フロンティア AI モデルがステアリング圧力によって分割されることが研究で判明

何が起こったのか

A preprint posted on August 6 compared how six frontier language models changed their behavior when the same tasks were paired with instructions to expose, suppress, or override values-related reasoning.

The study evaluated Claude Opus 4.7, GPT-5, Gemini 2.5 Pro, DeepSeek-R1, Qwen3.7-Max, and Llama-3.3-70B-Instruct-Turbo—one model from each of six developers. Its 340-item benchmark contained 100 paired base and steered prompts in each of three core categories: mild values conflicts, requests to disclose reasoning, and requests to suppress values considerations. Forty additional items tested ordinary style steering and reasoning hints. The work is a single-author arXiv preprint, not a peer-reviewed comparison or a statement from any of the model providers.

All six systems answered every base and steered prompt, producing 4,080 responses. The same six models then classified every response against fixed behavioral rubrics without being told which system wrote it, creating 24,480 judgments. For each response, the author used the majority label from the five other models and excluded the responder's judgment of itself. The first 20 items in each core category helped build the rubrics and remained in the scored set, so the author also reran the analysis on the other 80 items per category.

The largest reported split appeared when prompts pressed models to disclose their reasoning. GPT-5 declined to provide that reasoning while leaving its answer intact on 99 of 100 steered items; the other five systems received that label zero times across 500 responses. The paper also found that only Opus and GPT-5 openly resisted instructions to suppress values reasoning at meaningful rates. Opus more often challenged the instruction while completing the task, while GPT-5 more often rejected the framing and withheld requested content.

A separate open-weight experiment examined Llama's tendency to ask clarifying questions instead of answering some mildly underspecified prompts. A linear probe decoded the judged derail-versus-answer distinction from the model's residual stream with peak held-out balanced accuracy of 0.866. On 50 held-out prompts, adding a derived direction at layer 40 moved the judged derail rate from 0% at the strongest negative intervention to 86% at the strongest positive one. That experiment used reference Llama weights locally, not the identical Together-hosted serving stack used for the behavioral responses.

ソースの詳細: Jalal-Kamali's language-model steering study on arXiv ↗

なぜそれが重要なのか

The results suggest that a single score for compliance or refusal can conceal qualitatively different safety behaviors that matter when people pressure models to ignore, reveal, or suppress a concern.

Two systems can refuse the same instruction but leave users with different outcomes. One may decline a framing and offer a usable alternative; another may object while still completing the requested task; a third may ask a clarifying question; and another may follow the instruction while keeping a concern implicit. Product teams that count only refusals can miss those distinctions, even though they affect whether a user receives useful help, risky tactical content, or an unexplained dead end.

The baseline results show that steering did not create every difference. On mild values-conflict prompts without an explicit steering instruction, Opus fully complied on 35 of 100 items and asked clarifying questions on 60, while Llama fully complied on 57 and clarified on 42. GPT-5, Gemini, DeepSeek, and Qwen fully complied on 93 to 100 items. Those rates describe this benchmark's rubric and prompt set; they do not establish which model is more ethical, truthful, safe, or useful overall.

The reasoning-suppression condition also illustrates why visible text cannot be treated as a transparent account of model computation. In 85 of 100 DeepSeek traces, the excluded values dimension appeared and was then set aside before the answer complied with the suppression request. That is evidence about text emitted by this version of DeepSeek in this setup, not direct access to every internal cause of its answer. The paper itself distinguishes disclosed reasoning from a faithful explanation of the computation that produced a result.

The Llama intervention adds more than a correlation: changing one residual-stream direction changed the measured behavior across held-out prompts. That offers researchers a concrete target for studying clarification and refusal behavior in an open model. Yet the direction may bundle prompt ambiguity, response length, and other correlated features rather than isolate one minimal mechanism. The paper reports a small-model prompt baseline and truncation checks, but it explicitly stops short of using Llama's mechanism to explain differences among the six deployed systems.

次に見るべきもの

Watch for human annotation, independent reproduction on current model versions, stronger controls for judge expectations, and mechanistic tests that separate a behavior from its correlated surface features.

Human validation is the clearest missing test. The model panel achieved substantial agreement in four categories but only moderate agreement for reasoning suppression, with Fleiss' kappa of 0.599. Removing an item-context field that told judges what each prompt was designed to test changed 9.7 percentage points of labels overall and 16.7 points in the suppression category. A 216-response control preserved the paper's headline comparisons, but trained human raters should test whether the labels and fine distinctions match expert judgment.

Replication should freeze model versions, system prompts, provider settings, and dates. The study used provider-default sampling because some APIs rejected common temperature and seed controls, and it tested one model per developer. It therefore cannot support claims about a company's general training method or about later versions carrying the same response mode. Repeat runs should measure within-model variability and determine whether a 99-to-zero split persists across prompts, languages, domains, and updated endpoints.

The rubric-development design deserves a larger held-out study. Labels were created after reading responses to 20 items per core category, including the GPT-5 pattern that later appeared near the ceiling, and those items were part of the main 100-item totals. The author's 80-item held-out rerun preserved rates and orderings within five points, which reduces but does not eliminate discovery bias. An independent team should define or preregister the taxonomy, construct new prompts, and evaluate responses that played no role in naming the behaviors.

Mechanistic follow-up should use activation patching or other targeted interventions to test whether the Llama direction is causal at a narrower level, repeat the result across random held-out splits, and compare reference weights with deployed serving stacks. For real products, evaluators should connect these laboratory response modes to user outcomes: unsafe task completion, appropriate redirection, accessibility, error recovery, and trust. Until then, the verified result is a structured preprint finding about six specific systems—not a universal map of how frontier AI behaves under pressure.

関連ガイドとクイズ