The Illusion of Control: Why Bare Classifier Inversion Silently Fails in Concept-Bottleneck Text Generation

Qi Bing; Xiaowei Shao

cs.CLAug 24, 2026

The Illusion of Control: Why Bare Classifier Inversion Silently Fails in Concept-Bottleneck Text Generation

Authors: Qi Bing, Xiaowei Shao

Organizations: Shanghai Jiao Tong University

Abstract

Concept-bottleneck controllable generation routes multi-attribute control through a low-dimensional concept code that, at deployment, must be synthesised from a target attribute configuration. We study this problem in concept-bottleneck text generation under multi-axis compositional generalisation, comparing three ways to obtain the inference-time code: classifier inversion against the encoder heads, reference-text encoding, and a post-hoc label-conditioned prior. Since a concept code admits no direct LM-fluency term, regularising inversion must instead constrain the code toward the encoder's training distribution. We therefore test bare inversion and three regularised variants: label-agnostic and label-conditioned Mahalanobis penalties, and a conditional normalising-flow density baseline. Every inversion variant we test underperforms a simple post-hoc prior fitted to per-combination encoder means on the same checkpoints, across three backbone families spanning $124$ M to $8$ B parameters. The bare form of classifier inversion also silently collapses to chance, traceable to a directly measured off-manifold code. We validate this diagnosis on real-world benchmarks and under external evaluators, enabling fair comparison with published baselines.

Figures & tables

Figure 1: The illusion of control. (a) In concept-code space, classifier inversion drifts off the encoder’s training manifold; a label-conditioned prior sits at the on-manifold per-combination mean, and ref-enc is one on-manifold sample. (b) CompMCTG Fyelp 4-axis accuracy: cls-inv sits at the $\approx\!42.5\%$ chance baseline while the prior recovers compositional control on the same checkpoints (split details: Table 1 † ).

Figure 2: Architecture of the concept-bottleneck CTG framework (§ 3.1 ). Module A encodes input text $\mathbf{x}$ into a concatenated concept code $\mathbf{z}=(\mathbf{z}_{1},\dots,\mathbf{z}_{A})$ using a frozen-LM encoder, per-axis MLPs, and classifier heads. z-Selector supplies the injector input: during training, $\mathbf{z}=E_{\phi}(\mathbf{x})$ ; during inference, $\mathbf{z}^{\star}$ is obtained by one of the protocols in § 3.2 ( prior , cls-inv , or ref-enc ). Module B maps the selected code to per-layer AdaLN-zero updates. Module C is a LoRA-adapted frozen Transformer generator that emits $\mathbf{y}$ autoregressively.

Panel of Figure 3 — Figure 3: Activation-level signature of classifier inversion (§ 5.2 ). We plot per-layer relative modulation $\mathrm{rel\_mod}_{\ell}=\|\tilde{\mathbf{h}}_{\ell}-\mathbf{h}_{\ell}\|/\|\mathbf{h}_{\ell}\|$ , averaged over tokens and prompts, on trained Fyelp checkpoints. Ref-Enc remains bounded on both backbones, while Cls-Inv produces depth-amplified over-modulation: severe on LLaMA-3.2 1B (log $y$ -axis) and milder but still visible on GPT-2 124M. The corresponding off-manifold distances are reported in Table 10 .

CompMCTG-paper baselines, GPT-2-Medium 355M (quoted from Zhong et al. 2024 )
Method / z-source	Backbone	HO	ACD
PPLM ( Dathathri et al. 2020 )	GPT-2-M 355M	42.49	40.63
Fudge ( Yang and Klein 2021 )	GPT-2-M 355M	41.71	40.42
CatPrompt ( Yang et al. 2023 )	GPT-2-M 355M	64.57	54.77
DCG ( Zeng et al. 2023 )	GPT-2-M 355M	66.39	64.71
Con.Prefix ( Qian et al. 2022 )	GPT-2-M 355M	67.50	63.93

Table 1: 4-axis mean accuracy (%) on CompMCTG Fyelp under the official RoBERTa-large evaluator ( Zhong et al. 2024 ) ; Hold-Out (HO) and ACD splits, idx=

-0

, chance baseline

\approx 42.5\%

. Unmarked rows report test_unseen (the compositional-generalisation number); † Cls-Inv on test_seen (its Hold-Out test_unseen number is inflated by a singleton artefact, App. Q ); ‡ artefact-free test_unseen on the ACD split, whose half-combination hold-out admits no singleton — the corresponding within-split lift over the Prior cells is

+7.4

+18.8

pp. Multi-seed entries (42/7/11) are marked

{}_{\pm\text{sd}}

. Backbones differ : every CompMCTG baseline uses GPT-2-Medium 355M; the strictly matched comparison is our GPT-2-Medium 355M block, where Prior does not surpass Meta-CTRL on either split; the LLaMA-1B win is cross-scale (

\approx 3.5\times

the baseline backbone). Per-axis breakdown in Tab. 7 (App. E ).

Protocol	GPT-2-124M	LLaMA-1B
Cls-Inv bare	$42.99$	$41.47$
+ Mahal. (agn.) $\diamond$	$57.52$	$52.91$
+ Mahal. (cond.) $\diamond$	$60.74$	$52.73$
flow-prior (cond. NF) ${\dagger}$	$57.21$	$69.95$
Prior ( $g_{\gamma}$ )	$\mathbf{67.7}$	$\mathbf{81.7}$

Table 2: Inversion-protocol comparison on Fyelp Hold-Out test_seen , 4-axis mean accuracy (%); the same checkpoints report

55.18\%/76.10\%

on test_unseen (Tab. 1 ). agn. / cond. : label-agnostic / label-conditioned per-axis manifold penalty (App. I ; best

\beta\in\{0.1,0.3,1.0,3.0\}

\diamond

; the label-agnostic row is the single-seed full test_seen number, matching the

57.4/52.8

three-seed subset means in Tab. 11 ). flow-prior : conditional normalising flow

p(\mathbf{z}\mid c)

(

{\dagger}

; App. K ); trails the MLP by

10.5

11.8

pp, matching the denoiser prediction (§ 6.2 ). Label-conditioned row uses the

312

-row subset (Tab. 12 ); others use full test_seen . Same ordering on ACD (Tab. 1 within-split block).

Appendix figures & tables20 assets

Supplementary material from the paper’s appendix.

Appendix

z-source	DistilBERT-SST-2	CB-LLMs RoBERTa
Ref-Enc	0.846 / 0.850	0.895 / 0.891
Prior	0.915 / 0.921	0.964 / 0.964
Cls-Inv	0.500 / 0.500	0.916 / 0.918
CB-LLMs (official ckpt, BOS)	—	0.950

Appendix

Table 3: LLaMA-3 8B YelpP single-axis check (seen / unseen). Our Prior reaches

0.964

under the CB-LLMs RoBERTa evaluator,

+1.4

pp above the reproduced CB-LLMs score at matched backbone and evaluator. YelpP is single-axis, so test_seen and test_unseen are random subsamples of the same distribution and agree within

\leq 0.7

pp. The high CB-LLMs RoBERTa score for Cls-Inv reflects a default-positive prediction artefact on lexically degraded generations; the DistilBERT score and perplexity diagnostics show the collapse.

z-source	split	sent.	topic	2-axis
Cls-Inv †	seen	72.8	20.2	46.5
Ref-Enc	seen	71.6	52.7	62.1
Prior	seen	78.7	74.3	76.5
Cls-Inv †	unseen	99.4	0 9.7	54.6
Ref-Enc	unseen	78.4	27.8	53.1
Prior	unseen	94.9	61.2	78.1

Appendix

Table 4: CompMCTG Amazon results with GPT-2-124M under Hold-Out idx=

-0

, evaluated by the official 2-axis Amazon classifier suite. We report per-axis and 2-axis-mean accuracy (%). Topic is six-way classification, with

16.7\%

chance accuracy; sentiment is binary, with

50\%

chance accuracy. Prior is the best protocol on both splits. Classifier inversion collapses most clearly on the topic axis and has a

5\times

perplexity inflation on the seen split (PPL

65.1

vs.

13.0

for Prior ). † On the unseen split, the held-out combination is a singleton with positive sentiment; the high Cls-Inv sentiment score is therefore a classifier-default artefact (App. Q ).

Backbone	Scale	Task	Cls-Inv mean
GPT-2	124M	synthetic 4-axis	0.239
Qwen-0.5B	500M	synthetic 4-axis	0.276
Qwen-1.5B	1.5B	synthetic 4-axis	0.239
LLaMA-1B	1B	synthetic 4-axis	0.280
LLaMA-3B	3B	synthetic 4-axis	0.224
LLaMA-3 8B	8B	YelpP binary ${\dagger}$	0.500

Appendix

Table 5: Classifier-inversion collapse on the synthetic 4-axis sanity check and single-axis YelpP. Cls-Inv mean accuracy on generated text stays within

\pm 0.03

of the random baseline on every backbone.

{\dagger}

YelpP is single-axis binary, with random baseline

0.50

; the synthetic rows are four-axis, with random baseline

0.25

Backbone	Cls-Inv	Ref-Enc	Prior	$\Delta$ pp
GPT-2 124M	0.239	0.536	0.574	$+3.8$
Qwen-0.5B	0.276	0.603	0.679	$+7.55$
Qwen-1.5B †	0.239	0.360	0.379	$+1.9$
LLaMA-1B ( $n{=}5$ )	0.280	0.791 $\pm$ 0.021	0.840 $\pm$ 0.026	$+4.86\pm 0.96$
LLaMA-3B	0.224	0.857	0.907	$+4.93$

Appendix

Table 6: Synthetic 4-axis unseen mean accuracy for classifier inversion, reference encoding, and the post-hoc prior. The prior improves over Ref-Enc on every backbone, matching the direction observed on natural data (§ 6 ). † Qwen-1.5B uses the additive injector with gate initialisation

-3.0

. The LLaMA-1B row reports the 5-seed mean

\pm

standard deviation.

CompMCTG-paper baselines (GPT-2-Medium 355M)
Method / z-source	Backbone	Acc ${}_{\text{s}}$	Acc ${}_{\text{g}}$	Acc ${}_{\text{c}}$	Acc ${}_{\text{t}}$
PPLM	GPT-2-M	49.96	50.02	19.93	50.06
Fudge	GPT-2-M	49.61	48.80	20.91	47.50
CatPrompt	GPT-2-M	83.82	54.07	56.04	64.36
DCG	GPT-2-M	90.29	56.39	57.00	61.88
Con.Prefix	GPT-2-M	93.66	59.24	48.30	68.78

Appendix

Table 7: Per-axis CompMCTG Fyelp Hold-Out idx=

-0

test_unseen accuracy (sentiment / gender / cuisine / tense), official RoBERTa-large evaluator; our rows are 65K-train _full runs, single seed (seed 42). Random baselines: s/g/t

=50.0

, c

=20.0

. Averaging the per-axis cells recovers the 4-axis means of Tab. 1 , except its LLaMA-3.2 1B Hold-Out column: that column is a 3-seed mean whereas these per-axis rows are the single seed-42 run, so they differ — by

0.3

pp for Prior and Cls-Inv but

1.9

pp for Ref-Enc , whose single-combination unseen split is the most seed-sensitive. Cls-Inv rows are reported on test_seen (per Tab. 1 , footnote

{\dagger}

). Gender is the weakest-controlled axis for almost every method — near or below the

50\%

chance level for the baselines and for classifier inversion — consistent with gender being barely encoded in

\mathbf{z}

(§ 6.2 ).

z-source	Generated text (target: negative_female_bar_past )
Cls-Inv	class class class Class Class Class Kids Class Class Sing Kid Class Kids Special Kids Special Children Class Kids Kids Special Special Kids Children …
Ref-Enc	adios everyone, this place is totally worth going back to. the owner, who was seated at the bar, told us he had come to check out and that he had some frien …
Prior	was so disappointed in this place. i ordered the last meal i had, which was a very small portion of the pizza. the waiter was so nice and attentive …

Appendix

Table 8: Representative generations per z-source on GPT-2-124M Fyelp Hold-Out for target negative_female_bar_past . Classifier inversion degenerates into a repetition loop, while Ref-Enc and Prior produce fluent restaurant-review text; only Prior clearly reflects the negative target in this example.

z-source	(mean /3)	fluent	degraded / salad
	attr. match	fluency ( $n=20$ )
Cls-Inv	0.80	0	11 / 9
Ref-Enc	1.90	16	4 / 0
Prior	2.45	20	0 / 0

Appendix

Table 9: LLM-as-judge evaluation:

20

combination-matched generations per z-source, GPT-2-124M Fyelp Hold-Out test_seen , judge = Claude under a fixed rubric. Attribute match counts the three policy-controlled axes; chance guessing

\approx 1.2/3

. The prior leads on both attribute match and fluency, and classifier inversion yields no fluent review.

Backbone	$\mathbf{z}^{\star}$ source	Mahalanobis	kNN-dist
GPT-2 124M	Cls-Inv	$3.34_{\pm 0.06}$	$17.6_{\pm 0.5}$
	Ref-Enc	$1.00_{\pm 0.21}$	$4.5_{\pm 0.5}$
	Prior	$\mathbf{0.50}_{\pm 0.05}$	$\mathbf{3.2}_{\pm 0.1}$
LLaMA-3.2 1B	Cls-Inv	$3.74_{\pm 0.15}$	$10.2_{\pm 0.9}$
	Ref-Enc	$1.00_{\pm 0.20}$	$2.4_{\pm 0.2}$
	Prior	$\mathbf{0.60}_{\pm 0.09}$	$\mathbf{1.7}_{\pm 0.1}$

Appendix

Table 10: Distance of each inference-time control code to the encoder’s training-data code distribution (Fyelp Hold-Out; mean

{}_{\pm\text{sd}}

across the

39

seen combinations). Diagonal-Gaussian Mahalanobis and mean distance to

10

nearest training neighbours. Classifier inversion lands

3

–

7\times

farther off-manifold than the prior or an encoded reference, on both backbones, with the gap many times its combination-level spread.

	GPT-2-124M		LLaMA-3.2 1B
$\beta$	Mahal.	shell	Mahal.	shell
$0$	$43.8_{\pm 0.6}$	$43.8_{\pm 0.6}$	$41.7_{\pm 1.2}$	$40.5_{\pm 0.5}$
$0.03$	$55.7_{\pm 1.3}$	$51.5_{\pm 0.6}$	$49.8_{\pm 0.3}$	$43.9_{\pm 0.8}$
$0.1$	$\mathbf{57.4}_{\pm 1.2}$	$\mathbf{52.2}_{\pm 0.4}$	$47.5_{\pm 0.8}$	$43.0_{\pm 0.7}$
$0.3$	$54.0_{\pm 0.8}$	$51.7_{\pm 1.3}$	$\mathbf{52.8}_{\pm 0.4}$	$49.1_{\pm 0.1}$
$1$	$50.5_{\pm 0.3}$	$50.7_{\pm 1.6}$	$48.5_{\pm 1.2}$	$\mathbf{49.6}_{\pm 0.8}$

Appendix

Table 11: Classifier inversion with a label-agnostic manifold regulariser of weight

\beta

: 4-axis seen accuracy (%), mean

{}_{\pm\text{sd}}

over 3 seeds (42/7/11). Fyelp, official evaluator, fixed

312

-row stratified test_seen subset (

8

reviews per seen combination);

\beta=0

reproduces plain classifier inversion. Mahal. :

((\mathbf{z}-\boldsymbol{\mu})/\boldsymbol{\sigma})^{2}

, pulls toward the per-axis centroid. shell :

\mathrm{relu}(((\mathbf{z}-\boldsymbol{\mu})/\boldsymbol{\sigma})^{2}-\rho^{2})

\rho=2

— zero inside the

\pm 2\sigma

ellipsoid, no centring pull. Every

\beta>0

lifts accuracy off chance on both backbones and both penalties (bold: per-column peak); the

+8

+14

pp lift exceeds the seed noise (

\leq 1.6

pp on

23/24

cells) by roughly

10\times

Reference (from Tab. 11 , 3-seed mean):
$\beta$	GPT-2-124M	LLaMA-3.2 1B
$0.1$	$\mathbf{60.74}$	$\mathbf{52.73}$
$0.3$	$56.65$	$48.31$
$1.0$	$53.93$	$49.92$
$3.0$	$54.89$	$49.36$
Mahal., best $\beta$ (label-agnostic)	$57.4$	$52.8$

Appendix

Table 12: Label-conditioned manifold regulariser (Eq. 8 ), 4-axis seen accuracy (%) on the same 312-row stratified Fyelp Hold-Out test_seen subset as Tab. 11 , single seed (42). Bold: per-column peak. The label-conditioned penalty modestly outperforms the label-agnostic centroid on GPT-2-124M (

+3.2

pp at

\beta=0.1

) and roughly ties on LLaMA-3.2 1B (

-0.1

pp), yet remains

7

and

29

pp below

g_{\gamma}

. The per-axis conditional marginal collapses the cross-axis structure that

g_{\gamma}

amortises directly per combination, so it cannot reach the prior’s per-combination joint pull target.

	steps
lr	$50$	$200$	$1000$
GPT-2-124M (paper default in bold):
$0.01$	$42.53$	$43.57$	$42.48$
$0.1$	$\mathbf{43.63}$	$41.91$	$42.28$
$1.0$	$46.61$	$45.74$	$46.96$
LLaMA-3.2 1B at steps $=1000$ :

Appendix

Table 13: Bare Cls-Inv accuracy (%) on a

3\times 3

inversion-side grid (GPT-2-124M) plus three LLaMA-3.2 1B sanity cells, Fyelp Hold-Out test_seen 4-axis mean. All

12

cells lie within

\pm 5

pp of the

42.5\%

chance line; the best cell (lr

=1.0

, GPT-2) reaches

46.96\%

, still

10.5

pp below the cheapest manifold regulariser (Mahal. label-agn.,

57.52\%

, Tab. 11 ) and

20.7

pp below the post-hoc prior. The bare-inversion collapse is therefore not an under-optimisation artefact of the paper’s default schedule.

	seen		unseen
Run	retr.	prior	retr.	prior
GPT-2 124M, HO	68.8	67.7	46.6	55.2
GPT-2 124M, ACD	74.6	74.2	53.3	55.9
LLaMA-3.2 1B, HO	83.0	81.7	66.9	76.4
LLaMA-3.2 1B, ACD	87.0	86.9	64.0	69.5

Appendix

Table 14: Nearest-seen-combination retrieval baseline versus the learned label prior

g_{\gamma}

: 4-axis accuracy (%) under the official CompMCTG evaluator. On seen combinations, retrieval and the prior agree within

1.3

pp, as both recover the observed per-combination mean. On every unseen split, the learned prior wins by

+2.6

+9.5

pp.

$k$ references	Hold-Out	ACD
$1$	$61.52_{\pm 2.00}$	$67.62_{\pm 0.74}$
$4$	$62.70_{\pm 0.31}$	$69.38_{\pm 0.43}$
$16$	$63.35_{\pm 0.31}$	$70.60_{\pm 0.26}$
$64$	$63.65_{\pm 0.26}$	$70.07_{\pm 0.16}$
$256$	$68.05$	$74.45$
prior $g_{\gamma}$	$67.67$	$74.23$

Appendix

Table 15: The

k

-sample within-combination averaging control: 4-axis test_seen accuracy (%) under the official evaluator, mean

{}_{\pm\text{sd}}

over three reference draws for

k\leq 64

. Averaging more same-combination references denoises the code: accuracy rises with

k

and the cross-draw spread collapses. By

k{=}256

the non-parametric average reaches the learned prior

g_{\gamma}

to within

0.4

pp on both datasets.

	Additive decomposition (% variance explained)					Concept-code variance
Backbone	Full	sent.	cuis.	tense	gend.	intra-std	inter-std	ratio	prior MSE
GPT-2 124M	31.7	45	23	10	5	0.42	0.29	0.68	0.20
GPT-2-Med. 355M	38.3	54	38	13	6	0.43	0.33	0.76	0.20
LLaMA-3.2 1B	47.6	67	51	20	12	0.25	0.25	1.02	0.07

Appendix

Table 16: Structure of the frozen-encoder concept code

\mathbf{z}

on the Fyelp training pool. Additive decomposition : percentage of variance explained by an additive per-axis model

\boldsymbol{\mu}+\sum_{a}\Delta_{a}(y_{a})

, and by each concatenated per-axis block alone. Concept-code variance : mean per-dimension within-combination and between-combination standard deviation, their ratio, and the residual MSE of a factorised label prior. Additivity rises with backbone scale, but within-combination variation is comparable to or larger than between-combination variation, suggesting a substantial sample-specific component in the encoder code.

Panel of Figure 4 — Figure 4: Inter-attribute statistical dependence on the full Fyelp corpus ( $70$ K records, all $40$ attribute combinations). Each off-diagonal cell is the normalised mutual information ( $\mathrm{NMI}\in[0,1]$ ) between two attribute axes. Every pair is exactly $0.00$ — raw mutual information and Cramér’s $V$ are likewise exactly zero, and every value-pair pointwise mutual information is $+0.000$ . The four Fyelp axes are independent by construction : CompMCTG samples attribute combinations uniformly. The non-additive residual of the concept code (§ 6.2 ) therefore cannot be attribute interaction — it is an encoder artefact.

Phase	Range	$\lambda_{\mathrm{c}}$	$\lambda_{\mathrm{o}}$
1 (LM warm-up)	$\tau<\tau_{1}$	$0$	$0$
2 (concept ramp)	$\tau_{1}\leq\tau<\tau_{1}+5$	$\to 1$ ${\dagger}$	$0$
3 (orthogonality ramp)	$\tau_{1}+5\leq\tau<\tau_{1}+10$	$1$	$\to 0.1$ ${\dagger}$
4 (full objective)	$\tau\geq\tau_{1}+10$	$1$	$0.1$

Appendix

Table 17: Four-phase loss-weight schedule for Eq. 6 .

{\dagger}

Linear ramp from

0

over

5

epochs. In phase 4, the concept and orthogonality weights are fixed at

\lambda_{\mathrm{c}}=1

and

\lambda_{\mathrm{o}}=0.1

, respectively.

	bf16-everywhere	bf16 + fp32 small
Synthetic 4-axis Acc ${}_{\text{4ax,unseen}}$ (mean)
LLaMA-3.2 1B (ref-enc)	$0.655\pm 0.098$	$\mathbf{0.791\pm 0.021}$
LLaMA-3.2 1B (prior)	$0.712\pm 0.098$	$\mathbf{0.840\pm 0.026}$
$\Delta$ prior $-$ ref-enc	$+5.7\pm 0.8$	$\mathbf{+4.86\pm 0.96}$
Qwen-2.5 0.5B (ref-enc)	$0.424$	$\mathbf{0.603}$
Qwen-2.5 0.5B (prior)	$0.497$	$\mathbf{0.679}$

Appendix

Table 18: Precision-recipe ablation: bf16-everywhere vs. mixed precision (bf16 backbone, fp32 small modules), four-axis synthetic, test_unseen . Absolute ref-enc/prior accuracies depend on dtype recipe by

\sim\!\!+18

pp; the

\Delta

magnitude between prior and ref-enc stays within

\pm 1.0

pp on all three backbones we measured. LLaMA-1B numbers are 5-seed means (phase1c bf16-everywhere vs. phase1d fp32-small modules); Qwen-0.5B and LLaMA-3B are single seed=42 (R5/R5d and R7/R7d ablation pairs); LLaMA-3B bf16-everywhere absolute numbers are approximate as the original bf16 run was not multi-seeded.

Axis	target	seen-split prior	cls-inv unseen
sentiment	negative	$\sim\!50\%$	$83.79\pm 27.62\%$
gender	male	$\sim\!48\%$	$\mathbf{100.0\pm 0.0\%}$
cuisine	american	$\sim\!20\%$	$5.15\pm 6.58\%$ ${\ddagger}$
tense	present	$\sim\!50\%$	$67.70\pm 37.37\%$
4-axis mean	—	$\sim\!42\%$ chance	$64.16\pm 14.25\%$

Appendix

Table 19: Per-axis breakdown of the singleton-combo artefact (LLaMA-1B Fyelp test_unseen Cls-Inv ,

n=5

{\ddagger}

cuisine is the only axis whose classifier default (

\sim\!1/5

) does not match the singleton target american ; the resulting cell is below random and confirms the classifier defaults are not informative on token-salad input.

Backbone	Cls-Inv	Prior	lift
GPT-2 124M	$48.47$	$55.91$	$+7.44$
LLaMA-3.2 1B	$50.75$	$69.53$	$+18.78$
Qwen-2.5 1.5B	$52.82$	$60.48$	$+7.66$

Appendix

Table 20: Artefact-free prior– Cls-Inv comparison on CompMCTG Fyelp ACD test_unseen , evaluated by the official RoBERTa-large classifier suite. ACD holds out half of all attribute combinations, so the evaluation does not reduce to a singleton target. The prior improves over Cls-Inv by

+7.4

+18.8

pp on matched checkpoints.

Synthetic 4-axis, marginal-independent attributes
Backbone	Mean joint	Grade
GPT-2 (R4)	0.028	ENT
Qwen-0.5B (R5d)	0.037	ENT
Qwen-1.5B (R2)	0.004	ENT
LLaMA-1B ( $n{=}5$ )	0.145 $\pm$ 0.019	PARTIAL
LLaMA-3B (R7d)	0.268	PARTIAL

Appendix

Table 21: Concept-swap fidelity. Bins are heuristic: HIGH

>0.40

, PARTIAL

0.10

–

0.40

, and ENT

<0.10

. On the synthetic task, LLaMA shows partial axis-wise fidelity while GPT-2 and Qwen remain entangled. On Fyelp, the same pattern does not transfer: both tested natural-data checkpoints remain entangled under this diagnostic.

Controllable Text Generation

Controllable text generation steers language models toward desired attributes, formats, audiences, and constraints while preserving useful, natural text.

See all 109 papers

Not All Latent Spaces Are Flat: Hyperbolic Concept Control
Mar 14, 2026Maria Rosaria Briglia, Simone Facchiano, Paolo Cursi +6Controllable Image Generation Safe T2I Generation
Department of Computer Science, Sapienza University of Rome, Rome, Italy · ItalAI Labs, Rome, Italy · Paradigma Inc., Rome, Italy
Concept Guidance: Precise, Training-Free Latent Control for Text-to-Image Generation
Aug 14, 2026Nikolai Röhrich, Isabell Hans, Felix Krause +1Diffusion Model Guidance T2I Generation
LMU Munich, Germany · Konrad Zuse School of Excellence in Reliable AI (relAI), Germany · Munich Center for Machine Learning (MCML), Germany
HyperTransport: Amortized Conditioning of T2I Generative Models
May 7, 2026Valentino Maiorca, Eleonora Gualdoni, Xavier Suau +3T2I Generation Hypernetworks
1ISTA · 2Apple

Mar 14, 2026J/K move · Enter open · S save

Not All Latent Spaces Are Flat: Hyperbolic Concept Control

Maria Rosaria Briglia, Simone Facchiano, Paolo Cursi, Alessio Sampieri+5

Department of Computer Science, Sapienza University of Rome, Rome, Italy · ItalAI Labs, Rome, Italy · Paradigma Inc., Rome, Italy

Controllable Image Generation Safe T2I Generation T2I Generation T2I Diffusion Models

Open paper AskPDF arXiv

As modern text-to-image (T2I) models draw closer to synthesizing highly realistic content, the threat of unsafe content generation grows, and it becomes paramount to exercise control. Existing approaches steer these models by applying Euclidean adjustments to text embeddings, redirecting the generation away from unsafe concepts. In this work, we introduce hyperbolic control (HyCon): a novel control mechanism based on parallel transport that leverages semantically aligned hyperbolic representation space to yield more expressive and stable manipulation of concepts. HyCon reuses off-the-shelf generative models and a state-of-the-art hyperbolic text encoder, linked via a lightweight adapter. HyCon achieves state-of-the-art results across four safety benchmarks and four T2I backbones, showing that hyperbolic steering is a practical and flexible approach for more reliable T2I generation.

Abstract

Controllable Text Generation

Explore similar work

Not All Latent Spaces Are Flat: Hyperbolic Concept Control

Concept Guidance: Precise, Training-Free Latent Control for Text-to-Image Generation

HyperTransport: Amortized Conditioning of T2I Generative Models