← The Steerability Spectrum

Vision-encoder interpretability · steering

Two readouts, one phenomenon: why a uniform steering shift survives attention pooling

CLIP and DINOv2 read the image off a single CLS token. SigLIP has no CLS — it pools every patch through an attention head (MAP). That one architectural choice is what made SigLIP awkward to steer. Here's the picture, and the one-line reason the edit doesn't get averaged away.

Fig 1Where does the image get read? — CLS token vs. MAP attention pool
CLIP · DINOv2 readout z transformer blocks CLS patch tokens
z = xCLS

A dedicated token does the reading. To steer, you edit that one lane; the rest of the image is left intact.

SigLIP readout z MAP attention pool patch tokens — no CLS
z = Σj αj · f(xj)

Every patch feeds an attention-weighted sum. There's no single lane to edit — and "won't pooling average my edit away?" becomes the worry.

Fig 2Why a uniform shift survives the pool — add Δ to every token, watch it reach the readout undiluted
readout z + WVΔ MAP attention pool transformer blocks + Δ every patch token gets the same offset Δ

The pool is an attention-weighted sum of transformed values — f(x)=WOWVx is linear:

z = Σj αj f(xj)

Steer: add the same Δ to every token, then pool again:

z′ = Σj αj f(xj + Δ)

Linearity splits it; the offset factors out:

= Σj αj f(xj) + (Σj αj) WVΔ

Attention weights sum to 1, so they can't shrink it:

= z + WVΔ   (Σ αj = 1)
A uniform offset added to every patch reaches the pooled readout as WVΔ — the value-projection of Δ — independent of the attention pattern. Pooling can't average away a coherent, shared direction. So the fix was never "steer harder"; it was steer in the value/MAP-pooler basis, inject late, and calibrate.

This decomposition is exactly Kobayashi et al., “Attention is Not Only a Weight” (EMNLP 2020): an attention output is Σ α·f(x), so a token's contribution is α·‖f(x)‖, not α alone — which is also why a high-attention CLS/SEP token can contribute little. Companion to The Steerability Spectrum of Visual Attributes. The flip side: with no protected CLS, a SigLIP edit hits the readout directly, so it steers — but its object identity frays sooner than a CLS-readout model's.