Paper deep dive
Activation Steering with a Feedback Controller
Dung V. Nguyen, Hieu M. Vu, Nhi Y. Pham, Lei Zhang, Tan M. Nguyen
Models: LLaMA3.1-8B, Qwen2.5-14B
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%
Last extracted: 3/12/2026, 5:24:18 PM
Summary
The paper introduces 'PID Steering', a control-theoretic framework for activation steering in Large Language Models (LLMs). It demonstrates that existing steering methods (like ActAdd and Mean-AcT) function as proportional (P) controllers, which inherently suffer from steady-state errors. By incorporating integral (I) and derivative (D) terms, PID Steering improves behavioral control, reduces steady-state error, and mitigates overshoot, providing a more robust and interpretable mechanism for model alignment.
Entities (5)
Relation Signals (3)
PID Steering → utilizes → PID Controller
confidence 100% · we propose Proportional-Integral-Derivative (PID) Steering, a principled framework that leverages the full PID controller
PID Steering → improves → Activation Steering
confidence 95% · PID Steering consistently outperforms existing approaches, achieving more robust and reliable behavioral control.
Activation Steering → implements → P Controller
confidence 90% · we develop a control-theoretic foundation for activation steering by showing that popular steering methods correspond to the proportional (P) controllers
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Controlling the behaviors of large language models (LLM) is fundamental to their safety alignment and reliable deployment. However, existing steering methods are primarily driven by empirical insights and lack theoretical performance guarantees. In this work, we develop a control-theoretic foundation for activation steering by showing that popular steering methods correspond to the proportional (P) controllers, with the steering vector serving as the feedback signal. Building on this finding, we propose Proportional-Integral-Derivative (PID) Steering, a principled framework that leverages the full PID controller for activation steering in LLMs. The proportional (P) term aligns activations with target semantic directions, the integral (I) term accumulates errors to enforce persistent corrections across layers, and the derivative (D) term mitigates overshoot by counteracting rapid activation changes. This closed-loop design yields interpretable error dynamics and connects activation steering to classical stability guarantees in control theory. Moreover, PID Steering is lightweight, modular, and readily integrates with state-of-the-art steering methods. Extensive experiments across multiple LLM families and benchmarks demonstrate that PID Steering consistently outperforms existing approaches, achieving more robust and reliable behavioral control.
Tags
Links
- Source: https://arxiv.org/abs/2510.04309
- Canonical: https://arxiv.org/abs/2510.04309
Trouble viewing inline? Open PDF directly →
Full Text
87,597 characters extracted from source content.
Expand or collapse full text
Preprint. ACTIVATION STEERING WITH A FEEDBACK CONTROLLER Dung V. Nguyen 1∗ Hieu M. Vu 3∗ Nhi Y. Pham 2∗ Lei Zhang 1† Tan M. Nguyen 1† 1 Department of Mathematics, National University of Singapore 2 VinUniversity 3 Independent dungnv@u.nus.edu, nhiiyennphamm@gmail.com, vmhieu17@gmail.com, matzhlei,tanmn@nus.edu.sg ABSTRACT Controlling the behaviors of large language models (LLM) is fundamental to their safety alignment and reliable deployment. However, existing steering methods are primarily driven by empirical insights and lack theoretical performance guarantees. In this work, we develop a control-theoretic foundation for activation steering by showing that popular steering methods correspond to the proportional (P) controllers, with the steering vector serving as the feedback signal. Building on this finding, we propose Proportional-Integral-Derivative (PID) Steering, a principled framework that leverages the full PID controller for activation steering in LLMs. The proportional (P) term aligns activations with target semantic directions, the integral (I) term accumulates errors to enforce persistent corrections across layers, and the derivative (D) term mitigates overshoot by counteracting rapid activation changes. This closed-loop design yields interpretable error dynamics and connects activation steering to classical stability guarantees in control theory. Moreover, PID Steering is lightweight, modular, and readily integrates with state-of-the-art steering methods. Extensive experiments across multiple LLM families and benchmarks demonstrate that PID Steering consistently outperforms existing approaches, achieving more robust and reliable behavioral control. 1INTRODUCTION Figure 1: Our paper connects LLM Behavior Con- trol, Feature Attribution for LLM and Control Theory. Specifically, we apply a PID-Controller to compute the steering vector for activation steering. Figure 2: PID Steering: To compute the steering vec- toru(k): a PID controller is applied at every layer f (k) (·), using the diff-in-means between 2 contrastive data x sp (k) and x(k) as the error signal e(k). Large language models (LLMs) have demonstrated remarkable capabilities across diverse domains, yet ensuring that their outputs align with desired behaviors remains a central challenge (Dang et al., 2025; Sclar et al., 2023; Kotha et al., 2023; Luo et al., 2025; Houlsby et al., 2019). Common post-training approaches (Wei et al., 2021; Ouyang et al., 2022) have proven effective for improving alignment. However, these techniques demand substantial computational resources (Houlsby et al., 2019) ∗ Co-first authors. † Co-last authors. Correspondence to: dungnv@u.nus.edu & tanmn@nus.edu.sg 1 arXiv:2510.04309v1 [cs.LG] 5 Oct 2025 Preprint. and require weight updates with new training data, which can unintentionally degrade fluency or performance on unrelated tasks (Templeton et al., 2024; Kotha et al., 2023; Luo et al., 2025). An increasingly popular alternative is activation steering, which modifies a model’s internal activations directly at inference time, avoiding costly retraining (Vu & Nguyen, 2025; Li et al., 2024; Turner et al., 2023; 2024; Lee et al., 2024; Rimsky et al., 2024; Rodriguez et al., 2025). This approach has been employed both to probe internal representations (Geiger et al., 2024; von R ̈ utte et al., 2024; Vu & Nguyen, 2025) and to enable fine-grained behavioral control (Vu & Nguyen, 2025; Rodriguez et al., 2025; Turner et al., 2024; Zou et al., 2023a; Rimsky et al., 2024; Li et al., 2024). Recent work demonstrates that steering along carefully chosen low-dimensional directions can effectively alter model behavior (Turner et al., 2024; Rimsky et al., 2024; Arditi et al., 2024; Zou et al., 2023a; Vu & Nguyen, 2025), highlighting its potential as a lightweight yet powerful alignment strategy. Steering through the Lens of Dynamical Systems. Recent methods leverage the geometric structure of the activation space (Marks & Tegmark, 2024; Park et al., 2024) using linear algebraic techniques (Turner et al., 2024; Zou et al., 2023a; Rimsky et al., 2024; Arditi et al., 2024; Vu & Nguyen, 2025) to compute the steering vectors. While effective, these works oversimplify the complex, dynamic behavior arising from the auto-regressive nature of LLMs. When viewed through this dynamical lens, activation steering can be interpreted as guiding the model’s trajectory through activation space, from a region encoding one concept to another, analogous to steering a dynamical system from one state to a desired target state. Contribution. Building on the aforementioned dynamical system insight, our work departs from the prevailing algebraic framing and instead adopts a control-theoretic perspective on activation steering. Although recent studies (Soatto et al., 2023; Kong et al., 2024; Luo et al., 2023) have begun exploring this direction, their focus has primarily remained at the level of the token-level generation proceses, treating high-level behaviors as control signals. In contrast, we take into account the internal mechanisms of LLMs by modeling the layer-wise construction of feature directions (Bricken et al., 2023; Park et al., 2024) as a dynamical system. These feature directions are then used as steering vectors (Turner et al., 2024; Zou et al., 2023a; Rimsky et al., 2024; Arditi et al., 2024; Vu & Nguyen, 2025). Specifically, we show that existing steering methods relying on difference-of-means feature directions (Rimsky et al., 2024), including Activation Addition (ActAdd) (Turner et al., 2024), Directional Ablation (Arditi et al., 2024), and Mean Activation Transport (Mean-AcT) (Rodriguez et al., 2025), can be interpreted as instances of a proportional (P) controller, thus suffering from the steady-state error due to the disturbance to the state of the system ( ̊ Astr ̈ om & H ̈ agglund, 1995b). This new perspective enables the application of principled control-theoretic strategies for extracting effective feature directions and computing steering vectors, thereby offering stronger robustness and performance guarantees for activation steering methods. An overview of our approach is shown in Fig. 1 and 2. In this paper, we use the terms feature direction and steering vector interchangeably, noting that steering vectors represent a practical application of feature directions in activation steering. Our contribution is three-fold: 1.Control-Theoretic Formulation for Feature Direction: We develop a new control-theoretic framework for constructing feature directions/steering vectors along the layers of an LLM. 2.PID-Based Steering: We propose the novel Proportional-Integral-Derivative (PID) Steering, a control-theoretic framework for computing feature directions using a PID controller to reduce the steady-state error inherent in existing activation steering methods (see Fig. 2). 3.Unified Theoretical Framework: We demonstrate that common activation steering methods correspond to proportional (P) controllers. This connection enables a theoretical analysis that highlights PID Steering’s advantages in reducing steady-state error and oscillations We comprehensively validate our PID Steering across diverse modalities (text and image), downstream applications (toxicity mitigation, jailbreaking attack, and image style control), steering paradigms (ActAdd, Mean-AcT, and Angular Steering (Vu & Nguyen, 2025)), model families (Qwen2.5 (Yang et al., 2024), Gemma2 (Gemma Team et al., 2024), Llama3 (Llama Team, 2024), SDXL-Lightning (Lin et al., 2024), and Flux (Labs, 2024)), and model scales (3B-14B for language models and 3.5B-12B for diffusion models). Organization. We organize the paper as follows: Section 2 reviews background; Section 3 links activation steering to P control and introduces PID Steering; Section 4 presents its theoretical analysis; Section 5 provides empirical validation; Appendix A discusses related work; and Section 6 concludes. Proofs, derivations, and additional experiments are in the Appendix. 2 Preprint. 2BACKGROUND 2.1TRANSFORMERS Decoder-only transformers take an input token sequenceq = [q 1 ,...,q n ]and map it to initial embeddings x(1) = [x 1 (1),...,x n (1)] ⊤ = Embed(q).The embeddings are then propagated throughKlayers. At each layer k, the residual activationx i (k) for token p i is updated by self-attention and an MLP block, with normalization applied before (and sometimes after) these modules: x i,post-attn (k) =x i (k)+SelfAttn (k) (Norm(x i (k))) x i (k +1) =x i,post-attn (k)+MLP (k) (Norm(x i,post-attn (k))). In this paper, for notational brevity, we summarize the layered processing above asx i (k + 1) = f (k) i (x(k)),i = 1,...,n, wheref (k) i encapsulates both the Self-Attention mechanism and Multi-Layer Perceptron at layerk. Finally, the output activations from the last layer,x i (L+1), are decoded over the model’s vocabulary to get the next token y i = Decode(x i (L+1)) for subsequent generation. 2.2ACTIVATION STEERING Features such as behaviors or concepts are hypothesized to align with (approximately) orthogonal directions in activation space (Park et al., 2024; Bereska & Gavves, 2024; Elhage et al., 2022). Activation steering leverages this by modifying hidden states at inference to amplify or suppress specific features (Bayat et al., 2025; Konen et al., 2024; Li et al., 2024; Marks et al., 2025; Templeton et al., 2024). Recent approaches operationalize this idea by constructing feature directions, which act as steering vectorsrfor adjusting hidden states. These steering vectors are computed as layerwise differences in mean activations between datasets with contrasting concepts (e.g., harmful vs. harmless), a difference-in-means approach (Rimsky et al., 2024), shown to effectively isolate salient feature directions (Turner et al., 2023; 2024; Arditi et al., 2024). 2.2.1APPLYING THE STEERING VECTORS Two popular activation steering approaches that use steering vectors are: Activation Addition (Turner et al., 2024), and Directional Ablation (Arditi et al., 2024). Both methods modify the token activation x(k)using the steering vectorr(k)at layerksuch that the activation expresses the target concept or behavior. By settingx(1,q) = Embed(q)andr(1) = 0, these methods apply the steering vectors r(k) to the activationx(k), k = [K], at each layer via a steering function ρ steer as follows: x(k−1,q) =ρ steer (x(k−1,q),r(k−1)),forq∈D source (1) x(k,q) =f (k) (x(k−1,q)),forq∈D source ∪D target .(2) We discuss here the details on how to design the steering function ρ steer for each method. Activation Addition (ActAdd). ActAdd and setsρ steer (x(k),r(k)) = x(k) + αr(k), where the coefficient α controls the strength of the effect. Directional Ablation (DirAblate). DirAblate removes the feature by projecting the token activation onto the orthogonal complement, ρ steer (x(k),r(k)) =x(k)−r(k)r(k) ⊤ x(k). 2.2.2COMPUTING THE STEERING VECTORS Non-sequential Mapping. Let us use the jailbreaking task as an example. In this task, we apply activation steering to force the LLM to respond to harmful prompts (Vu & Nguyen, 2025; Arditi et al., 2024). In order to compute the steering vectors, i.e., refusal direction, for each layerk∈ [K]and post-instruction token positioni∈I, we calculate the mean activationμ i,target (k)for harmless prompts fromD (train) target andμ i,source (k) for harmful prompts fromD (train) source : μ i,target (k) = 1 |D (train) target | X q∈D (train) target x i (k,q), μ i,source (k) = 1 |D (train) source | X q∈D (train) source x i (k,q).(3) We then compute the difference-in-means vectors,r i (k) =μ i,target (k)−μ i,source (k), and use them as steering vectors. Optionally, among the difference-in-means vectorr i (k)for each post-instruction token positioni∈Iat layerk, we can select the single most effective vectorr(k) = Select(r i (k) i∈I ) from this set by evaluating each candidate vector over validation setsD (val) source andD (val) target . Sequential Mapping. A non-sequential mapping neglects the causal dependency across activations, where outputs from one layer are passed to the next, i.e.,x i (k +1) =f (k) i (x(k)) . Consequently, any 3 Preprint. intervention applied at one layer must be accounted for before introducing an intervention at the subse- quent layer. To capture this causal structure, Mean Activation Transport (Mean-AcT) in (Rodriguez et al., 2025) estimates the steering vectors incrementally at each layer as follows: x i (k−1,q) =ρ steer (x i (k−1,q),r(k−1)),forq∈D source (4) x i (k,q) =f (k) i (x(k−1,q)),forq∈D source ∪D target (5) μ target (k) = 1 |D (train) target | X i∈I,q∈D (train) target x i (k,q), μ source (k) = 1 |D (train) source | X i∈I,q∈D (train) source x i (k,q) r(k) =μ target (k)−μ source (k).(6) Like ActAdd, Mean-AcT sets ρ steer (x(k),r(k)) =x(k)+αr(k). 2.3PROPORTIONAL–INTEGRAL–DERIVATIVE CONTROLLER Proportional-Integral-Derivative (PID) control is a feedback mechanism extensively used in control systems (Minorsky, 1922). It is valued for its simplicity, robustness, and effectiveness in a broad range of applications, from industrial automation to robotics and aerospace systems (Visioli, 2006; Borase et al., 2021). The core idea behind PID control is to compute a control signal based on the error between a target reference signal and the actual output of a system. Specifically, consider a continuous-time dynamical system governed by a state space model ̇ x(t) =g(x(t),u(t),t),y(t) =h(x(t),u(t),t), (7) wherex(t) ∈ R d denotes the state variable,u(t) ∈ R m is the control variable, andy(t) ∈ R d ′ represents the measured output signal. Here,g : R d × R m → R d specifies the system dynamics, andh : R d ×R m → R d ′ is an output mapping. A PID controller applies the control variableu(t)to minimize the discrepancy between a target reference, or also known as the setpoint in the literature of PID control,y sp (t) and the actual outputy(t). This discrepancy, called control error, is defined as e(t) =y sp (t)−y(t).(8) In a PID controller, the control variableu(t)is composed of the proportional (P), integral (I), and derivative (D) terms and given by: u(t) =K p e(t)+K i Z t 0 e(τ )dτ +K d de(t) dt ,(9) whereK p ,K i ,K d ≥ 0are the proportional, integral, and derivation gains, respectively. In PID control design, the P, I, and D play different roles: Proportional term (P) outputs a correction proportional to the current errore t , but alone leaves a steady-state offset; Integral term (I) accumulates past errors to remove residual bias, ensuring offsets are corrected even as proportional effects fade; and Derivative term (D) responds to the error’s rate of change, damping rapid growth to improve stability and reduce overshoot. State-Feedback PID Controller. A special case of the PID controller is obtained by choosing the measured outputy(t)to be the state variablex(t)in Eqn. 7, yielding the following state-space model ̇ x(t) =g(x(t),u(t),t),y(t) =x(t). (10) The control error then becomes the state tracking error,e(t) = x sp (t)−x(t), and the system is controlled through feedback of the state ( ̊ Astr ̈ om & Murray, 2021). 3STEERING WITH A FEEDBACK CONTROLLER In this section, we will formulate popular activation steering methods, such as ActAdd, DirAblate, and Mean-AcT, as a state-feedback P controller. Based on this new interpretation, we propose PID Steering, a novel steering method that uses a PID controller. 3.1ACTIVATION STEERING AS A P CONTROLLER We consider the state-feedback PID controller given in Eqn. 10 and the continuous steering vector r(t)in which we replace the layer indexkby the time indext. Substituting the state tracking errore(t) by the difference-in-means vectorr(t)and using the P controller whose system dynamics is governed by g(x(t),u(t),t) =f (ρ steer (x(t),u(t)),t)−x(t), we obtain ̇ x(t) =f (ρ steer (x(t),K p r(t)),t)−x(t).(11) 4 Preprint. We discretize Eqn. 11 using Euler method (Euler, 1768; Hairer et al., 1993) to obtain x(k)−x(k−1) =f (k) (ρ steer (x(k−1),K p r(k−1)))−x(k−1), or equivalently, x(k) =f (k) (ρ steer (x(k−1),K p r(k−1))),(12) where f (k) (·) =f (·,k), a function depending on index k. Comparing Eqn. 12 with Eqn. 1 and 2 shows that applying the steering vectors as in Section 2.2.1 is equivalent to implementing the P controller, wheref (k) is thek-th layer in an LLM,u(t) =K p r(t) is the new steering vector. Thus, activation steering computes the expected state tracking error. r(t) = ̄ e(t) =E q sp ∈D (train) target [x sp (t,q sp )]−E q∈D (train) source [x(t,q)].(13) This expected state tracking error, i.e., the difference-in-means vectorr(t), can be computed non- sequentially or sequentially, as explained in Section 2.2.2. Whenr(t)is computed non-sequentially andρ steer (x(k),u(k)) =x(k)+αu(k)orx(k)−u(k)u(k) ⊤ x(k), we obtain ActAdd or DirAblate, respectively. Whenr(t)is computed sequentially andρ steer (x(k),u(k)) =x(k) +αu(k), we attain Mean-AcT. Limitations of P Controller. There is always a steady state error in P control. The error decreases with increasing gain, but the tendency towards oscillation also increases. Since activation steering methods, i.e., ActAdd, DirAblate, and Mean-Act, are P controllers, they share the same limitations. We informally state our theoretical guarantees that P-control activation steering methods cannot alleviate the steady state error in Proposition 1 below and provide detailed proofs in Appendix B.4. Proposition 1 (Steady-state error of P-control activation steering)P-control activation steering ensures input-to-state stability (ISS) for an appropriate range ofK p . However, there still exists a steady-state error due to the disturbancew(k)to the state of the system. In the best case, whenw(k) converges tow, under a mild condition, the expected error, i.e., the difference-in-means,r(k) = ̄ e(k) eventually converges to a steady state ̄ e s ∝w. Therefore, ̄ e s ̸= 0 ifw̸= 0. We further provide empirical evidence to validate Proposition 1 in Figure 3 below. To archive this, we apply Sequential P-control activation steering (P Steering) on a randomly intitialized model with 150 layers deep, and pretrained Qwen2.5-3B-Instruct. We use⟨ ̄e(0), ̄e(t)⟩ as metric since it is a scalar measure of the energy retained along ̄e(0). If this quantity fails to decay to zero, e.g., under noise, it indicates a persistent component of the initial error, i.e., an undesired dynamic (see Appendix B.6 for further explanation). It can be seen that, for both the randomly initialized and the pretrained models, the errors do not vanish completely. These results confirm that P-control activation steering ensures stability but admits a persistent steady-state error due to the disturbance. 050100150200250 −0.20 −0.10 0.00 0.10 0.20 0.30 0.40 0.50 0.60 P PI PID Extraction Points <e(0), e(k)> (a) Randomly Initialized LLama3 010203040506070 0 0.002 0.004 0.006 0.008 0.01 P PI PID Extraction Points <e(0), e(k)> (b) Pretrained Qwen2.5-3B-Instruct Figure 3: Scalar errors across time step of randomly initialized model after applying P, PI, and PID controller. 3.2PROPORTIONAL–INTEGRAL–DERIVATIVE (PID) STEERING 3.2.1OVERVIEW To overcome the steady-state error inherent in P-control activation steering, we extend the method by adding integral (I) and derivative (D) terms to the steering vectors. PID Steering thus (i) reacts immediately to errors via the P term for greater responsiveness, (i) removes steady-state offsets with the I term, ensuring convergence to the desired set point, and (i) anticipates error trends through the D term, improving stability and reducing overshoot. Together, these properties yield the following advantages: •Generalization. PID Steering extends P-control methods like ActAdd, DirAblate, and Mean-AcT by adding integral and derivative components. 5 Preprint. •Methodological Agnosticism. Our PID framework can be applied across different activation steering techniques, including ActAdd, DirAblate, and Mean-AcT. •Stability. We theoretical prove and empirical demonstrate that PID Steering reduces steady-state error and overshoot in P-controllers, improving existing steering methods. •Interpretability. Derived from classical feedback control (Minorsky, 1922), the framework inherits the simplicity and interpretability that underpin the wide use of PID controllers. 3.2.2COMPUTING THE STEERING DIRECTION USING A PID FEEDBACK CONTROLLER Following Section 3.1, we consider the state-feedback PID controller in Eqn. 10, replacing the state tracking errore(t)with the difference-in-means vectorr(t). With the PID controller governed by the system dynamics g(x(t),u(t),t) =f (ρ steer (x(t),u(t)),t)−x(t), we obtain ̇ x(t) =f (ρ steer (x(t),K p r(t)+K i Z t 0 r(τ )dτ +K d dr(t) dt ),t)−x(t).(14) Eqn. 14 defines the continuous-time model of PID Steering, whose steering vector is given by: u(t) =K p r(t)+K i Z t 0 r(τ )dτ +K d dr(t) dt .(15) In order to obtain the discrete-time formulation of PID Steering, we first discretize the sytem dynamics ̇ x(t) =f (ρ steer (x(t),u(t)),t)−x(t)using Euler method (Euler, 1768; Hairer et al., 1993), same as in Section 3.1, and attain x(k) =f (k) (ρ steer (x(k−1),u(k−1))),(16) Next, we discretizeu(t) given in Eqn. 15 to obtainu(k) using Lemma 1 below. Lemma 1 (Discretizing PID steering vector)Consider the continuous PID steering vector defined in Eqn. 15. The discrete-time PID steering vector is given by: u(k) =K p r(k)+K i k−1 X j=0 r(j)+K d (r(k)−r(k−1)).(17) Proof of Lemma 1 is in Appendix B.1. With Eqn. 16 and Lemma 1, we now define PID Steering. Definition 1 (PID Steering)Given a large language model whose layers are f (k) K k=1 and a steering function ρ steer , PID Steering constructs the steering vectors as follows: u(k) =K p r(k)+K i k−1 X j=0 r(j)+K d (r(k)−r(k−1)),(18) where for non-sequential mapping, r(k) =E q sp ∈D (train) target [x sp (k,q sp )]−E q∈D (train) source [x(k,q)], and for sequential mapping, ̃ x(k) =f (k) ρ steer x(k−1),u(k−1) , r(k) =E q sp ∈D (train) target [x sp (k,q sp )]−E q∈D (train) source [ ̃ x(k,q)]. 4THEORETICAL ANALYSIS OF PID STEERING This section provides theoretical evidence for our claims: (i) adding integral action (PI) reduces steady-state error that remains under pure P-control (Proposition 3); and (i) adding a derivative term (PID) preserves bias removal while mitigating oscillations/overshoot (Proposition 1 and 2). We denote K p :=K p I ,K i :=K i I , andK d :=K d I . Detailed proofs are provided in Appendix B. 4.1DYNAMICS OF THE AVERAGE ERROR ACROSS LAYERS To formalize the problem, we considerNpairs of prompts/input tokens from two contrastive datasets, e.g. harmful and harmless,(q + i ,q − i ) N i=1 with corresponding activationsx ± i (k)∈ R d at layerk. A steering inputu(k) perturbs the undesired branch: x − i (k +1) = f (k) i x − i (k)+u(k) .(19) Let ̄ e(k) := 1 N P N i=1 (x + i (k)−x − i (k)) , the error dynamics of activation steering is then given by Proposition 2 below. 6 Preprint. Proposition 2 (Error dynamics of activation steering)The error dynamics ̄ e(k) in activation steering is of the form: ̄ e(k +1) = ̄ A(k) ̄ e(k)− ̄ A(k)u(k)+w(k),(20) where ̄ A(k) is the mean local Jacobian off (k) i atx + i (k)and the disturbance termw(k)collects heterogeneity. See Appendix B.3 for detailed proof and explanations of the terms. Our control objective is to drive ̄ e(k)to zero with input-to-state stability (ISS) for disturbed discrete system Eqn. 20 (Jiang et al., 1999). 4.2STABILITY OF THE ERROR DYNAMICS: ROLES AND CAVEATS OF PI AND PID CONTROL In the following stability analysis, we consider the orthogonal decomposition for the disturbance w(k) =w ∥ (k)+w ⊥ (k), wherew ∥ (k)∈ Im ̄ A(k) andw ⊥ (k)∈ (Im ̄ A(k)) ⊥ . 4.2.1PI CONTROL The following proposition provides a theoretical guarantee of PI Steering’s steady-state error reduction. Proposition 3 (Stabilizing the PI loop reduces steady-state error)LetM p (k) = ̄ A(k)(I−K p ), and denote∥K i ∥ =:h. Assumesup k ∥ ̄ A(k)∥≤M <∞andsup k ∥M p (k)∥≤q < 1. Ifq +Mh< 1, then the PI closed-loop control is ISS. Furthermore, the integral part exactly cancels the matched disturbance componentw ∥ . The remaining error is due only to the unmatched componentw ⊥ , which cannot be compensated. Full proof and term explanations provided in Appendix B.5 Limitations of PI control. Overshoot is common under PI: the closed loop oscillates about the setpoint before settling ( ̊ Astr ̈ om & H ̈ agglund, 1995a, Ch. 3, §3.3, p. 68-69), and large overshoot can arise with a high integral gainK i . In our steering setting, we explain this by scalarizing the dynamics along a reference direction . The scalarized integral state accumulates past error, pushing the trajectory beyond the setpoint; when the scalarized error changes sign, the integral discharges and the error subsequently approaches zero. See Fig. 6 for an illustration and Appendix B.6 for the formal derivation. 4.2.2PID CONTROL The derivative action counteracts PI-induced oscillations near the setpoint by responding to decreases in the scalarized error, while preserving the integral term’s bias-removal role, as shown in Theorems 1 and 2. For detailed proofs and explanations, see Appendix B.7. Theorem 1 (Stabilizing the PID loop preserves bias removal)LetM p (k) = ̄ A(k)(I−K p ), and denote∥K i ∥ =: h,∥K d ∥ =: ℓ. Assumesup k ∥ ̄ A(k)∥≤ M <∞andsup k ∥M p (k)∥≤ q < 1. If q +Mh < 1(stable PI loop), then there existsℓ > 0such that the PID closed-loop control is ISS. Therefore, the integral part in PID design still cancels the matched disturbance componentw ∥ . Theorem 2 (PID reduces the first-overshoot amplitude)Let the first overshoot occur at indexk 0 with amplitudeA 0 (definition in Eqn. 53). Then, the first-overshoot amplitude under PID Steering, A PID 0 , satisfies A PID 0 ≤A PI 0 , where A PI 0 denotes the corresponding amplitude under PI Steering. To support the theory, we present empirical evidence in Fig. 3. PI and PID controllers clearly improve over P-only control: PI removes steady-state error but causes large overshoot, while adding the derivative term mitigates overshoot and enables faster, cleaner convergence to zero. 5CONTROLLING THE STEERING EFFECT In this section, we demonstrate the applicability and effectiveness of PID-Steering by using it as a drop-in replacement for the steering vector computation step across multiple steering frameworks. 5.1TOXICITY MITIGATION We evaluate the effectiveness of PID Steering for toxic language mitigation in comparison to sequential steering methods, specifically Linear-AcT and Mean-AcT (Rodriguez et al., 2025), by closely following their experimental setup. We apply PID-Steering into Mean-AcT and call it PID-AcT. Experimental Setup.Our evaluation is conducted on Gemma2-2B (Gemma Team et al., 2024) and Llama3-8B (Llama Team, 2024), using 1,000 randomly sampled prompts from the 7 Preprint. RealToxicityPrompts dataset (Gehman et al., 2020). Toxicity is quantified with a ROBERTA-based clas- sifier (Logacheva et al., 2022), following the methodology of Suau et al. (2024). We also assess toxicity in a zero-shot setting by employing Llama3-8B-Instruct as an LLM-as-a-judge (Zheng et al., 2023). To measure general utility of the intervened models, we report: (i) perplexity (PPL) on a fixed set of 20k Wikipedia sentences, (i) PPL of model-generated outputs evaluated with Mistral-7B (Jiang et al., 2023), and (i) 5-shot MMLU (Hendrycks et al., 2021) accuracy. Table 1: Toxicity mitigation results for Gemma-2B and Llama-8B, averaged over 10 runs. Lower is better for toxicity and perplexity; higher is better for MMLU. Best and second-best exclude the Original baseline. Seq.CLS Tox. (%)↓0-shot Tox. (%)↓PPL Wikipedia↓PPL Mistral-7B↓MMLU↑ Original–4.13±0.4312.85±0.9414.40±0.206.05±0.5153.03±0.60 Mean-Act1.12±0.235.20±0.4214.53±0.216.81±0.1951.74±0.55 Linear-Act0.95±0.365.37±0.8014.75±0.227.24±0.2451.63±0.50 Mean-Act✓0.68±0.213.23±0.4414.92±0.256.97±0.7451.80±0.55 Linear-Act✓1.00±0.274.13±0.8914.98±0.227.13±0.7051.47±0.50 PID-Act✓0.51±0.212.90±0.5515.22±0.247.02±0.6551.30±0.52 Original–5.30±0.3515.24±0.409.17±0.185.18±0.2065.33±0.42 Mean-Act1.78±0.336.56±0.549.36±0.285.45±0.3464.35±0.39 Linear-Act1.87±0.396.55±0.219.35±0.175.56±0.3364.55±0.33 Mean-Act✓1.21±0.415.09±0.649.83±0.215.71±0.3364.22±0.40 Linear-Act✓1.68±0.486.47±0.389.48±0.195.46±0.4464.49±0.38 PID-Act✓0.72±0.494.36±0.819.56±0.206.08±0.3764.50±0.36 Gemma2-2B Llama3-8B Results. PID-AcT cuts toxicity by up to 8×while preserving utility. As shown in Table 1, it lowers scores by 8.1×on Gemma2-2B and 7.3×on LLaMA3-8B, consistently outperforming Mean-AcT and Linear-AcT. It achieves the lowest toxicity under both classifier and LLM-judge evaluations, while maintaining utility: MMLU drops≤1% and perplexity rises only modestly (≤6%). Unlike sequential methods that plateau, PID’s integral-derivative dynamics deliver stronger, more stable mitigation without harming performance. 5.2JAILBREAKING LARGE LANGUAGE MODELS We evaluate our method on ActAdd within the Angular Steering framework (Vu & Nguyen, 2025) on the jailbreaking task, which seeks to override a model’s refusal behavior and elicit harmful outputs. Experimental Setup. Following (Vu & Nguyen, 2025), we replace DIM with our method and baselines RePE (Zou et al., 2023a) and ITI (Li et al., 2024). Refusal directions are built from 80% of ADVBENCH (Zou et al., 2023b) and 512 harmless ALPACA (Taori et al., 2023) samples, with the remaining 20% for evaluation. General LM ability is tested on TINYBENCHMARKS (Maia Polo et al., 2024). We evaluate across Gemma2, LLaMA3, and Qwen2.5 models (3B–14B). Results. PID Steering consistently outperforms DIM and scales robustly across models and metrics (see Tab. 2). On Qwen2.5-14B and LLaMA3.1-8B, PID achieves the largest ASR reductions of 92.7% and 94.9%, exceeding DIM by 1.5-2 points, while maintaining almost the same performance, with marginal cost, on TinyBenchmarks. Smaller models also see consistent gains: +2.0 ASR on Qwen2.5-3B and +1.3 on LLaMA3.2-3B. In contrast, ITI and RePE fail to scale, collapsing on larger models with ASR values of 33.7 and 25.4, respectively, on Qwen2.5-14B. A full version of Table 2 which also studies Qwen2.5-7B and Llama3.2-3B is provided in Appendix C.2. 5.3IMAGE GENERATION STYLES CONTROL We study activation steering in diffusion models using FLUX.1.Schnell’s denoising transformer (Labs, 2024), built on T5-XXL encoders (Raffel et al., 2020) and requiring just 4 diffusion steps. Experimental Setup. Following (Rodriguez et al., 2025), we intervene on all normalization layers after most residual blocks in FLUX. Style/concept expression is measured by a CLIP zero-shot classifier with two labels (A picture of a style/concept’vs.A picture of something’), and content preservation by CLIPScore (Hessel et al., 2021). Training uses 2,048 COCO Captions (Chen et al., 2015) prompts augmented with cyberpunk/steampunk modifiers from LLaMA-8B-Instruct (source = unmodifiedp, target = modifiedq). Evaluation samples 512 validation prompts to generate images across intervention strengths. 8 Preprint. Table 2: Comparison of Original, DIM, ITI, RePE, and PID across models on ASR and general benchmarks. Bold = best, underline = second-best within each model (ASR column). Refer to Tab. 3 for results on all tested models. MethodASR↑tinyArc↑tinyGSM8k strict↑tinyMMLU↑tinyTruthQA↑tinyHellaSwag↑tinyWinoGrande↑ Original–62.2917.6468.0356.4373.1870.65 DIM74.0361.9514.8066.1154.9572.4069.85 ITI70.1961.2815.5766.6254.7572.7170.12 RePE68.4461.0514.6065.7054.3072.0369.40 PID76.0761.2016.0167.2954.1072.5969.72 Original–73.9690.1274.6064.5082.7073.77 DIM90.3872.7487.0174.3063.0181.9472.93 ITI33.6573.1589.2774.5564.0382.24073.31 RePE25.4272.4086.2073.9063.2081.5272.60 PID 92.6572.1388.9674.5263.6082.6073.04 Original–65.3363.2162.0254.3982.5165.56 DIM93.2662.0160.5760.9654.1781.7364.81 ITI79.8064.2661.8561.3754.3382.0165.21 RePE70.4261.4060.0060.2053.7081.3564.45 PID94.8562.3061.9961.5454.2481.8764.93 Original–69.3183.1976.6055.0782.3172.34 DIM77.8868.2180.1472.2951.8681.4571.51 ITI35.5768.3281.4775.3353.1381.7071.82 RePE28.6467.5079.2071.1051.1081.2071.15 PID79.5067.9179.2474.8952.4981.5971.42 Qwen2.5-3BInstruct Qwen2.5-14BInstruct Llama3.1-8BInstruct Gemma2-9BInstruct 0.20.40.60.81.0 0.20.40.60.81.0 (a) Cyberpunk concept. 0.20.40.60.81.0 0.20.40.60.81.0 (b) Steampunk concept. Figure 4: Qualitative results of activation steering in FLUX-Schnell across two style concepts with the prompt ”Lady bent over with red polka dot umbrella inside a brick building.” 0.000.200.400.600.801.00 0.70 0.80 0.90 0.000.200.400.600.801.00 0.24 0.25 0.26 0-shot (→) (a) Cyberpunk concept 0.000.200.400.600.801.00 0.70 0.75 0.80 0.85 0.90 0.000.200.400.600.801.00 0.26 0.26 0.27 Mean-AcT PID-AcT 0-shot (→) (b) Steampunk concept Figure 5: 0-shot and CLIPScore results for ‘cyperpunk‘ and ‘steampunk‘ concept. Results. In Fig. 4, raising intervention strength from0to1yields a smooth progression of stylistic traits, e.g., neon hues for cyberpunk, mechanical textures for steampunk, while preserving core content. At moderate strengths, style is pronounced yet faithful, and even at high strengths semantic alignment largely holds. Quantitatively (Figs. 5), style expression measured by a zero-shot classifier increases monotonically, with PID-AcT surpassing Mean-AcT, especially at mid strengths (0.4-0.8). CLIPScore reveals the trade-off:Both Mean-AcT and PID-AcT exhibit a steady decline. While PID-AcT drops slightly more, the difference is marginal. 6CONCLUDING REMARKS We introduced PID Steering, a control-theoretic approach to activation steering that models layer-wise representations as a dynamical system. This framework unifies prior methods, offers robustness guarantees, and leverages PID dynamics for computing steering vectors. Across language and diffusion models, PID Steering achieves stronger and more stable performance than existing approaches in toxicity mitigation, jailbreak prevention, and style control, while preserving model utility. Our results highlight control theory as a principled foundation for developing reliable and generalizable steering methods. A limitation of our work is the use of “stability-first, one-gain-at-a-time” analytical strategy to find controller gains: it clarifies the role of each component but may miss optimal choices and can overlook broader feasible regions. To address this, numerical methods, for example, LMI-based computations, can be employed. We leave these for future work. 9 Preprint. Ethics Statement. Given the nature of the work, we do not foresee any negative societal and ethical impacts of our work. However, risks remain: by tightening activation-level control, PID Steering may inadvertently ease the generation of nuanced harmful content (e.g., persuasive misinformation or biased narratives). Although it does not expand the baseline risk profile of LLMs, robust safeguards, transparency, accountability, and ongoing ethical review are required for responsible use. Reproducibility Statement. Source codes for our experiments are provided in the supplementary materials of the paper. The details of our experimental settings and computational infrastructure are given in Section 5 and the Appendix. All datasets that we used in the paper are published, and they are easy to access in the Internet. LLM Usage Declaration. We use large language models (LLMs) for grammar checking and correction. REFERENCES Andy Arditi, Oscar Balcells Obeso, Aaquib Syed, Daniel Paleka, Nina Rimsky, Wes Gurnee, and Neel Nanda.Refusal in language models is mediated by a single direction.In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024.URL https://openreview.net/forum?id=pH3XAQME6c. Karl Johan ̊ Astr ̈ om and Tore H ̈ agglund. PID Controllers: Theory, Design, and Tuning. ISA - The Instrumentation, Systems and Automation Society, 1995a. ISBN 1-55617-516-7. Karl Johan ̊ Astr ̈ om and Tore H ̈ agglund. PID Controllers: Theory, Design, and Tuning. ISA - The Instrumentation, Systems and Automation Society, 1995b. ISBN 1-55617-516-7. Karl Johan ̊ Astr ̈ om and Richard Murray. Feedback systems: an introduction for scientists and engineers. Princeton university press, 2021. Reza Bayat, Ali Rahimi-Kalahroudi, Mohammad Pezeshki, Sarath Chandar, and Pascal Vincent. Steering Large Language Model Activations in Sparse Spaces, February 2025. Leonard Bereska and Efstratios Gavves. Mechanistic Interpretability for AI Safety – A Review, April 2024. Rakesh P Borase, DK Maghade, SY Sondkar, and SN Pawar. A review of pid control, tuning methods and applications. International Journal of Dynamics and Control, 9(2):818–827, 2021. Trenton Bricken, Adly Templeton, Joshua Batson, Brian Chen, Adam Jermyn, Tom Conerly, Nick Turner, Cem Anil, Carson Denison, Amanda Askell, Robert Lasenby, Yifan Wu, Shauna Kravec, Nicholas Schiefer, Tim Maxwell, Nicholas Joseph, Zac Hatfield-Dodds, Alex Tamkin, Karina Nguyen, Brayden McLean, Josiah E Burke, Tristan Hume, Shan Carter, Tom Henighan, and Christopher Olah.Towards monosemanticity: Decomposing language models with dictionary learning.Transformer Circuits Thread, 2023.URL https://transformer-circuits.pub/2023/monosemantic-features/index.html. Xinlei Chen, Hao Fang, Tsung-Yi Lin, Ramakrishna Vedantam, Saurabh Gupta, Piotr Dollar, and C. Lawrence Zitnick. Microsoft coco captions: Data collection and evaluation server, 2015. URL https://arxiv.org/abs/1504.00325. Emily Cheng and Carmen Amo Alonso. Linearly controlled language generation with performative guarantees. arXiv preprint arXiv:2405.15454, 2024. URL https://arxiv.org/abs/2405.15454. Huu-Tien Dang, Tin Pham, Hoang Thanh-Tung, and Naoya Inoue. On effects of steering latent representation for large language model unlearning. In Proceedings of the AAAI Conference on Artificial Intelligence, p. 23733–23742, 2025. Nelson Elhage, Tristan Hume, Catherine Olsson, Nicholas Schiefer, Tom Henighan, Shauna Kravec, Zac Hatfield-Dodds, Robert Lasenby, Dawn Drain, Carol Chen, Roger Grosse, Sam McCandlish, Jared Kaplan, Dario Amodei, Martin Wattenberg, and Christo- pher Olah.Toy models of superposition.Transformer Circuits Thread, 2022.URL ”https://transformer-circuits.pub/2022/toymodel/index.html”. L. Euler. Institutionum calculi integralis. Number v. 1 in Institutionum calculi integralis. imp. Acad. imp. Sa ` ent., 1768. URL https://books.google.com.sg/books?id=Vg8OAAAAQAAJ. 10 Preprint. Zoran Gajic and Muhammad Tahir Javed Qureshi. Lyapunov matrix equation in system stability and control. Courier Corporation, 2008. Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. RealToxic- ityPrompts: Evaluating neural toxic degeneration in language models. In Trevor Cohn, Yulan He, and Yang Liu (eds.), Findings of the Association for Computational Linguistics: EMNLP 2020, p. 3356–3369, Online, November 2020. Association for Computational Linguistics. doi: 10.18653/v1/2020.findings-emnlp.301. URL https://aclanthology.org/2020.findings-emnlp.301/. Atticus Geiger, Zhengxuan Wu, Christopher Potts, Thomas Icard, and Noah Goodman. Finding alignments between interpretable causal variables and distributed neural representations. In Causal Learning and Reasoning, p. 160–187. PMLR, 2024. Google Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, L ́ eonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ram ́ e, et al. Gemma 2: Improving open language models at a practical size. arXiv preprint arXiv:2408.00118, 2024. Ernst Hairer, Gerhard Wanner, and Syvert P Nørsett. Solving ordinary differential equations I: Nonstiff problems. Springer, 1993. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. Proceedings of the International Conference on Learning Representations (ICLR), 2021. Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. CLIPScore: A reference-free evaluation metric for image captioning. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen-tau Yih (eds.), Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, p. 7514–7528, Online and Punta Cana, Dominican Republic, November 2021. Association for Computational Linguistics. doi: 10.18653/v1/2021.emnlp-main.595. URL https://aclanthology.org/2021.emnlp-main.595/. Roger A Horn and Charles R Johnson. Matrix analysis. Cambridge university press, 2012. Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin De Laroussilhe, Andrea Gesmundo, Mona Attariyan, and Sylvain Gelly. Parameter-efficient transfer learning for nlp. In International conference on machine learning, p. 2790–2799. PMLR, 2019. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, L ́ elio Re- nard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timoth ́ e Lacroix, and William El Sayed. Mistral 7b, 2023. URL https://arxiv.org/abs/2310.06825. Zhong-Ping Jiang, Eduardo Sontag, and Yuan Wang. Input-to-state stability for discrete-time nonlinear systems. IFAC Proceedings Volumes, 32(2):2403–2408, 1999. ISSN 1474-6670. doi: https://doi.org/10.1016/S1474-6670(17)56408-3. URL https://w.sciencedirect.com/science/ article/pii/S1474667017564083. 14th IFAC World Congress 1999, Beijing, Chia, 5-9 July. Kai Konen, Sophie Jentzsch, Diaoul ́ e Diallo, Peer Sch ̈ utt, Oliver Bensch, Roxanne El Baff, Dominik Opitz, and Tobias Hecking. Style Vectors for Steering Generative Large Language Models. In Yvette Graham and Matthew Purver (eds.), Findings of the Association for Computational Linguistics: EACL 2024, p. 782–802, St. Julian’s, Malta, March 2024. Association for Computational Linguistics. Lingkai Kong, Haorui Wang, Wenhao Mu, Yuanqi Du, Yuchen Zhuang, Yifei Zhou, Yue Song, Rongzhi Zhang, Kai Wang, and Chao Zhang. Aligning large language models with representation editing: A control perspective. arXiv preprint arXiv:2406.05954, 2024. URL https://arxiv.org/abs/2406.05954. Suhas Kotha, Jacob Mitchell Springer, and Aditi Raghunathan. Understanding catastrophic forgetting in language models via implicit inference. arXiv preprint arXiv:2309.10105, 2023. Black Forest Labs. Flux. https://github.com/black-forest-labs/flux, 2024. 11 Preprint. Bruce W Lee, Inkit Padhi, Karthikeyan Natesan Ramamurthy, Erik Miehling, Pierre Dognin, Manish Nagireddy, and Amit Dhurandhar. Programming refusal with conditional activation steering. arXiv preprint arXiv:2409.05907, 2024. Kenneth Li, Oam Patel, Fernanda Vi ́ egas, Hanspeter Pfister, and Martin Wattenberg. Inference-Time Intervention: Eliciting Truthful Answers from a Language Model, June 2024. Shanchuan Lin, Anran Wang, and Xiao Yang. Sdxl-lightning: Progressive adversarial diffusion distillation, 2024. URL https://arxiv.org/abs/2402.13929. AI @ Meta Llama Team. The llama 3 herd of models, 2024. URL https://arxiv.org/abs/2407.21783. Varvara Logacheva, Daryna Dementieva, Sergey Ustyantsev, Daniil Moskovskiy, David Dale, Irina Krotova, Nikita Semenov, and Alexander Panchenko. ParaDetox: Detoxification with parallel data. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 6804–6818, Dublin, Ireland, May 2022. Association for Computational Linguistics. URL https://aclanthology.org/2022.acl-long.469. Yifan Luo, Yiming Tang, Chengfeng Shen, Zhennan Zhou, and Bin Dong. Prompt engineer- ing through the lens of optimal control.arXiv preprint arXiv:2310.14201, 2023.URL https://arxiv.org/abs/2310.14201. Yun Luo, Zhen Yang, Fandong Meng, Yafu Li, Jie Zhou, and Yue Zhang. An empirical study of catastrophic forgetting in large language models during continual fine-tuning. IEEE Transactions on Audio, Speech and Language Processing, 2025. Felipe Maia Polo, Lucas Weber, Leshem Choshen, Yuekai Sun, Gongjun Xu, and Mikhail Yurochkin. tinybenchmarks: evaluating llms with fewer examples. arXiv preprint arXiv:2402.14992, 2024. Samuel Marks and Max Tegmark. The geometry of truth: Emergent linear structure in large language model representations of true/false datasets. In First Conference on Language Modeling, 2024. URL https://openreview.net/forum?id=aajyHYjjsk. Samuel Marks, Can Rager, Eric J. Michaud, Yonatan Belinkov, David Bau, and Aaron Mueller. Sparse Feature Circuits: Discovering and Editing Interpretable Causal Graphs in Language Models, March 2025. Nicolas Minorsky. Directional stability of automatically steered bodies. Journal of the American Society for Naval Engineers, 34(2):280–309, 1922. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35: 27730–27744, 2022. Kiho Park, Yo Joong Choe, and Victor Veitch. The Linear Representation Hypothesis and the Geometry of Large Language Models, July 2024. Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. J. Mach. Learn. Res., 21(1), January 2020. ISSN 1532-4435. Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Turner. Steering llama 2 via contrastive activation addition. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar (eds.), Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 15504–15522, Bangkok, Thailand, August 2024. Association for Computational Linguistics. doi: 10.18653/v1/2024.acl-long.828. URL https://aclanthology.org/2024.acl-long.828/. Pau Rodriguez, Arno Blaas, Michal Klein, Luca Zappella, Nicholas Apostoloff, marco cuturi, and Xavier Suau.Controlling language and diffusion models by transporting activations. In The Thirteenth International Conference on Learning Representations, 2025.URL https://openreview.net/forum?id=l2zFn6TIQi. 12 Preprint. Melanie Sclar, Yejin Choi, Yulia Tsvetkov, and Alane Suhr. Quantifying language models’ sensitivity to spurious features in prompt design or: How i learned to start worrying about prompt formatting. arXiv preprint arXiv:2310.11324, 2023. Stefano Soatto, Paulo Tabuada, Pratik Chaudhari, and Tian Yu Liu. Taming ai bots: Controllability of neural states in large language models. arXiv preprint arXiv:2305.18449, 2023. URL https://arxiv.org/abs/2305.18449. Xavier Suau, Pieter Delobelle, Katherine Metcalf, Armand Joulin, Nicholas Apostoloff, Luca Zappella, and Pau Rodr ́ ıguez. Whispering experts: neural interventions for toxicity mitigation in language models. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org, 2024. Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. Stanford alpaca: An instruction-following llama model. https://github.com/tatsu-lab/stanfordalpaca, 2023. Adly Templeton, Tom Conerly, Jonathan Marcus, Jack Lindsey, Trenton Bricken, Brian Chen, Adam Pearce, Craig Citro, Emmanuel Ameisen, Andy Jones, Hoagy Cunningham, Nicholas L Turner, Callum McDougall, Monte MacDiarmid, C. Daniel Freeman, Theodore R. Sumers, Edward Rees, Joshua Batson, Adam Jermyn, Shan Carter, Chris Olah, and Tom Henighan. Scaling monosemanticity: Extracting interpretable features from claude 3 sonnet. Transformer Circuits Thread, 2024. URL https://transformer-circuits.pub/2024/scaling-monosemanticity/index.html. Alexander Turner, Sam Ringer, Rohin Shah, Andrew Critch, Victoria Krakovna, and Evan Hubinger. Activation addition: Steering language models without optimization. arXiv preprint arXiv:2308.10248, 2023. URL https://arxiv.org/abs/2308.10248. Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan J. Vazquez, Ulisse Mini, and Monte MacDiarmid. Steering Language Models With Activation Engineering, October 2024. Antonio Visioli. Practical PID control. Springer, 2006. Dimitri von R ̈ utte, Sotiris Anagnostidis, Gregor Bachmann, and Thomas Hofmann. A Language Model’s Guide Through Latent Space, February 2024. Hieu M. Vu and Tan Minh Nguyen. Angular steering: Behavior control via rotation in activation space. Advances in Neural Information Processing Systems, 2025. Jason Wei, Maarten Bosma, Vincent Y Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M Dai, and Quoc V Le. Finetuned language models are zero-shot learners. arXiv preprint arXiv:2109.01652, 2021. An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. Qwen2. 5 technical report. arXiv preprint arXiv:2412.15115, 2024. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. Judging llm-as-a-judge with mt-bench and chatbot arena. In Proceedings of the 37th International Conference on Neural Information Processing Systems, NIPS ’23, Red Hook, NY, USA, 2023. Curran Associates Inc. Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J. Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, J. Zico Kolter, and Dan Hendrycks. Representation Engineering: A Top-Down Approach to AI Transparency, October 2023a. Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models, 2023b. 13 Preprint. Supplement to “Activation Steering with a Feedback Controller” Table of Contents A Related Works14 B Theoretical Proofs15 B.1 Discretized PID controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15 B.2 Background on Input-to-state Stability & Notations . . . . . . . . . . . . . . . . .16 B.3 Dynamics of the Average Error Across Layers . . . . . . . . . . . . . . . . . . . .16 B.4 Proportional (P) Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17 B.5 Proportional-Integral (PI) Control . . . . . . . . . . . . . . . . . . . . . . . . . . .18 B.6 Oveshoot Mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21 B.7 PID Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23 B.7.1Stability of PID closed loop . . . . . . . . . . . . . . . . . . . . . . . . . .23 B.7.2Overshooting under PID law of control . . . . . . . . . . . . . . . . . . . .26 C Additional Experimental Results28 C.1 Qualitative Examples of Concept Steering . . . . . . . . . . . . . . . . . . . . . .28 C.2 Jailbreaking Large Language Models . . . . . . . . . . . . . . . . . . . . . . . . .29 ARELATED WORKS Recent works increasingly frame large language models (LLMs) as dynamical systems, where gen- eration is a trajectory in latent space. This view shifts activation steering from heuristic nudging to principled control: rather than biasing outputs without guarantees, controllers enforce constraints on tra- jectories with formal assurances (Cheng & Amo Alonso, 2024). In our PID-steering framework, this dis- tinction is key: we treat the model as a plant with hidden states evolving under controlled interventions. Controllability of LLMs.Soatto et al. (2023) model decoder-only LLMs as discrete-time stochastic systems and prove that, under idealized assumptions (Euclidean embeddings, well-trained semantics), they are controllable in the space of meanings. This establishes that any semantic state is theoretically reachable, but probabilities may be negligible in practice, and emergent behaviors like chain-of-thought are not captured. Their results highlight both opportunities and risks: controllability opens adversarial attack surfaces but also suggests defensive controllers. Prompting as open-loop control. Luo et al. (2023) recast multi-round prompt engineering as an optimal control problem, where each prompt is a control input maximizing task reward. This provides a unifying formalism for prompt strategies, akin to open-loop control. Yet, the framework remains conceptual: metrics in discrete language space are poorly defined, and no guarantees of stability or convergence are provided. Closed-loop activation control. Cheng & Amo Alonso (2024) propose Linear Semantic Control (LiSeCo), which projects activations into safe subspaces at each decoding step via a closed-form controller. This yields lightweight, guaranteed control of simple attributes (e.g., toxicity, sentiment). However, the linearity assumption only approximates LLM embeddings, guarantees are local rather than global, and long-horizon stability remains unaddressed. Dynamic representation editing.Kong et al. (2024) introduce RE-CONTROL, which learns a value function on hidden states and applies gradient-based interventions at test time. This dynamic approach generalizes steering into a Bellman-optimal control problem, balancing alignment with fluency. Still, 14 Preprint. accuracy of the learned value function is critical, test-time optimization adds overhead, and local interventions may not guarantee global alignment. Together, these works move activation steering from heuristics to control theory. Soatto et al. (2023) prove fundamental controllability (but under strong assumptions), Luo et al. unify prompt strategies as open-loop control (without guarantees), Cheng & Amo Alonso (2024) derive closed-form activation control (limited to linear approximations), and Kong et al. (2024) extend to dynamic optimal control (with overhead and approximation risks). BTHEORETICAL PROOFS B.1DISCRETIZED PID CONTROLLER Implementing a continuous-time controller on digital hardware, such as PID, requires discretizing its derivative and integral terms ( ̊ Astr ̈ om & H ̈ agglund, 1995a, p.95) Lemma 1 (Discretizing PID steering vector) Consider the continuous PID steering vector defined in Eqn. 15. The discrete-time PID steering vector is given by: u(k) =K p r(k)+K i k−1 X j=0 r(j)+K d (r(k)−r(k−1)).(17) Proof. We follow the discretization procedure for PID controllers in ( ̊ Astr ̈ om & H ̈ agglund, 1995a, Sec. 3.6, Ch. 3). For simplicity, the sampling period is normalized to h = 1. Proportional term in Eqn. 15. P (t) =K p r(t). The discrete-time form is obtained by substituting sampled variables for their continuous counterparts: P (k) =K p r(k).(21) Integral term in Eqn. 15. I(t) =K i Z t 0 r(τ )dτ ⇒ dI dt =K i r(t). Using forward Euler with h = 1, I(k +1)−I(k) =K i r(k). Hence I(k +1) =I(k)+K i r(k), which is equivalent to I(k) =I(0)+K i k−1 X j=0 r(j) =K i k−1 X j=0 r(j),(22) since I(0) = 0. Derivative term in Eqn. 15. D(t) =K d dr(t) dt . Approximating the derivative by the backward Euler difference with h = 1 gives D(k) =K d r(k)−r(k−1) .(23) Combining equation 21, equation 22, and equation 23 yields u(k) =K p r(k) +K i k−1 X j=0 r(j) +K d r(k)−r(k−1) . □ 15 Preprint. B.2BACKGROUND ON INPUT-TO-STATE STABILITY & NOTATIONS Background on Input-to-state Stability (ISS) In our proofs, the input-to-state stability (ISS) of a system can be established either through the definition of an ISS system in (Jiang et al., 1999, Def. 2.1) or via the use of an ISS-Lyapunov function as in (Jiang et al., 1999, Def. 2.2, Prop. 2.3). We also rely on the definition of a Lyapunov function and the difference Lyapunov equation for linear discrete-time homogeneous dynamical systems in (Gajic & Qureshi, 2008, Ch. 1, p. 8). The existence of a solution to the Lyapunov equation, together with its bound, is stated in (Gajic & Qureshi, 2008, Ch. 4, p. 110). For reference, we briefly note that input-to-state stability (ISS) extends the classical notion of Lyapunov by explicitly accounting for external inputs: the state remains bounded and eventually whenever the input is bounded. A Lyapunov function provides an energy-like certificate for stability, while the associated Lyapunov equation offers a constructive method for obtaining such functions in linear settings. These notions are central for analyzing stability and will be used throughout our proofs. Conventions and assumptions (used throughout). Let∥·∥denote the Euclidean norm onR d ; for a matrixM ∈ R d×d we also write∥M∥for the operator norm induced by the Euclidean norm, i.e.∥M∥ := sup ∥x∥=1 ∥Mx∥(the spectral norm) (Horn & Johnson, 2012, p. 343–346). We assume (i)sup k ∥ ̄ A(k)∥<∞; (i)w(k)is bounded (for a signalwwe set∥w∥ ∞ := sup k≥0 ∥w(k)∥) ; (i) the controller gains are static and time-invariant scalar multiples of the identity. We use the standard meaning of the classesK andKL as in (Jiang et al., 1999). B.3DYNAMICS OF THE AVERAGE ERROR ACROSS LAYERS To formalize the problem setup, we considerNpairs of contrastive prompt/input tokens(q + i ,q − i ) N i=1 , whereq + i carries the desired property andq − i represents the opposite. For discrete time (layer)k, let x ± i (k)∈R d denote the corresponding activation vectors. The layer-to-layer evolution is x i (k +1) = f (k) i x(k) ,i = 1,...,N,(24) withf (k) i : R d → R d differentiable on the operating region. A steering inputu(t)is applied on the undesired branch: x − i (k +1) = f (k) i x − i (k)+u(k) .(25) Defining ̄ x ± (k) := 1 N P N i=1 x ± i (k), we track the per-pair and average errors as e i (k) :=x + i (k)−x − i (k), ̄ e(k) := ̄ x + (k)− ̄ x − (k), ̃ e i (k) =e i (k)− ̄ e(k).(26) Furthermore, we defineA i (k) as the Jacobian of f (k) i atx + i (k): A i (k) :=J f (k) i x + i (k) , ̄ A(t) := 1 N N X i=1 A i (k), ̃ A i (k) =A i (k)− ̄ A(k).(27) The dynamic of the average error ̄ e(k) is then given by Proposition 2. Proposition 2 (Error dynamics of activation steering) The error dynamics ̄ e(k)in activation steering is of the form: ̄ e(k +1) = ̄ A(k) ̄ e(k)− ̄ A(k)u(k)+w(k),(20) where ̄ A(k) is the mean local Jacobian off (k) i atx + i (k)and the disturbance termw(k)collects heterogeneity. See Appendix B.3 for detailed proof and explanations of the terms. Proof. The evolution of the average error ̄ e(k) through layers can be described as follows: ̄ e(k +1) = ̄ x + (k +1)− ̄ x − (k +1) = 1 N N X i=1 h f (k) i x + i (k) −f (k) i x − i (k)+u(k) i .(28) Linearizing f (k) i aroundx + i (k), we obtain f (k) i x + i (k)+δ ≈f (k) i x + i (k) +J f (k) i x + i (k) ·δ,(29) where J f (k) i denotes the Jacobian of f (k) i . 16 Preprint. Setting δ =−e i (k)+u(k) yields f (k) i x + i (k)+δ ≈f (k) i x + i (k) +A i (k) e i (k)+u(k) , Insert this into Eqn.28 we obtain ̄ e(k +1) = 1 N N X i=1 A i (k)e i (k)− ̄ A(k)u(k).(30) Recall that e i (k) = ̄ e(k)+ ̃ e (i) (k), then 1 N N X i=1 ̃ e (i) (k) = 0, and A (i) (t) = ̄ A(k)+ ̃ A (i) (k), then 1 N N X i=1 ̃ A (i) (k) = 0. Therefore, ̄ e(k +1) = 1 N N X i=1 A i (k)e i (k)− ̄ A(k)u(k) = 1 N N X i=1 ̄ A(k) ̄ e i (k)− ̄ A(k)u(k)+ 1 N N X i=1 ̃ e (i) (k) ̃ A (i) (k) + ̄ A(k) 1 N N X i=1 ̃ e (i) (k)+ ̄ e(k) 1 N N X i=1 ̃ A (i) (k) |z =0 (31) We then obtain the final state-space model for the dynamics of ̄e(t) as ̄ e(k +1) = ̄ A(k) ̄ e(k)− ̄ A(k)u(k)+w(k),(32) where w(k) = 1 N N X i=1 ̃ A i (k) ̃ e i (k), which acts as a time-dependent exogeneous disturbance to the model□ B.4PROPORTIONAL (P) CONTROL Consider proportional control with u(k) =K P ̄ e(k), (K I =K D = 0). The dynamics Eqn. 20 then become ̄ e(k) =M P (k) ̄ e(k)+w(k),(33) where M P (k) = ̄ A(k)(I−K P ). With a suitable choice ofK P , the system can be made input-to-state stable (ISS); that is, there exist aKL-functionβand aK-functionγsuch that, for all disturbancewwith bounded sup norm and all initial states ̄ e(0), ∥ ̄ e(k)∥ ≤ β(∥ ̄ e(0)∥,k) + γ(∥w∥ ∞ ), k∈Z ≥0 ,(34) see (Jiang et al., 1999, Def. 2.1). In particular, the error decays from the initial condition and remains bounded under bounded disturbances. Proposition 1 (Steady-state error of P-control activation steering) P-control activation steering ensures input-to-state stability (ISS) for an appropriate range ofK p . However, there still exists a steady-state error due to the disturbancew(k)to the state of the system. In the best case, whenw(k) converges tow, under a mild condition, the expected error, i.e., the difference-in-means,r(k) = ̄ e(k) eventually converges to a steady state ̄ e s ∝w. Therefore, ̄ e s ̸= 0 ifw̸= 0. 17 Preprint. Proof. Assumesup k ∥ ̄ A(k)∥≤ M <∞,K P = pIwithp > 0. SinceM P (k) = ̄ A(k)(I−K P ) = ̄ A(k)(1−p)I , by sub-multiplicative property of matrix norm we have ∥M P (t)∥≤∥ ̄ A(t)∥(1−p)I∥≤M|1−p| =:q.(35) For p∈ 1− 1 M ,1+ 1 M , we have q< 1. Expanding recursively, ̄ e(k) =M P (k−1)·M P (0) ̄ e(0)+ k−1 X j=0 M P (k−1)·M P (j +1)w(j). Hence, ∥ ̄ e(k)∥≤q k ∥ ̄ e(0)∥+ k−1 X j=0 q k−1−j ∥w(j)∥≤q k ∥ ̄e(0)∥+ 1−q k 1−q ∥w∥ ∞ ≤q k ∥ ̄e(0)∥+ 1 1−q ∥w∥ ∞ . (36) Sinceq < 1, we can setβ(s,k) = q k s, which is aKL-function (decaying to zero ask→∞), and γ(s) = 1 1−q s, which is aK-function, satisfying Eqn. 34. Therefore, the system is ISS. However, there exists a steady-state error due to the disturbancew(k). In the best case, when ̄ A(k) converges to ̄ Aandw(k)converges tow, the error ̄ e(k) eventually converges to a steady state given by ̄ e s = (I− ̄ A(1−pI)) −1 w. Therefore, ̄ e s ̸= 0 ifw̸= 0.□ Remark 1 (Convergence rate versus K P .)From Ineq. 36, smallerqyields faster convergence. Because q(p) =M|1−p| = ( M (1−p), p∈ 1− 1 M ,1 , M (p−1), p∈ 1,1+ 1 M , we have d dp q(p) =−M < 0 forp< 1and d dp q(p) =M > 0 forp> 1. Therefore the contraction factor q(p) is minimized at p ⋆ = 1 =⇒ q ⋆ = 0, and increases as p moves away from 1 within the admissible interval. B.5PROPORTIONAL-INTEGRAL (PI) CONTROL To reduce the steady-state error, the proportional controller is extended with an integral action, resulting in a proportional-integral (PI) control law: u(k) =K p ̄ e(k)+K I s(k), s(k +1) =s(k)+ ̄ e(k),(K D = 0).(37) The dynamics Eqn. 20 then become ̄ e(k +1) = ̄ A(k)(I−K P ) ̄ e(k)− ̄ A(k)K I s(k)+w(k).(38) We use the following orthogonal decomposition forw(k): w(k) =w ∥ (k)+w ⊥ (k), wherew ∥ (k)∈ Im ̄ A(k) andw ⊥ (k)∈ (Im ̄ A(k)) ⊥ . The impact ofw ∥ (k)on the error can be eliminated by PI control, as discussed below. On the other hand, P-only control is not able to do so, because keeping ̄ e(k) = 0requiresu(k) = 0, leaving no component inu(k) that can compensate forw ∥ (k). Sincew ∥ (k)∈ Im ̄ A(k), it can be expressed as w ∥ (k) = ̄ A(k)K I s ∗ (k). ⇐⇒ s ∗ (k) =K −1 I ̄ A(k) † w ∥ (k) Let ̃ s(k) =s(k)−s ∗ (k) and d(k) =s ∗ (k +1)−s ∗ (k). Therefore, ̃ s(k +1) = ̃ s(k)+ ̄ e(k)−d(k)(39) 18 Preprint. Inserts(k) =s ∗ (k)+ ̃ s(k) andw(k) =w ∥ (k)+w ⊥ (k) = ̄ A(k)K I s ∗ (k)+w ⊥ (k) into Eqn. 38, ̄ e(k +1) = ̄ A(k)(I−K p ) ̄ e(k)− ̄ A(k)K i s ∗ (k)− ̄ A(k)K i ̃ s(k)+ ̄ A(k)K i s ∗ (k)+w ⊥ (k) = ̄ A(k)(I−K p ) ̄ e(k)− ̄ A(k)K i ̃ s(k)+w ⊥ (k) (40) We introduce the lifted state ̃ ζ PI (k) = ̄ e(k) ̃ s(k) with its dynamic derived from Eqn. 39-40 as follow ̃ ζ PI (k +1) =M i (t) ̃ ζ PI (k) + ̃ w PI (k),(41) where M i (k) = M p (k) −G(k) I , withM p (k) = ̄ A(p)(I−K p ),G(k) = ̄ A(k)K i and ̃ w PI (k) = w ⊥ (k) −d(k) , Proposition 3 (Stabilizing the PI loop reduces steady-state error) LetM p (k) = ̄ A(k)(I−K p ), and denote∥K i ∥ =:h. Assumesup k ∥ ̄ A(k)∥≤M <∞andsup k ∥M p (k)∥≤q < 1. Ifq +Mh< 1, then the PI closed-loop control is ISS. Furthermore, the integral part exactly cancels the matched disturbance componentw ∥ . The remaining error is due only to the unmatched componentw ⊥ , which cannot be compensated. Full proof and term explanations provided in Appendix B.5 Proof. Using the sub-multiplicativity of the induced matrix norm and the triangle inequality, and noting that∥M p (k)∥≤q,∥G(k)∥ =∥ ̄ A(k)K i ∥≤∥ ̄ A(k)∥K I ∥≤Mh, we obtain ∥ ̄ e(k +1)∥≤∥M p (k)∥ ̄ e(k)∥+∥G(k)∥ ̃ s(k)∥+∥w ⊥ (k)∥ ≤q∥ ̄ e(k)∥+Mh∥ ̃ s(k)∥+∥w ⊥ (k)∥,(42) ∥ ̃ s(k +1)∥≤∥ ̄ e(k)∥+∥ ̃ s(k)∥+∥d(k)∥.(43) Introduce z(k) := ∥ ̄ e(k)∥ ∥ ̃ s(k)∥ , H := q Mh 11 , v(k) := ∥w ⊥ (k)∥ ∥d(k)∥ . Then Eqn. 42- 43 give the comparison system z(k +1) ≤ Hz(k)+v(k).(44) Expanding Eqn. 44 recursively yields z(k) ≤ H k z(0)+ k−1 X i=0 H k−1−i v(i).(45) Consider the characteristic equation of H : (λ−q)(λ−1)−Mh = 0 ⇐⇒ λ 2 −(q +1)λ+(q +Mh) = 0. Since q +Mh< 1, the maximal root λ ⋆ satisfies λ ⋆ < 1, hence the spectral radius ρ(H)< 1. Let r :=ρ(H)< 1 be the spectral radius of H . By the Gelfand formula for induced (operator) norms, lim k→∞ ∥H k ∥ 1/k = r(Horn & Johnson, 2012, p. 349). Fix any ρ∈ (r,1). Then, by the definition of the limit, there exists N∈N such that ∥H k ∥ 1/k ≤ ρ for all k≥N =⇒ ∥H k ∥≤ ρ k ∀k≥N. Define the constant C := max n 1, max 0≤k≤N ∥H k ∥ρ −k o . Then: 19 Preprint. • If k≥N , we have∥H k ∥ρ −k ≤ 1≤C, hence∥H k ∥≤Cρ k . • If 0≤k≤N , we have∥H k ∥ρ −k ≤ max 0≤k≤N ∥H k ∥ρ −k ≤C, hence∥H k ∥≤Cρ k . Therefore, ∥H k ∥≤ Cρ k for all k≥ 0.(46) Applying Eqn. 46 to Eqn. 45 gives ∥z(k)∥≤∥H k ∥z(0)∥+ k−1 X i=0 ∥H k−1−i ∥v(i)∥ ≤Cρ k ∥z(0)∥+C k−1 X i=0 ρ k−1−i ∥v(i)∥ ≤Cρ k ∥z(0)∥+ C 1−ρ ∥v∥ ∞ ,(47) where∥v∥ ∞ := sup i≥0 ∥v(i)∥. By construction, ∥ ̃ ζ PI (k)∥ = ̄ e(k) ̃ s(k) = ∥ ̄ e(k)∥ 2 +∥ ̃ s(k)∥ 2 1/2 =∥z(k)∥. Combining this identity with Eqn. 47, the ISS estimate follows with β(s,k) :=Cρ k s ∈ KL, γ(s) := C 1−ρ s ∈ K, which proves that the PI closed loop Eqn. 41 is ISS.□ The integral part exactly cancels the matched disturbance componentw ∥ . The remaining error is due only to the unmatched componentw ⊥ , which cannot be compensated, and to the variation rated(k) when ̄ A(k)andw(k)change over time. In the best scenario, if a steady state exists, i.e., ̄ A(k)→ ̄ A andw(k)→w withw∈ Im ̄ A, thenw ⊥ ≡ 0, d≡ 0, and thus ̄ e(k)→ 0. Remark 2 (Convergence rate versusK i )From proposition 3, the convergence rate of ̃ ζ PI (t) depends onρ: the smallerρ, the faster the convergence. We also adopt the convention (as in the proof) thatρ∈ (r,1). Equivalently, we examinedr(h) =ρ(H)and proved that withh = (1−q) 2 4M this quantity is minimized. Proof Consider the characteristic polynomial of H : λ 2 −(q +1)λ+(q +Mh) = 0. Its discriminant is ∆(h) = (q +1) 2 −4(q +Mh) = (q−1) 2 −4Mh. If ∆(h)≥ 0 (i.e., 0≤h≤ (1−q) 2 4M ), then r(h) = q +1+ p ∆(h) 2 , and r(h) decreases as h increases. If ∆(h)< 0 (i.e., (1−q) 2 4M <h< 1−q M ), then r(h) = p q +Mh, and r(h) decreases as h decreases. Hence r(h) can achieve its best (smallest) value at h = (1−q) 2 4M ,(48) for which the error converges to zero the fastest.□ Nevertheless, as we discuss in the next section, in some situations such a large value ofhmay become a practical obstacle for PI control. 20 Preprint. B.6OVESHOOT MECHANISM Phenomenon. A common issue in standard PI settings is overshooting: the closed loop oscillates around the setpoint before settling (see ̊ Astr ̈ om & H ̈ agglund (1995a, Ch. 3, §3.3)). In our terms, the integral part accumulates past error and can push the output beyond the setpoint; subsequent sign changes of the error gradually “discharge” the integral, producing a decaying oscillation. The big overshoot is undesirable when we prefer a more stable response near zero. Below we analyze the same mechanism for our PI steering setting. Citing an observation from Vu & Nguyen (2025): in the absence of steering, the cosine similarity between error vectors at different layers is consistently positive, i.e., cos∠ ̄ e(i), ̄ e(j) > 0 for all layers i,j, so the layerwise errors share (approximately) the same direction. Consequently, with ̄ x + (k) serving as the trajectory setpoints and ̄ x − (k)the system output, an overshoot event occurs when the instantaneous error reverses its initial orientation, namely when ⟨ ̄ e(k), ̄ e(0)⟩< 0. We now introduce the definitions used below. Scalarization along a direction. Let v := ̄ e(0) ∥ ̄ e(0)∥ and project onto v: e v (k) :=v ⊤ ̄ e(k), s v (k) :=v ⊤ ̃ s(k). From the PI loop dynamics Eqn. 41 we obtain the scalar PI pair e v (k +1) =a(k)e v (k)− b(k)s v (k) + w ⊥ v (k),(49) s v (k +1) =s v (k) + e v (k)− d v (k),(50) witha(k) = v ⊤ ̄ A(k)(I −K p )v = v ⊤ M p (k)v, b(k) = v ⊤ ̄ A(k)K i v = v ⊤ G(k)v,and projected disturbancesw ⊥ v (k) := v ⊤ w ⊥ (k) ,d v (k) := v ⊤ d(k). Empirically (and consistently with the angular-steering observation in our setup), we havev ⊤ ̄ A(k)v≥ 0for allk; together with the gain K i =hI with h≥ 0, this implies b(k)≥ 0. Also, the assumption q := sup k ∥M p (k)∥ and M := sup k ∥ ̄ A(k)∥ yeilds a(k)≤q< 1,0≤b(k)≤Mh,(51) Since the system Eqn. 41 is ISS, so is the system Eqn. 49-Eqn. 50. In other words, bothe v (k)and s v (k) decay. Recall that s v (k) = k−1 X i=0 e v (i). Hence,s v (k)can only decrease whene v (k) < 0, which is precisely the moment when overshoot occurs. These overshooting and decaying phenomena are observed in empirical simulation, see Fig. 6. Below, we define the overshoot in our setting. Definition 2 (Overshoot and its amplitude)We say an overshoot occurs from timek a tok a +mif e v (k)< 0∀k =k a ,k a +1,...,k a +m−1ande v (k)≥ 0fork =k a −1,k a +m. Its amplitude is defined as A a :=max kt a ≤i≤k a +m−1 |e v (i)| .(52) In standard PID settings illustrated in ̊ Astr ̈ om & H ̈ agglund (1995a, Ch. 3, §3.3)), it is observed that the overshoot amplitude decays over time. This decay is also consistent with the ISS property of the closed loop: as bothe v (t) ands v (t) are driven down, subsequent oscillations tend to diminish in magnitude. In our simulation (see Fig. 6), the first overshoot appear to be representative. Hence, while we are not yet able to provide a formal proof, the empirical evidence and ISS intuition justify the first overshoot which is typically the dominant one and serves as a representative indicator of oscillatory behavior. This assumption is for Proposition 4. Suppose thata(t)≥ 0; equivalently,p∈ (1− 1 M ,1], which is the result of proposition 1. This assumption is expected to entail no loss of generality relative to the |a(t)|≤q< 1 assumption. 21 Preprint. −20−15−10−505 −0.20 0.00 0.20 0.40 0.60 0.80 1.00 1.20 1.40 1.60 <e(0), s(k)> <e(0), e(k)> (a) PI 0.10.150.20.25 0.00 0.02 0.04 0.06 0.08 <e(0), s(k)> <e(0), e(k)> (b) PID Figure 6: Scalar errors across time step of randomly initialized model after applying PI and PID controller. Colors from blue to red denote the time (layer) dimension. Proposition 4 (Agressive PI gain leads to a large first overshoot)Letk 0 be the first sign-change time, i.e., e v (j)≥ 0 ∀j = 0,1,...,k 0 −1, e v (k 0 )< 0, and let k 1 be the first time the trajectory returns to the nonnegative side, e v (k 1 )≥ 0, e v (i)< 0 ∀i =k 0 ,k 0 +1,...,k 1 −1. As in Eqn.52, the first overshoot amplitude is A 0 =max k 0 ≤i≤k 1 −1 |e v (i)| = |e v (i max )|.(53) Assumesup k ∥ ̄ A(k)∥≤M <∞andsup k ∥M p (k)∥≤q< 1. Denote∥K i ∥ =:h.and givenq +Mh< 1. Therefore, A 0 ≤ Mh 1 1−q + 1 (1−q) 2 e v (0) + Mh 1−q (k 0 −1)+ Mh 1−q ∥d∥ ∞ + Mh(k 0 −1)+1 1−q ∥w∥ ∞ ; (54) Proof. Before the first crossing (j≤k 0 −1) we haves v (j)≥ 0, hence from Eqn. 49 e v (j +1) =a(j)e v (j)−b(j)s v (j)+w ⊥ v (j) ≤ a(j)e v (j)+w ⊥ v (j) ≤ qe v (j)+∥w∥ ∞ , so by inductione v (j)≤q j e v (0)+ 1 1−q ∥w∥ ∞ . Summing Eqn. 50, s v (k 0 −1) = k 0 −2 X i=0 e v (i)− k 0 −2 X i=0 d v (i) ≤ e v (0) 1−q + (k 0 −1)∥d∥ ∞ + k 0 −1 1−q ∥w∥ ∞ .(55) Since a(k)≥ 0 ande v (k 0 −1)≥ 0, at the crossing step, |e v (k 0 )| = −e v (k 0 ) ≤ b(k 0 −1)s v (k 0 −1) +∥w∥ ∞ ≤ Mh e v (0) 1−q +(k 0 −1)∥d∥ ∞ + k 0 −1 1−q W ∞ +∥w∥ ∞ . = Mh 1−q e v (0)+Mh(k 0 −1)∥d∥ ∞ +(Mh k 0 −1 1−q +1)∥w∥ ∞ (56) Assume thatd v (k)is small enough s.t during the overshoot time,s v is nonincreasing (sincee v < 0 a.e. on[k 0 ,k 1 − 1]), sos v (i)≤s v (k 0 − 1)fori∈ [k 0 ,k 1 − 1]. Using Eqn. 49 again and unrollingm steps from k 0 , |e v (k 0 +m)| ≤ q m |e v (k 0 )| + m−1 X k=0 q k Mhs v (k 0 −1)+∥w∥ ∞ ≤ |e v (k 0 )| + Mhs v (k 0 −1)+∥w∥ ∞ 1−q . (57) 22 Preprint. Taking the maximum overm∈0,1,...,k 1 −k 0 and substituting Ineq. 55 and Ineq. 56 into Ineq. 57 yields A 0 ≤ Mh 1 1−q + 1 (1−q) 2 e v (0) + Mh 1−q (k 0 −1)+ Mh 1−q ∥d∥ ∞ + Mh(k 0 −1)+1 1−q ∥w∥ ∞ (58) □ Consequently, the right-hand side of Ineq.58 is monotone increasing inh(via the factorMh) and increases asqdecreases (through the factors 1 1−q ). In particular, more aggressive PI leads to a larger first–overshoot amplitude. Remark 3 (“Fast-PI” specialization.) With the tuning used in our analysis in remark 2,h = (1−q) 2 4M (the value that minimizes the comparison-system rate), soMh = (1−q) 2 4 . Plugging into equation 58 gives A 0 ≤ 1−q 4 + 1 4 e v (0) + 1−q 4 (k 0 −1)+ 1 4 ∥d∥ ∞ + k 0 1−q ∥w∥ ∞ . In particular, in the disturbance-free case (∥w∥ ∞ =∥d∥ ∞ = 0) we obtain A 0 ≤ 1−q 4 + 1 4 e v (0), so stronger proportional action (smallerq) comes with a larger first-overshoot envelope, even though the closed-loop settles faster. B.7PID CONTROL B.7.1STABILITY OF PID CLOSED LOOP We consider the PID update u(k) =K p ̄ e(k) +K i s(k) +K d ̄ e(k)− ̄ e(k−1) , and define the auxiliary matrices M p (k) := ̄ A(k) I−K p , G(k) := ̄ A(k)K i , H(k) := ̄ A(k)K d , together with the error increment ∆ ̄ e(k) := ̄ e(k)− ̄ e(k−1),∆ ̄ e(−1) = 0 Using the plant relation, we obtain ∆ ̄ e(k +1) = M p (k)−I ̄ e(k)−G(k) ̃ s(k)−H(k)∆ ̄ e(k) +w ⊥ (k),(59) Introduce the lifted state from the auxiliary PI state in Eqn. 41 ̃ ζ PID (k) := ̄ e(k) ̃ s(k) ∆ ̄ e(k) , Then the closed-loop evolution reads ̃ ζ PID (k +1) =M d (k) ̃ ζ PID (k) + ̃ w PID (k),(60) where M d (k) := " M p (k) −G(k) −H(k) I0 M p (k)−I −G(k) −H(k) # , ̃ w PID (k) := w ⊥ (k) −d(k) w ⊥ (k) . Theorem 1 (Stabilizing the PID loop preserves bias removal) LetM p (k) = ̄ A(k)(I−K p ), and denote∥K i ∥ =: h,∥K d ∥ =: ℓ. Assumesup k ∥ ̄ A(k)∥≤ M <∞andsup k ∥M p (k)∥≤ q < 1. If q +Mh < 1(stable PI loop), then there existsℓ > 0such that the PID closed-loop control is ISS. Therefore, the integral part in PID design still cancels the matched disturbance componentw ∥ . 23 Preprint. Proof. We establish the ISS for system 60 using the method of ISS-Lyapunov function, see (Jiang et al., 1999, Def. 2.2, Prop. 2.3). It then suffices to construct a candidate ISS-Lyapunov functionV PID (k) satisfying that there exist classK ∞ functions α 1 ,α 2 ,α 3 and a classK function σ such that α 1 (∥ ̃ ζ PID (k)∥)≤V PID ( ̃ ζ PID (k))≤ α 2 (∥ ̃ ζ PID (k)∥),(61) and V ( ̃ ζ PID (k +1))−V ( ̃ ζ PID (k))≤−α 3 (∥ ̃ ζ PID (k)∥)+σ(∥w∥).(62) Step 1: CandidtateV PID (k) and PI-closed loop baseline Define V PID (k) :=V PI ̃ ζ PI (k),k +r∥∆ ̄ e(k)∥ 2 , r> 0,(63) whereV PI ( ̃ ζ PI ,k) = ̃ ζ ⊤ PI P (k) ̃ ζ PI withP (k) =P (k) ⊤ ≻ 0 and there exists some μ PI > 0 such that M i (k) ⊤ P (k)M i (k)−P (k)≤−μ PI I, ∀k,(64) Regarding the existence of suchV PI , recall the homogeneous PI-loop ̃ ζ PI (k + 1) = M i (k) ̃ ζ PI (k) withM i (k) = M p (k) −G(k) I , being asymptotically stable. Suppose there isQ(k) =Q(k) ⊤ ⪰ 0 bounded so that the pair(M i (k), p Q(k))is observable for allk, hence the difference Lyapunov equation M ⊤ i (k)P (k +1)M i (k)−P (k) =−Q(k) admits a unique positive definite solutionP (k) = P ⊤ (k) ≻ 0for allk, and a uniform bound ∥P∥ ∞ := sup k ∥P (k)∥<∞ (see (Gajic & Qureshi, 2008, Ch. 4, p. 110)) Step 2: Condition (i) as in Eqn. 61 We writeV PID as a quadratic form V PID (k) = ̃ ζ PID (k) ⊤ P ∗ (k) ̃ ζ PID (k), P ∗ (k) := P (k)0 0 rI .(65) ClearlyP ∗ (k) =P ∗ (k) ⊤ andP ∗ (k)≻ 0becauseP (k)≻ 0andrI≻ 0; henceP ∗ (k)is symmetric positive definite for all k. By the spectral theorem, there exists an orthogonal matrixU ∗ (k)and a diagonal Λ ∗ (k) = diag(λ 1 (k), ... , λ n ∗ (k)) with positive entries such thatP ∗ (k) = U ∗ (k)Λ ∗ (k)U ∗ (k) ⊤ . Moreover, becauseP ∗ (k)is block diagonal, its eigenvalues are precisely the union of the eigenvalues ofP (k)and the repeated eigenvaluer. Using the uniform bounds already established forP (k)(there existsλ> 0withλ min (P (k))≥λandλ max (P (k))≤∥P∥ ∞ := sup k ∥P (k)∥<∞), we obtain the k-independent bounds λ min P ∗ (k) ≥ λ ∗ := minλ ,r > 0, λ max P ∗ (k) ≤λ ∗ := max|P∥ ∞ ,r <∞. For every vectorzand every symmetric positive definiteM,λ min (M )∥z∥ 2 ≤z ⊤ Mz≤λ max (M )∥z∥ 2 . Applying this to M =P ∗ (k) and z = ̃ ζ PID (k) in Eqn. 65 yields λ ∗ ̃ ζ PID (k) 2 ≤V PID (k)≤ λ ∗ ̃ ζ PID (k) 2 . Therefore, choosing the class-K ∞ functions α 1 (s) :=λ ∗ s 2 , α 2 (s) := λ ∗ s 2 , we obtain the desired bound α 1 ̃ ζ PID (k) ≤V PID (k)≤ α 2 ̃ ζ PID (k) ,(66) which establishes condition (i) in 61. Step 3: Condition (i) as in Eqn. 62. From Eqn. 63, ∆V PID (k) = ∆V PI ̃ ζ PI (k) PID | z PI part under PID update +r ∥∆ ̄ e(k +1)∥ 2 −∥∆ ̄ e(k)∥ 2 .(67) 24 Preprint. Bounding the PI part under the PID update. Under PI rule (K d = 0), ̃ ζ PI (k +1) PI =M i (k) ̃ ζ PI (k)+ ̃ w PI (k), M i (k) := M p (k) −G(k) I then ∆V PI ̃ ζ PI (k) PI = ̃ ζ PI (k) ⊤ M i (k) ⊤ P (k+1)M i (k)−P (k) ̃ ζ PI (k) +2 ̃ ζ PI (k) ⊤ M i (k) ⊤ P (k+1) ̃ w PI (k)+ ̃ w PI (k) ⊤ P (k+1) ̃ w PI (k) By Eqn. 64, Cauchy-Schwarz inequality and Young’s inequality, ∆V PI ̃ ζ PI (k) PI ≤−μ PI ∥ ̃ ζ PI (k)∥ 2 +2∥M i ∥ ∞ ∥P∥ ∞ ∥ ̃ ζ PI (k)∥ ̃ w PI (k)∥+∥P∥ ∞ ∥ ̃ w PI (k)∥ 2 ≤−(μ PI −ε 1 )∥ ̃ ζ PI (k)∥ 2 + ∥M i ∥ 2 ∞ ∥P∥ 2 ∞ ε 1 +∥P∥ ∞ ∥ ̃ w PI (k)∥ 2 =−μ ∗ PI ∥ ̃ ζ PI (k)∥ 2 +C 1 ∥ ̃ w PI (k)∥ 2 , for any ε 1 > 0. Under PID rule (K d ̸= 0), ̃ ζ PI (k +1) PID =M i (k) ̃ ζ PI (k)−δ(k) +w PI (k), with the “perturbation” δ(k) := H(k)∆ ̄ e(k) 0 Hence, ∆V PI ̃ ζ PI (k) PID =V PI ̃ ζ PI (k +1) PI −V PI ̃ ζ PI (k) =V PI ̃ ζ PI (k +1) PI −V PI ̃ ζ PI (k) +2 ̃ ζ PI (k +1) PI ⊤ Pδ(k)+δ(k) ⊤ Pδ(k) (68) Bounding each term in Eqn. 68 • V PI ̃ ζ PI (k +1) PI −V PI ̃ ζ PI (k) ≤−μ ∗ PI ∥ ̃ ζ PI (k)∥ 2 +C 1 ∥ ̃ w PI (k)∥ • Applying Young’s inequality for inner product, there exists ε> 0 s.t 2 ̃ ζ PI (k +1) PI ⊤ Pδ(k)≤ε ̃ ζ PI (k +1) PI 2 + 1 ε δ(k) ⊤ Pδ(k)(69) ≤ε∥P∥ ̃ ζ PI (k +1) PI 2 + ∥P∥ ε M 2 ℓ 2 ∥∆ ̄ e(k)∥ 2 (70) Since ̃ ζ PI (k +1) PI 2 ≤ 2∥M i ∥ 2 ∞ ∥ ̃ ζ PI (k)∥ 2 +2∥ ̃ w PI (k)∥ 2 ⇒ 2 ̃ ζ PI (k +1) PI ⊤ Pδ(k)≤ 2ε∥P∥M i ∥ 2 ∞ ∥ ̃ ζ PI (k)∥ 2 +2ε∥P∥ ̃ w PI (k)∥ 2 + ∥P∥ ε M 2 ℓ 2 ∥∆ ̄ e(k)∥ 2 = 2ε∥P∥M i ∥ 2 ∞ ∥ ̃ ζ PI (k)∥ 2 + ∥P∥ ε M 2 ℓ 2 ∥∆ ̄ e(k)∥ 2 +C 2 ∥ ̃ w PI (k)∥ 2 , where C 2 = 2ε∥P∥ • δ(k) ⊤ Pδ(k)≤∥P∥δ(k)∥ 2 ≤∥P∥M 2 ℓ 2 ∥∆ ̄ e(k)∥ 2 Therefore, ∆V PI ̃ ζ PI (k) PID ≤−μ ∗ PI ∥ ̃ ζ PI (k)∥ 2 +C 1 ∥ ̃ w PI (k)∥ 2 +2ε∥P∥M i ∥ 2 ∞ ∥ ̃ ζ PI (k)∥ 2 + ∥P∥ ε M 2 ℓ 2 ∥∆ ̄ e(k)∥ 2 +C 2 ∥ ̃ w PI (k)∥ 2 +∥P∥M 2 ℓ 2 ∥∆ ̄ e(k)∥ 2 =−(μ ∗ PI −2ε∥P∥M i ∥ 2 ∞ )∥ ̃ ζ PI (k)∥ 2 +∥P∥M 2 ℓ 2 1 ε +1 ∥∆ ̄ e(k)∥ 2 +C 3 ∥ ̃ w PI (k)∥ 2 , (71) 25 Preprint. where C 3 =C 1 +C 2 . Bounding the increment term. From Eqn. 59 and applying the inequality (x+y +z) 2 ≤ 3(x 2 +y 2 +z 2 ), ∥∆ ̄ e(k +1)∥ 2 ≤ 3 ∥M p (k)−I∥ 2 ∞ +Mh ∥ ̃ ζ PI (k)∥ 2 + 3M 2 ℓ 2 ∥∆ ̄ e(k)∥ 2 + 3∥ ̃ w PID (k)∥ 2 , and so r ∥∆ ̄ e(k +1)∥ 2 −∥∆ ̄ e(k)∥ 2 ≤ 3r ∥M p (k)−I∥ 2 ∞ +Mh ∥ ̃ ζ PI (k)∥ 2 −r 1−3M 2 ℓ 2 ∥∆ ̄ e(k)∥ 2 + 3r∥ ̃ w PID (k)∥ 2 . (72) Combination Combining Eqn. 67, Ineq. 71, and Ineq. 72, ∆V PID (k)≤− μ ∗ PI −2ε∥P∥ ∞ ∥M i ∥ 2 ∞ −3r ∥M p (k)−I∥ 2 ∞ +Mh ∥ ̃ ζ PI (k)∥ 2 − r(1−3M 2 ℓ 2 )−∥P∥ ∞ M 2 ℓ 2 1 ε +1 ∥∆ ̄ e(k)∥ 2 +C∥ ̃ w PI (k)∥ 2 , where C =C 3 +r. Define S(r,ε) :=μ ∗ PI −2ε∥P∥ ∞ ∥M i ∥ 2 ∞ −3r ∥M p (k)−I∥ 2 ∞ +Mh ,(73) T (r,ε,ℓ) :=r(1−3M 2 ℓ 2 )−∥P∥ ∞ M 2 ℓ 2 1 ε +1 .(74) ISS of the PID loop follows if S(r,ε)> 0 and T (r,ε,ℓ)> 0. Feasible choices. We are free to choose any ε> 0 and r> 0 such that S(r,ε)> 0. One convenient selection is ε = μ ∗ PI 8∥P∥ ∞ ∥M i ∥ 2 ∞ , r = μ ∗ PI 8 ∥M p (k)−I∥ 2 ∞ +Mh ⇒ S(r,ε) = 3 8 μ ∗ PI > 0. With ε,r fixed as above, pick ℓ> 0 small enough to satisfy T (r,ε,ℓ)> 0, namely ℓ 2 < r ∥P∥ ∞ 1 ε +1 +3r M 2 , Under these choices,∆V PID (k)≤−α 3 ∥ζ PI (k)∥ 2 −α 4 ∥∆ ̄ e(k)∥ 2 +β∥w PI (k)∥ 2 for someα 3 ,α 4 ,β> 0, which satisfies condition (i) as in Eqn. 62 and proves ISS of the PID closed loop.□ B.7.2OVERSHOOTING UNDER PID LAW OF CONTROL Developing from Sec. B.6, we introduce scalar PID recursion along v: e v (k +1) =a(k)e v (k)−b(k)s v (k)−c(k)∆e v (k)+w ⊥ v (k), s v (k +1) =s v (k)+e v (k)−d v (k), (75) where a(k) :=v ⊤ M p (k)v, b(k) :=v ⊤ G(k)v, c(k) :=v ⊤ H(k)v, ∆e v (k) =v ⊤ ∆ ̄ e(k), w ⊥ v (k) =v ⊤ w ⊥ (k). By constructiona(k)≤ q < 1,b(k)≤ Mh,c(k)≤ MℓwithM := sup k ∥ ̄ A(k)∥,h :=∥K i ∥and ℓ :=∥K d ∥. We now impose an additional requirement on the derivative gainK d so that, without the effect of noise, the PID update secures the monotonic decrease ofe v (k)before the first negative peak of scalar error e v (k). Remark 4 (Pre-overshoot monotonic decrease of scalar errors)Assume the setting of Proposi- tion 4 and further suppose the scalar error trajectory before the first largest overshoot under PID law is smooth in the sense that there exists R≥ 1 such that e v (k−1) e v (k) ≤ Rfor all k = 1,2,...,i max −1,(76) 26 Preprint. whereA 0 := max k 0 ≤i≤k 1 |e v (i)| =|e v (i max )| from Eqn.53. Assume thatw ⊥ v ≡ 0 andd v ≡ 0. If, in addition, the derivative gain satisfies l =∥K d ∥ ≤ 1−q (R−1)M ,(77) then under PID law e v (k +1) ≤ e v (k)for all k = 0,1,...,i max −1. Proof. Beforek 0 , we havee v (k) > 0, sos v (k)≥ 0(sinces v accumulatese v ands v (0) = 0). For k 0 ≤k≤i max −1,s v (k)≥ 0 proved in remark 5 Hence e v (k +1) =a(k)e v (k)−b(k)s v (k)−c(k) e v (k)−e v (k−1) ≤a(k)e v (k)+c(k) e v (k−1)−e v (k) ≤ h a(k)+c(k)(R−1) i e v (k) ≤ h q +(R−1)Mℓ i e v (k) ≤ e v (k), where the last inequality is exactly Eqn. 77.□ Note forR: In practice, one may estimate a conservativeRfrom PI-law traces and use a small safety factor Adding Disturbance: With bounded disturbances, the scalar update reads e v (k +1) ≤ q +(R−1)c max e v (k) +|w ⊥ v (k)| , so the same one-step monotonicity conclusion holds whenever |w ⊥ v (k)|≤ 1− q +(R−1)c max e v (k) for all pre-first-largest-overshooting steps. If this smallness condition on disturbances fails at some step, one-step monotonicity may be lost, but the ISS bounds proved earlier still guarantee geometric decay up to a disturbance-dependent radius. Remark 5 (before the first negative peak, the integral state is positive)Assume the setting of Remark. 4. Hence, s v (k) > 0for all k =k 0 ,...,i max −1. Proof. We argue by contradiction. Suppose there exists the firstτ∈ [k 0 ,i max −1]such thats v (τ )≤ 0. Thens v (τ− 1) > 0, and since we are on the first negative lobe,e v (τ ) < 0. Compute the one-step change ofe v : e v (τ +1)−e v (τ ) = (a(τ )−1)e v (τ )−b(τ )s v (τ ) = (1−a(τ ))|e v (τ )| +b(τ )(−s v (τ )) > 0, becausea(τ )≤q< 1,e v (τ )< 0ands v (τ )≤ 0. Hencee v (τ +1)>e v (τ ). By the same reasoning, as long as bothe v (k)< 0 ands v (k)≤ 0 hold, we have e v (k+1)−e v (k)≥ (1−q)|e v (k)|+b min (−s v (k))> 0, whereb min := inf k b(k) > 0. Meanwhiles v (k+1) = s v (k) +e v (k)≤ s v (k)on that interval, so s v (k)is non-increasing; equivalenty−s v (k)is non-decreasing. Ife v stayed negative forever, then P N k=0 e v (τ +k)→−∞ , so−s v (k)would grow without bound and the incrementse v (k+1)−e v (k) would eventually be arbitrarily large, forcinge v to cross0in finite time. This contradicts the choice of i max as the first negative peak. Therefore suchτcannot exist ands v (k)> 0for allk =k 0 ,...,i max −1.□ Theorem 2 (PID reduces the first-overshoot amplitude) Let the first overshoot occur at indexk 0 with amplitudeA 0 (definition in Eqn. 53). Then, the first-overshoot amplitude under PID Steering, A PID 0 , satisfies A PID 0 ≤A PI 0 , where A PI 0 denotes the corresponding amplitude under PI Steering. Proof. Under the PI law we have A PI 0 =−a(i max −1)e v (i max −1)+b(i max −1)s v (i max −1)−w ⊥ v (i max −1), 27 Preprint. while under the PID law A PID 0 =−a(i max −1)e v (i max −1)+b(i max −1)s v (i max −1)+c(i max −1)∆e v (i max −1)(78) −w ⊥ v (i max −1),(79) Due to the monotone decrease before this first largest overshooting condition stated in the previous part and the fact that c(k)> 0, we have c(k 0 −1)∆e v (k 0 −1)< 0. Therefore, A PID 0 ≤ b(i max −1)s v (i max −1)−a(i max −1)e v (i max −1)−w ⊥ v (i max −1) = A PI 0 .(80) □ Remark 4 is neccessary because monotonic decrease ofe v (t)before the first peak is both a key technical property for proving Theorem 2 and a desirable feature of PID control itself. Indeed, as noted by ̊ Astr ̈ om & H ̈ agglund (1995a, p.70), poorly tuned derivative gains may produce non-monotonicity, in which case reducing only the first overshoot does not translate into improved overall behavior. CADDITIONAL EXPERIMENTAL RESULTS C.1QUALITATIVE EXAMPLES OF CONCEPT STEERING Fig. 7 and 8 show that varying the intervention strengthα∈ [0,1]produces a smooth and controllable progression of stylistic traits in the generated images. At low strengths (α≈ 0.2), subtle cues emerge, such as faint neon accents for the cyberpunk style or mild metallic shading for steampunk, while the overall image remains close to the original prompt. At moderate strengths (α≈ 0.5), stylistic features become more salient: cyberpunk generations exhibit vivid neon lighting and futuristic cityscapes, whereas steampunk outputs show prominent brass textures, gears, and industrial motifs. Importantly, in this regime, the central semantic content of the prompt (i.e. objects, entities, and spatial composition) is preserved with high fidelity. At high intervention strengths (α≥ 0.8), stylistic traits dominate the visual appearance, often saturating the scene with strong color palettes or dense textures, yet semantic alignment to the original prompt remains largely intact, indicating that the steering primarily affects style without eroding core content. 28 Preprint. Figure 7: concept cyberpunk. C.2JAILBREAKING LARGE LANGUAGE MODELS Tab. 3 reports a comprehensive comparison of attack success rate (ASR) and general benchmark performance across multiple instruction-tuned models under different defense methods. Overall, PID consistently achieves the highest ASR among defenses, while maintaining comparable performance on downstream benchmarks. 29 Preprint. Figure 8: Concept steampunk 30 Preprint. Table 3: Full comparison of Original, DIM, ITI, RePE, and PID across models on ASR and general benchmarks on all tested models. Bold = best, underline = second-best within each model (ASR column). MethodASR↑tinyArc↑tinyGSM8k strict↑tinyMMLU↑tinyTruthQA↑tinyHellaSwag↑tinyWinoGrande↑ Original–62.2917.6468.0356.4373.1870.65 DIM74.0361.9514.8066.1154.9572.4069.85 ITI70.1961.2815.5766.6254.7572.7170.12 RePE68.4461.0514.6065.7054.3072.0369.40 PID76.0761.2016.0167.2954.1072.5969.72 Original–68.3681.6872.5756.4178.8775.19 DIM96.1565.1580.8171.1955.2278.1474.42 ITI84.6165.7679.4871.2355.6378.3674.75 RePE80.3265.0078.9070.6055.0077.7374.15 PID96.4666.6180.7871.2255.5278.2874.58 Original–73.9690.1274.6064.5082.7073.77 DIM90.3872.7487.0174.3063.0181.9472.93 ITI33.6573.1589.2774.5564.0382.24073.31 RePE25.4272.4086.2073.9063.2081.5272.60 PID92.6572.1388.9674.5263.6082.6073.04 Original–55.8659.4063.4850.1975.9158.63 DIM88.4654.2458.6361.6849.7875.1057.94 ITI76.9253.6757.7761.8549.9575.2258.16 RePE70.1553.4057.0061.1049.5074.7557.53 PID89.7653.9357.2662.0150.1975.0757.83 Original–65.3363.2162.0254.3982.5165.56 DIM93.2662.0160.5760.9654.1781.7364.81 ITI79.8064.2661.8561.3754.3382.0165.21 RePE70.4261.4060.0060.2053.7081.3564.45 PID94.8562.3061.9961.5454.2481.8764.93 Original–69.3183.1976.6055.0782.3172.34 DIM77.8868.2180.1472.2951.8681.4571.51 ITI35.5768.3281.4775.3353.1381.7071.82 RePE28.6467.5079.2071.1051.1081.2071.15 PID79.5067.9179.2474.8952.4981.5971.42 Qwen2.5-3BInstruct Qwen2.5-7BInstruct Qwen2.5-14BInstruct Llama3.2-3BInstruct Llama3.1-8BInstruct Gemma2-9BInstruct 31