Steering a Frozen Model: Two Hard Limits

One way to enforce a policy on a model, without retraining it, is to steer the model's internal activations as it runs; the motivating application is language-model safety. Because the policy is not part of the weights, it can be revised or replaced without updating them, and one fixed model can be governed by different policies at different times. Whether such enforcement succeeds, though, is largely uncharacterised. We argue that it rests on three conditions, and we characterise each. The model's existing read state must imply the correct target (Read); a finite intervention budget must be able to reach that target (Reach); and later edits must leave the corrected result intact (Preserve). Two of these are hard limits, a ceiling and a horizon that no amount of tuning passes; the third, Preserve, is a failure of compositional integrity rather than a wall.

We treat each condition formally where its object is exact and empirically where it must be measured. For Read, under a frozen, read-immutable regime with a deterministic hard read and writes restricted to the target, an exact operator identity fixes a ceiling on the accuracy of complete functional enforcement; we measure its finite-field approximation across a grid of 27 separately trained model configurations whose ceilings span a 42-fold range, matched to within 0.0008. The ceiling has a constructive counterpart: an exact completion-or-abstention operator emits only rule-consistent outputs across 67,500 retained cases, abstains exactly where no permitted write can satisfy the rule, and cannot correct a read that is valid but wrong. For Reach, we give the finite path-length limit for globally bounded additive corrections, derive an exact finite-step horizon for the proportional field used in the controlled testbed, and measure finite-budget geometry on real activations from Qwen2.5-7B and 32B. For Preserve, protecting only the coordinates a constraint writes worsens an earlier constraint by 19 to 27 times, whereas a conservative declared-dependency mask restores it exactly. In controlled continuous-versus-discrete comparisons on this task, we find no robust continuous-time enforcement advantage, and one inside-dynamics configuration destabilises enforcement. We give a scoped account of when in-model enforcement on a frozen model works and where it fails.
 
What this version adds. A new section gives an exact completion-or-abstention operator and tests it on all 27 saved configurations: 67,191 grants, 309 abstentions and no invalid output, while 25,485 grants remain wrong for the task because a valid read can still be wrong. An exact hard-read comparison shows that agreement within 0.0008 in accuracy can hide per-example differences of up to 0.0032, and it separates invalid operand reads. The all-13/all-17 sign flip is traced to its saved states, five of its six runs are replayed bit for bit, and it is reported as a finite-field effect of carry supervision. SAFM_code_and_data.zip contains the ceiling grid, both new studies with their pre-run protocols and hash records, the sign-flip and tuned-point states, the substrate analysis plan whose hash the paper prints, and the cascade code with a script that rebuilds its MNIST input from the standard files. One script, check_replay.py, re-runs every check and compares the results with the saved results.