PaperlayerView exact revision on arXiv

Source-linked AI summary

Topological Steering

Benoît Guérand, Tan Minh Nguyen

arXiv:2609.00597v1cs.LG

TL;DR

LLM behavior is difficult to control reliably, especially under adversarial or distribution-shifted prompts, and existing activation-space interventions can be sensitive to local perturbations. Topological Steering uses persistent-homology structure to identify robust, behavior-specific activation subsets and injects derived directions during inference. Across tested models and layers, it produces positive separation gains and measurable behavioral movement, while remaining a proof-of-concept with setup- and scope-dependent limitations.

  • Problem

    Existing behavioral steering methods can be sensitive to outliers, distribution shifts, noise, and local perturbations when controlling undesirable LLM behavior.

  • Method

    Topological Steering compares persistent-homology diagrams of harmful and harmless activation clouds to derive interpretable steering directions from robust, behavior-specific substructures.

  • Results

    Topological Steering produces consistent positive separation gains across tested models and layers and measurable behavioral movement on external judge benchmarks.

  • Takeaways & Limitations

    The method makes multiscale activation structure and selected support subsets explicit components of inference-time behavioral intervention without retraining.

  • Takeaways & Limitations

    The method focuses on refusal, and transfer to other behaviors requires new contrast sets and careful evaluation.

Abstract

from arXiv · show

With the rapid rise of large language models (LLMs), controlling undesirable model behaviors has become increasingly important. Existing behavioral control methods typically intervene directly in activation or feature space, but such approaches can be sensitive to outliers, distributional shifts, noise, and other local perturbations. Motivated by Topological Data Analysis (TDA), which captures global rather than purely local structure, we propose Topological Steering, a new framework for steering LLM behavior through the topological representation of activation spaces. Using persistence diagrams, our method connects activation-based steering with TDA and enables more robust behavioral control. We show that Topological Steering consistently modifies LLM behavior across multiple model families and model sizes.

1 Introduction

Topological Steering addresses unreliable behavioral control by replacing local geometric interventions with topology-aware analysis of activation spaces. It uses persistent diagrams to identify behavior-relevant structure and consistently changes behavior across model families and sizes, while trading some raw efficacy for interpretability.

  • LLM behavior can remain undesirable under adversarial or distribution-shifted prompts, motivating lightweight inference-time control without retraining or weight changes.
  • Existing geometric steering methods can average away heterogeneous behavioral structure and remain sensitive to outliers, noise, and perturbations.
  • Topological Steering applies joint dimensionality reduction and Vietoris–Rips persistence diagrams to contrastive activation point clouds, selecting persistent behavior-specific features.
  • Persistence diagrams provide an interpretable way to localize behavior-relevant regions, including connected components and higher-order structures, in the residual stream.
  • Topological Steering consistently improves over unsteered baselines across model families and sizes, while offering a structured and inspectable alternative to optimized geometric steering.

2 Related work

Prior steering methods primarily manipulate activation geometry through additive or rotational interventions, while TDA offers tools for representing global, nonlinear structure. Topological Steering applies these topological ideas to expand behavioral-control methods beyond simple geometric shifts.

  • Activation steering provides a lightweight inference-time alternative to fine-tuning by perturbing internal representations during the forward pass.
  • Recent methods such as Angular Steering move beyond additive shifts but still predominantly treat activation spaces as geometrically simple.
  • Topological Steering targets complex, global, and nonlinear invariants in high-dimensional activation manifolds.
  • Persistent homology tracks connected components, loops, and higher-dimensional voids across spatial scales using filtrations such as Vietoris–Rips.
  • Although topological machine learning developed stable vectorizations of persistence diagrams, training-time persistent-homology computation was constrained by combinatorial and memory costs.

3 Background

The paper connects inference-time residual-stream steering with topological summaries of activation point clouds. Its background introduces activation interventions, persistent homology, persistence diagrams, and Vietoris–Rips filtrations as the technical foundation.

  • Activation steering adds a direction vector to an internal residual activation at a chosen layer and token position during inference.
  • Persistent homology describes activation point-cloud shape by tracking the appearance and disappearance of topological features across distance scales.
  • Persistence is the difference between a feature’s death and birth scales, with larger values indicating greater stability across scales.
  • A persistence diagram records birth–death pairs for topological features and enables comparison between harmful and harmless activation clouds.
  • Vietoris–Rips filtrations construct nested simplicial complexes from pairwise distances, whose evolving topology yields the birth/death pairs.

4 Topological Steering

Topological Steering replaces a global harmful–harmless centroid shift with directions derived from persistent, behavior-specific activation substructures. The method extracts and compares topological features, assembles local contrastive vectors, and injects the aggregate direction at inference time.

  • Motivation for Topological Steering: A global mean-difference direction can dilute refusal signals when harmful activations contain multimodal or heterogeneous behavioral modes.
  • Motivation for Topological Steering: The method seeks robust refusal subsets whose mean contrasts with harmless activations, rather than averaging the entire harmful cloud.
  • Topological feature selection: Persistent and cross-class-mismatched features are selected because they combine geometric stability with behavioral specificity.
  • Overview of Topological Steering: Topological Steering identifies refusal-specific sub-clusters, computes local contrasts with nearest harmless neighbors, and aggregates them using topological significance and effect size.
  • Inference-Time Intervention: The aggregate steering vector is injected into the target residual-stream layer during autoregressive generation to nudge representations toward refusal sub-manifolds.
  • Advantages: The approach emphasizes heterogeneous local clusters, coordinate-free structure, and target-specific features rather than global class averages.
  • Activation processing: Joint PCA projects harmful and harmless activations into a shared low-dimensional space before Vietoris–Rips persistent-homology computation.

5 Experimentations

The experiments evaluate Topological Steering through activation-separation scores and jailbreak-oriented behavioral metrics, then test whether its gains extend across model families. Across models, the method improves held-out separation relative to mean-difference steering, while automated judge outcomes increase in the representative end-to-end evaluation.

  • Experimental design: The experiments separate representation-level diagnostics from downstream behavioral tests across benchmarks, metrics, models, and held-out evaluations.Steering vectors use training splits, are injected at the last prompt token, and are evaluated on held-out activations and open-ended generations.
  • Activation metrics: Positive ∆ρ indicates that the topological direction separates harmful from harmless activation clouds more sharply than the train-split mean-difference baseline.The steering score is defined as ∆ρ = ρ(vsteer) − ρ(vbase), with vbase = X̄+ − X̄−.
  • Benchmark results: The representative end-to-end evaluation reports improved activation separability and increased automated jailbreak rates under the same intervention, with the largest relative movement on Llama Guard 3.HarmBench shows a smaller but consistent gain, while the substring probe moves modestly.
  • Cross-model results: All six evaluated models show ∆ρ > 0 at their selected layer, supporting cross-family consistency under the same training, holdout, and sweep protocol.The models span Llama, Qwen, and Gemma families, but gains are not monotone in parameter count.
  • Cross-model results: The optimal injection depth varies by model family, with selected layers ranging from Qwen-7B at ℓ⋆=8 to several models reaching the sweep cap at ℓ⋆=20.Llama-3.1-8B peaks at ℓ⋆=16, motivating layer sweeps rather than a universal injection layer.
  • Interpretation and limitations: Raw refusal-separation scores are not cross-model calibrated, so the results emphasize within-model ∆ρ gains rather than absolute steerability comparisons.Gemma-2-9b-it has a much larger ∆ρ but a much smaller baseline ρbase than the other five models.

6 Conclusion, limits and remarks

Topological Steering converts persistent-homology structure in activation spaces into an inspectable inference-time steering signal, with positive separation gains across tested models and layers. The paper presents this as a proof-of-concept and identifies tuning, semantic ambiguity, computational scaling, and limited behavioral scope as boundaries.

  • Conclusion: Topological Steering builds steering directions from persistent-homology structure rather than a single global mean contrast.The method matches harmful and harmless persistence diagrams, selects robust contrastive features, and aggregates local directions.
  • Conclusion: ∆ρ > 0 across tested models and layers in the single-layer setup, alongside measurable behavioral movement on external judge benchmarks.
  • Limitations: The method’s gains depend on preprocessing and feature-selection hyperparameter tuning, while persistent diagrams may capture nuisance geometry without contrastive matching and behavioral validation.
  • Limitations: The study focuses on refusal as a safety axis; transfer to other behaviors requires new contrast sets and careful evaluation.Computational cost also scales with point-cloud size and homology degree.
  • Remarks: Future work proposes hybrid steering and persistence diagrams as structured evidence for safety debugging and representation-level auditing.
  • Remarks: Topology makes activation support subsets and multiscale structure explicit components of intervention design, even when specialized baselines lead on specific benchmarks.

A.1.1 Transformers

A decoder-only transformer maps token sequences into residual states and processes them through repeated pre-norm self-attention and MLP residual updates. Causal attention uses query, key, and value projections with a causal mask.

  • Transformers: Tokenization maps input text to discrete token IDs, which are embedded in R^d_h and combined with positional information to form initial residual states.
  • Transformers: Each pre-norm transformer layer applies self-attention and a position-wise MLP through residual updates.
  • Transformers: Attention weights are computed from query, key, and value projections, with a causal mask and head dimension d_k.

A.1.2 Activation Steering

Classical activation steering derives a vector from the centroid difference between positive and negative activation collections. A positive steering coefficient moves activations toward the target behavioral region and away from the contrast region before later layers produce the output.

  • Activation Steering: The steering vector v is estimated from positive and negative prompt-conditioned activations collected at the same layer and token position.The positive set represents behavior to increase, while the negative set represents behavior to suppress.
  • Activation Steering: v = µ+ − µ− defines the displacement between the positive and negative activation centroids.
  • Activation Steering: Positive α moves the modified residual state toward the target behavioral region and away from the contrast region.
  • Activation Steering: The modified state is propagated through subsequent layers to produce final logits and generated text.

A.2 Persistent Homology

Persistent homology summarizes how activation point-cloud topology changes across distance scales using filtrations, homology groups, and persistence intervals. In this work, these multiscale signals support steering without assuming linear separability.

  • Persistent Homology: A finite activation point cloud is converted into a nested filtration of simplicial complexes as the distance scale ε increases.
  • Persistent Homology: H_0 tracks connected components, H_1 tracks loops, and H_2 tracks voids through Betti numbers at each scale.
  • Persistent Homology: A topological feature’s persistence is its death scale minus birth scale, with long-lived classes treated as structurally robust and short-lived classes often attributed to sampling noise.Persistence intervals record the feature’s birth and death scales.
  • Persistent Homology: Persistent homology supplies a multiscale summary of activation geometry without assuming linear separability.Birth and death events are encoded in persistence diagrams and used to construct steering-relevant subsets and directions.

A.3 Persistence Diagram

Persistence diagrams summarize multiscale topological structure in activation point clouds, while Vietoris–Rips filtrations and diagram distances enable behavioral comparison. The section also reports implementation choices, evaluation caveats, and robustness evidence for Topological Steering.

  • Persistence diagrams: Persistence diagrams encode the birth and death of topological classes across homology dimensions, with points far from the diagonal representing more persistent structure.The method compares diagrams across behavioral conditions using matching-based distances such as bottleneck or p-Wasserstein metrics.
  • Vietoris–Rips construction: Vietoris–Rips complexes build simplices from pairwise distance thresholds, forming a filtration whose persistent homology yields persistence diagrams.Edges appear first, followed by higher-dimensional simplices as the scale parameter increases.
  • Computational scope: Vietoris–Rips persistence is convenient for activation point clouds but can grow combinatorially with sample size and intrinsic dimension.Implementations therefore typically cap homology degree and apply dimensionality reduction before computing persistence.
  • Behavioral evaluation: The reported benchmark stack combines Llama Guard 3, HarmBench, and substring matching to evaluate refusal-related behavior.Llama Guard and HarmBench scores are setup-dependent, while substring matching is an inexpensive diagnostic that misses paraphrased refusals.
  • Implementation clarifications: The implementation uses heuristic H0-component recovery and empirically validated direction polarity rather than exact symbolic component tracking or a theoretically unique weighting scheme.The reported weighting uses wi ∝πici∆i, combining persistence, mismatch, and separation.
  • Robustness evidence: 0.00752–0.01271: five robustness runs produced positive ∆ρ values, with mean ∆ρ ≈0.00922 and sample standard deviation s ≈0.00218.The 95% t-confidence interval for the mean was approximately [0.00652, 0.01192], under exchangeability and approximately symmetric-error assumptions.
Loading 2609.00597v1…