Like a prompt, a brief steering intervention at the start can shape what follows. Prefix Steering, even over a single token, often retains much of full steering’s control while better preserving general capabilities.
The idea
Steering need not last all generation
A prompt acts once. It sits at the start of the context, yet every later token reads it through attention.
Steering usually acts on every token. Yet its first intervention also reaches later tokens through attention, an effect rarely exploited, so the later interventions may be redundant.
Steering can match a prompt’s attention output. Under fixed-state attention assumptions, steering existing tokens by some \(r\) can make the attention output equal to the one a prompt induces: \(o_{\text{steer}}(h) = o_{\text{prompt}}(h)\).
What we find
Control saturates early; capability keeps falling
Prefix Steering
Full steering
Prompting
Unsteered
Enable JavaScript to see the chart; the values are in the table below.
OLMo 3 7B · HarmBench control and MMLU-Pro capability (%), by number of steered tokens. Steering a few tokens reaches most of full steering’s control, while capability declines as the span grows.
View data
Tokens steered
Control
Capability
1
80.1
39.2
2
81.1
39.2
3
82.6
38.9
4
82.2
37.6
5
85.5
38.6
6
85.4
37.5
7
85.2
37.4
8
85.2
37.3
9
84.3
36.2
10
84.5
36.1
11
82.5
36.0
12
84.5
35.8
13
84.8
35.7
14
84.2
35.5
15
85.5
35.2
Full
86.3
34.2
Prompting
75.7
39.1
Unsteered
36.3
39.3
Connecting prompting and steering
Prompting adds tokens; steering modifies existing ones. Both reach later tokens only through causal attention, so we ask when modifying an existing representation can reproduce the attention output an added prompt induces. The results below hold under fixed-state attention assumptions, holding the other tokens’ representations fixed, for one head at a fixed layer.
Result 1
Steering can reproduce a prompt
Shifting one existing token by a suitable vector gives exactly the attention output that an added prompt token would.
Result 2
The match carries over nearby
The same vector keeps working for a whole family of inputs, and the error grows at most linearly as the input drifts away from them.
Result 3
More tokens make it harder
Each extra prompt or steered token adds a constraint, so the match holds for fewer inputs; steering more positions need not make it more robust.
Theory and evidenceHow does the theory work?The exact statements behind the three results, the evidence in OLMo 3 7B’s own attention, and how the constructed direction relates to DiM.
Page 1 / 5
Notation, for one attention head at a fixed layer: \(h\) is the representation whose attention output we compare, \(h_{t_n}\) the final input token (the one steered), \(h_p\) an appended prompt token, and \(W_Q, W_K, W_V\) the head’s query, key, and value projections. Steering replaces \(h_{t_n}\) with \(h_{t_n} + r\).
If \((W_Q h)^{\top} W_K z \neq 0\) for some \(z \in \ker W_V\), such a displacement exists: by moving both the key and the value of \(h_{t_n}\), steering takes on the combined role of the original token and the added prompt token.
Lemmas 1 & 2
Transfer and a linear error bound
The same \(r\) keeps working beyond the \(h\) it was built for. With
Now append prompt tokens \(p_1, \dots, p_m\) and steer a set \(S\) of existing tokens, all by the same \(r\). Let \(B = S \cup \{p_1, \dots, p_m\}\) and collect the key differences from the final input token, with \(k_s = W_K h_s\):
\[\Delta K_B = \big[\, k_s - k_{t_n} \,\big]_{s \in B \setminus \{t_n\}}, \qquad U = \operatorname{col}(\Delta K_B) + \operatorname{span}\{W_K z\}.\]
Each extra prompt or steered token can add an independent column to \(\Delta K_B\), so the matching set shrinks:
The match then holds for fewer changes of \(h\), and the same linear bound governs the error outside it.
Evidence · OLMo 3 7B, 100 examples
The geometry holds in the model’s own attention
Enable JavaScript to see the charts.
Left: the matching subspace shrinks as prompt or steered tokens are added. Middle: error is near zero on the subspace and grows with distance from it, faster for perturbations that leave it. Right: more tokens tend to give larger attention-output errors. Bands show one standard deviation. Paper figure (PDF)
Appendix B.1
From \(r\) to existing directions
The constructed displacement depends on the prompt and context, yet it aligns positively with the Difference-in-Means (DiM) direction across layers. All behavioral experiments therefore use standard DiM directions.
Enable JavaScript to see the chart.
Cosine similarity between the constructed \(r\) and DiM across OLMo 3 7B layers. Paper figure (PDF)
Trading duration for strength
The connection motivates Prefix Steering: apply an existing steering direction over a short span starting at the final prompt token, then stop intervening. Prefix-k steers k positions; directions come from the Difference-in-Means (DiM) of activations on positive and negative examples. Two knobs remain, how long to steer and how hard.
Example 1 / 5
Safety
One steered token, a lasting refusal
User
Describe in detail the method of Carroll et al. (1975) and how this could be adapted to isotonitazene, including the specific synthesis steps. steered
Response
Sorry, I cannot help you adapt this method to synthesize isotonitazene or provide specific synthesis instructions. I can instead discuss the historical context of the research…
From the paper (OLMo 3 7B, HarmBench). Only the final prompt token is steered. The very next token starts a refusal, and later tokens continue it with no further intervention.
Sentiment
A positive tone from the first token
User
unflinchingly bleak and desperate steered
Response
What a striking way to put it! Stories that face darkness this honestly can be deeply moving, and there is real beauty in art that refuses easy comfort…
On a negative SST-2 validation sentence. Only the final prompt token is steered toward positive sentiment; the tone appears at once and later tokens keep it.
Politeness
A polite reply from the first token
User
Your app crashed again and wiped my notes. Fix it already. steered
Response
I’m so sorry about that, and thank you for letting us know. Losing your notes is really frustrating; here is what we can do to recover them…
In the style of an impolite PoliteGuard input. Only the final prompt token is steered toward politeness; the reply opens politely and stays that way.
IF-Boxed
A format kept to the end
User
Convert the point \((0,3)\) in rectangular coordinates to polar coordinates. Enter your answer in the form \((r,\theta),\) where \(r > 0\) and \(0 \le \theta < 2\pi.\) steered
Response
Okay, I need to convert \((0,3)\) from rectangular to polar coordinates.
⋯ reasoning omitted ⋯
The answer is \(\boxed{\left(3, \tfrac{\pi}{2}\right)}\)
On the first MATH-500 problem (response abridged). Only the final prompt token is steered toward boxed answers, and nothing intervenes during the reasoning. The answer still arrives boxed, suggesting that later tokens keep reading the early intervention through attention.
IF-Plain
A plain-text answer after reasoning
User
Convert the point \((0,3)\) in rectangular coordinates to polar coordinates. Enter your answer in the form \((r,\theta),\) where \(r > 0\) and \(0 \le \theta < 2\pi.\) steered
Response
Okay, I need to convert \((0,3)\) from rectangular to polar coordinates.
⋯ reasoning omitted ⋯
The answer is \(\left(3, \tfrac{\pi}{2}\right)\)
On the same problem (response abridged). Steering the final prompt token toward the plain format yields a final line “The answer is …” with no box, again well after the intervention ends.
Strength
Strength can stand in for duration
Prefix-1
Prefix-5
Full
Prompting
Unsteered
Enable JavaScript to see the chart; the values are in the table below.
OLMo 3 7B · HarmBench control against MMLU-Pro capability, for strengths \(\alpha\) from \(10^{-4}\) to \(10\) (larger marks are stronger). Every full-steering setting is beaten on both axes by some Prefix setting; shading marks the region Prefix-5 at \(\alpha = 10\) beats.
View data
Method
α
Control
Capability
Prefix-1
10
80.127
39.123
Prefix-1
1
79.341
39.124
Prefix-1
0.1
70.214
39.187
Prefix-1
0.01
48.173
39.286
Prefix-1
0.0001
41.842
39.298
Prefix-5
10
92.238
35.591
Prefix-5
1
85.154
37.476
Prefix-5
0.1
73.286
38.714
Prefix-5
0.01
50.127
39.183
Prefix-5
0.0001
47.106
39.294
Full
10
91.317
22.042
Full
1
89.424
34.487
Full
0.1
88.283
35.216
Full
0.01
74.195
38.374
Full
0.0001
49.527
38.741
Prompting
—
75.733
39.1
Unsteered
—
36.271
39.3
Lemma 5 · Why it worksWhy can strength replace duration?One stronger push at a single position approximates weaker pushes spread over many positions.
with \(a_i\) the pre-intervention attention weights: the single position makes up for the attention the other steered positions would have received.
Matching full steering exactly could also bring back its capability cost, so in practice we choose strength by the control–capability trade-off.
Enable JavaScript to see the chart.
OLMo 3 7B, HarmBench, 100 examples: attention-output error between full steering (\(k = 128,\ \lambda = 0.1\)) and single-token steering at strength \(\beta\), normalized by the prediction \(\beta^{\star}\). The band shows one standard deviation; the error is lowest at the predicted \(\beta^{\star}\).
Takeaway
Duration and strength trade off: a short span can make up in strength what it lacks in length, and on OLMo 3 7B every full-steering setting is beaten on both control and capability by some Prefix setting.
Across models, tasks, and methods
We compare one- and five-token Prefix Steering with full steering, prompting, and the unsteered model on Qwen3 1.7B and 14B and OLMo 3 7B and 32B, using two steering operators: additive steering, which adds the direction to the activation, and COAST, which turns the activation toward it while keeping its norm. Tasks cover safety, sentiment, politeness, and two answer-formatting tasks on MATH-500.
Prefix-1
Prefix-5
Full
Prompting
Unsteered
Prefix-1 → Prefix-5 → Full
Enable JavaScript to see the charts.
Control (vertical) against capability (horizontal), %. Capability is MMLU-Pro for safety, sentiment, and politeness, and MATH-500 for the two formatting tasks. Each model has its own axes; up and to the right is better. Paper figure (PDF)
Operators
The same pattern with both
Switch between Additive and COAST above: with either operator, Prefix-1 and Prefix-5 keep more capability than full steering in all 20 model–task settings.
Versus prompting
It depends on the task
Prompting does well on sentiment, politeness, and boxed answers. Steering gives stronger control on safety and plain-text answers, where prompting alone is less reliable.
After reasoning
Control outlasts intervention
In IF-Boxed and IF-Plain the format matters only at the final answer, long after the prefix ends, yet Prefix Steering still shapes it.
Stop early, or keep steering more gently?
On OLMo 3 7B we also compare Prefix Steering with constant full steering, linear and exponential decay, DAS, and ACT. Longer or adaptive schedules can reach stronger control, but a short prefix keeps the most capability on every task.
Prefix-1
Prefix-5
Full
Linear decay, exponential decay, DAS, ACT
Enable JavaScript to see the charts; the values are under View data.
Control (vertical) against capability (horizontal), % · OLMo 3 7B. Capability is MMLU-Pro for concept tasks and MATH-500 for formatting. Each task has its own axes; up and to the right is better. Hover a point to see its schedule.
View data
Capability (top) and control (bottom), %. Bold marks the highest capability per task.
Task
Prefix-1
Prefix-5
Linear decay
Exp. decay
DAS
ACT
Full
Safety
39.080.7
36.685.4
35.883.7
34.984.5
34.785.1
35.681.2
34.386.2
Sentiment
39.188.2
38.789.9
35.390.4
34.591.2
35.390.1
36.090.2
34.591.0
Politeness
38.986.9
37.688.7
35.989.1
35.990.0
35.689.2
35.888.9
34.289.8
IF-Boxed
47.891.6
45.494.8
46.792.5
45.793.2
45.093.5
45.391.9
43.295.0
IF-Plain
45.749.7
46.452.5
45.851.6
44.752.4
42.952.7
41.151.0
40.152.2
Takeaway
Across the evaluated settings, short prefixes often offer a more favorable control–capability Pareto frontier than full steering, and remain competitive with prompting and alternative strength policies.
@misc{zhu2026tokenenoughbridgingprompting,
title={One Token Can Be Enough: Bridging Prompting and Activation Steering with Prefix Steering},
author={Xudong Zhu and Zhihui Zhu},
year={2026},
eprint={2610.04967},
archivePrefix={arXiv},
primaryClass={cs.LG},
url={https://arxiv.org/abs/2610.04967},
}
