What is written in the activations, and what happens when you push on it

A companion to the MOSS voice-acting technical report. Hidden states were extracted from the model while it followed real recordings; probes were trained to read five different things out of them; the resulting directions were then injected back into generation to see whether the model could be steered. The probes found a clear, stable, replicated ordering. The steering destroyed the output at every strength tested, and this page reports that as the result it is.

LAION · MOSS voice-acting line · written 28 August 2026 on JUPITER (Jülich Supercomputing Centre). Sources: out/actforensics/report/answers.json, layer_ranking.parquet and release.json; the task definitions in actf_probe.py::build_targets; the vector construction in actf_vectors.py; the injection scheme in actf_steer.py; and the 393 per-clip records in out/actforensics/steer/*.jsonl.

1. The question this was built to answer

The main report's central unresolved problem is that the model will not perform an emotion at a requested intensity. Ask for the 90th-to-98th percentile of a named emotion and it delivers something around the 35th. Four training objectives have been aimed at that gap and none of them moved it. Before spending compute on a fifth, there is a prior question, and it splits in two:

1. Is the information even there? If the model's internal state does not represent “how angry is this”, no amount of preference tuning will give it a handle to pull, and the remaining lever is data.
2. If it is there, can it be used directly? If a direction in activation space corresponds to an attribute, adding a multiple of that direction during generation should move the attribute — the intervention usually called activation steering. That would be a control surface requiring no training at all.

Question 1 is answered by probing: freeze the model, collect one hidden-state vector per clip, train a small supervised model to predict an attribute from that vector alone. If the attribute can be read out, it is present. Question 2 is answered by taking the direction and injecting it. Both were run. The answers are, respectively, largely yes, and it depends sharply on which attribute, and no.

2. What was captured, and the regime it was captured in

One forward pass per corpus row, teacher-forced: the row's own audio codes are placed on the assistant side and the whole example is packed byte-identically to how the supervised trainer packs a training example. Nothing is generated and nothing is re-scored — the extraction code says so in its own docstring, in those words. The model is reading a real recording.

From that pass, a window of frames is averaged: from 80 % of the way through the assistant audio span to its end, capped at 100 frames (8.0 s at 12.5 frames per second) and floored at 8 frames for short clips. The tail of the utterance was chosen on the reasoning that whatever summary the model has assembled of the performance is most complete there.

The averaged state is kept at 38 taps:

Each tap is a 2,560-dimensional vector. Storage is float16 and tap-major — one [N, 2560] array per tap rather than one array per row — because every downstream operation reads one tap across all rows and none reads one row across all taps.

The model under the taps is the SFT-3 export with the best preference adapter attached and never merged — base out/sft3/export, adapter out/dpo_sft3_p2/ckpt-step5022/adapter, 36 layers, hidden size 2,560. Those are the artefacts published as …-v2-sft3 and laion/moss-va-sft3-dpo-lora-p2. (Merging is not an option here for the reason the main report gives in §17.2: the audio heads are weight-tied to the audio embeddings.)

3. The five probe tasks, defined

The results were originally reported by task letter, and the letters were not defined anywhere in the released artefacts — a gap serious enough that the project's 28 August status record listed “recover the A–E mapping before any of these numbers are quoted” as an open task. They were recovered from actf_probe.py::build_targets, and every definition below is that function's own.

3.1 The splits, which are not what they look like

This is worth stating carefully because getting it backwards is the source of the error in §8. The primary split is by voice: no clip identifier and no speaker appears in both the training and the test half. That is the strong condition, and it is the default. A second run uses a uid-only split, where clips are disjoint but a speaker may appear on both sides — the weaker control. The gap between the two is the measurement of how much a probe is reading speaker identity rather than the attribute.

That gap is below 0.007 R² on four of the five tasks. The exception is Task D, where the uid-only split scores +0.062 higher — genuineness is partly a speaker property, which is unsurprising and is exactly what the control exists to reveal.

Two further checks were run. The neutral extraction repeats everything on a different set of rows. And a caption control removes the emotion caption from the prompt before extraction, to test whether the probe is reading the model's own instruction back out rather than anything about the audio: stripping it costs at most 0.015 R², under 3.4 % relative, on every task. The probes are reading the performance, not the prompt.

3.2 The missing sixth task

There is also a Task A2 in the same function — Task A with the question supplied to the input as a one-hot of the assigned dimension — built specifically to measure what the missing conditioning is worth. No A2 results exist. answers.json carries keys A–E only and the layer ranking's task column holds only A…E. The experiment was defined and queued and its numbers were never produced. It is the single most informative missing number in this line of work, for the reason §7 sets out.

4. Results, task by task

Best tap and macro R² under the MLP probe on the primary voice-disjoint split, ordered by result. The metadata-only baseline is the same probe trained on the row's metadata alone — speaker, language, duration — with no activations at all. It is the number to beat before any claim about the representation can be made.

4.1 Task C — voice quality is written down early, clearly, and robustly

This is the clearest result in the set and by far the most robust: the same peak tap and essentially the same number under four conditions, including one where no speaker is shared between training and test. The whole 57-dimension VoiceNet description of a clip is recoverable from one mid-stack layer at R² 0.82, and even the worst of the 57 dimensions reaches 0.675. It peaks earliest of the five, at h12, and is already at 0.39 in the embeddings. Timbre, pace and clarity are low-level properties; they are encoded early and they stay encoded.

It is also one of only two tasks whose peak resolves to a single layer rather than a band: h12's margin over its runner-up h26 is t = 10.38.

4.2 Task D — genuineness is present, and is the least linear of the five

“Does this sound like a person rather than a reading?” is not an abstract judgement the model assembles at the top of the stack. It is legible in the middle, at R² 0.67 against a metadata baseline of 0.20. Two properties are specific to this task. It has the largest gap between the MLP probe and ridge of any task — 0.67 against 0.60 — so the encoding is real but not linear. And it is the only task where relaxing the split from voice-disjoint to uid-only buys a material gain (+0.062), which says that part of what a genuineness probe reads is who is speaking. Both matter for §10: a linear intervention is the wrong instrument for an attribute that a linear read-out recovers worst.

4.3 Task E — vocal-burst blend is middling and late

Blend peaks at h22, the latest peak of any task, and reaches only 0.50. Whether a sigh is woven in naturally is evidently a more distributed property than either voice quality or genuineness — consistent with what the quantity means, since it depends on the relation between a burst and the speech around it rather than on either alone. It is also the only task where the neutral extraction scores higher than the primary one, and the only one whose worst tap is h01 rather than the embeddings.

4.4 Task B — emotion is present, but only half-legibly

The macro R² of 0.43 against a metadata baseline of 0.05 says the representation carries far more about emotion than speaker and length do. But the spread across the 40 heads runs from 0.181 to 0.666. Some emotions are written clearly into the activations and others are barely there at all — the same asymmetry the generation-side work keeps finding, arriving this time from the inside. h18 is a statistical tie with the h20 peak (t = 1.08), so Task B's location should be read as “h18–h20” rather than as one layer.

5. What holds across all five

• The information sits in the middle of the stack. Every task peaks between h12 and h23 of a 36-layer model. h00 — the embeddings — is the worst tap for four of the five (E's worst is h01). Nothing peaks at the top of the network.
• The ordering is stable. C (0.82) > D (0.67) > E (0.50) > B (0.43) >> A (0.13) holds under the MLP probe, under ridge, under the uid-only split and on the separate neutral extraction. It is not an artefact of one split.
• Ridge is close behind the MLP everywhere except D. Most of what is present is linearly available; genuineness is the exception.
• Speaker identity is not doing the work. Going from a uid-only to a fully voice-disjoint split costs under 0.007 R² on four of five tasks. That is the first thing a probe result of this kind is usually guilty of, and it is ruled out here.
• Nor is the prompt. Stripping the emotion caption before extraction costs at most 0.015 R² anywhere — under 3.4 % relative.
• Only two of the five localise to a layer. B (h20) and C (h12) resolve; A, D and E are bands, with their top taps within 0.006–0.013 R² of each other. Quoting a single best tap for A, D or E over-states what the ranking supports, which is one reason the disagreement in §8 arose at all.

6. Where the emotion signal goes on its way to the decoder

Because the projection from the global stack into the local one is the identity in this checkpoint, the final tap h36 is the vector handed to the acoustic decoder. That makes one comparison available that is otherwise hard to get:

That is a single number and it should not be asked to carry more than it can. It does not establish that the loss causes the intensity ceiling — a decoder does not need a linearly decodable copy of an attribute in order to realise it, and 0.262 is still five times the metadata baseline. What it does say is that the emotion representation is at its strongest in the middle of the stack and is substantially attenuated by the point where audio codes are actually chosen, while the VoiceNet representation peaks eight layers earlier and is what the model demonstrably controls best. It is the most concrete internal candidate this project has for the emotion/timbre asymmetry, and it is cheap to follow up: the same measurement on C, D and E is already on disk in the layer ranking and has not been pulled out.

7. Task A, and why 0.13 is not a representation finding

Task A is the one task the probe essentially fails, and the code says why in its own comment: the question is not in the input. The probe is handed a hidden state and asked for a number, but nothing tells it which dimension is being asked about. A row drawn from the Anger bucket and a row drawn from the whisper-bottom bucket present the probe with two vectors and two targets on unrelated axes, and it has no way to tell which is which.

The decomposition confirms it. On the test split, 54.8 % of Task A's target variance sits between the three bucket families — emotion, VoiceNet-high, VoiceNet-low — whose identity the probe cannot see. And within each family the probe scores worse than that family's own mean: R² of −0.02, −5.46 and −4.32 respectively. A negative R² of −5.46 is not a weak result; it is a probe answering a question it was never given.

R² = 0.13 is therefore a statement about an under-specified question, not about the representation. The strongest evidence that it is the question and not the model: Task B asks for all 40 emotion scores at once from the same activations and reaches 0.43.

This is exactly what Task A2 was written to measure, and A2 was never run. Task A should not be quoted as a result, and it is on this page only so that a reader who meets the number elsewhere knows what it is.

8. A defect in this project's own write-up of these numbers

Two internal records report the probe table with different numbers for tasks B and D. The cause has been found, and it is worth publishing because it is a mistake that is easy to make and invisible without the source data.

The write-up's B and D figures are the uid-split values reported as if they were the primary result. The tell is visible in the write-up itself: for exactly those two tasks its “main split” row and its second row are byte-identical, which cannot happen if they are two different splits. Two related errors travel with it — that page states n_test = 8,673 for B and D, which is the uid-split test-set size rather than the primary 7,975; and it labels the second row “speaker-disjoint split” when in fact the primary split is the speaker-disjoint one and the second is the weaker uid-only control.

The status record's numbers were right and were distrusted, because the status record also — and correctly — said that the A–E mapping had not yet been recovered from the artefacts, and a table whose row labels are unknown invites the assumption that its values are unreliable too. They were not. The values used on this page are the primary-split values from answers.json, cross-checked against the layer-ranking parquet and the run's own report page.

None of this changes any conclusion. Corrected, D falls from 0.73 to 0.67 and B from 0.44 to 0.43; the ordering, the middle-of-the-stack finding, the C-against-B comparison and the steering result all stand unchanged. It is recorded because the alternative — quietly using the right numbers — would leave two of this project's own pages disagreeing with no explanation.

9. The steering vectors, and the geometry that shaped them

A probe direction is a vector in the 2,560-dimensional space of one tap. The vectors used here are difference-of-means directions rather than probe weights, which is the more common and more robust construction: take the mean activation of clips that are high on a dimension, subtract the mean of clips that are low, and the difference points from one to the other.

For each of 97 dimensions — the 40 emotion heads plus the 57 VoiceNet axes — and each of the 38 taps, three buckets are drawn: top1 (the top 1 % on the corpus percentile scale), bot1 (the bottom 1 %) and mid (the 5–10 % slice). From those, d_hi_lo, d_hi_mid and d_mid_lo.

Two further vectors exist for the same reason. A quality vector d_qual — the mean of the 2,000 highest-quality rows of the whole p3 extraction minus the mean of the 2,000 lowest — and an orthogonalised dimension vector d_dim_orth, which is d_hi_lo with its quality component projected out.

That orthogonalisation is not a formality. Measured:

This is the §13.1 finding restated as geometry, and it is sharper inside the model than outside it. The corpus observation was a correlation between two scores. This is a cosine of −0.954 between two directions in the very last state before audio codes are chosen: at that point, in this model, “more emotional” and “more genuine” are close to opposite instructions. Any method that pushes on emotional intensity without controlling for it is pushing on quality in the wrong direction, and that includes every merge-weight sweep and every reward term in the main report. It is the strongest available argument for the quality gate that §13.1 imposes on training data, and it arrives from a completely different direction.

10. The steering grid: a clean negative result

The injection rule is

h  ←  h + α · (v / ‖v‖) · ‖h‖

so α is dimensionless: it is the fraction of the current hidden state's own magnitude added along the steering direction. α = 1 doubles the norm. Injection points are the taps themselves — tap 0 into the input embeddings, taps 1–35 by a forward hook on the corresponding layer, tap 36 into the last hidden state, and loc into the local transformer's state at the frame slot only, not the eleven within-frame channel steps. Steering is applied during generation only.

The grid is 393 clip records over 27 cells, each clip record being four sampled completions — 6 emotions × 2 languages × 4 samples per cell. Every clip is scored by the same instruments and the same harness as the rest of the project. The α = 0 control is shared across the grid and therefore carries 84 clip records rather than 12.

10.1 The α sweep on the dimension vector

At every non-zero strength, in both directions, the output collapses. Unsteered, the model transcribes at word error rate 0.094 and lands within 0.01 s of the length its own script asks for. At α = +0.5 — the smallest positive strength tried — the word error rate is already 1.14, which means the recogniser produces more errors than there are words in the script. The composite reward halves at every non-zero cell and never recovers. The emotion percentile does not rise: it is 0.458 unsteered and lower at +0.5, +1.0 and +2.0.

10.2 The rest of the grid

Tap order for the multi-tap stacks came from the ranking: the dimension vector follows Task B's layer ordering (h20, h18, h21, h19, h22) and the quality vector follows Task E's (h22, h18, h23, h20, h24). One cell (dim, five taps) lost one clip record to a generation failure and carries 11 rather than 12.

The random-vector control is what makes the result clean. A random Gaussian direction of matched magnitude at α = 1.0 gives word error rate 2.065 — roughly twice as damaging as the probe direction at the same strength — so the probe directions are not merely noise; they do less damage than chance. But at α = 0.5 the random direction gives 0.949 against the dimension vector's 1.139, i.e. it is less damaging there, and its emotion percentiles (0.34–0.40) sit inside the same range as the real directions. No cell of the grid shows the dimension vector moving its own attribute in a way a matched random vector does not. That is the result.

11. Reading the steering failure

Four readings are consistent with the grid. They are not mutually exclusive and none is tested yet.

1. The intervention is in the wrong place. The vectors are differences of means over a window average — a summary that exists nowhere in the model as a single activation. Adding it at one tap at every generated frame is not the inverse of the operation that produced it. A direction found by averaging is not necessarily a direction the model can be pushed along.
2. The regimes do not match. The directions were extracted teacher-forced, with real audio on the assistant side, and are injected while the model generates freely. That is the gap the extraction code warns about, and this grid is the measurement of how large it is. The probes say an attribute is decodable while the model follows a recording; the steering says the model cannot be driven along that direction while it generates.
3. The output space is brittle in a way a text model's is not. The target is discrete residual-vector-quantised audio codes across 13 channels. A perturbation that would leave a text model producing odd but well-formed sentences leaves this one producing codes that decode to something a recogniser cannot read. The collapse appearing already at α = 0.5 — small by the standards of the text-steering literature — is consistent with that, as is the fact that h36, the very last state, is one of the most damaging injection points (WER 1.152) despite having the least network left to propagate through.
4. The dimension direction may be mostly a quality direction. §9 measured cos(d_hi_lo, d_qual) = −0.75 at h20 for emotion heads. Adding an emotion direction is therefore substantially subtracting a quality direction, which is one concrete mechanism for the degradation. The orthogonalised vector was built to test exactly this — and it degrades the output too, at every α, so if this is part of the story it is not the whole of it.

Reading 1 is the cheapest to test; reading 3 is the most likely to be decisive. The practical conclusion for this project is narrower and firmer than any of them: activation steering is not currently a route to intensity control here, and the budget that would have gone into tuning it is better spent on the data-side levers the main report identifies.

12. What would be worth trying next

1. Run Task A2 and write its numbers out. It already exists in the code. It turns Task A from an under-specified question into a specified one, and the difference between A and A2 is a direct measurement of what conditioning is worth — the same quantity the entire intensity problem turns on.
2. Pull the h36 retention figure for C, D and E. The 39 % emotion loss into the decoder is the most suggestive single number here, and the layer ranking already contains everything needed to say whether the other four attributes survive the same journey better. It costs no GPU time.
3. Sweep below α = 0.5. The grid's smallest non-zero strength already produces a word error rate above 1.0. Whether there is a usable window between 0 and 0.5 or the collapse is immediate is unknown and costs one afternoon.
4. Probe the generating model, not the teacher-forced one. Extract activations from free generation and ask whether the same attributes are decodable there. If they are not, that is a more interesting negative result than this one and it would explain the steering failure outright.
5. Use the pairs extraction. 53,325 rows were captured from the preference corpus specifically so that a chosen-minus-rejected contrast direction could be built. That direction is not in the grid above.
6. Re-aggregate the grid into the report artefacts, so that report/steer_grid.parquet stops describing a smoke test.

13. Provenance, artefacts and limits

13.1 Limits of everything above

• Teacher forcing. Repeated because it bounds every probe number on this page: these activations are conditioned on ground-truth audio. Decodability under teacher forcing is not evidence of use during generation, and §10 is the direct evidence that the two come apart.
• The targets are themselves model outputs. Tasks B, C, D and E predict the scores of learned scorers, not human labels. A probe reaching R² 0.82 on Task C has learned to predict the VoiceNet regressor, including whatever that regressor gets wrong. The main report's §6 sets out how far these instruments can be trusted; those caveats are inherited here in full, and §10's quality-vector row is what happens when they break.
• Difference-of-means vectors are quality-matched by construction (§9), so they are deliberately not the raw intensity direction. A steering failure with these vectors is not a steering failure with every possible vector.
• One capture window. The tail of the utterance was chosen on an argument, not measured against alternatives. An attribute that lives early in a clip is under-represented in every number here.
• One model. All of it is the SFT-3 export with one adapter. Whether the same layers carry the same attributes in the base model, or before preference tuning, is not measured.
• Small cells. Each steering cell is 12 clip records over 6 emotions and 2 languages. That is enough to see a collapse from WER 0.09 to WER 1.1 and nowhere near enough to resolve a difference of 0.03 in emotion percentile between cells. Nothing on this page leans on one.
• No human listening anywhere in this line of work, including on the steered clips — where a listener would have settled the “quality 1.000” row in four seconds.

---

Part of the MOSS voice-acting documentation set: the technical report · the trajectory corpus. Every number on this page was read from a named on-disk artefact; where two of this project's own records disagreed, §8 and §10 show both and say which is right and why.