Mind Control of LLMs via Closed-Loop Stimulation: Out-of-Distribution Robustness

Kasra Fallah^1,* Rudramani Singha^2,* Hannah Ghanei³ Paul Sajda⁴ James Anderson¹ Erfan Zabeh^5,†

¹ Electrical Engineering, Columbia University · ² Peter O’Donnell Jr. Brain Institute, UT Southwestern Medical Center

³ Computer Science and Electronic Engineering, University of Surrey · ⁴ Biomedical Engineering, Columbia University

⁵ Center for Theoretical Neuroscience, Zuckerman Institute, Columbia University

* Equal contribution† Correspondence: ez2290@columbia.edu

Code BibTeX

Figure 1 from the paper: conceptual connection between closed-loop neurostimulation, robust language-model steering, and robust steerability. — Figure 1. Borrowing from closed-loop neurostimulation, we steer LLMs with robust \(H_\infty\) feedback and derive a score characterizing steering reliability under distribution shift.

Abstract

Brains and large language models need not be considered equivalent systems to reveal an interpretable commonality: both exhibit high-dimensional, nonlinear dynamics whose behavior can only be modeled imperfectly. This creates a shared challenge whenever we seek to intervene in their dynamics. A controller may either rely on a model identified around a particular operating regime and risk failure as the system moves away from that regime, or explicitly account for uncertainty and a changing internal state. Neurostimulation has confronted an analogous problem for decades. The limitations of fixed, open-loop stimulation have motivated closed-loop and state-dependent approaches that condition intervention on the ongoing state of the neural system. Inspired by this principle, we formulate LLM steering as a feedback-control problem in which the network’s internal state, rather than a fixed intervention alone, determines how the system is perturbed.

We further account for the inevitable mismatch between tractable dynamical models and the nonlinear transformer they approximate by adopting a robust control approach. As one principled realization of this framework, we develop an \(H_\infty\)-based steering controller that explicitly limits sensitivity to disturbances and linearization mismatches. Across multiple steering benchmarks, the resulting controller improves performance over existing steering baselines, with particularly pronounced gains under out-of-distribution conditions and varying length complexities—regimes in which the assumptions underlying locally identified dynamics are increasingly challenged. Beyond controller performance, we introduce robust steerability, \(S_{\mathrm{rob}}\), a pre-deployment measure of tolerance to dynamics mismatch; across model–task pairs, it exhibits task-specific structure and varies systematically with model scale. Beyond robust LLM steering, our measure asks not merely whether control is possible, but how much uncertainty it can survive—a principle that may span artificial and biological neural systems.

An Example of Multilingual Grade-School Mathematics

A successful perturbation is not the same as reliable control.

First, the effect of stimulation depends on the state in which it is delivered: across invasive and non-invasive paradigms, state alters the magnitude, direction and behavioral consequence of otherwise identical stimulation.
At deployment, shifts in prompt, context, or activation trajectory alter the network’s local Jacobians and therefore how the same intervention propagates. Distribution shift thus changes not only the state being controlled but also the dynamics of control itself.
Language models and biological circuits are not equivalent systems, but both are high-dimensional, nonlinear and imperfectly modeled, and intervention in both inherits the same reliability problem.

Can a language model’s internal dynamics tell us, before deployment, whether a representation will remain reliably steerable as those dynamics change?

Method schematic comparing open-loop and state-dependent closed-loop neurostimulation, alongside closed-loop steering of a language model. — Figure 2. Closed-loop stimulation enables controlled modulation of the system’s behavioral dynamics.

Robust activation steering

We treat transformer depth as a finite control horizon, hidden representations as states, and activation interventions as control inputs. Given a target behavior, desired and undesired calibration activations define reduced behavior coordinates. Projected Jacobians estimate local dynamics, while empirical residuals identify the directions and scales of model mismatch:

\[\xkp = \Ak\xk + \Bk\uk + \Dk\wk.\]

Here, \(\Ak\) describes nominal layer dynamics, \(\Bk\uk\) the activation intervention, and \(\Dk\wk\) the structured mismatch. Rather than assuming that mismatch is negligible or isotropic, we design the controller against its amplification through the network.

For a candidate attenuation \(\gamma\), robust feedback solves a finite-horizon dynamic game subject to the local dynamics above:

\[\min_{\pi}\max_{w_{1:L}}\;x_{L+1}^{\top}Q_f x_{L+1}+\sum_{k=1}^{L}\left(\lVert\zk\rVert_2^2-\gamma^2\lVert\wk\rVert_2^2\right).\]

The controller minimizes steering error and intervention cost; the adversary acts through the empirical mismatch channels. The regulated output \(\zk\) combines target-tracking error, intervention effort, and optional off-target representation change. A backward \(H_\infty\) recursion and attenuation search produce the layer-wise policy \(\uk=-\steervar{K_k^\star}\xk.\)

Feedback makes the intervention depend on the current activation state; robustness accounts for the fact that the local model is imperfect. Model weights remain unchanged, and dynamics estimation and controller synthesis are performed offline.

Read the methodology in the paper

Benchmark results

We ask whether feedback controllers identified at calibration time remain effective when the deployment distribution changes.

Prompt-language shift (TruthfulQA)

Across all four model families, \(\mathrm{H}_{\infty}\) attains the highest T×I under both ID and OOD evaluation.

TruthfulQA truthfulness–informativeness frontiers for English and Spanish input, with GPT-2 XL category-level comparisons. — Figure 4. TruthfulQA under prompt-language shift. Left: truthfulness–informativeness frontiers for matched English (ID) and Spanish-input, English-output transfer (OOD). Right: category-level GPT-2 XL performance for the original model, strongest competitor, and \(\mathrm{H}_{\infty}\).

Overall performance

T×I ↑ · Table 1(a)

Model	English (ID)		Spanish (OOD)
Model	Baseline	\(H_\infty\)	Baseline	\(H_\infty\)
GPT-2 XL	34.91 ± 2.58	35.18 ± 0.43	9.93 ± 0.95	18.14 ± 1.31
Llama-3-8B	57.81 ± 0.29	61.42 ± 1.15	52.81 ± 0.69	55.29 ± 0.35
Qwen-2.5-14B	69.66 ± 0.62	76.27 ± 0.42	80.40 ± 0.52	82.57 ± 0.50
OLMo-2-32B	81.74 ± 0.65	86.31 ± 0.42	82.70 ± 1.14	91.50 ± 1.07

Adversarial prompt shift (HarmBench)

Across the three models and six prompt conditions, \(\mathrm{H}_{\infty}\) has lower ASR than both the unsteered model and A-LQR (the strongest competing method) in all 18 model–condition comparisons.

HarmBench attack success rates, safe-concept relevance, and response-type comparisons. — Figure 5. Robust refusal under adversarial prompting. Left: ASR across direct requests and five frozen jailbreak templates for three Llama scales. Center: mean ASR versus safe-concept relevance. Right: response-type decomposition. Lower ASR is better.

Overall performance

Attack success (%) ↓ · Table 1(b)

Model	Direct (ID)		Jailbreak (OOD)
Model	Baseline	\(H_\infty\)	Baseline	\(H_\infty\)
Llama-3.2-1B	9.58 ± 1.76	2.92 ± 1.40	5.50 ± 0.25	0.92 ± 0.26
Llama-3.2-3B	16.67 ± 2.48	8.33 ± 1.86	11.59 ± 1.32	3.67 ± 0.43
Llama-3.1-8B	15.83 ± 4.02	3.33 ± 1.84	10.83 ± 1.99	0.50 ± 0.36

Multilingual input shift (MGSM)

At the individual language level, \(\mathrm{H}_{\infty}\) exceeds A-LQR accuracy in 13 of 15 model–language pairs.

MGSM capability loss versus response quality and accuracy retained across transfer languages. — Figure 6. Cross-lingual transfer on MGSM. Left: capability loss relative to the unsteered model versus response quality. Right: accuracy retained relative to the original model across transfer languages. Controllers are calibrated in English and frozen before multilingual evaluation.

Overall performance

Accuracy (%) / Spanish relevance · Table 1(c)

Model	Accuracy (%)			Spanish relevance
Model	Original	A-LQR	\(H_\infty\)	A-LQR	\(H_\infty\)
Qwen-3-4B	41.6 ± 2.5	22.4 ± 2.3	32.2 ± 2.4	1.81 ± 0.02	1.44 ± 0.03
Phi-4-mini	45.4 ± 2.6	0.0 ± 0.0	35.2 ± 2.6	1.09 ± 0.04	1.21 ± 0.04
Granite-3.3-2B	22.2 ± 2.0	18.8 ± 2.0	21.2 ± 1.9	0.04 ± 0.02	0.00 ± 0.00

Context-length shift (L-CiteEval)

Controllers are calibrated at 8K context and evaluated at both 8K and 16K using matched question identities.

L-CiteEval context-length transfer and local-model residual growth. — Figure 7. Context-length transfer and residual growth. A: answer recall and citation F1 at matched 8K and shifted 16K context for Qwen2.5-3B. B: growth of local-model residuals with prediction horizon in language-model representations and an illustrative nonlinear biological network.

Overall performance

Answer recall (%) ↑ · Table 1(d)

Model	8K (ID)		16K (OOD)
Model	Baseline	\(H_\infty\)	Baseline	\(H_\infty\)
Qwen-2.5-3B	72.1 ± 9.3	66.4 ± 7.9	65.2 ± 7.6	65.2 ± 8.6
Llama-3.2-1B	59.8 ± 9.3	61.7 ± 7.8	50.1 ± 8.0	47.9 ± 7.8

Baseline denotes the strongest non-\(H_\infty\) result. Full results are available in the paper.

Robust steerability

Intuitively, it characterizes how much deviation from the identified dynamics can be tolerated before the same model is no longer sufficient for reliable intervention.

\[\Srob = \frac{1}{\gammastar}, \qquad \gammastar = \inf_{\steervar{K}} \lVert T_{w\to z}(\steervar{K})\rVert_\infty.\]

A larger \(\Srob\) therefore corresponds to a regime in which steering is less sensitive to modeling error and uncertainty.

Robust steerability across model–task pairs and its relationship with model scale within tasks. — Figure 8. Robust steerability across models and tasks. \(S_{\mathrm{rob}}\) exhibits task-dependent structure across model–benchmark pairs, while within a fixed task it also varies systematically with model scale.

Citation

@unpublished{fallah2026mindcontrol,
  title = {Mind Control of {LLMs} via Closed-Loop Stimulation:
           Out-of-Distribution Robustness},
  author = {Fallah, Kasra and Singha, Rudramani and Ghanei, Hannah
            and Sajda, Paul and Anderson, James and Zabeh, Erfan},
  year = {2026},
  note = {Manuscript}
}