Topological Steering

# Topological Steering
Source: [https://arxiv.org/html/2609.00597](https://arxiv.org/html/2609.00597)
Benoît GuérandAffiliation:Department of MathematicsAffiliation:National University of Singapore \(NUS\)Affiliation:2 Science Drive 2, Singapore 117543Email:[benoit\.guerand@u\.nus\.edu](mailto:)Tan Minh NguyenAffiliation:Department of MathematicsAffiliation:National University of Singapore \(NUS\)Affiliation:2 Science Drive 2, Singapore 117543Email:[tanmn@nus\.edu\.sg](mailto:)

###### Abstract

With the rapid rise of large language models \(LLMs\), controlling undesirable model behaviors has become increasingly important\. Existing behavioral control methods typically intervene directly in activation or feature space, but such approaches can be sensitive to outliers, distributional shifts, noise, and other local perturbations\. Motivated by Topological Data Analysis \(TDA\), which captures global rather than purely local structure, we propose Topological Steering, a new framework for steering LLM behavior through the topological representation of activation spaces\. Using persistence diagrams, our method connects activation\-based steering with TDA and enables more robust behavioral control\. We show that Topological Steering consistently modifies LLM behavior across multiple model families and model sizes\.

## 1Introduction

Large language models \(LLMs\) are increasingly deployed as general\-purpose assistants, yet their behavior remains difficult to control reliably\. Even highly aligned models can produce harmful, dishonest, sycophantic, or otherwise undesirable outputs under adversarial or distribution\-shifted prompts\. As a result, a growing line of work has sought lightweight mechanisms for controlling model behavior at inference time, without retraining the model or modifying its weights\[[3](https://arxiv.org/html/2609.00597#bib.bib1),[16](https://arxiv.org/html/2609.00597#bib.bib2),[2](https://arxiv.org/html/2609.00597#bib.bib3)\]\.

A particularly promising direction is*activation steering*\[[15](https://arxiv.org/html/2609.00597#bib.bib4)\], which intervenes directly on internal representations\. Early methods showed that adding a fixed steering vector to the residual stream can induce predictable changes in sentiment, refusal, truthfulness, or safety\-related behavior\. Subsequent approaches, including contrastive activation addition\[[14](https://arxiv.org/html/2609.00597#bib.bib5)\]and more recent nonlinear or rotational interventions\[[16](https://arxiv.org/html/2609.00597#bib.bib2)\], have improved the flexibility of this paradigm\. However, most existing steering methods are fundamentally*geometric and local*: they construct directions from means, linear contrasts, or low\-dimensional subspaces in activation space\. Such approaches can be effective, but they implicitly assume that the behavioral concept of interest is well captured by a simple global direction or a smooth local transformation\.

This assumption is often too restrictive\. Behavioral representations in LLMs may be multimodal, nonlinearly organized, and distributed across heterogeneous regions of activation space\. For example, refusal behavior may not correspond to a single cluster or linear axis; instead, it may be supported by several distinct activation substructures associated with different prompt types, semantic contexts, or safety mechanisms\. In such settings, a global mean\-difference vector can dilute or average away the relevant signal, while purely local geometric interventions may be sensitive to outliers, noise, and small perturbations\. These limitations motivate a more structural view of activation space: rather than asking only where individual activations lie, we ask what*shape*the activation cloud has and which multiscale structures distinguish one behavioral regime from another\.

Topological Data Analysis \(TDA\) provides mathematical tools precisely for this purpose\. Persistent homology summarizes the multiscale topology of a point cloud by tracking when connected components, loops, and higher\-dimensional features appear and disappear as a distance scale varies\. The resulting persistence diagrams are stable summaries of global structure and have been widely studied as robust descriptors of complex high\-dimensional data\. Historically\[[1](https://arxiv.org/html/2609.00597#bib.bib6),[5](https://arxiv.org/html/2609.00597#bib.bib7)\], however, the use of TDA in large\-scale machine learning has been limited by computational cost: persistent homology can be expensive to compute inside training loops or on very large datasets\. In the context of inference\-time steering, this bottleneck is substantially reduced\. Steering requires only a finite collection of activation vectors from contrastive prompt sets, making it possible to use persistent topology as an actionable signal for intervention design\.

Contribution\.In this paper, we introduce*Topological Steering*, a new inference\-time method for controlling LLM behavior through the topology of activation spaces\. Given contrastive prompt sets, such as refusal\-eliciting and compliance\-eliciting prompts, we extract residual\-stream activations and view them as point clouds\. We then apply joint dimensionality reduction, compute Vietoris–Rips persistence diagrams, and compare the diagrams of the two behavioral regimes\. Features that are both persistent and specific to the target behavior are used to identify coherent activation subsets, rather than averaging indiscriminately over all examples\. These subsets define localized contrastive directions, which are aggregated into a steering vector and injected into the residual stream during generation\.

The key idea is that topology provides a mechanism for moving beyond global centroid shifts\. Classical activation steering\[[14](https://arxiv.org/html/2609.00597#bib.bib5)\]constructs a direction from the mean difference between positive and negative activations\. Topological Steering instead identifies robust, behavior\-specific substructures in the positive activation cloud and steers using directions derived from those substructures\. This allows the intervention to reflect the heterogeneous organization of behavioral concepts in representation space, while also providing an interpretable account of which activation components support the steering signal\.

Our contributions are three\-fold:

1. 1\.Topology\-Aware Steering for LLMs:We introduce Topological Steering, an inference\-time framework that uses tools from Topological Data Analysis to construct steering directions from the multiscale structure of LLM activation spaces\. By applying TDA outside the training loop, our method avoids the computational bottlenecks that have historically limited its use in large\-scale deep learning\.
2. 2\.Structural Interpretability via Persistence Diagrams:In contrast to linear or angular steering methods\[[16](https://arxiv.org/html/2609.00597#bib.bib2)\]that operate through geometric shifts in activation space, our approach uses persistence diagrams to identify robust topological features of behavioral representations, such as connected components and higher\-order structures\. This provides an interpretable way to localize behavior\-relevant regions in the residual stream\.
3. 3\.Empirical Validation for Topological Intervention:We demonstrate that Topological Steering consistently improves over unsteered baselines and produces measurable behavioral changes across model families and sizes\. While the current implementation is not intended to outperform highly optimized geometric steering methods, it offers a complementary trade\-off: sacrificing some raw efficacy in exchange for a more structured and inspectable intervention mechanism grounded in the topology of activation space\.

## 2Related work

Activation Steering\.Because of its simplistic idea, activation steering has emerged as a lightweight, inference\-time alternative to fine\-tuning, enabling researchers to alter Large Language Model \(LLM\) behavior by perturbing internal representations during the forward pass\. In the early foundational work, it was shown that a linear intervention, i\.e\., adding a fixed “steering vector” to the residual stream, could shift model sentiment and alignment properties\[[15](https://arxiv.org/html/2609.00597#bib.bib4)\]\. This technique was naturally refined with more advanced methods, such as Contrastive Activation Addition \(CAA\), which isolates behavioral directions by averaging activation differences between paired positive and negative prompts\[[14](https://arxiv.org/html/2609.00597#bib.bib5)\]\.

Most Recent Steering Methods\.Most recently, the field has begun exploring beyond purely additive, translational shifts; for instance, Angular Steering frames behavioral control as rotational interventions within fixed activation subspaces\[[16](https://arxiv.org/html/2609.00597#bib.bib2)\]\. However, while these methods successfully manipulate representations, they predominantly treat the activation space as possessing relatively simple geometry\. This leaves room for approaches such as Topological Steering that can isolate and leverage the complex, global, and non\-linear invariants inherent to high\-dimensional data manifolds\.

Topological Data Analysis and Persistent Homology\.TDA provides a rigorous mathematical framework for quantifying the "shape" of complex, high\-dimensional datasets\. One of the most important methods of TDA is persistent homology\[[10](https://arxiv.org/html/2609.00597#bib.bib9),[7](https://arxiv.org/html/2609.00597#bib.bib10)\], which tracks the evolution of topological features such as connected components, one\-dimensional loops, and higher\-dimensional voids across a continuous range of spatial scales\. By constructing a sequence of expanding simplicial complexes \(e\.g\., a Vietoris\-Rips filtration\) over a point cloud, persistent homology records the scale at which each topological feature appears \(birth\) and the scale at which it ultimately merges or closes \(death\)\. These structural invariants are summarized in a Persistence Diagram, offering a multiscale signature of the data’s topology\. According to stability theorems\[[8](https://arxiv.org/html/2609.00597#bib.bib11)\], Persistence Diagrams are robust to noise and continuous geometric deformations within the data manifold\. This is why they have been the subject of extensive research in machine learning\.

Topological Machine Learning\.The integration of these topological summaries into deep learning led to the creation of the term Topological Machine Learning\. Initially, the main focus was on improving Persistence Diagrams\. PDs are inherently discrete, and to make these topological features compatible with standard neural networks, researchers have developed stable, finite\-dimensional vectorization techniques, the most famous being Persistence Landscapes\[[6](https://arxiv.org/html/2609.00597#bib.bib12)\]in 2015 and Persistence images\[[1](https://arxiv.org/html/2609.00597#bib.bib6)\]in 2016\. In the following year, the researchers developed differentiable topological layers\[[11](https://arxiv.org/html/2609.00597#bib.bib13),[5](https://arxiv.org/html/2609.00597#bib.bib7)\], allowing models to optimize for specific topological properties directly during gradient descent\.

Despite their theoretical elegance, these methods were fundamentally limited by computational constraints\. The combinatorial explosion of tracking high\-dimensional simplices, coupled with the expensive matrix reduction algorithms required for persistent homology, scaled poorly\. Consequently, computing these topological penalties within the iterative training loops of large\-scale models became prohibitively slow and memory\-intensive, thereby stalling the field of Topological Machine Learning\. Our method revives these powerful topological tools by shifting their application from training\-time optimization to inference\-time activation steering, effectively bypassing the historical computational barrier\.

## 3Background

This section introduces the technical ingredients used by our method\. We first formalize the transformer computation and the activation\-steering intervention used at inference time\. We then review the topological knowledge needed to characterize activation geometry: persistent homology, persistence diagrams, and Vietoris–Rips filtrations\. Together, these tools let us connect representation\-level interventions \(steering vectors in residual space\) with structure\-level summaries \(topological features across scales\), which is the central perspective ofTopological Steering\. Some supplementary details can be found in the Appendix[A\.1](https://arxiv.org/html/2609.00597#A1.SS1)\.

### 3\.1Transformers and Activation Steering

For the rest of the paper we are going to fix the notation for a decoder\-only transformer withLLlayers, hidden widthdhd\_\{h\}, and token sequence lengthTT\. At a layerℓ∈\{0,…,L−1\}\\ell\\in\\\{0,\\dots,L\-1\\\}we have self attention denotedAttn\(ℓ\)\\mathrm\{Attn\}^\{\(\\ell\)\}with head dimensiondkd\_\{k\}\.

Activation steering modifies an internal residual activation at a chosen layerℓ⋆\\ell^\{\\star\}and token positiont⋆t^\{\\star\}\(often the final prompt token\[[17](https://arxiv.org/html/2609.00597#bib.bib8),[14](https://arxiv.org/html/2609.00597#bib.bib5),[15](https://arxiv.org/html/2609.00597#bib.bib4)\]\) by adding a direction vector at inference time:ht⋆\(ℓ⋆\)′=ht⋆\(ℓ⋆\)\+α𝐯,h\_\{t^\{\\star\}\}^\{\(\\ell^\{\\star\}\)\\,\\prime\}=h\_\{t^\{\\star\}\}^\{\(\\ell^\{\\star\}\)\}\+\\alpha\\,\\mathbf\{v\},where:ht⋆\(ℓ⋆\)∈ℝdhh\_\{t^\{\\star\}\}^\{\(\\ell^\{\\star\}\)\}\\in\\mathbb\{R\}^\{d\_\{h\}\}is the original residual activation,𝐯∈ℝdh\\mathbf\{v\}\\in\\mathbb\{R\}^\{d\_\{h\}\}is the steering vector, andα∈ℝ\\alpha\\in\\mathbb\{R\}is a scalar steering strength\.

### 3\.2Persistent Homology, Persistence Diagrams and Vietoris–Rips Filtration

Persistent homologyis a multiscale way to describe the shape of a point cloudXX\(here, activation vectors\)\. As we vary a distance scaleϵ\\epsilon, topological features \(connected components, loops, etc\.\) appear and disappear; for featureii, we denote its birth and death by\(bi,δi\)\(b\_\{i\},\\delta\_\{i\}\), and its persistence byπi=δi−bi\\pi\_\{i\}=\\delta\_\{i\}\-b\_\{i\}\. Features with largerπi\\pi\_\{i\}are more stable across scales and are treated as more structurally meaningful\.

APersistence Diagramis the set of birth–death pairsD⁡\(X\)=\{\(bi,δi\)\}iD\(X\)=\\\{\(b\_\{i\},\\delta\_\{i\}\)\\\}\_\{i\}returned by persistent homology\. Each point corresponds to one topological feature, and its distance from the diagonal\(u,u\)\(u,u\)equals \(up to a constant factor\) its persistenceπi\\pi\_\{i\}\. In our method, these diagrams summarize activation geometry and allow comparison between harmful and harmless activation clouds\.

To compute Persistent Homology, we build aVietoris–Rips Filtrationfrom pairwise distances\. For each scaleϵ\\epsilon, we connect points inXXwhose distance is at mostϵ\\epsilon, forming a simplicial complexVRϵ​\(X\)\\mathrm\{VR\}\_\{\\epsilon\}\(X\)\. Asϵ\\epsilonincreases, these complexes are nested, and tracking topology across this nested sequence yields the birth/death pairs used in our theory and experiments\.

## 4Topological Steering

### 4\.1Motivation for Topological Steering

Classical activation steering typically uses a global contrastive direction𝐯base=X¯\+−X¯−,\\mathbf\{v\}\_\{\\text\{base\}\}=\\bar\{X\}^\{\+\}\-\\bar\{X\}^\{\-\},whereX¯\+\\bar\{X\}^\{\+\}andX¯−\\bar\{X\}^\{\-\}are class means of harmful and harmless activations\. This is optimal only under restrictive geometric assumptions \(e\.g\., approximately unimodal classes with similar covariance structure\), where a single linear axis captures the relevant class gap\.

A convenient way to see this is through a mixture model\. Suppose harmful activations are multi\-modal:p\+​\(x\)=∑r=1Rπr​pr​\(x\),p^\{\+\}\(x\)=\\sum\_\{r=1\}^\{R\}\\pi\_\{r\}\\,p\_\{r\}\(x\),∑r=1Rπr=1,πr\>0,\\sum\_\{r=1\}^\{R\}\\pi\_\{r\}=1,\\;\\pi\_\{r\}\>0,while harmless activations followp−​\(x\)p^\{\-\}\(x\)\. ThenX¯\+−X¯−=∑r=1Rπr​\(μr−μ−\),\\bar\{X\}^\{\+\}\-\\bar\{X\}^\{\-\}=\\sum\_\{r=1\}^\{R\}\\pi\_\{r\}\\bigl\(\\mu\_\{r\}\-\\mu^\{\-\}\\bigr\),withμr=𝔼x∼pr​\[x\]\\mu\_\{r\}=\\mathbb\{E\}\_\{x\\sim p\_\{r\}\}\[x\]andμ−=𝔼x∼p−​\[x\]\\mu^\{\-\}=\\mathbb\{E\}\_\{x\\sim p^\{\-\}\}\[x\]\. Hence𝐯base\\mathbf\{v\}\_\{\\text\{base\}\}averages over potentially incompatible behavioral modes; if only a subset of modes encode refusal behavior, their signal is diluted by unrelated components\.

This motivates replacing “global centroid shift” with “structure\-aware subset shift\.” Let𝒮\+⊂X\+\\mathcal\{S\}^\{\+\}\\subset X^\{\+\}denote activation subsets that correspond to robust refusal structure\. The desired direction is𝐯⋆≈μ𝒮\+−μ−,\\mathbf\{v\}\_\{\\star\}\\approx\\mu\_\{\\mathcal\{S\}^\{\+\}\}\-\\mu^\{\-\},whereμ𝒮\+\\mu\_\{\\mathcal\{S\}^\{\+\}\}is the mean of the structurally selected subset, not of the entire harmful cloud\. The challenge is to identify𝒮\+\\mathcal\{S\}^\{\+\}without supervision on latent modes\.

Topological summaries provide a natural criterion because they are multiscale and coordinate\-free\. Given a filtration\{𝒦ϵ\}ϵ≥0\\\{\\mathcal\{K\}\_\{\\epsilon\}\\\}\_\{\\epsilon\\geq 0\}on the activation cloud, persistent homology yields featuresγi=\(bi,δi\),\\gamma\_\{i\}=\(b\_\{i\},\\delta\_\{i\}\),pers⁡\(γi\)=δi−bi,\\mathrm\{pers\}\(\\gamma\_\{i\}\)=\\delta\_\{i\}\-b\_\{i\},where high persistence indicates geometric stability across scales\. Comparing harmful and harmless diagrams introduces a second criterion: behavioral specificity\. Ifm⁡\(γi\+\)m\(\\gamma\_\{i\}^\{\+\}\)is the optimal match of harmful featureγi\+\\gamma\_\{i\}^\{\+\}in the harmless diagram \(or diagonal\), defineci=d∞​\(γi\+,m⁡\(γi\+\)\),c\_\{i\}=d\_\{\\infty\}\\\!\\bigl\(\\gamma\_\{i\}^\{\+\},\\,m\(\\gamma\_\{i\}^\{\+\}\)\\bigr\),so largecic\_\{i\}indicates a refusal\-unique topological signature\.

We therefore seek features that are simultaneously*stable*and*class\-specific*:ℱsel=\{γi\+:pers\(γi\+\)≥πmin,ci≥cmin\}\.\\mathcal\{F\}\_\{\\text\{sel\}\}=\\bigl\\\{\\gamma\_\{i\}^\{\+\}:\\;\\mathrm\{pers\}\(\\gamma\_\{i\}^\{\+\}\)\\geq\\pi\_\{\\min\},\\;c\_\{i\}\\geq c\_\{\\min\}\\bigr\\\}\.Each selected feature induces a local componentCi⊂X\+C\_\{i\}\\subset X^\{\+\}and a local contrastive direction𝐯i\\mathbf\{v\}\_\{i\}\. Topological steering then constructs𝐯steer=∑i∈ℱselωi​𝐯i,\\mathbf\{v\}\_\{\\text\{steer\}\}=\\sum\_\{i\\in\\mathcal\{F\}\_\{\\text\{sel\}\}\}\\omega\_\{i\}\\,\\mathbf\{v\}\_\{i\},ωi∝pers⁡\(γi\+\)​ci​Δi,\\omega\_\{i\}\\propto\\mathrm\{pers\}\(\\gamma\_\{i\}^\{\+\}\)\\,c\_\{i\}\\,\\Delta\_\{i\},which emphasizes refusal\-relevant submanifolds rather than global class averages\.

In short, the motivation is that refusal behavior in residual space is often*structurally heterogeneous*: linear global means collapse this heterogeneity, whereas persistent topology isolates robust local structure and yields steering directions with stronger mechanistic interpretability\.

### 4\.2Overview of Topological Steering

We propose*Topological Steering*, a method for constructing activation\-space steering vectors for large language models \(LLMs\) that exploits persistent\-homology structure in residual\-stream representations\. Rather than using the global mean difference between harmful and harmless activations, we identify topologically\-significant, refusal\-unique sub\-clusters in the harmful activation cloud and use those to derive a more precise steering direction\. The end\-to\-end pipeline consists of five key steps:

1. 1\.Activation Extraction and Joint Projection:We hook into an intermediate transformer layerℓ\\ellto extract residual stream representations for both harmful \(X\+X^\{\+\}\) and harmless \(X−X^\{\-\}\) prompts\. We project these sets into a shared low\-dimensional subspace using joint PCA\.
2. 2\.Topological Feature Extraction:We treat the projected activations as finite metric spaces and compute their persistent homology via Vietoris–Rips filtrations\. This yields persistence diagrams \(Dgm\+\\mathrm\{Dgm\}^\{\+\}andDgm−\\mathrm\{Dgm\}^\{\-\}\) that capture the birth and death of topological features \(e\.g\., connected components\) across multiple spatial scales\.
3. 3\.Refusal\-Unique Feature Selection:We compare the topological summaries of both classes using optimal bottleneck matching\. By identifying features with high persistence \(geometric stability\) and high mismatch cost \(absence in the harmless class\), we isolate structural signatures that uniquely encode refusal behavior\.
4. 4\.Local Steering Vector Assembly:For each selected topological feature, we trace back to its constituent points in the activation cloud\. We compute local contrastive vectors \(𝐯i\\mathbf\{v\}\_\{i\}\) between these refusal\-specific clusters and their nearest harmless neighbors, weighting them by their topological significance and effect size to form the final aggregate vector,𝐯steer\\mathbf\{v\}\_\{\\text\{steer\}\}\.
5. 5\.Inference\-Time Intervention:During autoregressive generation,𝐯steer\\mathbf\{v\}\_\{\\text\{steer\}\}is injected into the target layer’s residual stream, consistently nudging the model toward the robustly identified refusal sub\-manifolds without compromising the surrounding semantic space\.

The advantages of the Topological Steering approach are the following:

- •Heterogeneity Awareness:It identifies and leverages specific, local clusters of target behavior, ensuring that the steering vector is not diluted by averaging disjoint sub\-populations\.
- •Coordinate\-Free Robustness:Because persistent homology characterizes the intrinsic geometry of representations independently of rigid coordinate assumptions, the method is highly resilient to noise and varied prompt distributions\.
- •Enhanced Specificity:The dual criteria of persistence and cross\-class mismatch ensure that the resulting steering vector is heavily anchored in features unique to the target behavior, maximizing the separation margin and minimizing off\-target side effects\.
- •Computational Cost:Traditional TDA methods for Deep Learning were focused on the training aspect but here we intervene only at the inference time, reducing the compute cost drastically\.

### 4\.3Notation and Setup

Letℳ\\mathcal\{M\}be a decoder\-only transformer withLLlayers\. Given an input prompt, we denote the residual\-stream activation at layerℓ\\elland the final token position ashℓ∈ℝdhh\_\{\\ell\}\\in\\mathbb\{R\}^\{d\_\{h\}\}, wheredhd\_\{h\}is the model’s hidden dimension\. We collect two datasets of prompts:

- •𝒟\+=\{si\+\}i=1N\+\\mathcal\{D\}^\{\+\}=\\\{s\_\{i\}^\{\+\}\\\}\_\{i=1\}^\{N^\{\+\}\}:*harmful*prompts that elicit model refusals\.
- •𝒟−=\{sj−\}j=1N−\\mathcal\{D\}^\{\-\}=\\\{s\_\{j\}^\{\-\}\\\}\_\{j=1\}^\{N^\{\-\}\}:*harmless*prompts on similar topics that elicit compliance\.

We split each dataset into disjoint train and holdout sets\. All steering vectors are derived exclusively from the train split; holdout activations are used only for evaluation\.

### 4\.4Activation Extraction

For each promptsi\+s\_\{i\}^\{\+\}\(resp\.sj−s\_\{j\}^\{\-\}\), we register a forward hook on the output of transformer blockℓ\\elland record the last\-token residual:X\+=\[hℓ​\(s1\+\),…,hℓ​\(sNtr\+\)\]∈ℝNtr\+×dhX^\{\+\}=\\bigl\[h\_\{\\ell\}\(s\_\{1\}^\{\+\}\),\\,\\ldots,\\,h\_\{\\ell\}\(s\_\{N\_\{\\text\{tr\}\}\}^\{\+\}\)\\bigr\]\\in\\mathbb\{R\}^\{N\_\{\\text\{tr\}\}^\{\+\}\\times d\_\{h\}\}andX−=\[hℓ​\(s1−\),…,hℓ​\(sNtr−\)\]∈ℝNtr−×dh\.X^\{\-\}=\\bigl\[h\_\{\\ell\}\(s\_\{1\}^\{\-\}\),\\,\\ldots,\\,h\_\{\\ell\}\(s\_\{N\_\{\\text\{tr\}\}\}^\{\-\}\)\\bigr\]\\in\\mathbb\{R\}^\{N\_\{\\text\{tr\}\}^\{\-\}\\times d\_\{h\}\}\.The choice of layerℓ\\ellis treated as a hyperparameter and swept over mid\-to\-late layers\.

### 4\.5Joint PCA Projection

Hidden dimensionsdhd\_\{h\}\(e\.g\.,dh=4096d\_\{h\}=4096for Llama\-3\.1\-8B\) are too large for tractable persistent\-homology computation\. We reduce dimensionality via joint PCA: both activation sets are projected into the same low\-dimensional space so that their relative geometry is preserved\. Concretely, we concatenateX±X^\{\\pm\}intoXall=\[X\+;X−\]∈ℝ\(N\+\+N−\)×dhX\_\{\\text\{all\}\}=\[X^\{\+\};X^\{\-\}\]\\in\\mathbb\{R\}^\{\(N^\{\+\}\+N^\{\-\}\)\\times d\_\{h\}\}, fit PCA onXallX\_\{\\text\{all\}\}, and project:X~\+=X\+​Wpca\\tilde\{X\}^\{\+\}=X^\{\+\}W\_\{\\text\{pca\}\},X~−=X−​Wpca\\tilde\{X\}^\{\-\}=X^\{\-\}W\_\{\\text\{pca\}\},Wpca∈ℝdh×kW\_\{\\text\{pca\}\}\\in\\mathbb\{R\}^\{d\_\{h\}\\times k\}, wherek≪dhk\\ll d\_\{h\}is the number of retained components \(defaultk=32k=32\)\. The effective rank is capped atmin⁡\(k,N\+\+N−−1,dh\)\\min\(k,\\,N^\{\+\}\+N^\{\-\}\-1,\\,d\_\{h\}\)to avoid degeneracy\.

### 4\.6Persistent Homology of Activation Clouds

We model each projected activation set as a finite metric space \(point cloud\) and compute its persistent homology using the Vietoris–Rips filtration\[[9](https://arxiv.org/html/2609.00597#bib.bib14)\]\.

Given a point cloudP⊂ℝkP\\subset\\mathbb\{R\}^\{k\}and a scale parameterϵ≥0\\epsilon\\geq 0, the Vietoris–Rips complexVR⁡\(P,ϵ\)\\mathrm\{VR\}\(P,\\epsilon\)is the simplicial complex containing every simplexσ⊆P\\sigma\\subseteq Pwhose pairwise diameter is at mostϵ\\epsilon\. Asϵ\\epsilongrows from00to∞\\infty, topological features \(connected components in degreeH0H\_\{0\}, loops in degreeH1H\_\{1\}, etc\.\) are born and die\. The Persistence DiagramDgmq​\(P\)\\mathrm\{Dgm\}\_\{q\}\(P\)records eachqq\-dimensional feature as a point\(β,δ\)∈ℝ2\(\\beta,\\delta\)\\in\\mathbb\{R\}^\{2\}with birthβ\\betaand deathδ\\delta; its persistence isπ=δ−β\\pi=\\delta\-\\beta\.

We compute persistence diagrams separately for each class:Dgm\+=Dgm⁡\(X~\+\)\\mathrm\{Dgm\}^\{\+\}=\\mathrm\{Dgm\}\(\\tilde\{X\}^\{\+\}\),Dgm−=Dgm⁡\(X~−\)\\mathrm\{Dgm\}^\{\-\}=\\mathrm\{Dgm\}\(\\tilde\{X\}^\{\-\}\), using the Ripser algorithm\[[4](https://arxiv.org/html/2609.00597#bib.bib15)\]withℤ/2​ℤ\\mathbb\{Z\}/2\\mathbb\{Z\}coefficients\. We computeH0H\_\{0\}features by default and optionallyH1H\_\{1\}features\.

### 4\.7Feature Matching and Refusal\-Unique Feature Selection

A topological feature inDgm\+\\mathrm\{Dgm\}^\{\+\}is refusal\-unique if it has no close counterpart inDgm−\\mathrm\{Dgm\}^\{\-\}\. To operationalise this, we compute an optimal matching betweenDgmq\+\\mathrm\{Dgm\}^\{\+\}\_\{q\}andDgmq−\\mathrm\{Dgm\}^\{\-\}\_\{q\}\(for each homology degreeqq\) under the bottleneck distance\[[8](https://arxiv.org/html/2609.00597#bib.bib11)\]\. Each featureγi\+∈Dgmq\+\\gamma\_\{i\}^\{\+\}\\in\\mathrm\{Dgm\}^\{\+\}\_\{q\}is matched to its nearest counterpartγσ⁡\(i\)−∈Dgmq−\\gamma\_\{\\sigma\(i\)\}^\{\-\}\\in\\mathrm\{Dgm\}^\{\-\}\_\{q\}\(or to the diagonal if no finite match exists\), yielding a mismatch costci=d∞​\(γi\+,γσ⁡\(i\)−\)c\_\{i\}=d\_\{\\infty\}\(\\gamma\_\{i\}^\{\+\},\\,\\gamma\_\{\\sigma\(i\)\}^\{\-\}\)\. We rank all finite features by their persistenceπi\\pi\_\{i\}and mismatch costcic\_\{i\}, filtering by thresholdsπmin\\pi\_\{\\text\{min\}\}andcminc\_\{\\text\{min\}\}:ℱ=\{γi\+:πi≥πmin,ci≥cmin\}\\mathcal\{F\}=\\bigl\\\{\\gamma\_\{i\}^\{\+\}\\,:\\,\\pi\_\{i\}\\geq\\pi\_\{\\text\{min\}\},\\;\\;c\_\{i\}\\geq c\_\{\\text\{min\}\}\\bigr\\\},sorted by​\(πi,ci\)​descending\.\\text\{sorted by \}\(\\pi\_\{i\},\\,c\_\{i\}\)\\text\{ descending\.\}

### 4\.8Steering Vector Construction

For each selectedH0H\_\{0\}featureγi\+∈ℱ\\gamma\_\{i\}^\{\+\}\\in\\mathcal\{F\}, we identify the corresponding sub\-cluster of harmful activations using the death radius\. Specifically, the death valueδi\\delta\_\{i\}of theH0H\_\{0\}feature corresponds to the scale at which its connected component merges into a larger one in the Vietoris–Rips filtration\. We extract the points belonging to that component just before merger:Ci=\{x∈X~\+:x​is in the component born at​γi\+​within radius​δi−ε\}C\_\{i\}=\\bigl\\\{x\\in\\tilde\{X\}^\{\+\}\\,:\\,x\\text\{ is in the component born at \}\\gamma\_\{i\}^\{\+\}\\text\{ within radius \}\\delta\_\{i\}\-\\varepsilon\\bigr\\\}, whereε\>0\\varepsilon\>0is a small numerical tolerance\. Only components satisfying\|Ci\|≥mmin\|C\_\{i\}\|\\geq m\_\{\\text\{min\}\}\(a minimum size threshold\) are retained\.

For each componentCiC\_\{i\}, we identify theknegk\_\{\\text\{neg\}\}nearest harmless training points \(in PCA space\) to the component centroid, forming a local negative contrast setNi⊂X−N\_\{i\}\\subset X^\{\-\}\. The per\-component steering direction is:𝐯i=X¯Ci\+−X¯Ni−\\mathbf\{v\}\_\{i\}=\\bar\{X\}^\{\+\}\_\{C\_\{i\}\}\-\\bar\{X\}^\{\-\}\_\{N\_\{i\}\},X¯Ci\+=1\|Ci\|​∑j∈Cixj\+\\bar\{X\}^\{\+\}\_\{C\_\{i\}\}=\\frac\{1\}\{\|C\_\{i\}\|\}\\sum\_\{j\\in C\_\{i\}\}x\_\{j\}^\{\+\},X¯Ni−=1\|Ni\|​∑j∈Nixj−\.\\bar\{X\}^\{\-\}\_\{N\_\{i\}\}=\\frac\{1\}\{\|N\_\{i\}\|\}\\sum\_\{j\\in N\_\{i\}\}x\_\{j\}^\{\-\}\.Each direction is weighted by a quality score combining persistence, mismatch cost, and the Cohen’sddeffect size along𝐯i\\mathbf\{v\}\_\{i\}:

Δi\\displaystyle\\Delta\_\{i\}=\|P¯i−N¯i\|σpool​\(Pi,Ni\),\\displaystyle=\\frac\{\|\\bar\{P\}\_\{i\}\-\\bar\{N\}\_\{i\}\|\}\{\\sigma\_\{\\text\{pool\}\}\(P\_\{i\},\\,N\_\{i\}\)\},\(1\)wi\\displaystyle w\_\{i\}=πi⋅ci⋅Δi,\\displaystyle=\\pi\_\{i\}\\cdot c\_\{i\}\\cdot\\Delta\_\{i\},\(2\)whereP¯i\\bar\{P\}\_\{i\}\(resp\.N¯i\\bar\{N\}\_\{i\}\) is the mean projection ofCiC\_\{i\}\(resp\.NiN\_\{i\}\) onto𝐯^i\\hat\{\\mathbf\{v\}\}\_\{i\}, andσpool\\sigma\_\{\\text\{pool\}\}is the pooled standard deviation\. The final steering vector is the normalised weighted sum over the top\-KKcomponents:

𝐯steer=∑i=1Kwi∑jwj​𝐯i,\\mathbf\{v\}\_\{\\text\{steer\}\}=\\sum\_\{i=1\}^\{K\}\\frac\{w\_\{i\}\}\{\\sum\_\{j\}w\_\{j\}\}\\,\\mathbf\{v\}\_\{i\},\(3\)
with orientation enforced so that⟨𝐯steer,X¯\+⟩\>⟨𝐯steer,X¯−⟩\\langle\\mathbf\{v\}\_\{\\text\{steer\}\},\\,\\bar\{X\}^\{\+\}\\rangle\>\\langle\\mathbf\{v\}\_\{\\text\{steer\}\},\\,\\bar\{X\}^\{\-\}\\rangle\. We compare against the naive mean\-difference direction𝐯base=X¯\+−X¯−\\mathbf\{v\}\_\{\\text\{base\}\}=\\bar\{X\}^\{\+\}\-\\bar\{X\}^\{\-\}, which corresponds to the standard activation\-steering approach\[[17](https://arxiv.org/html/2609.00597#bib.bib8)\]\.

### 4\.9Inference\-Time Steering

At inference time, we inject the steering vector into the residual stream at the same layerℓ\\ellused for extraction\. Given a new input promptss, we modify the last\-token hidden state at every generation step:hℓ​\(⋅\)←hℓ​\(⋅\)\+α⋅𝐯steer‖𝐯steer‖h\_\{\\ell\}\(\\cdot\)\\;\\leftarrow\\;h\_\{\\ell\}\(\\cdot\)\+\\alpha\\cdot\\frac\{\\mathbf\{v\}\_\{\\text\{steer\}\}\}\{\\\|\\mathbf\{v\}\_\{\\text\{steer\}\}\\\|\}, whereα\>0\\alpha\>0is the steering magnitude\. Applying the hook only at the final token position preserves the full autoregressive context while consistently nudging the model’s representation towards the refusal subspace\.

### 4\.10Evaluation Metric

We measure steering quality via the*refusal score*: the normalised class gap along the steering direction evaluated on held\-out activationsXho\+X^\{\+\}\_\{\\text\{ho\}\}andXho−X^\{\-\}\_\{\\text\{ho\}\}:ρ⁡\(𝐯\)=⟨𝐯,X¯ho\+⟩−⟨𝐯,X¯ho−⟩σpool​\(Xho\+,Xho−,𝐯\)\.\\rho\(\\mathbf\{v\}\)=\\frac\{\\langle\\mathbf\{v\},\\,\\bar\{X\}^\{\+\}\_\{\\text\{ho\}\}\\rangle\-\\langle\\mathbf\{v\},\\,\\bar\{X\}^\{\-\}\_\{\\text\{ho\}\}\\rangle\}\{\\sigma\_\{\\text\{pool\}\}\(X^\{\+\}\_\{\\text\{ho\}\},\\,X^\{\-\}\_\{\\text\{ho\}\};\\,\\mathbf\{v\}\)\}\.We report the*steering score delta*Δ​ρ=ρ⁡\(𝐯steer\)−ρ⁡\(𝐯base\)\\Delta\\rho=\\rho\(\\mathbf\{v\}\_\{\\text\{steer\}\}\)\-\\rho\(\\mathbf\{v\}\_\{\\text\{base\}\}\)as the primary comparative metric, where positive values indicate that our topological direction separates harmful from harmless activations more effectively than the baseline\.

## 5Experimentations

Following recent steering papers that separate representation\-level diagnostics from downstream behavioral tests \(e\.g\., refusal sweeps and automated judges; cf\. Angular Steering\[[16](https://arxiv.org/html/2609.00597#bib.bib2)\]\), we organize this section intoOPENi\)i\)datasets and modelsand then separate our experiment section intoOPENi​i\)ii\)aproof that TS is workingwith benchmarks and metrics[5\.2](https://arxiv.org/html/2609.00597#S5.SS2)andOPENi​i​i\)iii\)aproof that TS is working across different model architectures[5\.3](https://arxiv.org/html/2609.00597#S5.SS3)\. Unless stated otherwise, steering vectors are computed on training splits only, injected at inference as a normalized residual update at the last prompt token, and evaluated on held\-out activations and on open\-ended generations\. All experiments were run on an A100 \(40Gb\) and for reproductibility purposes the hyperparameter details are in Appendix[A\.5\.3](https://arxiv.org/html/2609.00597#A1.SS5.SSS3)\. Moreover proof that the experiment results we obtain are not due to randomness are in[A\.6](https://arxiv.org/html/2609.00597#A1.SS6)\.

### 5\.1Datasets and Models

##### Construction of Contrastive Activation Pairs for Steering\.

Harmful prompts are drawn from AdvBench\[[18](https://arxiv.org/html/2609.00597#bib.bib16)\]\. We use the standard harmful split materialized as line\-delimited prompts; the preparation utility enforces520520unique harmful strings with a fixed calibration/evaluation partition:416416calibration and104104evaluation harmful prompts\. Harmless prompts are sampled from the public instruction corpustatsu\-lab/alpacaon Hugging Face as we require at least512512unique instructions for calibration\-side harmless data; when no local snapshot is supplied, prompts are fetched with thedatasetslibrary and de\-duplicated by normalized text\. This mirrors the contrastive pipeline in our codebase: activations are collected at a chosen transformer block, projected with joint PCA, and passed to the topological construction of𝐯steer\\mathbf\{v\}\_\{\\text\{steer\}\}\.

##### Models\.

The default development model in our configuration ismeta\-llama/Llama\-3\.1\-8B\-Instruct; the repository also supports multi\-model sweeps \(Qwen 2\.5 and Gemma 2 families\) through a shared hooking interface\. Layer indexℓ\\elland TDA hyperparameters \(PCA dimension, persistence thresholds,knegk\_\{\\mathrm\{neg\}\}, component merge depth, etc\.\) are treated as tunables; a representative end\-to\-end tuning run selects a single layer and hyperparameter hash before behavioral validation\.

### 5\.2Experimental Proof that Topological Steering is working with relevant Benchmarks

The first goal of the Experiment section[5](https://arxiv.org/html/2609.00597#S5)is to show that our method is indeed steering LLMs and working\. This is shown in table[1](https://arxiv.org/html/2609.00597#S5.T1)\.

We report three complementary families of numbers: \(i\) activation steering scores, \(ii\) lightweight lexical jailbreak\-rates, and \(iii\) external LLM judges aligned with community red\-teaming practice\. We now explain the different metrics computed:

##### Activation Separation Metric \(Δ​ρ\\Delta\\rho\)\.

LetXho\+,Xho−X^\{\+\}\_\{\\mathrm\{ho\}\},X^\{\-\}\_\{\\mathrm\{ho\}\}be harmful and harmless*held\-out*activations at\(ℓ,t⋆\)\(\\ell,t^\{\\star\}\)\. For a candidate direction𝐯\\mathbf\{v\}, writeu=𝐯/‖𝐯‖u=\\mathbf\{v\}/\\\|\\mathbf\{v\}\\\|and define the scalar refusal scoreρ⁡\(𝐯\)=\(μ\+−μ−\)/σpool\\rho\(\\mathbf\{v\}\)=\(\\mu^\{\+\}\-\\mu^\{\-\}\)/\\sigma\_\{\\mathrm\{pool\}\}, whereμ\+\\mu^\{\+\}\(resp\.μ−\\mu^\{\-\}\) is the mean ofu⊤​Xho\+u^\{\\top\}X^\{\+\}\_\{\\mathrm\{ho\}\}\(resp\.u⊤​Xho−u^\{\\top\}X^\{\-\}\_\{\\mathrm\{ho\}\}\) andσpool\\sigma\_\{\\mathrm\{pool\}\}is the pooled standard deviation of the concatenated projections \(implementation matches our training\-time weighting routine\)\. The steering score delta isΔ​ρ=ρ⁡\(𝐯steer\)−ρ⁡\(𝐯base\)\\Delta\\rho=\\rho\(\\mathbf\{v\}\_\{\\text\{steer\}\}\)\-\\rho\(\\mathbf\{v\}\_\{\\text\{base\}\}\)with𝐯base=X¯\+−X¯−\\mathbf\{v\}\_\{\\text\{base\}\}=\\bar\{X\}^\{\+\}\-\\bar\{X\}^\{\-\}on the train split\. PositiveΔ​ρ\\Delta\\rhocertifies that the topological direction separates harmful from harmless clouds more sharply than the mean\-difference baseline before any decoding\. This steering score delta is vital as it is the first indicator that our model is indeed steering, allowing us to then compute different benchmark methods that will more precisely evaluate the answers of our steered model\.

The different benchmarks used are Llama Guard 3 implemented from\[[12](https://arxiv.org/html/2609.00597#bib.bib17)\], Harmbench classifier\[[13](https://arxiv.org/html/2609.00597#bib.bib18)\]and Substring Matching\. More details are found in[A\.5\.1](https://arxiv.org/html/2609.00597#A1.SS5.SSS1)\.

Table 1:Representative end\-to\-end result after single\-layer steering with comparison to baseline; steering injectionα=1\\alpha\{=\}1in that run\)\. “JudgeΔ\\Delta” is steered minus baseline success rate\.Metric familyBaselineTopologicalΔ\\DeltaActivation: bestΔ​ρ\\Delta\\rho\(held\-out\)——\+0\.0127\+0\.0127Activation: mean±\\pmstd\.Δ​ρ\\Delta\\rho\(robustness replicates\)——\+0\.0092±0\.0022\+0\.0092\\pm 0\.0022Llama Guard 3 success rate0\.5100\.5100\.6920\.692\+0\.183\+0\.183HarmBench classifier success rate0\.0100\.0100\.0290\.029\+0\.019\+0\.019Substring refusal lexicon success rate0\.0290\.0290\.0380\.038\+0\.010\+0\.010
##### Interpretation\.

Table[1](https://arxiv.org/html/2609.00597#S5.T1)answers two distinct questions:

- •First, theactivation rowshows that the learned topological vector improves the linear separability of harmful versus harmless activations relative to the global mean direction\. This is direct evidence that the persistence\-guided subset construction is extracting a refusal\-aligned axis in representation space\.
- •Second, thejudge rowsshow that decoding under the same intervention increases automated jailbreak rates on a fixed harmful evaluation set, with the largest relative movement on Llama Guard 3 and a smaller but consistent gain on HarmBench; the substring probe moves modestly\.

##### Limitations\.

Automated judge metrics are subject to evaluation drift: measured success rates can change when the judge stack changes \(e\.g\., prompt template, backend model revision, API/server configuration\), even if the generated responses are held fixed; therefore HarmBench and Llama Guard scores should be interpreted as setup\-dependent and not directly interchangeable\. Our substring\-based refusal probe is intentionally lightweight but misses non\-lexical refusals \(safe refusals that do not contain predefined trigger phrases for example “That request is unsafe and I won’t provide operational instructions”\), which can bias jailbreak\-rate estimates upward for semantically valid but lexically novel refusals\. Moreover, oppositely because our substring probe only flags generic refusal phrases and does not assess whether a response still contains harmful instructional content, partially compliant or “disclaimer\-first” answers can look like refusals to the probe while remaining unsafe under a semantic judge \(for example, prefacing harmful steps with a refusal\-like disclaimer\), this can bias jailbreak\-rate estimates downward\. Higher activation\-space separation \(e\.g\., higherΔ​ρ\\Delta\\rho\) does not guarantee uniform improvements across other capabilities, so helpfulness, reasoning, truthfulness, and related tasks must be measured directly rather than inferred from steering metrics\.

Table 2:Multi\-model comparative run\. For each checkpoint we sweep transformer blocksℓ∈\{8,…,20\}\\ell\\in\\\{8,\\ldots,20\\\}, pickℓ⋆\\ell^\{\\star\}that maximizes held\-outΔ​ρ\\Delta\\rho\(topological vs\. mean\-difference baseline\), and reportρ⁡\(𝐯base\)\\rho\(\\mathbf\{v\}\_\{\\text\{base\}\}\),ρ⁡\(𝐯steer\)\\rho\(\\mathbf\{v\}\_\{\\text\{steer\}\}\), andΔ​ρ\\Delta\\rhoatℓ⋆\\ell^\{\\star\}\.LLis the total number of decoder blocks;ℓ⋆/L\\ell^\{\\star\}/Lis a coarse “depth” readout\.

### 5\.3Experimental Proof that Topological Steering is working across different Model Architectures

The second goal of our experiments is to show that our method does not work only onmeta\-llama/Llama\-3\.1\-8B\-Instructbut also on other models\. So we compared the steering scoreΔ​ρ\\Delta\\rhoof different models, as a positiveΔ​ρ\\Delta\\rhois proof of a working TS method\. Our results are shown in table[2](https://arxiv.org/html/2609.00597#S5.T2)\.

##### Interpretation\.

All six models showΔ​ρ\>0\\Delta\\rho\>0at their selected layer: the persistence\-guided steering direction consistently improves linear separability of harmful vs\. harmless activations relative to the global mean contrast, under the same training/holdout protocol and sweep budget\. The ranking isnot monotonein parameter count \(e\.g\. Llama\-3\.2\-3B gains more than Llama\-3\.1\-8B\), which is expected if refusal geometry is shaped by post\-training alignment and width/depth tradeoffs, not raw capacity alone\. The optimal injection depthℓ⋆\\ell^\{\\star\}varies by family: Qwen\-7B peaks very early \(ℓ⋆=8\\ell^\{\\star\}\{=\}8\), whereas Qwen\-3B/14B and Llama\-3\.2\-3B peak at the sweep cap \(ℓ⋆=20\\ell^\{\\star\}\{=\}20\), and Llama\-3\.1\-8B peaks mid\-stack \(ℓ⋆=16\\ell^\{\\star\}\{=\}16\)\. Such spread is consistent with the hypothesis that “where” harmful/harmless structure is most readable in the residual stream depends on stacking depth, normalization placement, and how safety\-related features are distributed across layers\. All of which differ between Llama\-3, Qwen2\.5, and Gemma\-2 blocks \(e\.g\., Gemma 2 uses alternating local/global attention and a different norm/attention ordering than Llama\)\. We notice a significative difference inGemma\-2\-9b\-itwith aΔ​ρ\\Delta\\rhoway bigger than the other models\. Gemma attains a much largerΔ​ρ\\Delta\\rhobut also a much smaller baselineρbase\\rho\_\{\\mathrm\{base\}\}than the other five models\. Architecturally, that pattern indicates that the scalar refusal score is not cross\-model calibrated: residual magnitudes, RMSNorm scaling, and hidden widthdhd\_\{h\}jointly change the scale of projectionsu⊤​hu^\{\\top\}h, so comparing rawρ\\rhoacross checkpoints is weaker than comparingΔ​ρ\\Delta\\rhowithin a model or reporting additional generation\-side judges\. Here, the lowρbase\\rho\_\{\\mathrm\{base\}\}suggests the mean\-difference axis is a poor proxy for refusal separation in Gemma’s activation geometry atℓ⋆\\ell^\{\\star\}, while the topological subset, hence the TS method, still recovers a strong separating direction \(largeρtda\\rho\_\{\\mathrm\{tda\}\}\)\. We therefore emphasizewithin\-modelgains and treat Gemma’s largeΔ​ρ\\Delta\\rhoas evidence that Gemma may benefit more from topology\-based steering than from simple global mean\-difference steering, not as a claim that Gemma is “100×100\\timesmore steerable” than Llama in an absolute sense\.

##### Remark 1\.

Table[2](https://arxiv.org/html/2609.00597#S5.T2)supports a cross\-familyproof of mechanism: topological steering is not an artifact of a single Llama checkpoint, it yields positiveΔ​ρ\\Delta\\rhoacross decoder\-only architectures with different depths, widths, and normalization/attention recipes\. The dispersion ofℓ⋆\\ell^\{\\star\}motivates reporting layer sweeps \(or at least a mid\-late band\) rather than a single universal layer, and motivates appendix plots ofΔ​ρ​\(ℓ\)\\Delta\\rho\(\\ell\)per model\. As shown in[Figure1](https://arxiv.org/html/2609.00597#A1.F1)and[Figure2](https://arxiv.org/html/2609.00597#A1.F2)\.

## 6Conclusion, limits and remarks

We introduced*Topological Steering*, an inference\-time method that builds steering directions from persistent\-homology structure in activation space rather than from a single global mean contrast\. By matching harmful/harmless persistence diagrams, selecting robust contrastive features, and aggregating local directions, the method turns activation geometry into an explicit and inspectable steering signal\. Our results show consistent positive separation gains \(Δ​ρ\>0\\Delta\\rho\>0\) across the tested models and layers in our single\-layer setup, together with measurable behavioral movement on external judge benchmarks\. More broadly, this work positions TDA as an actionable representation\-level tool for intervention design, not only a descriptive visualization aid\. While we acknowledge that specialized geometric methods may still lead on specific benchmarks, the results presented here argue for a conceptual pivot\. By providing areproducibleandinspectablepipeline, this paper opens a new ’steering primitive’ for the field\. It is indeed a contribution we believe will remain relevant as model architectures continue to evolve and as engineering refinements will likely improve its absolute performance in the future\.

Some limitations of our method are:

1. 1\.Persistent Homology is sensitive to preprocessing and to hyperparameters that govern feature selection; our gains depend on tuning, as is common for steering\.
2. 2\.Diagram\-based summaries are not uniquely tied to semantics: high\-persistence features can reflect nuisance geometry unless paired with contrastive matching and behavioral validation\.
3. 3\.Computational cost, while modest compared to training using TDA tools, still scales with point\-cloud size and homology degree\.
4. 4\.We focus on refusal as a concrete safety axis; transfer to other behaviors will require new contrast sets and careful evaluation\.

A natural next step is hybrid steering: use topology to identify where to intervene, then combine with optimized geometric update rules for how to intervene\. Another direction is to use persistence diagrams as structured evidence for safety debugging and representation\-level auditing\.

##### Closing Remark\.

Topological Steering is a proof\-of\-concept that multiscale structure in activation space can be converted into a practical intervention without retraining\. Even when not outperforming specialized baselines, it expands the steering design space by making support subsets and multiscale structure first\-class components of the method\. We believe that Topological Steering will be a promising foundation for the next generation of representation level safety tools and we hope it helps revive topological thinking in modern deep learning research\.

## References

- \[1\]H\. Adams, S\. Chepushtanova, T\. Emerson, E\. Hanson, M\. Kirby, F\. Motta, R\. Neville, C\. Peterson, P\. Shipman, and L\. Ziegelmeier\(2016\)Persistence images: a stable vector representation of persistent homology\.External Links:1507\.06217,[Link](https://arxiv.org/abs/1507.06217)Cited by:[§1](https://arxiv.org/html/2609.00597#S1.p4.1),[§2](https://arxiv.org/html/2609.00597#S2.p4.1)\.
- \[2\]\(2024\)Refusal in language models is mediated by a single direction\.Advances in Neural Information Processing Systems37,pp\. 136037–136083\.Cited by:[§1](https://arxiv.org/html/2609.00597#S1.p1.1)\.
- \[3\]A\. Askell, Y\. Bai, A\. Chen, D\. Drain, D\. Ganguli, T\. Henighan, A\. Jones, N\. Joseph, B\. Mann, N\. DasSarma,et al\.\(2021\)A general language assistant as a laboratory for alignment\.arXiv preprint arXiv:2112\.00861\.Cited by:[§1](https://arxiv.org/html/2609.00597#S1.p1.1)\.
- \[4\]U\. Bauer\(2021\)Ripser: efficient computation of vietoris–rips persistence barcodes\.Journal of Applied and Computational Topology5\(3\),pp\. 391–423\.Cited by:[§4\.6](https://arxiv.org/html/2609.00597#S4.SS6.p3.1)\.
- \[5\]R\. Brüel\-Gabrielsson, B\. J\. Nelson, A\. Dwaraknath, P\. Skraba, L\. J\. Guibas, and G\. Carlsson\(2020\)A topology layer for machine learning\.External Links:1905\.12200,[Link](https://arxiv.org/abs/1905.12200)Cited by:[§1](https://arxiv.org/html/2609.00597#S1.p4.1),[§2](https://arxiv.org/html/2609.00597#S2.p4.1)\.
- \[6\]P\. Bubenik\(2015\)Statistical topological data analysis using persistence landscapes\.External Links:1207\.6437,[Link](https://arxiv.org/abs/1207.6437)Cited by:[§2](https://arxiv.org/html/2609.00597#S2.p4.1)\.
- \[7\]G\. Carlsson\(2009\)Topology and data\.Bulletin of the American Mathematical Society46\(2\),pp\. 255–308\.Cited by:[§2](https://arxiv.org/html/2609.00597#S2.p3.1)\.
- \[8\]D\. Cohen\-Steiner, H\. Edelsbrunner, and J\. Harer\(2005\)Stability of persistence diagrams\.InProceedings of the twenty\-first annual symposium on Computational geometry,pp\. 263–271\.Cited by:[§2](https://arxiv.org/html/2609.00597#S2.p3.1),[§4\.7](https://arxiv.org/html/2609.00597#S4.SS7.p1.1)\.
- \[9\]H\. Edelsbrunner and J\. Harer\(2010\)Computational topology: an introduction\.American Mathematical Soc\.\.Cited by:[§4\.6](https://arxiv.org/html/2609.00597#S4.SS6.p1.1)\.
- \[10\]Edelsbrunner, Letscher, and Zomorodian\(2002\)Topological persistence and simplification\.Discrete & computational geometry28\(4\),pp\. 511–533\.Cited by:[§A\.2](https://arxiv.org/html/2609.00597#A1.SS2.p3.1),[§2](https://arxiv.org/html/2609.00597#S2.p3.1)\.
- \[11\]C\. Hofer, R\. Kwitt, M\. Niethammer, and A\. Uhl\(2018\)Deep learning with topological signatures\.External Links:1707\.04041,[Link](https://arxiv.org/abs/1707.04041)Cited by:[§2](https://arxiv.org/html/2609.00597#S2.p4.1)\.
- \[12\]H\. Inan, K\. Upasani, J\. Chi, R\. Rungta, K\. Iyer, Y\. Mao, M\. Tontchev, Q\. Hu, B\. Fuller, D\. Testuggine,et al\.\(2023\)Llama guard: llm\-based input\-output safeguard for human\-ai conversations\.arXiv preprint arXiv:2312\.06674\.Cited by:[item 1](https://arxiv.org/html/2609.00597#A1.I1.i1.p1.1),[§5\.2](https://arxiv.org/html/2609.00597#S5.SS2.SSS0.Px1.p2.1)\.
- \[13\]M\. Mazeika, L\. Phan, X\. Yin, A\. Zou, Z\. Wang, N\. Mu, E\. Sakhaee, N\. Li, S\. Basart, B\. Li,et al\.\(2024\)Harmbench: a standardized evaluation framework for automated red teaming and robust refusal\.arXiv preprint arXiv:2402\.04249\.Cited by:[item 2](https://arxiv.org/html/2609.00597#A1.I1.i2.p1.1),[§5\.2](https://arxiv.org/html/2609.00597#S5.SS2.SSS0.Px1.p2.1)\.
- \[14\]N\. Panickssery, N\. Gabrieli, J\. Schulz, M\. Tong, E\. Hubinger, and A\. M\. Turner\(2024\)Steering llama 2 via contrastive activation addition\.External Links:2312\.06681,[Link](https://arxiv.org/abs/2312.06681)Cited by:[§1](https://arxiv.org/html/2609.00597#S1.p2.1),[§1](https://arxiv.org/html/2609.00597#S1.p6.1),[§2](https://arxiv.org/html/2609.00597#S2.p1.1),[§3\.1](https://arxiv.org/html/2609.00597#S3.SS1.p2.1)\.
- \[15\]A\. M\. Turner, L\. Thiergart, G\. Leech, D\. Udell, J\. J\. Vazquez, U\. Mini, and M\. MacDiarmid\(2024\)Steering language models with activation engineering\.External Links:2308\.10248,[Link](https://arxiv.org/abs/2308.10248)Cited by:[§1](https://arxiv.org/html/2609.00597#S1.p2.1),[§2](https://arxiv.org/html/2609.00597#S2.p1.1),[§3\.1](https://arxiv.org/html/2609.00597#S3.SS1.p2.1)\.
- \[16\]H\. M\. Vu and T\. M\. Nguyen\(2025\)Angular steering: behavior control via rotation in activation space\.arXiv preprint arXiv:2510\.26243\.Cited by:[item 2](https://arxiv.org/html/2609.00597#S1.I1.i2.p1.1),[§1](https://arxiv.org/html/2609.00597#S1.p1.1),[§1](https://arxiv.org/html/2609.00597#S1.p2.1),[§2](https://arxiv.org/html/2609.00597#S2.p2.1),[§5](https://arxiv.org/html/2609.00597#S5.p1.1)\.
- \[17\]A\. Zou, L\. Phan, S\. Chen, J\. Campbell, P\. Guo, R\. Ren, A\. Pan, X\. Yin, M\. Mazeika, A\. Dombrowski, S\. Goel, N\. Li, M\. J\. Byun, Z\. Wang, A\. Mallen, S\. Basart, S\. Koyejo, D\. Song, M\. Fredrikson, J\. Z\. Kolter, and D\. Hendrycks\(2025\)Representation engineering: a top\-down approach to ai transparency\.External Links:2310\.01405,[Link](https://arxiv.org/abs/2310.01405)Cited by:[§3\.1](https://arxiv.org/html/2609.00597#S3.SS1.p2.1),[§4\.8](https://arxiv.org/html/2609.00597#S4.SS8.p3.1)\.
- \[18\]A\. Zou, Z\. Wang, N\. Carlini, M\. Nasr, J\. Z\. Kolter, and M\. Fredrikson\(2023\)Universal and transferable adversarial attacks on aligned language models\.External Links:2307\.15043,[Link](https://arxiv.org/abs/2307.15043)Cited by:[§5\.1](https://arxiv.org/html/2609.00597#S5.SS1.SSS0.Px1.p1.1)\.

## Appendix ATechnical appendices and supplementary material

### A\.1Complementary Theoritical Background

#### A\.1\.1Transformers

We recall the notation for a decoder\-only transformer withLLlayers, hidden widthdhd\_\{h\}, and token sequence lengthTT\. Given an input text, tokenization maps it to discrete token IDs

\(x1,…,xT\)∈𝒱T,\(x\_\{1\},\\dots,x\_\{T\}\)\\in\\mathcal\{V\}^\{T\},where𝒱\\mathcal\{V\}is the vocabulary\. Each tokenxtx\_\{t\}is embedded intoℝdh\\mathbb\{R\}^\{d\_\{h\}\}and combined with positional information to form the initial residual states

ht\(0\)∈ℝdh,t=1,…,T\.h\_\{t\}^\{\(0\)\}\\in\\mathbb\{R\}^\{d\_\{h\}\},\\qquad t=1,\\dots,T\.
At layerℓ∈\{0,…,L−1\}\\ell\\in\\\{0,\\dots,L\-1\\\}, a standard pre\-norm block applies self\-attention and an MLP through residual updates:

h~t\(ℓ\)=ht\(ℓ\)\+Attn\(ℓ\)\(LN1\(ℓ\)\(h1:T\(ℓ\)\)\)t,\\tilde\{h\}\_\{t\}^\{\(\\ell\)\}=h\_\{t\}^\{\(\\ell\)\}\+\\mathrm\{Attn\}^\{\(\\ell\)\}\\\!\\left\(\\mathrm\{LN\}\_\{1\}^\{\(\\ell\)\}\(h\_\{1:T\}^\{\(\\ell\)\}\)\\right\)\_\{t\},ht\(ℓ\+1\)=h~t\(ℓ\)\+MLP\(ℓ\)​\(LN2\(ℓ\)​\(h~t\(ℓ\)\)\)\.h\_\{t\}^\{\(\\ell\+1\)\}=\\tilde\{h\}\_\{t\}^\{\(\\ell\)\}\+\\mathrm\{MLP\}^\{\(\\ell\)\}\\\!\\left\(\\mathrm\{LN\}\_\{2\}^\{\(\\ell\)\}\(\\tilde\{h\}\_\{t\}^\{\(\\ell\)\}\)\\right\)\.Here,Attn\(ℓ\)\\mathrm\{Attn\}^\{\(\\ell\)\}denotes multi\-head causal self\-attention andMLP\(ℓ\)\\mathrm\{MLP\}^\{\(\\ell\)\}is the position\-wise feed\-forward block\. For each head, attention weights are computed from queries, keys, and values:

Q=X​WQ,K=X​WK,V=X​WV,Attn⁡\(X\)=softmax⁡\(Q​K⊤dk\+M\)​V,Q=XW\_\{Q\},\\quad K=XW\_\{K\},\\quad V=XW\_\{V\},\\quad\\mathrm\{Attn\}\(X\)=\\mathrm\{softmax\}\\\!\\left\(\\frac\{QK^\{\\top\}\}\{\\sqrt\{d\_\{k\}\}\}\+M\\right\)V,with causal maskMMand head dimensiondkd\_\{k\}\.

#### A\.1\.2Activation Steering

To complement the Background[3](https://arxiv.org/html/2609.00597#S3)section we add that:

In our setting,𝐯\\mathbf\{v\}is estimated from two prompt\-conditioned activation collections: a*positive*set \(target behavior to increase\) and a*negative*set \(behavior to suppress\)\. LetX\+,X−⊂ℝdhX^\{\+\},X^\{\-\}\\subset\\mathbb\{R\}^\{d\_\{h\}\}be activations extracted at the same\(ℓ⋆,t⋆\)\(\\ell^\{\\star\},t^\{\\star\}\), and letμ\+\\mu^\{\+\}andμ−\\mu^\{\-\}be the respective training\-set centroids,

μ\+=1\|X\+\|​∑x∈X\+x,μ−=1\|X−\|​∑x∈X−x,\\mu^\{\+\}=\\frac\{1\}\{\|X^\{\+\}\|\}\\sum\_\{x\\in X^\{\+\}\}x,\\qquad\\mu^\{\-\}=\\frac\{1\}\{\|X^\{\-\}\|\}\\sum\_\{x\\in X^\{\-\}\}x,and sets the steering vector to the displacement between these class summaries,

𝐯=μ\+−μ−\.\\mathbf\{v\}=\\mu^\{\+\}\-\\mu^\{\-\}\.
This makes steering explicit: positiveα\\alphamoves activations toward the target behavioral region and away from the contrast region in residual space\. The modified stateht⋆\(ℓ⋆\)′h\_\{t^\{\\star\}\}^\{\(\\ell^\{\\star\}\)\\,\\prime\}is then propagated through layersℓ⋆\+1,…,L\\ell^\{\\star\}\+1,\\dots,Lto produce the final logits and generated text\.

### A\.2Persistent Homology

LetX=\{x1,…,xn\}⊂ℝmX=\\\{x\_\{1\},\\dots,x\_\{n\}\\\}\\subset\\mathbb\{R\}^\{m\}be a finite point cloud \(in our case, sampled activations\), and letdist⁡\(⋅,⋅\)\\operatorname\{dist\}\(\\cdot,\\cdot\)be a metric onXX\(typically Euclidean distance after preprocessing\)\. Persistent homology studies how the topology ofXXevolves across spatial scales by constructing a nested family of simplicial complexes𝒦ϵ1⊆𝒦ϵ2⊆⋯\\mathcal\{K\}\_\{\\epsilon\_\{1\}\}\\subseteq\\mathcal\{K\}\_\{\\epsilon\_\{2\}\}\\subseteq\\cdots,ϵ1≤ϵ2≤⋯,\\epsilon\_\{1\}\\leq\\epsilon\_\{2\}\\leq\\cdots,called a filtration\.

For each scaleϵ\\epsilonand homological dimensionk≥0k\\geq 0, thekk\-th homology groupHk​\(𝒦ϵ,𝔽\)H\_\{k\}\(\\mathcal\{K\}\_\{\\epsilon\};\\mathbb\{F\}\)\(with coefficients in a field𝔽\\mathbb\{F\}, e\.g\.,ℤ2\\mathbb\{Z\}\_\{2\}\) encodeskk\-dimensional topological features:H0H\_\{0\}tracks connected components,H1H\_\{1\}tracks 1\-dimensional loops,H2H\_\{2\}tracks voids, etc\. Its rankβk​\(ϵ\):=rank​Hk​\(𝒦ϵ,𝔽\)\\beta\_\{k\}\(\\epsilon\):=\\mathrm\{rank\}\\,H\_\{k\}\(\\mathcal\{K\}\_\{\\epsilon\};\\mathbb\{F\}\)is thekk\-th Betti number at scaleϵ\\epsilon\.

Asϵ\\epsilonincreases, features appear and disappear\. A feature in dimensionkkis said to be*born*at scalebbif it first appears inHk​\(𝒦b\)H\_\{k\}\(\\mathcal\{K\}\_\{b\}\), and*dies*at scaleδ\>b\\delta\>bif it merges into an older class or becomes a boundary inHk​\(𝒦δ\)H\_\{k\}\(\\mathcal\{K\}\_\{\\delta\}\)\. Its lifetime \(or persistence\) ispers=δ−b\.\\mathrm\{pers\}=\\delta\-b\.Long\-lived classes are typically interpreted as structurally robust, while short\-lived classes are often attributed to sampling noise\[[10](https://arxiv.org/html/2609.00597#bib.bib9)\]\.

Formally, persistence is induced by inclusion maps in the filtration\. Forϵ≤ϵ′\\epsilon\\leq\\epsilon^\{\\prime\}, the inclusion𝒦ϵ↪𝒦ϵ′\\mathcal\{K\}\_\{\\epsilon\}\\hookrightarrow\\mathcal\{K\}\_\{\\epsilon^\{\\prime\}\}yields a linear mapfϵ,ϵ′k:Hk​\(𝒦ϵ,𝔽\)→Hk​\(𝒦ϵ′,𝔽\)\.f\_\{\\epsilon,\\epsilon^\{\\prime\}\}^\{k\}:H\_\{k\}\(\\mathcal\{K\}\_\{\\epsilon\};\\mathbb\{F\}\)\\to H\_\{k\}\(\\mathcal\{K\}\_\{\\epsilon^\{\\prime\}\};\\mathbb\{F\}\)\.A class born atbbthat remains nonzero underfb,ϵkf\_\{b,\\epsilon\}^\{k\}forϵ<δ\\epsilon<\\deltabut vanishes atδ\\deltahas persistence interval\[b,δ\)\[b,\\delta\)\.

In this work, persistent homology provides a multiscale summary of activation geometry without assuming linear separability\. By tracking birth/death events of components and higher\-order structures across scales, it supplies the topological signal that we later encode with persistence diagrams and use to construct steering\-relevant subsets/directions\.

### A\.3Persistence Diagram

A persistence diagram is a finite multiset of birth–death pairs that summarizes the output of persistent homology for a fixed dimensionkk\. Given a filtration\{𝒦ϵ\}ϵ≥0\\\{\\mathcal\{K\}\_\{\\epsilon\}\\\}\_\{\\epsilon\\geq 0\}and its induced persistence module in dimensionkk, each topological class contributes one point\(bi\(k\),δi\(k\)\)∈ℝ2,\(b\_\{i\}^\{\(k\)\},\\delta\_\{i\}^\{\(k\)\}\)\\in\\mathbb\{R\}^\{2\},bi\(k\)<δi\(k\)≤\+∞,b\_\{i\}^\{\(k\)\}<\\delta\_\{i\}^\{\(k\)\}\\leq\+\\infty,wherebi\(k\)b\_\{i\}^\{\(k\)\}is the birth scale andδi\(k\)\\delta\_\{i\}^\{\(k\)\}is the death scale\. The corresponding diagram isDk​\(X\)=\{\(bi\(k\),δi\(k\)\)\}i\.D\_\{k\}\(X\)=\\\{\(b\_\{i\}^\{\(k\)\},\\delta\_\{i\}^\{\(k\)\}\)\\\}\_\{i\}\.

The diagonalΔ=\{\(u,u\):u∈ℝ\}\\Delta=\\\{\(u,u\):u\\in\\mathbb\{R\}\\\}represents zero persistence\. Distance from a point toΔ\\Deltais proportional to its lifetimepersi\(k\)=δi\(k\)−bi\(k\),\\mathrm\{pers\}\_\{i\}^\{\(k\)\}=\\delta\_\{i\}^\{\(k\)\}\-b\_\{i\}^\{\(k\)\},so points far from the diagonal correspond to topologically robust structure, while points near the diagonal are typically less stable under perturbations\. In practice, we compute diagrams separately by homology degree \(e\.g\.,D0D\_\{0\}for connected components andD1D\_\{1\}for loops\), then compare diagrams across behavioral conditions\.

To compare two diagramsDk​\(X\)D\_\{k\}\(X\)andDk​\(Y\)D\_\{k\}\(Y\), one uses a matching\-based metric \(e\.g\., bottleneck orpp\-Wasserstein\) that allows points to match either across diagrams or to the diagonal\. Intuitively, this quantifies how much geometric deformation is required to transform one topological summary into the other\.

### A\.4Vietoris–Rips Filtration

LetX=\{x1,…,xn\}⊂ℝmX=\\\{x\_\{1\},\\dots,x\_\{n\}\\\}\\subset\\mathbb\{R\}^\{m\}with metricdist\\operatorname\{dist\}\. For a scale parameterϵ≥0\\epsilon\\geq 0, the Vietoris–Rips complex at scaleϵ\\epsilonisVRϵ\(X\)=\{σ⊆X:dist\(xi,xj\)≤ϵfor allxi,xj∈σ\}\.\\mathrm\{VR\}\_\{\\epsilon\}\(X\)=\\left\\\{\\sigma\\subseteq X\\;:\\;\\operatorname\{dist\}\(x\_\{i\},x\_\{j\}\)\\leq\\epsilon\\ \\text\{for all \}x\_\{i\},x\_\{j\}\\in\\sigma\\right\\\}\.Equivalently, a simplex is included iff all pairwise distances among its vertices are at mostϵ\\epsilon\. Thus, edges appear first, then triangles, tetrahedra, and higher\-dimensional simplices asϵ\\epsilongrows\.

Because pairwise constraints are monotone inϵ\\epsilon, these complexes form a filtration:VRϵ1​\(X\)⊆VRϵ2​\(X\)wheneverϵ1≤ϵ2\.\\mathrm\{VR\}\_\{\\epsilon\_\{1\}\}\(X\)\\subseteq\\mathrm\{VR\}\_\{\\epsilon\_\{2\}\}\(X\)\\quad\\text\{whenever\}\\quad\\epsilon\_\{1\}\\leq\\epsilon\_\{2\}\.Applying homology to this nested sequence yields persistent homology and, in turn, persistence diagrams\.

Vietoris–Rips is especially convenient for activation point clouds because it only requires pairwise distances and does not need an explicit manifold model\. Its main trade\-off is combinatorial growth: the number of simplices can increase rapidly with sample size and intrinsic dimension, so implementations typically cap the maximum homology degree and rely on dimension reduction \(e\.g\., PCA\) before computing persistence\.

### A\.5Complements on experiments

#### A\.5\.1Benchmarks

In this section we are going to detail more on the 3 benchmarks used:

1. 1\.Llama Guard 3:We call a hosted chat\-completions endpoint with a Llama Guard 3\-compatible model card and aggregate the fraction of generations labeled safe refusal versus compliance, following the spirit of the Llama Guard evaluator line\[[12](https://arxiv.org/html/2609.00597#bib.bib17)\]\. To be clear the success rate is currently scored as unsafe \(higher = more jailbreak success\)\. The implementation recordsbaseline\_success\_rateandsteered\_success\_rateon the same fixed harmful evaluation prompts\.
2. 2\.HarmBench classifier:We use the HarmBench behavioral test harness with a HarmBench\-style binary classifier \(default backend modelcais/HarmBench\-Llama\-2\-13b\-clsin our launcher\) that reads the harmful prompt and model answer and returns a harm / no\-harm style verdict\[[13](https://arxiv.org/html/2609.00597#bib.bib18)\]; we export the resultingsuccess\_ratefields analogously to Llama Guard\. More concretely a higher Harmbench score is equal to worse safety\)
3. 3\.Substring matching:We mark a generation as a “refusal hit” if its lowercased text contains any phrase from a fixed short lexicon \(default list includes templates such as “i’m sorry”, “i cannot”, “as a language model”, …\); the reported success rate is non\-refusal rate under substring proxy\. This probe is inexpensive and correlates loosely with human\-visible refusals, but it is brittle on paraphrases; we therefore treat it as a diagnostic, not a standalone claim\.

#### A\.5\.2Implementation clarifications and scope\.

For transparency, we clarify that the reported Topological Steering results use an*operational*H0\-component recovery procedure rather than an exact birth\-component oracle\. Concretely, for a selected H0featureγi\+=\(bi,δi\)\\gamma\_\{i\}^\{\+\}=\(b\_\{i\},\\delta\_\{i\}\), we extract a connected subset at scaleδi−ε\\delta\_\{i\}\-\\varepsilonand apply deterministic selection heuristics \(e\.g\., viability/size filtering and component scoring\) to obtain the steering subset; therefore, statements of the form “the component born atγi\+\\gamma\_\{i\}^\{\+\}” should be read as an implementation\-level approximation to the intended topological object, not as exact symbolic tracking across the full filtration\. In addition, sign orientation is not claimed as a universal post\-hoc guarantee for every possible builder: in the single\-layer component\-aggregation pipeline used for the main results, direction polarity follows the constructed local contrasts and is validated empirically through held\-outΔ​ρ\\Delta\\rho, rather than by a separate mandatory global sign\-flip step logged for every run\. Weighting is also fixed only for the reported experiments: we usewi∝πi​ci​Δiw\_\{i\}\\propto\\pi\_\{i\}c\_\{i\}\\Delta\_\{i\}\(persistence×\\timesmismatch×\\timesseparation\) as the chosen experimental setting, and do not claim this weighting is theoretically unique or mandatory beyond the present study\.

Table 3:Hyperparameters selected for the row in Table[1](https://arxiv.org/html/2609.00597#S5.T1)\.Table 4:Approximate wall\-clock runtime for the end\-to\-end best\-run pipeline \(reconstructed from artifact timestamps\)\.These durations are reconstructed from filesystem mtime windows for each phase folder, so they’re a good approximation but not perfect wall\-clock start/stop time of each subprocess\. All experiments were run on a GPU A100 with 40Gb memory\.

Regarding experiment 2[5\.3](https://arxiv.org/html/2609.00597#S5.SS3)the times for the run are in[Table5](https://arxiv.org/html/2609.00597#A1.T5):

Table 5:Approximate compute time for the multi\-model comparative run \(artifact\-time reconstruction\)\.Note:durations are reconstructed from filesystem timestamps of run artifacts and are therefore approximate wall\-clock estimates\.

#### A\.5\.3Reproducibility details for the reported runs\.

To make the main results reproducible, we fix the full implementation scope and runtime configuration used in the final single\-layer study\. All reported numbers are produced with a*single\-layer*Topological Steering pipeline onmeta\-llama/Llama\-3\.1\-8B\-Instruct, where the steering vector is injected at the last prompt token withα=1\.0\\alpha=1\.0\. We use deterministic random control with controller seed4242, baseline calibration seeds0:190\{:\}19, and robustness seeds\{20,21,22,23,24\}\\\{20,21,22,23,24\\\}\. Layer selection is performed overℓ∈\{8,…,20\}\\ell\\in\\\{8,\\dots,20\\\}, and the final reported winner usesℓ⋆=15\\ell^\{\\star\}=15\. The steering builder ish0\_componentswithH0H\_\{0\}\-only persistence \(maxdim=0,homology\_focus=h0\_first\), and fixed winner hyperparameters listed in Table[6](https://arxiv.org/html/2609.00597#A1.T6)\. Behavioral evaluation is run on the fixed harmful evaluation set with the same prompt list for baseline and steered generations, using the judge stacksubstring\_matching,llamaguard3, andharmbench; exact endpoint/model settings are also fixed and reported in the table so the judge layer is reproducible\.

Table 6:Reproducibility configuration for the final reported single\-layer run\.
#### A\.5\.4Hyperparameter selection

We selected single\-layer topological\-steering hyperparameters with a staged search orchestrated by our tuning script \(random\-integer seeds; full search space and per\-phase budgets archived with each run\)\.

First, a*baseline calibration*phase repeatedly runs the unsteeered pipeline over many seeds and records the mean, best, and standard deviation of the activation\-side steering statistic produced by the code \(the same separability gain we report asΔ​ρ\\Delta\\rhorelative to a mean\-difference baseline\)\. From this we derive a minimum gain threshold \(a floor value together with a multiple of the baseline standard deviation\) so that later stages ignore improvements indistinguishable from seed noise\.

Second, a*coarse search*draws a large batch of random configurations from a discrete grid over injection layer, PCA dimension, persistent\-homology filtration knobs, component selection and weighting options, local negative\-pool size, and subsampling controls; each configuration is evaluated by one end\-to\-end pipeline run, ranked by average gain, and only the top fraction is kept\.

Third, a*focused search*densifies the grid around those survivors by local moves that perturb several TDA\-related coordinates \(and occasionally the layer\) to propose refined candidates, again ranked by the same activation objective\.

Fourth, a*robustness*phase re\-evaluates the leading candidates on additional fresh seeds, aggregates per\-candidate statistics, and discards settings whose mean gain does not exceed the calibrated baseline plus the minimum gain threshold\.

Finally, a*behavioral validation*phase generates baseline versus steered outputs on harmful prompts and scores them with external judges \(e\.g\. Llama Guard and HarmBench classifiers, plus inexpensive substring refusal probes where desired\); the*final selection*then picks from the robust shortlist using this behavioral evidence \(in our main experiment, ranking by the sum of Llama Guard and HarmBench success\-rate deltas\), freezing the resulting YAML configuration and steering vector for downstream evaluation\.

#### A\.5\.5Layer sweeps plots

Figure 1:Per\-model layer sweeps ofΔ​ρ​\(ℓ\)\\Delta\\rho\(\\ell\)on the comparative run\. Each panel reports one model, with the selected best layer marked\.Figure 2:Overlay view ofΔ​ρ​\(ℓ\)\\Delta\\rho\(\\ell\)across all models\.

### A\.6Statistical Significance

Table[7](https://arxiv.org/html/2609.00597#A1.T7)and Figure[3](https://arxiv.org/html/2609.00597#A1.F3)quantify how stable the observed steering gain is under randomness\. In particular,Δ​ρ\\Delta\\rhodenotes the steering\-score delta \(the improvement in the held\-out refusal separation over the global mean\-difference baseline\) produced by the*same*winning single\-layer configuration, while only the random seed is changed\. This isolates a key source of variability that can affect topological feature selection, subset extraction, and downstream direction construction, even when the data split, model architecture, and hyperparameters are held fixed\.

Each table entry corresponds to one full re\-run of the pipeline for the selected configuration\. The five robustness seeds yieldΔ​ρ\\Delta\\rhovalues of approximately0\.007520\.00752–0\.012710\.01271, with a mean ofΔ​ρ¯≈0\.00922\\overline\{\\Delta\\rho\}\\approx 0\.00922and a sample standard deviation ofs≈0\.00218s\\approx 0\.00218\. The fact that*all*five runs are positive indicates that the improvement is not driven by a single lucky run: the steering direction recovered from persistent\-topology\-guided selection consistently enhances linear separability between harmful and harmless activation clouds relative to the baseline\. Moreover, the relative spread is modest; the standard deviation is about24%24\\%of the mean, suggesting that seed\-induced fluctuations affect the magnitude of the gain but not its sign\.

To further assess statistical significance, we report uncertainty around the mean\. The table includes the standard error of the mean \(SEM\) and a 95%tt\-confidence interval for the mean value ofΔ​ρ\\Delta\\rho\(withn=5n=5robustness runs\)\. This interval is approximately\[0\.00652,0\.01192\]\[0\.00652,\\ 0\.01192\], which remains clearly above zero\. Under the standardtt\-interval assumptions \(exchangeability of runs and reasonable approximation to symmetric errors\), this supports the interpretation that the steering gain is robust and not merely an artifact of run\-to\-run noise\.

Figure[3](https://arxiv.org/html/2609.00597#A1.F3)provides an intuitive visual complement\. The dashed horizontal line shows the mean across robustness seeds\. The shaded darker band represents±1​σ\\pm 1\\sigmaaround the mean, illustrating the observed variability across seeds, while the lighter band shows the 95%tt\-confidence interval for the mean\. All seed points lie within the±1​σ\\pm 1\\sigmaregion, consistent with the numeric summary in Table[7](https://arxiv.org/html/2609.00597#A1.T7)\. Overall, the combined evidence from the table and figure indicates that the persistent\-topology\-guided steering direction is stable: the method yields consistently positive improvements over the baseline across independent re\-runs, and the uncertainty in the mean estimate does not overlap zero\.

Table 7:Robustness of the selected configuration across 5 random seeds in phase\-3 robustness runs\.Δ​ρ\\Delta\\rhois the steering\-score improvement over the baseline direction\.![Refer to caption](https://arxiv.org/html/2609.00597v1/neurips_2026/figures/Appendix_figures/delta_rho_robustness_errorbars.png)Figure 3:Robustness of the selected configuration across 5 random seeds\. The shaded band shows±1​σ\\pm 1\\sigma; the lighter band shows the 95%tt\-confidence interval for the mean\.
### A\.7Societal impact \(positive and negative\)\.

This work studies inference\-time steering methods intended to improve refusal behavior and reduce harmful responses in large language models, which can have positive societal impact by strengthening safety guardrails in high\-risk interaction settings\. In particular, improving controllable refusal may lower accidental assistance with dangerous requests and support safer deployment practices when combined with independent safety monitoring\. At the same time, the same class of representation\-level intervention techniques can be repurposed negatively: steering methods may be adapted to weaken existing safeguards, evade policy\-aligned behavior, or induce model behaviors that are difficult to detect from surface text alone\. Additional risks include over\-reliance on automated judges, setup\-dependent evaluation drift, and false confidence if activation\-space gains are interpreted as universal safety guarantees\. For these reasons, we frame our contribution as a diagnostic and methodological study under controlled benchmarks, not as a complete solution to safe deployment, and we encourage layered evaluation \(multiple judges, robustness checks, and transparent reporting of failure modes\) before real\-world use\.