CANS gives every feed-forward neuron its own scaling coefficient, steering safety, toxicity and hallucination while holding general capability
Synopsis
Behavior control in large language models often costs general capability; CANS instead assigns each feed-forward network neuron a scaling coefficient that accounts both for its contribution to the target behavior and for its disruption of general outputs. Target behavior is proxied by the log-probability of target tokens in model responses, capability preservation by output-distribution KL divergence on general-purpose text, and local approximations of the two yield a closed-form solution with no iterative training and no added inference-time computation. On Qwen3-4B and Llama models, CANS matches or beats SFT, CAA and neuron-level baselines on safety, toxicity and hallucination control while better preserving MMLU, BBH and IFEval performance.
Interpretation
Behavior control no longer uniformly amplifies or zeroes selected neurons; every feed-forward neuron gets its own scaling coefficient, so neurons that help the target behavior with little disruption move more and disruptive ones move less. Earlier neuron-level methods picked neurons by domain-specific rules and then intervened uniformly, through shared scaling, activation zeroing or neuron removal; those designs do not put capability preservation into the objective, and transferring them across domains gave limited steering gains or clear capability loss. Across safety, toxicity and hallucination tasks on Qwen3-4B and Llama models, CANS is compared with SFT, CAA, SN-Tune, DAP, AurA, H-Neurons and the gradient-only CANS-Grad-Only, and its steering-capability trade-off is generally more favorable.
Two computable proxies turn the problem into a single closed-form solve: the change in target-token log-probability estimates steering benefit, and output-distribution KL divergence on general-purpose inputs estimates capability disruption. The KL divergence is quadratically approximated near the unmodified model with the Fisher information matrix, keeping only diagonal entries to limit storage and computation and damping directions with small curvature. Reference text is drawn from the first 128 tokens of WikiText-2 training contexts with sampled continuations; one backward pass gives diagonal Fisher entries for all neurons, and the coefficients are then folded into the down-projection weights so inference adds no parameters or operations.
The same data-construction and intervention procedure carries to a new domain: sample responses from the unmodified model, filter by the target behavior, annotate target spans, and build the steering corpus. Safety uses Circuit Breakers refusals with the first refusal cue marked, toxicity uses toxic spans from RealToxicityPrompts, and hallucination uses answer spans judged correct on TruthfulQA. On Qwen3-4B safety, raising the preservation budget from a smaller to a larger value lowers attack success rate while average capability drops only a few points; Qwen3 hallucination saturates, so a larger budget does not always further improve the target behavior.
Perspective
The demonstrated scope is safety, toxicity and hallucination control on Qwen3-4B and Llama models, with capability measured as the equally weighted mean of IFEval, BBH and MMLU; the preservation criterion itself guarantees neither safety nor fairness, and deployment still requires application-specific evaluation.
Keeping only the Fisher diagonal omits interactions among neurons; steering depends on the quality of generated responses, behavior labels and target-span annotations, and a single target span may give incomplete supervision for hallucination, which is intertwined with the model's underlying knowledge.