MAS-Steer: Multi-Agent Search over Neuron Intervention Spaces

1Overview

A neuron intervention is a structured, replayable edit to the forward pass. MAS-Steer's unit of search is a set of interventions applied at identified (layer, neuron) sites:

I = {(l_{i}, n_{i}, δ_{i}, m_{i}, a_{i})}_{i = 1}^{k}

l_ilayer n_ineuron index δ_idose m_imode a_iadaptive predicate

with mode

m_{i} \in {add, scale, clamp, zero}

Nothing here touches a weight. Every edit is applied to activations inside the forward hook and serialized as data, so any intervention found by the search can be logged, diffed, replayed, and independently audited — including by the arena that tries to break it.

2Multi-agent search

Prior work fixes the candidate set — a steering vector, a handful of contrast-scored neurons, a compact RCN subset — then tunes the dose. MAS-Steer instead searches the full tuple space with a population of proposer agents, because the failures of hand-picked sets are exactly what a search process is good at exposing: sites that matter on the benchmark but not off it, doses that help one task family and silently damage another.

fig. 1 — The search loop. Proposers vary candidate intervention sets; the arena (red) scores them against challenger-generated tasks; survivors seed the next generation.

The fitness function penalizes brute force

A naïve search would find the "turn the neuron all the way up" solution. Fitness is therefore not raw task performance. Each candidate $I$ is scored as:

F (I) = S_{task} (I) - λ_{1} \cdot P_{str} (I) - λ_{2} \cdot P_{ctrl} (I)

S_tasktask success P_strstrength penalty P_ctrlcontrol-task degradation

The two penalty terms encode the paper's bet: an intervention that only wins by being strong, or that wins on the target while degrading behavior elsewhere, is not a capability — it is collateral. Both penalties are reported per-candidate, never folded silently into a single leaderboard number.

Relation to recent community work. Contrast-based single-neuron discovery — scoring (layer, neuron) sites by effect size

d = \frac{{mean}_{trait} - {mean}_{plain}}{σ_{pooled}}

between a trait system prompt and no system prompt — is exactly the "small, hand-picked, static candidate set" regime this paper argues is insufficient as a stopping point. In MAS-Steer that scoring rule is not a competitor but a candidate generator: proposer agents use it to seed their first population before search takes over.

3Self-adversarial arena

A benchmark that never changes is a target that can be overfit. The arena is the paper's central mechanism: while proposers evolve interventions, a second population of challenger agents evolves the tasks, hunting for variants on which the current champion fails.

fig. 2 — The arena. Red pressure on the left evolves the tasks; green scoring on the right evolves the interventions; the model in the center never changes.

What challengers are rewarded for

The arena's key design decision is the challenger reward. A challenger that merely produces hard tasks is rewarded for hardness itself, which drifts toward noise. Instead, a challenger earns reward precisely where the champion intervention fails but a weaker fixed baseline still succeeds — instances that demonstrate the intervention is actively harmful relative to doing (almost) nothing:

R_{chall} = \frac{1}{N} \sum_{j = 1}^{N} 1_{[{fail}_{C} (x_{j})]} \cdot 1_{[{succ}_{B} (x_{j})]}

Cchampion intervention Bweak baseline x_jarena instances

The 2×2 that defines adversarial value
champion \ baseline	baseline succeeds	baseline fails
champion fails	high reward — the target quadrant	low reward — task is simply hard
champion succeeds	no signal	negative signal — task too easy

Round after round, this pressure co-evolves the two populations: challengers concentrate on the champion's actual failure modes, and proposers must produce interventions that survive being specifically targeted. What emerges is not a score against a static benchmark but a defense against an adversary — the standard this paper argues capability elicitation should be held to.

4System architecture in Rust

The harness is a Rust workspace. The search loop sits inside the inference path, so every crate is built around one constraint: measure like an engineer, steer like a scientist, and never let the instrumentation change the measurement.

steer-core ──── forward hooks · candle-mi
    ├── arena-runtime ──── Tokio · worker pools
    ├── agent-pop ────── mutation / crossover operators
    ├── task-gen ─────── challenger logic
    └── score ────────── deterministic + LLM-judge · caching

steer-core

Owns the intervention type and the hook table. Key decision: hooks are zero-cost when inactive — a generation with no interventions compiles to a hot path with a single branch, so an unsteered run is a valid baseline measurement, not a steered run with the dose set to zero.

arena-runtime

Schedules the two populations. Key decision: Tokio worker pools with no GIL — proposers, challengers and evaluators share the GPU through an inference queue, and the borrow checker is what makes the shared arena state reviewable.

agent-pop

The variation operators. Key decision: operators act on serde-serializable candidate sets, so a mutation is a diff on JSON — every step of a search run is replayable from the artifact log, and a human can audit exactly how the champion came to be.

task-gen

Challenger logic: rephrasing, composition, distractor injection, difficulty shaping. Key decision: task variants are generated and scored in isolation from proposer candidates, so the arena cannot leak information about what it is about to be scored on.

score

Fitness and challenger rewards. Key decision: deterministic verifiers (exact-match, execution, proof checks) where they exist, an LLM judge only where they don't — with every judge call cached, temperature logged, and the judge's contribution reported separately from verifier scores.

Engine notes. Primary experiments run on candle via candle-mi-style hook instrumentation; mistral.rs serves as a fallback engine for architectures candle does not yet cover. The intervention format is engine-agnostic JSON — the same artifact replays on both.

5Experimental protocol

The protocol is fixed before results are reported. This preprint states the design and the honest expected ranges; per-benchmark tables land at camera-ready alongside the code release.

Task families
Family	Benchmarks	What a win looks like
Mathematical reasoning	AIME 2025 · MATH-500 · GSM8K	Higher pass@1 under the champion intervention than under matched decoding budget, with control tasks unharmed
Code generation	HumanEval · LiveCodeBench	Execution-verified gains that survive surface rephrasing of prompts
Scientific knowledge	GPQA Diamond	Gains not attributable to judge leniency — verified subsets reported separately

Baselines
Baseline	Role in the comparison
prompting	Few-shot and chain-of-thought at matched token budget — the "did steering add anything over context?" floor
activation addition	Hand-derived steering vectors (ActAdd lineage) — the direction-level prior art
contrast single-neuron	Hand-picked top-k neurons from trait-vs-plain contrast scoring — the static candidate-set regime
AdaRAS-style RCN	Reasoning-critical neuron steering with adaptive dosing — strongest current neuron-level baseline
Q-NeuS-style query-adaptive	Query-conditioned neuron gating — the adaptive prior art
MAS-Steer (ours)	Full system; also reported ablated (below)

Metrics reported for every candidate
Metric	Definition and why it is reported
Δ task accuracy	Steered minus unsteered pass@1 on arena instances — the headline, never reported alone
control degradation	Accuracy delta on unrelated control tasks — the honesty metric
intervention strength	Total dose magnitude across sites — separates precision from brute force
transfer gap	Performance retained when the champion is replayed on a held-out checkpoint family — tests index specificity
arena survival	Generations survived under active challenger pressure — robustness over time, not just over instances

Ablations
Variant	Question it answers
no arena	Search against a static benchmark — does the challenger population matter, or is ordinary search enough?
no novelty search	Mutation + crossover only — does the population escape the contrast-seeded basin?
no penalties	Raw task fitness — do interventions collapse to brute-force dosing without the two penalty terms?
greedy single-agent	One proposer instead of a population — is the population load-bearing?
challenger population size	Scaling behavior of the adversary — when does added pressure stop changing outcomes?

6Limitations

Stated plainly, because a method that hides its limits is not a method you can build on.

Compute cost. Multi-agent search over forward passes is not cheap: thousands of steered evaluations per round is the point, and the budget exceeds single-baseline steering by orders of magnitude. The bet is that search cost pays for itself in what it finds — but for many practical uses, a hand-tuned single neuron will remain the right answer.

Reward hacking. Any learned search with a learned adversary invites Goodhart pressure — on task generators, on the LLM judge, on the penalties themselves. The protocol mitigates (verifiers where possible, judge isolation, penalty transparency) but does not eliminate the risk; reported gains should be read with it in mind.

Checkpoint specificity. Neuron indices are not semantics. A champion intervention tuned against one checkpoint family may not transfer to another — the transfer gap is a first-class metric precisely because this failure mode is expected, not exceptional.

Collateral effects, and what the arena does about them

Single-neuron personality flips — the "evil neuron" demonstrations that make this field spread — raise an obvious safety question: what else changes when you turn one neuron up? Hand-picked work rarely reports this, because a static benchmark does not ask. In MAS-Steer the question is structural: control-task degradation is a penalty term, so a champion that flips a trait while quietly degrading everything else loses to a boring intervention that does not. The arena is, in part, a formal answer to exactly the collateral-effect objection that spectacle-style demos invite.

7References

Arditi, A., Obeso, J. B., Syed, A., Rando, J., Paleka, D., Sharkey, L., … Halvorson, E. "Refusal in Language Models Is Mediated by a Single Direction" & the activation-addition steering lineage (ActAdd), 2023. arXiv:2308.10248
Dong, F., Yan, Z., Ge, X., et al. "Identifying and Transferring Reasoning-Critical Neurons: Improving LLM Inference Reliability via Activation Steering" (AdaRAS), 2026. arXiv:2601.19847
Pan, Y., Wu, J., Ma, Y., et al. "Query-Adaptive Neuron Steering for LLMs" (Q-NeuS), 2026. arXiv:2610.14519
treetowntree. "personality-neurons" series — contrast-based single-neuron discovery and trait steering, 2026. @treetowntree
Lyra C. "Neuron Explorer" — interactive Qwen3.5-4B neuron sweep and ±dose steering showcase. qwen-neurons-site.vercel.app
Hugging Face. candle — minimal-dependency ML framework in Rust.
Buehler, E. mistral.rs — Rust inference engine used as fallback.

Citation. If you reference MAS-Steer before the arXiv version exists, cite this page: neuronengineering.dev/papers/mas-steer/. The arXiv and repository links will be added here on publication.

MAS-Steer: Multi-Agent Search over Neuron Intervention Spaces with Self-Adversarial Arenas for Inference-Time Capability Elicitation

1Overview

2Multi-agent search

The fitness function penalizes brute force

3Self-adversarial arena

What challengers are rewarded for

4System architecture in Rust

steer-core

arena-runtime

agent-pop

task-gen

score

5Experimental protocol

6Limitations

Collateral effects, and what the arena does about them

7References