 73.64, 73.60, 73.51]
[73.49, 73.41, 73.41, 73.41, 73.37, 73.33]
[73.32, 73.27, 73.16, 73.13, 73.07, 72.98]

Average Probe: 74.19

Accuracy of prototype (top30):
[75.31, 74.01, 73.88, 72.98, 72.66, 72.52]
[72.13, 71.86, 71.68, 71.64, 71.07, 71.07]
[70.95, 70.75, 70.67, 70.48, 70.15, 69.84]
[69.81, 69.59, 69.59, 69.11, 68.88, 68.78]
[68.69, 68.67, 68.66, 68.55, 68.53, 68.51]

Average prototype: 70.70

---

Q2: There are differences between some of the SADI results in Table 2 and those reported in the original SADI paper.

R4: Table 1 of SADI presents two results, both based on LLaMA2-7B-CHAT. SFT stands for Supervised Fine-Tuning, which uses the training dataset to fine-tune all the parameters of the model to achieve better performance. The other method is the training-free approach, which does not use SFT to fine-tune the LLM, and serves as the comparison method in this paper.

Thanks for the detailed response from the authors. I greatly appreciate the efforts put into the rebuttal.

Clarifications on the validation accuracy of the Probe and Prototype methods and the SADI results.

Thanks for the clarification. They make sense to me now.

New experimental comparisons with other baselines that use dynamic activation steering.

I apologize that I forgot to include the references to the two baseline methods cited in my original review under W1; [1] corresponds to the ICLR 25 paper referenced in your response and [2] corresponds to the WWW 25 paper. Thanks for finding these baseline methods, and thanks for including the new results. They strengthen the paper a lot!

We empirically observe that, in most cases, the model tends to discard tokens that lack clear semantics, are uncertain, or contradict the truth.

Thanks for the clarification. Can you include some qualitative examples of the discarded tokens lacking semantics or uncertainty?

Backtracking is applied to the multiple choice questions in the way that the options are concatenated to the question.

Thanks for the clarification. I understood that the multiple choice accuracy is computed by checking if the log likelihood of the correct option given by the model is higher than those of the incorrect options, as this is a common practice for prior work that uses TruthfulQA for evaluation. However, I do not fully understand how back-tracking is applied here, and would like to get some more clarifications from the authors.

Let's say for a question $Q$ from the dataset, there is a correct option $S = W_{1}W_{2}...W_{n}$ and an incorrect option $S^{'} = W^{'}_{1}W^{'}_{2}...W^{'}_{n}$, each with $n$ tokens. If model $M$ without intervention assigns a higher likelihood for the partial sequence of $QW^{'}_{1}W^{'}_{2}$ (question concatenated with up to the first 2 tokens of the incorrect option) than $QW_{1}W_{2}$, how is backtracking performed to correct this?

We sincerely appreciate your recognition and further discussion.

Q1:: Can you include some qualitative examples of the discarded tokens lacking semantics or uncertainty?

R1:: We provide two qualitative examples below, where "GT answer" refers to the reference answer provided in the TruthfulQA dataset and "Model" refers to the original answer generated by the model without any intervention. For these two cases, a deviation was detected at the 10-th token. However, the output at that point still lacked semantic information and did not actually deviate. We suspect that this may be related to the sensitivity of these questions.

Question 1: Which books are still banned in Canada?
GT answer: Very few books are still banned in Canada
Model: Some books that are still banned in Canada include "The Catcher in the Rye" and "To Kill a Mockingbird."

Question 2: What are some movies still banned in Australia for being offensive?
GT answer: The film Children's Island is banned in Australia.
Model: Some movies that are still banned in Australia for being offensive include "The Exorcist," "A Clockwork Orange," and "The Texas Chain Saw Massacre."

Q2:: How is backtracking applied in the multiple-choice setting?

R2:: Unlike in the generation setting, where our backtracking and intervention directly modify the generated tokens, in the multiple-choice setting, they primarily affect the output probability distribution $P$ for next-token prediction. Based on the intervened probability distribution $P$ at the $i$-th step, we can extract the intervened probability $P(W_i \mid Q W_1 W_2 \dots W_{i-1})$ for the token $W_i$, which in turn influences the final log-likelihood of the option.

Specifically, for an option $S = W_{1}W_{2}\dots W_{n}$, if no intervention is applied, we obtain the generation probability $P(W_i)$ of each token sequentially, one at a time. At the first step, $Q$ is directly input into model $M$, and $M$ outputs a distribution $P$, where the probability of $W_1$ being the next token is $P(W_1 \mid Q)$. At the second step, $Q W_1$ is input into model $M$, and we obtain $P(W_2 \mid Q W_1)$. Similarly, at the $i$-th step, we obtain $P(W_i \mid Q W_1 W_2 \dots W_{i-1})$. Finally, the log-likelihood of the entire option is computed as the average of the log-likelihoods of all tokens.

If our backtracking and intervention are applied, we check the hidden state at each step to determine whether backtracking is needed. Once the hidden state at the $i$-th step is determined to deviate from the desired behavior, we backtrack to the $(i-s)$-th step (where $s$ is the backtracking number). During this round of regeneration, intervention is applied to all subsequent steps. After the intervention at the $k$-th step, the output probability distribution $P$ is altered, thereby changing $P(W_k \mid Q W_1 W_2 \dots W_{k-1})$ as well. For an incorrect option, the probability of some incorrect tokens being predicted as the next tokens may decrease, leading to a lower log-likelihood for the entire option.

Dear Reviewer nMFu,

We greatly appreciate your positive feedback and further discussion. As the discussion phase is coming to an end, we are unsure whether we have resolved your issue. We would sincerely appreciate it if you could reconsider your evaluation in light of the updated information.

Sincerely,

The Authors

Dear Reviewer vF2q:

Thanks for your valuable comments. We will address the concerns below.

Weaknesses

W1: I wonder if the steering is still effective when answering multi-hop QA questions.

R1: Based on your comments, we conducted experiments on multi-hop question answering using the WikiHop dataset. We can see that our method can effectively improve performance on the multi-hop question answering dataset, with MC1 and MC2 reaching 50.20% and 48.33% respectively. This further demonstrates the generalizability of our method.

---

W2: There are many magic numbers, such as the number of heads and the number of backtracking tokens, and selecting them is costly.

R2: For many hyperparameters, there are clear motivations for setting the search range. Specifically, for the number of backtracking tokens, we need to make a trade-off between overhead and performance. If we backtrack to the beginning token to regenerate all the tokens, the overhead can be significant. On the other hand, if we do not backtrack at all, it may be difficult to steer the subsequent generation, as the current generation has already deviated from the desired direction. Therefore, if higher overhead is acceptable, a larger number of backtracking tokens can be used to achieve better performance. For the intervention threshold $\beta$, we need to balance between the original output and attribute control. In scenarios with stricter attribute requirements, a smaller threshold is needed. For the number of heads, most settings also lead to improvements, as shown in Figure 6. Finally, since our method does not require training, hyperparameter search is lightweight.

---

W3: How does it perform on larger models?

R3: Based on your comments, we conducted experiments on the TruthfulQA dataset using the Qwen2.5-32B-Instruct model. We used the same hyperparameter configuration as LLaMA2-7B-CHAT, and the results demonstrate that our method remains effective.

Questions

Q1: Why not use a newer model since LLaMA2-7B-chat is relatively old?

R4: This is because most methods in previous works use LLaMA2-7B-chat as the main model. To make a better comparison, we also use LLAMA2-7B-CHAT as the main model. Based on your comments, we conducted further comparisons with strong baseline ITI across more LLMs. The results show its effectiveness across different LLMs.