Steering with Words

A machine with no ears

We can generate. We cannot yet steer — the model has never been told what we want. Chapter 5's machine runs happily without us: pour in a field of random numbers, walk it down the noise schedule, decode, and an apple appears. A fine apple — possibly red, possibly golden, possibly on a marble counter we never asked for. The noise predictor $\boldsymbol{\epsilon}_\theta(\mathbf{z}_t, t)$ has exactly two inputs — a noisy latent and a noise level — and neither is a place to put a sentence.

This chapter bolts on a steering wheel. Our standing request throughout is "a green apple on a wooden table." By the end you will know what happens to those seven words: how they become numbers, where those numbers enter the U-Net, how one patch of latent decides to listen to "green" rather than "table", and what the guidance number in your workflow is actually multiplying.

A prompt becomes numbers

The trip from text to numbers happens in two stages, and you have met both in the sister book.

Stage one: tokens. The sentence is cut into tokens, the chunks a model actually reads. Ours becomes seven — one per word, which is convenient but not guaranteed, since rarer words split into pieces. The LLM book's Chapter 7 does this properly.

Stage two: the text encoder. Those tokens go into a separate trained network whose only job is to turn them into vectors — ordered lists of numbers, the same object Chapter 1 also called a point — that carry meaning in the direction they point, the idea from meaning as direction. It is a cousin of the transformer that runs a chatbot, not the same animal, and we treat it as a sealed box: text in one end, numbers out the other.

What comes out is the conditioning, written $\mathbf{c}$: a set of vectors, one per token. Not one vector for the whole sentence — a stack, kept separate, so "green" and "wooden" stay individually addressable further down. That separateness is what the next section spends all its arithmetic on.

The denoiser grows a third input

Here is the entire structural change, and it is one symbol:

In words: the noise predictor now takes three things — the noisy latent $\mathbf{z}_t$, the noise level $t$, and the conditioning $\mathbf{c}$ — and still hands back one thing.

Be precise about that one thing, because it is the easiest sentence in this book to get wrong. The output is still a noise estimate, the same shape as $\mathbf{z}_t$, exactly as in Chapter 3. The prompt does not make the network output an apple; it makes the network output a different guess about the noise. Since Chapter 5's update rule subtracts a fraction of that guess at every sampler step, a different guess walks the latent down a different path, and a different apple comes out of Chapter 4's decoder $\mathrm{Dec}$.

Training is unchanged too. We still manufacture the answer key the way Chapter 3 did — real image, random noise level, drawn noise blob, built $\mathbf{z}_t$ — except the training image now arrives with a caption, that caption is encoded into $\mathbf{c}$, and the network is handed $\mathbf{c}$ while it guesses. The loss does not change one character. Over millions of examples the network discovers that the vectors in $\mathbf{c}$ are worth using, because using them makes its noise guesses better.

Patches that ask the prompt

Inside those mint diamonds is a mechanism you already own, and here it is in one breath, because I promised to define everything I use: attention is a way for one thing to gather information from several candidates, taking more from the ones that are relevant to it and less from the ones that are not. Everything inside it plays one of three roles — the same three the LLM book's attention chapter uses, so if you have read that, this is a reunion: a query ("what am I looking for?"), a key ("here's the kind of thing I am"), and a value (the payload it hands over if picked). Dot products made scores, softmax made shares, shares mixed the values. That entire recipe is unchanged here. One thing differs — where the roles come from.

Cross-attention takes its queries from the image and its keys and values from the text. Each patch of the latent asks; every token of the prompt answers. Same-sequence roles are self-attention; roles split across two different things — a picture asking a sentence — make it cross-attention. Nothing about the arithmetic changes.

Let's run one. Take a single patch of the latent — one small square in the middle of the fruit — with the two-number query $\mathbf{q} = [1,\, 1]$, and two tokens of our prompt, "green" and "apple". As in the attention chapter, real vectors are hundreds of numbers long; two keeps every digit checkable by hand and changes nothing. Every number here is rounded to three decimals, and every intermediate is printed.

One honest note on where those numbers come from, because "who decided green's key is $[1, 1]$?" is the right question to ask. Inside the block, each token's vector is turned into its key by a small learned matrix and into its value by a second one — the same trick, twice — and the patch's numbers are turned into its query by a third. Those matrices are part of $\theta$, tuned during training like everything else in the model. The numbers below are hand-picked stand-ins, small enough to check; what matters is what happens to them.

Step one, the scores — each a dot product: multiply matching slots, add them up.

In words: this patch's question lines up well with what "green" advertises, giving a score of 2.

In words: the same question against "apple"'s label cancels out exactly, giving a score of 0 — this patch is asking a color-ish question, and "apple" is not answering it.

Step two, turn the scores into shares totaling 1 — that is softmax: raise $e$ to each score, then divide each result by the total of all of them.

Two things in that sentence need unpacking. The first is the symbol $e$, which is a specific fixed number, about $2.718$ — a mathematical constant like $\pi$, and for our purposes nothing more mysterious than that: a number we raise to powers. The second is why we raise anything to a power at all, and there are two reasons, which together are the whole justification. Every share has to come out positive, and raising $e$ to a power guarantees that even when the score is negative. And it exaggerates the gaps, so a slightly higher score takes a much larger slice of the patch's attention than a plain division by the total would give it.

With $e^{2} = 7.389$ and $e^{0} = 1$ — anything raised to the power 0 is 1 — the total is $7.389 + 1 = 8.389$.

In words: this patch spends 88.1% of its listening on the token "green" and 11.9% on "apple". The two shares add to 1.000, which softmax guarantees.

Step three, mix the values using those shares.

In words: take 88.1% of green's payload and 11.9% of apple's, and add them. First slot: $0.881 \times 2 + 0.119 \times 0 = 1.762 + 0 = 1.762$. Second slot: $0.881 \times 0 + 0.119 \times 3 = 0 + 0.357 = 0.357$.

That vector $[1.762,\, 0.357]$ folds back into the patch's own numbers before the U-Net carries on. The patch arrived carrying "I am somewhere in a noisy blob"; it leaves carrying "…and the prompt says my neighborhood is overwhelmingly green, with a dash of apple." Every patch does this, at every scale of the U-Net, at every sampler step.

Green apple, red apple

Now change one word and watch the arithmetic move. Swap "green" for "red". A color word still advertises itself as a color word, so its key stays $\mathbf{k}_{\text{red}} = [1,\, 1]$ — but what it hands over is the opposite end of the color axis: $\mathbf{v}_{\text{red}} = [-2,\, 0]$.

The scores are identical, because the keys are: $1 \times 1 + 1 \times 1 = 2$ against "red" and $0$ against "apple" as before. So the shares are identical too, $0.881$ and $0.119$ — the patch listens in the same proportions. What changes is what it hears:

In words: first slot, $0.881 \times (-2) + 0.119 \times 0 = -1.762 + 0 = -1.762$. Second slot, unchanged at $0.881 \times 0 + 0.119 \times 3 = 0.357$.

Read the two results side by side — $[1.762,\, 0.357]$ against $[-1.762,\, 0.357]$. The second number, the appleness, did not move. The first flipped sign. One word swung this patch to the far end of one axis and left everything else alone: the mechanical meaning of "the prompt changed the color but not the subject." Multiply it by thousands of patches and a couple of dozen sampler steps and you get a red apple from the same starting static.

Two runs from the same static

To see what conditioning buys us, run Chapter 5's sampler twice from the identical starting latent $\mathbf{z}_T$ — same seed, same noise schedule, same number of sampler steps — changing nothing but the third input.

Run one is unconditioned: we pass the empty prompt $\varnothing$, a real prompt containing no words, run through the same text encoder into a real stack of vectors. The predictor still works; it just has nothing to lean on, so it guesses the way a witness with no description guesses — aiming at the average of everything that could look like this: a generic, plausible, uncommitted image. Run two is conditioned: same $\mathbf{z}_T$, but $\mathbf{c}$ carries "a green apple on a wooden table". At the first sampler step the two predictions already disagree slightly, and since the update rule subtracts a fraction of the prediction, from step two onward the runs stand on different latents, ask different questions, and drift apart. Two paths, one origin.

Here is the observation the rest of the chapter is built on: we have both predictions, and the difference between them is a direction. Subtract the unconditioned guess from the conditioned one and what remains is exactly the part of the answer the prompt is responsible for — the greenness and woodenness the empty prompt did not contribute. That difference is a vector we can lean on harder than the model did on its own.

The guidance scale

The technique is called classifier-free guidance: run the noise predictor twice at every sampler step, once with the prompt and once with the empty prompt, then push away from the unconditioned answer in the direction of the conditioned one — and keep pushing past it. The amount of push is the guidance scale $s$.

In words: start at the unconditioned noise guess, measure the step from there to the conditioned noise guess, multiply that step by $s$, and take it. The result $\hat{\boldsymbol{\epsilon}}$ — "epsilon-hat" — is what we hand to Chapter 5's update rule in place of a plain prediction.

Three values of $s$ deserve the algebra done out loud rather than asserted, because the middle one is the most misread number in the field.

At $s = 0$, write $\boldsymbol{\epsilon}_\varnothing$ for the unconditioned guess and $\boldsymbol{\epsilon}_{\mathbf{c}}$ for the conditioned one:

In words: multiply the step by zero and you never leave the starting point. The prompt is thrown away entirely and you get the unconditioned image.

At $s = 1$, the term in brackets is taken exactly once:

In words: the two copies of $\boldsymbol{\epsilon}_\varnothing$ cancel — one added, one subtracted — and what is left is exactly the conditioned prediction, on its own.

Sit with that line, because it is where most explanations go wrong. $s = 1$ is not guidance switched off. It is the model's honest, unamplified answer to your prompt — the prediction it would make if you had passed $\mathbf{c}$ and never run the second pass. Guidance switched off is $s = 0$, which gives an image with no prompt in it. Between the two you fade the prompt in; above 1 you exaggerate it.

At $s > 1$ we extrapolate past the conditioned answer. Work it on one number — one coordinate of one latent at one sampler step. Suppose the unconditioned prediction there is $0.60$ and the conditioned prediction is $0.50$. The difference is

In words: knowing the prompt moved this coordinate's noise guess down by one-tenth. That tenth is the prompt's entire contribution here.

At a guidance scale of $s = 7.5$ — a common default, and we will see in a moment where the useful band lies:

In words: multiply the prompt's one-tenth of influence by seven and a half to get $-0.75$, add that to the unconditioned $0.60$, and land on $-0.15$.

Look at where that lands. The two predictions the model actually made were $0.60$ and $0.50$; the guided value $-0.15$ is not between them and nowhere near them. We took a small, trustworthy direction and stretched it seven and a half times. At $s = 3$ we would have landed on $0.60 + 3 \times (-0.10) = 0.60 - 0.30 = 0.30$ — a shorter stretch of the same move.

So what breaks at high $s$? The noise predictor was trained on latents from real images at real noise levels, and its guesses are reliable in that neighborhood. Extrapolating seven or twenty times past the honest answer marches the estimate out of the region where it was ever checked against reality, and the sampler dutifully follows it there. In pictures that shows up as blown-out color, scorched contrast, hard edges where things should be soft, and rigid, literal, poster-like obedience to the prompt. Low $s$ gives weak adherence — the prompt is a suggestion the image half-takes. The useful band for most models runs roughly 5 to 9, with $s = 7.5$ a common default; those are typical configuration choices, not laws.

One last note. Nothing requires the second pass to use the empty prompt: swap $\varnothing$ for a real encoded prompt like "blurry, extra stems" and the formula pushes away from that instead — which is all a negative prompt is.

See it move

Where you'll meet this

Open any Stable-Diffusion-style workflow graph and this chapter is drawn on the screen. There are two CLIP Text Encode nodes, not one. Each is the sealed text-encoder box from earlier: a prompt goes in, and out comes a wire labeled CONDITIONING — that wire carries $\mathbf{c}$. Both wires run into the sampler node, into sockets marked positive and negative. The positive socket is $\mathbf{c}$; the negative socket is what stands in for $\varnothing$ in the guidance formula, which is why leaving it blank is a perfectly normal thing to do — blank is the empty prompt, exactly as derived.

On the sampler node sits a field labeled cfg, usually defaulting near 7 or 8. That is $s$ — not a quality dial and not a prompt-strength dial, but the multiplier on the gap between the two predictions the sampler is already computing. When someone's images look "burnt", that is the first number to check, and you now know why: they are reading a calibration curve far outside the range it was built on.

Two everyday experiences come straight out of this chapter's arithmetic. Prompt crowding — a twelve-word prompt honouring each word less than a four-word one — is the softmax shares splitting further, exactly as our style word dropped green's 0.881 to 0.665. And phrasing mattering more than it "should" is the text encoder producing a genuinely different $\mathbf{c}$ for a different sentence; there is no keyword matching anywhere in the pipeline to be robust for you.

There is a hard edge to all of it. Every one of these knobs steers the model within what it already knows. If you want the heirloom apple variety in your garden, or one illustrator's line quality, no prompt reaches it: the text encoder will encode your words, the cross-attention will blend them, and the model will produce its best generic guess, because nothing in $\theta$ ever saw your apple. So how do you teach a fixed, finished model one new specific thing without retraining all of it? Hold that question.