Local Linearity of LLMs Enables Activation Steering
via Model-Based Linear Optimal Control

Julian Skifstad1  Xinyue Annie Yang2  Glen Chou1,3

Georgia Institute of Technology — 1School of Aerospace Engineering, 2Computer Science, 3Cybersecurity and Privacy

Correspondence to: Julian Skifstad jskifstad3 [at] gatech [dot] edu

Paper Code Poster Video

TL;DR: LLM transformer layers are locally linear — we exploit this to apply the Linear Quadratic Regulator (LQR) to synthesize a training-free, closed-loop activation steering controller (A-LQR) that achieves state-of-the-art behavior control across models and tasks.

Abstract

Inference-time LLM alignment via activation steering offers an alternative to fine-tuning by directly modifying hidden activations during generation. Existing methods, however, often rely on non-anticipative interventions that ignore how perturbations propagate through transformer layers and lack online error feedback, yielding suboptimal, open-loop control.

To address this, we show empirically that layer-wise dynamics across multiple LLM architectures and scales are well-approximated by locally-linear models, despite the nonlinear structure of transformer blocks. Exploiting this property, we model LLM inference as a linear time-varying (LTV) dynamical system and adapt the classical linear quadratic regulator (LQR) to compute feedback controllers using layer-wise Jacobians. This steers activations toward desired semantic setpoints in closed-loop, with minimal computational overhead and no offline training.

We also derive theoretical bounds on setpoint tracking error, providing formal guarantees on steering performance. Using a novel adaptive semantic feature setpoint signal (LFS), our method yields robust, fine-grained behavior control across models, scales, and tasks — including state-of-the-art modulation of toxicity, truthfulness, refusal, and arbitrary concepts, surpassing baseline steering methods.

Method

Our method, Activation-LQR (A-LQR), consists of two components: a feedback signal that tracks semantic features across layers, and an optimal control policy that minimizes deviation from those semantic targets while penalizing large interventions. This is enabled by modelling the LLM as a linear time varying (LTV), dynamical systam, which we emprically validate.

A-LQR Method Overview
Figure 1: Method overview. At each LLM layer k, A-LQR computes a steering intervention uk that minimizes the deviation between the semantic feature value βk at the current activation and a desired target βk*, using LQR with linear approximations of the transformer blocks.
1

Local Linearity Analysis

We show that within each transformer layer, the Jacobians at different reachable activations are highly correlated — their dominant singular subspaces align substantially. This justifies approximating the full nonlinear LLM as a linear time-varying (LTV) dynamical system, enabling efficient LQR-based control synthesis without resolving the hard nonlinear problem.

2

Linear Feature Setpoint (LFS)

Given contrastive prompt datasets (e.g., toxic vs. non-toxic), we compute the mean-difference activation direction at each layer, giving a unit vector vk that captures the target semantic concept. The Linear Feature Setpoint βk* = λμk scales this target adaptively with layer-wise activation norms, providing an online closed-loop feedback signal for LQR tracking.

3

Activation-LQR (A-LQR)

We linearize each transformer block around the mean positive-class trajectory, then solve the LQR tracking problem via Riccati recursions to obtain feedback gains {Kk}. At runtime, the steering intervention is uk* = (βk* − vkTzk) Kkvk — a closed-loop controller that adapts the perturbation magnitude to the current activation error, with gains precomputed offline in O(log ℓ · log2d) on GPU.

Jacobian Spectra
Jacobian spectra. Normalized singular values across Gemma-2-2B layers for random nominal trajectories — spectra are dominated by a few shared modes, supporting the LTV approximation.
Jacobian Alignment
Jacobian alignment. Pairwise subspace similarity across 50 Jacobians in Gemma-2-2B at early, middle, and late layers. Lighter = stronger alignment. Random matrices (a) serve as baseline; concept-related inputs (b, c) show substantial alignment.

Results

We evaluate A-LQR on eight open-source models (1B–70B parameters) across four tasks. Baselines include ITI, ActAdd, Mean/Linear-AcT, PID-AcT, ODESteer, and a new Setpoint-PID (S-PID) baseline sharing our LFS feedback signal.

30–50×
toxicity reduction vs. base model (baselines: ~8–10×)
+17%
TruthfulQA T·I improvement on Llama-3-8B while preserving >96% informativeness
76.9%
jailbreak compliance (A-LQR+) vs. 12.5% best baseline

Concept Steering: Qualitative Example

Models are prompted with "Once upon a time" and A-LQR is used to induce arbitrary concepts (e.g., "Dog", "Cloud", "Love") from the OneSeC dataset. The LFS strength parameter λ provides smooth, fine-grained control over concept prevalence as measured by an LLM-as-a-judge.

Prompt "Once upon a time," Gemma-2-2B · concept: Dog · λ = 2
Unsteered
A-LQR Steered
Qualitative examples from Appendix A of the paper. Generations are real model outputs.
Concept Steering Results
Figure: Concept prevalence vs. λ. Proportion of 500 generations exhibiting each target concept, scored by Llama-3.1-8B as judge. Scaling λ achieves monotone, fine-grained control across concepts and models.

Toxicity Mitigation

Using the RealToxicityPrompts dataset (5 × 1000 trials), A-LQR achieves consistent toxicity reduction across all models while preserving output diversity (Dist scores) and knowledge (MMLU). Results below show selected models; full tables appear in the paper.

Toxicity — Gemma-2-2B
MethodToxicity ↓MMLU ↑
Original4.16%54.54%
Best Baseline (Mean-AcT)0.50%54.62%
A-LQR0.18%53.56%
Toxicity — Llama-3-8B
MethodToxicity ↓MMLU ↑
Original5.14%66.04%
Best Baseline (ITI)0.64%62.14%
A-LQR0.12%67.08%
Toxicity — Qwen-2.5-14B
MethodToxicity ↓MMLU ↑
Original3.26%79.40%
Best Baseline (S-PID — ours)0.60%78.64%
A-LQR0.12%78.52%
Toxicity — Qwen-2.5-32B
MethodToxicity ↓MMLU ↑
Original3.72%82.45%
Best Baseline (S-PID — ours)0.28%82.46%
A-LQR0.22%82.82%

Truthfulness (TruthfulQA)

Evaluated on the TruthfulQA generation split. T·I = Truthfulness% × Informativeness% (higher is better). A-LQR achieves top T·I scores while maintaining high informativeness, unlike ActAdd which improves truthfulness at the cost of coherence.

TruthfulQA — Gemma-2-2B
MethodT·I ↑True% ↑Info% ↑
Original48.6450.62%96.08%
Best Baseline (ODESteer)63.5066.24%95.86%
A-LQR67.8173.17%92.68%
TruthfulQA — Llama-3-8B
MethodT·I ↑True% ↑Info% ↑
Original46.2247.44%97.43%
Best Baseline (S-PID — ours)62.9964.99%96.92%
A-LQR63.6365.80%96.70%

Jailbreaking

We also evaluate A-LQR in the inverse task of overriding model refusal behavior — demonstrating that A-LQR provides bidirectional control. A variant, A-LQR+, intervenes across all token positions rather than just the last, which is necessary to override the full compliance representation. Results on Qwen2.5-14B-Instruct below; full multi-model results appear in the paper.

Jailbreaking — Qwen2.5-14B-Instruct
MethodASR ↑Refusal ↓
Original1.9%97.1%
AAS77.9%0%
S-PID65.4%0%
A-LQR69.2%0%
A-LQR+97.1%0%

ASR = Attack Success Rate. A-LQR+ intervenes on all token positions.

Citation

If you find this work useful, please cite:

@inproceedings{skifstad2026local, title = {{Local Linearity of {LLM}s Enables Activation Steering via Model-Based Linear Optimal Control}}, author = {Skifstad, Julian and Yang, Xinyue Annie and Chou, Glen}, booktitle = {Proceedings of the 43rd International Conference on Machine Learning}, year = {2026} }