Feedback Control Helps Steer Language Models Through Unfamiliar Inputs

From fixed nudges to feedback

Activation steering changes a language model’s internal representations during inference without updating its weights. A direction associated with a desired behavior—such as truthfulness or refusal—is used to perturb intermediate activations. The challenge addressed in this preprint is that an intervention calibrated on one distribution may behave differently on unfamiliar inputs.

In Mind Control of LLMs via Closed-Loop Stimulation: Out-of-Distribution Robustness, Kasra Fallah and colleagues borrow a principle from closed-loop neurostimulation: condition an intervention on the system’s current state. Despite the title, the work concerns mathematical control of activations, not consciousness, and the authors explicitly reject equating language models with brains.

Feedback alone is not their central distinction. Existing steering methods already use feedback. Their additional ingredient is robust control: designing the controller to account for errors in the simplified model used to predict how interventions propagate.

Designing around an imperfect model

The researchers treat transformer layers as successive steps in a dynamical system. During calibration, they construct an eight-dimensional representation at each layer, including a direction associated with the target behavior, and estimate how states propagate between layers.

Those estimates cannot fully describe a nonlinear transformer. The team therefore measures prediction residuals and uses their covariance to represent the directions and scales of observed model mismatch, rather than assuming uncertainty is identical in every direction.

An H-infinity controller then seeks to limit worst-case amplification of disturbances entering through those fitted channels, while penalizing tracking error and intervention effort. During generation, it reads the current final-token activation at controlled layers and applies a corresponding correction. Dynamics estimation and controller synthesis happen offline; the stored controller remains fixed during evaluation, although its actions depend on the evolving state.

The mathematical guarantee applies to the identified, reduced-order system and its specified additive disturbances. It is not a guarantee against arbitrary changes to the transformer or every possible deployment input.

Stronger truthfulness and refusal results

On TruthfulQA, the controllers were constructed using English data and evaluated on both English prompts and Spanish questions requesting English answers. The primary score multiplies aggregate truthfulness and informativeness, discouraging improvements based solely on vague responses.

The authors report the highest joint score for H-infinity across all four tested models in both conditions. For OLMo-2-32B under Spanish-input transfer, it reached 91.50, compared with 82.70 for the strongest reported non-H-infinity baseline. These are joint metric scores, not percentages of answers individually judged both truthful and informative.

On HarmBench, the study evaluated direct harmful requests and five fixed jailbreak templates across three Llama models. H-infinity produced lower attack success rates than both the unsteered model and Activation-LQR in all 18 model–condition comparisons. Averaged across model scales and jailbreak templates, attack success fell from 9.3% for the strongest non-H-infinity baseline to 1.7%.

That result does not establish uniformly better response quality. Safety-concept relevance remained high, but auxiliary fluency and instruction-relevance scores declined in several conditions. The attacks were frozen templates, not an unrestricted test of future adversaries.

Preserving capability is not enough

The multilingual mathematics experiment separates two objectives: producing Spanish responses and retaining correct arithmetic when inputs arrive in five other languages.

H-infinity preserved more average mathematical accuracy than Activation-LQR on all three tested models. Phi-4-mini, for example, achieved 35.2% accuracy, versus 0.0% for Activation-LQR and 45.4% without steering. But target-language success remained uneven. Granite-3.3-2B scored zero Spanish relevance under H-infinity, despite retaining much of its original accuracy. Preserving reasoning therefore did not necessarily mean achieving the requested intervention.

The long-context experiment similarly targeted positive sentiment while measuring answer recall and citation quality. It used 40 matched questions at approximately 8,000 and 16,000 tokens. For Qwen2.5-3B, H-infinity recall declined from 66.4% to 65.2%, while citation F1 increased. On Llama-3.2-1B, however, its 16,000-token recall trailed Activation-LQR. Sentiment relevance was generally near zero, qualifying any interpretation as successful style steering.

A diagnostic, not a universal certificate

The paper also introduces robust steerability: the reciprocal of the smallest achievable disturbance amplification in the fitted control problem. Larger values indicate greater tolerance within that formulation. The score depends on the model, objective, intervention and chosen performance weights—not simply parameter count.

Across three HarmBench controllers, the lowest score accompanied the weakest refusal performance, while the two higher-scoring controllers approached ceiling-level refusal and changed ordering across attacks. This supports a preliminary diagnostic role, not a universal ranking.

The benchmark comparisons also combine synthesis differences with controller selection: H-infinity receives a calibration cost-grid search, while competing settings remain frozen. The reported gains consequently evaluate the full procedure, rather than isolating robust synthesis alone. The contribution is a concrete way to design around measured mismatch—and to ask how much uncertainty a steering intervention can withstand.