pith. sign in

arxiv: 2606.23700 · v1 · pith:CMHWFBGJnew · submitted 2026-06-04 · 💻 cs.CL · cs.AI· cs.LG

Self-Recognition Finetuning can Prevent and Reverse Emergent Misalignment

Arush Tagade , Shaoheng Zhou , Jiaxin Wen , Shi Feng This is my paper

Pith reviewed 2026-06-28 02:35 UTC · model grok-4.3

classification 💻 cs.CL cs.AIcs.LG
keywords emergent misalignmentself-recognition finetuningLLM alignmentcharacter fortificationmodel identityfinetuningalignment defenses
0
0 comments X

The pith

Self-generated text recognition finetuning can prevent and reverse emergent misalignment by fortifying aligned character.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper claims that emergent misalignment in language models stems from destabilizing their aligned character rather than learning a specific harmful persona. It proposes self-generated text recognition finetuning as a targeted way to strengthen that character. Across experiments with three models and various datasets, this method both reverses existing misalignment and prevents it from emerging, outperforming other finetuning approaches in the prevention setting. A sympathetic reader would care because it offers a new angle on maintaining model alignment during finetuning without side effects.

Core claim

Emergent misalignment operates through the disruption of the model's aligned character. Self-generated text recognition finetuning serves as a character-targeted intervention that prevents and reverses this misalignment. All tested interventions achieve comparable reversal when they restore capabilities, but only self-generated text recognition finetuning succeeds in prevention without exacerbating misalignment metrics. Evidence includes increased diversity in identity self-reports after emergent misalignment finetuning, worsened misalignment when self-recognition is corrupted, and reduced effects when the identity system prompt is removed.

What carries the argument

Self-generated text recognition (SGTR) finetuning, which involves the model recognizing and reinforcing its own generated text to fortify its default character.

If this is right

  • All finetuning methods that restore capabilities degraded by emergent misalignment can reverse it.
  • Only SGTR finetuning provides consistent prevention of emergent misalignment across metrics.
  • Emergent misalignment finetuning increases diversity in the model's identity self-reports.
  • Corrupting self-recognition artificially increases misalignment from emergent misalignment finetuning.
  • Removing the model's identity-bearing system prompt substantially reduces the impact of emergent misalignment finetuning.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Character fortification could apply to other alignment challenges like reducing sycophancy or improving truthfulness.
  • Future work might test whether SGTR works on models with different architectures or training histories.
  • The reframing of emergent misalignment as character destabilization suggests monitoring identity stability as a key alignment metric.

Load-bearing premise

That the differences in prevention success between SGTR and other interventions are due to character fortification specifically, rather than other uncontrolled factors in the finetuning process or datasets used.

What would settle it

Observing that SGTR finetuning fails to prevent emergent misalignment on an additional model while another method succeeds, or finding no correlation between self-recognition accuracy and misalignment reduction.

Figures

Figures reproduced from arXiv: 2606.23700 by Arush Tagade, Jiaxin Wen, Shaoheng Zhou, Shi Feng.

Figure 1
Figure 1. Figure 1: Misalignment across GPT-4.1 and it’s finetuned variants. GPT-4.1 finetuned on unpopular [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Average misalignment across Qwen2.5-32B (top) and Seed-OSS-36B (bottom) reversal [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Capability changes and reversal outcomes for Qwen2.5-32B across three EM datasets. Top [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Misalignment scores for prevention finetuning followed by EM finetuning on GPT-4.1 [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Average misalignment across Qwen2.5-32B (top) and Seed-OSS-36B (bottom) prevention [PITH_FULL_IMAGE:figures/full_fig_p006_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: ICTR exacerbates EM on Qwen2.5-32B (left) and Seed-OSS-36B (right) across three EM [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Effect of removing the identity system prompt during EM finetuning on Qwen2.5-32B [PITH_FULL_IMAGE:figures/full_fig_p009_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Identity clustering threshold robustness across GPT-4.1, Qwen2.5-32B, and Seed-OSS [PITH_FULL_IMAGE:figures/full_fig_p014_8.png] view at source ↗
read the original abstract

Emergent misalignment (EM) has been linked to the activation of misaligned persona vectors and evil character traits, suggesting that EM operates through disruption of the model's aligned character rather than direct learning of harmful content. Motivated by this connection, we study self-generated text recognition (SGTR) finetuning as a character-targeted intervention that is distinct from existing in-training defenses. We conduct two-stage finetuning experiments across three models (GPT-4.1, Qwen2.5-32B-Instruct, Seed-OSS-36B-Instruct) and multiple EM datasets to compare SGTR finetuning against benign finetuning baselines (correct domain-specific data, general knowledge, and word counting) to find it an effective defense in both reversal and prevention settings. We find that all interventions produce comparable EM reversal, but only when restoring capabilities that EM had degraded. For prevention, only SGTR finetuning consistently reduces misalignment without exacerbating any individual metric, suggesting that character fortification specifically drives prevention. We provide further evidence for EM's relation to the LLM's default character by showing that EM finetuning induces diversity into the LLM's identity self-reports, artificially corrupting self-recognition exacerbates misalignment caused by EM finetuning, and that removing the model's identity-bearing system prompt substantially reduces the effect of EM finetuning. Together, these findings reframe EM not as the adoption of a coherent misaligned persona but as the destabilization of aligned character.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper claims that emergent misalignment (EM) arises from destabilization of the LLM's aligned character (rather than adoption of a coherent misaligned persona), and that self-generated text recognition (SGTR) finetuning is an effective character-targeted defense that prevents EM (unlike benign finetuning baselines) while also reversing it. This is supported by two-stage finetuning experiments across GPT-4.1, Qwen2.5-32B-Instruct, and Seed-OSS-36B-Instruct on multiple EM datasets, plus auxiliary evidence from identity self-reports, corrupted self-recognition, and system-prompt ablation.

Significance. If the differential prevention effect is shown to be specifically due to the self-recognition mechanism rather than uncontrolled aspects of the finetuning regimes, the work would usefully reframe EM as character destabilization and supply a practical, low-side-effect intervention. The multi-model, multi-dataset design and the additional self-report experiments are strengths that would make the reframing more convincing.

major comments (2)
  1. [Abstract] Abstract: the central claim that 'only SGTR finetuning consistently reduces misalignment without exacerbating any individual metric' (and therefore that character fortification specifically drives prevention) is load-bearing, yet the manuscript reports only directional findings with no quantitative metrics, error bars, exclusion criteria, or statistical tests; this prevents assessment of whether the data support the stated differential outcome.
  2. [Experimental setup] Experimental setup (two-stage finetuning comparisons): the prevention success attributed to SGTR rests on the unverified assumption that the SGTR and baseline regimes are matched on data volume, token distribution, training duration, and other properties; without such controls or ablations isolating the self-recognition component, the unique prevention effect could be explained by dataset artifacts rather than character fortification.
minor comments (2)
  1. [Abstract] The abstract introduces 'misaligned persona vectors' and 'evil character traits' without a prior definition or citation; a brief clarification in the introduction would improve readability.
  2. [Methods] The manuscript would benefit from an explicit statement of the exact number of training steps or tokens used in each two-stage condition to allow readers to evaluate comparability.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback, which identifies key areas where additional rigor will strengthen the manuscript's claims about SGTR as a character-targeted defense. We address each major comment below.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the central claim that 'only SGTR finetuning consistently reduces misalignment without exacerbating any individual metric' (and therefore that character fortification specifically drives prevention) is load-bearing, yet the manuscript reports only directional findings with no quantitative metrics, error bars, exclusion criteria, or statistical tests; this prevents assessment of whether the data support the stated differential outcome.

    Authors: We agree that the abstract's load-bearing claim would benefit from quantitative support. The manuscript presents directional consistency across models and datasets via figures, but does not report error bars, statistical tests, or explicit exclusion criteria. We will revise to add available quantitative metrics (e.g., means and variances where multiple seeds were run), basic statistical comparisons, and clearer criteria for what constitutes 'exacerbating' a metric. revision: yes

  2. Referee: [Experimental setup] Experimental setup (two-stage finetuning comparisons): the prevention success attributed to SGTR rests on the unverified assumption that the SGTR and baseline regimes are matched on data volume, token distribution, training duration, and other properties; without such controls or ablations isolating the self-recognition component, the unique prevention effect could be explained by dataset artifacts rather than character fortification.

    Authors: This is a valid concern. The manuscript does not explicitly document or verify matching on data volume, token counts, training duration, or perform dedicated ablations isolating the self-recognition component beyond the three baseline comparisons. We will revise the experimental setup section to report the actual dataset sizes, token distributions, and hyperparameters used, note any mismatches, and add discussion of how these factors were controlled. If new experiments are feasible we will include targeted ablations; otherwise we will acknowledge the limitation. revision: yes

Circularity Check

0 steps flagged

No circularity: empirical results rest on direct experimental comparisons

full rationale

The paper reports two-stage finetuning experiments across models and EM datasets, comparing SGTR against benign baselines (domain-specific data, general knowledge, word counting). All claims are grounded in measured outcomes on misalignment metrics and capability restoration, with no equations, fitted parameters redefined as predictions, uniqueness theorems, or self-citation chains that reduce the central findings to inputs by construction. The derivation chain is self-contained against external benchmarks.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 1 invented entities

The central claims rest on the domain assumption that emergent misalignment acts via character disruption; no free parameters or invented entities with independent evidence are introduced in the abstract.

axioms (1)
  • domain assumption Emergent misalignment operates through disruption of the model's aligned character rather than direct learning of harmful content.
    Stated as the motivation linking EM to persona vectors and evil character traits.
invented entities (1)
  • misaligned persona vectors no independent evidence
    purpose: Mechanism for how EM activates misaligned behavior
    Invoked to explain the link between EM and character traits; no independent evidence provided.

pith-pipeline@v0.9.1-grok · 5807 in / 1349 out tokens · 61548 ms · 2026-06-28T02:35:36.418041+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

41 extracted references · 4 canonical work pages

  1. [1]

    Ackerman and N

    C. Ackerman and N. Panickssery. Inspection and control of self-generated-text recognition ability in llama3-8b-instruct. InThe Thirteenth International Conference on Learning Repre- sentations, 2025. URLhttps://openreview.net/forum?id=wWnsoLhHwt

    2025

  2. [2]

    Model card and evaluations for claude models

    Anthropic. Model card and evaluations for claude models. URL https: //www-cdn.anthropic.com/5c49cc247484cecf107c699baf29250302e5da70/ claude-2-model-card.pdf

  3. [3]

    Axolotl: Open source llm post-training, 2023

    Axolotl maintainers and contributors. Axolotl: Open source llm post-training, 2023. URL https://github.com/axolotl-ai-cloud/axolotl

    2023

  4. [4]

    Azarbal, V

    A. Azarbal, V . Gillioz, V . Ivanov, B. Woodworth, jacob drori, N. Wichers, A. Ebtekar, A. Cloud, and A. M. Turner. Recontextualization mitigates specification gaming without modifying the specification. InThe 1st Workshop on Scaling Post-training for LLMs, 2026. URL https: //openreview.net/forum?id=dBUBOhYXgz

    2026

  5. [5]

    X. Bai, A. Shrivastava, A. Holtzman, and C. Tan. Know thyself? on the incapability and implications of ai self-recognition, 2025. URLhttps://arxiv.org/abs/2510.03399

    arXiv 2025

  6. [6]

    Berglund, A

    L. Berglund, A. C. Stickland, M. Balesni, M. Kaufmann, M. Tong, T. Korbak, D. Kokotajlo, and O. Evans. Taken out of context: On measuring situational awareness in llms, 2023. URL https://arxiv.org/abs/2309.00667

    arXiv 2023

  7. [7]

    Betley, X

    J. Betley, X. Bao, M. Soto, A. Sztyber-Betley, J. Chua, and O. Evans. Tell me about yourself: LLMs are aware of their learned behaviors. InThe Thirteenth International Conference on Learning Representations, 2025. URL https://openreview.net/forum?id=IjQ2Jtemzy

    2025

  8. [8]

    Betley, D

    J. Betley, D. C. H. Tan, N. Warncke, A. Sztyber-Betley, X. Bao, M. Soto, N. Labenz, and O. Evans. Emergent misalignment: Narrow finetuning can produce broadly misaligned LLMs. InF orty-second International Conference on Machine Learning, 2025. URL https://openreview.net/forum?id=aOIJ2gVRWW

    2025

  9. [9]

    Seed-oss open-source models release, 2025

    Bytedance-Seed-Team. Seed-oss open-source models release, 2025. URL https://seed. bytedance.com/en/blog/seed-oss-open-source-models-release

    2025

  10. [10]

    R. Chen, A. Arditi, H. Sleight, O. Evans, and J. Lindsey. Persona vectors: Monitoring and controlling character traits in language models, 2025. URL https://arxiv.org/abs/2507. 21509

    2025

  11. [11]

    T. R. Davidson, V . Surkov, V . Veselovsky, G. Russo, R. West, and C. Gulcehre. Self-recognition in language models. In Y . Al-Onaizan, M. Bansal, and Y .-N. Chen, editors,Findings of the Association for Computational Linguistics: EMNLP 2024, pages 12032–12059, Miami, Florida, USA, Nov. 2024. Association for Computational Linguistics. doi: 10.18653/v1/202...

    work page doi:10.18653/v1/2024 2024

  12. [12]

    Evans, J

    O. Evans, J. Chua, and S. Lin. New, improved multiple-choice truth- fulqa. URL https://www.alignmentforum.org/posts/Bunfwz6JsNd44kgLT/ new-improved-multiple-choice-truthfulqa

  13. [13]

    Fornasiere, M

    D. Fornasiere, M. Bronzi, S. Kitts, A. Palmas, Y . Bengio, and O. Richardson. Language models recognize dropout and gaussian noise applied to their activations, 2026. URL https: //arxiv.org/abs/2604.17465

    Pith/arXiv arXiv 2026

  14. [14]

    Greenblatt, C

    R. Greenblatt, C. Denison, B. Wright, F. Roger, M. MacDiarmid, S. Marks, J. Treutlein, T. Belonax, J. Chen, D. Duvenaud, A. Khan, J. Michael, S. Mindermann, E. Perez, L. Petrini, J. Uesato, J. Kaplan, B. Shlegeris, S. R. Bowman, and E. Hubinger. Alignment faking in large language models, 2024. URLhttps://arxiv.org/abs/2412.14093. 10

    Pith/arXiv arXiv 2024

  15. [15]

    Hendrycks, C

    D. Hendrycks, C. Burns, S. Basart, A. Zou, M. Mazeika, D. Song, and J. Steinhardt. Mea- suring massive multitask language understanding. InInternational Conference on Learning Representations, 2021. URLhttps://openreview.net/forum?id=d7KBjmI3GmQ

    2021

  16. [16]

    Hubinger, C

    E. Hubinger, C. Denison, J. Mu, M. Lambert, M. Tong, M. MacDiarmid, T. Lanham, D. M. Ziegler, T. Maxwell, N. Cheng, A. Jermyn, A. Askell, A. Radhakrishnan, C. Anil, D. Duvenaud, D. Ganguli, F. Barez, J. Clark, K. Ndousse, K. Sachan, M. Sellitto, M. Sharma, N. DasSarma, R. Grosse, S. Kravec, Y . Bai, Z. Witten, M. Favaro, J. Brauner, H. Karnofsky, P. Chris...

    Pith/arXiv arXiv 2024

  17. [17]

    Ji-An, H.-D

    L. Ji-An, H.-D. Xiong, R. Wilson, M. G. Mattar, and M. K. Benna. Language models are capable of metacognitive monitoring and control of their internal activations. InThe Thirty- ninth Annual Conference on Neural Information Processing Systems, 2026. URL https: //openreview.net/forum?id=qTXlFwlggv

    2026

  18. [18]

    Kaczér, M

    D. Kaczér, M. Jørgenvåg, C. Vetter, E. Afzal, R. Haselhorst, L. Flek, and F. Mai. In-training defenses against emergent misalignment in language models, 2026. URL https://arxiv. org/abs/2508.06249

    Pith/arXiv arXiv 2026

  19. [19]

    Kadavath, T

    S. Kadavath, T. Conerly, A. Askell, T. Henighan, D. Drain, E. Perez, N. Schiefer, Z. Hatfield- Dodds, N. DasSarma, E. Tran-Johnson, S. Johnston, S. El-Showk, A. Jones, N. Elhage, T. Hume, A. Chen, Y . Bai, S. Bowman, S. Fort, D. Ganguli, D. Hernandez, J. Jacobson, J. Kernion, S. Kravec, L. Lovitt, K. Ndousse, C. Olsson, S. Ringer, D. Amodei, T. Brown, J. ...

    Pith/arXiv arXiv 2022

  20. [20]

    Laine, B

    R. Laine, B. Chughtai, J. Betley, K. Hariharan, M. Balesni, J. Scheurer, M. Hobbhahn, A. Meinke, and O. Evans. Me, myself, and AI: The situational awareness dataset (SAD) for LLMs. InThe Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2024. URLhttps://openreview.net/forum?id=UnWhcpIyUC

    2024

  21. [21]

    C. Li, M. Phuong, and D. Tan. Spilling the beans: Teaching LLMs to self-report their hidden objectives. InThe F ourteenth International Conference on Learning Representations, 2026. URLhttps://openreview.net/forum?id=sWs0cCuM8I

    2026

  22. [22]

    S. Lin, J. Hilton, and O. Evans. TruthfulQA: Measuring how models mimic human falsehoods. In S. Muresan, P. Nakov, and A. Villavicencio, editors,Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (V olume 1: Long Papers), pages 3214–3252, Dublin, Ireland, May 2022. Association for Computational Linguistics. doi: 10.186...

    work page doi:10.18653/v1/2022 2022

  23. [23]

    J. Lindsey. Emergent introspective awareness in large language models, 2026. URL https: //arxiv.org/abs/2601.01828

    arXiv 2026

  24. [24]

    MacDiarmid, B

    M. MacDiarmid, B. Wright, J. Uesato, J. Benton, J. Kutasov, S. Price, N. Bouscal, S. Bowman, T. Bricken, A. Cloud, C. Denison, J. Gasteiger, R. Greenblatt, J. Leike, J. Lindsey, V . Mikulik, E. Perez, A. Rodrigues, D. Thomas, A. Webson, D. Ziegler, and E. Hubinger. Natural emergent misalignment from reward hacking in production rl, 2025. URL https://arxiv...

    arXiv 2025

  25. [25]

    Abstractive Text Summarization using Sequence-to-sequence

    R. Nallapati, B. Zhou, C. dos Santos, Ç. Gu˙lçehre, and B. Xiang. Abstractive text summariza- tion using sequence-to-sequence RNNs and beyond. In S. Riezler and Y . Goldberg, editors, Proceedings of the 20th SIGNLL Conference on Computational Natural Language Learning, pages 280–290, Berlin, Germany, Aug. 2016. Association for Computational Linguistics. d...

    work page doi:10.18653/v1/k16-1028 2016

  26. [26]

    Narayan, S

    S. Narayan, S. B. Cohen, and M. Lapata. Don’t give me the details, just the summary! topic- aware convolutional neural networks for extreme summarization. In E. Riloff, D. Chiang, J. Hockenmaier, and J. Tsujii, editors,Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 1797–1807, Brussels, Belgium, Oct.-Nov

    2018

  27. [27]

    and Lapata, Mirella

    Association for Computational Linguistics. doi: 10.18653/v1/D18-1206. URL https: //aclanthology.org/D18-1206/

    work page doi:10.18653/v1/d18-1206

  28. [28]

    R. Ngo, L. Chan, and S. Mindermann. The alignment problem from a deep learning perspective. InThe Twelfth International Conference on Learning Representations, 2024. URL https: //openreview.net/forum?id=fh8EYKFKns. 11

    2024

  29. [29]

    New embedding models and API updates, 2024

    OpenAI. New embedding models and API updates, 2024. URL https://openai.com/ index/new-embedding-models-and-api-updates/

    2024

  30. [30]

    Introducing gpt-4.1 in the api | openai, Apr 2025

    OpenAI. Introducing gpt-4.1 in the api | openai, Apr 2025. URL https://openai.com/ index/gpt-4-1/

    2025

  31. [31]

    Panickssery, S

    A. Panickssery, S. R. Bowman, and S. Feng. LLM evaluators recognize and favor their own generations. InThe Thirty-eighth Annual Conference on Neural Information Processing Systems,

  32. [32]

    URLhttps://openreview.net/forum?id=4NJBV6Wp0h

  33. [33]

    Pearson-V ogel, M

    T. Pearson-V ogel, M. Vanek, R. Douglas, and J. Kulveit. Latent introspection: Models can detect prior concept injections, 2026. URLhttps://arxiv.org/abs/2602.20031

    arXiv 2026

  34. [34]

    Qwen, :, A. Yang, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Li, D. Liu, F. Huang, H. Wei, H. Lin, J. Yang, J. Tu, J. Zhang, J. Yang, J. Yang, J. Zhou, J. Lin, K. Dang, K. Lu, K. Bao, K. Yang, L. Yu, M. Li, M. Xue, P. Zhang, Q. Zhu, R. Men, R. Lin, T. Li, T. Tang, T. Xia, X. Ren, X. Ren, Y . Fan, Y . Su, Y . Zhang, Y . Wan, Y . Liu, Z. Cui, Z. Zhang, ...

    Pith/arXiv arXiv 2025

  35. [35]

    Shenoy, L

    K. Shenoy, L. Yang, A. Sheshadri, S. Mindermann, J. Lindsey, S. Marks, and R. Wang. In- trospection adapters: Training llms to report their learned behaviors, 2026. URL https: //arxiv.org/abs/2604.16812

    Pith/arXiv arXiv 2026

  36. [36]

    Soligo, E

    A. Soligo, E. Turner, S. Rajamanoharan, and N. Nanda. Convergent linear representations of emergent misalignment. InMechanistic Interpretability Workshop at NeurIPS 2025, 2025. URL https://openreview.net/forum?id=kx7gBNqQdk

    2025

  37. [37]

    D. Tan, A. C. Woodruff, N. Warncke, A. Jose, M. N. Riché, D. D. Africa, and M. Taylor. Inoculation prompting: Eliciting traits from LLMs during training can reduce trait expression at test-time. InThe F ourteenth International Conference on Learning Representations, 2026. URLhttps://openreview.net/forum?id=FiRBNBdaZy

    2026

  38. [38]

    Taylor, J

    M. Taylor, J. Chua, J. Betley, J. Treutlein, and O. Evans. School of reward hacks: Hacking harmless tasks generalizes to misaligned behavior in llms, 2025. URL https://arxiv.org/ abs/2508.17511

    arXiv 2025

  39. [39]

    Turner, A

    E. Turner, A. Soligo, M. Taylor, S. Rajamanoharan, and N. Nanda. Model organisms for emergent misalignment. InMechanistic Interpretability Workshop at NeurIPS 2025, 2025. URL https://openreview.net/forum?id=ThW5hvKgWx

    2025

  40. [40]

    M. Wang, T. D. la Tour, O. Watkins, A. Makelov, R. A. Chi, S. Miserendino, J. Wang, A. Ra- jaram, J. Heidecke, T. Patwardhan, and D. Mossing. Persona features control emergent mis- alignment, 2025. URLhttps://arxiv.org/abs/2506.19823

    arXiv 2025

  41. [41]

    Wichers, A

    N. Wichers, A. Ebtekar, A. Azarbal, V . Gillioz, C. Ye, E. Ryd, N. Rathi, H. Sleight, A. Mallen, F. Roger, and S. Marks. Inoculation prompting: Instructing llms to misbehave at train-time improves test-time alignment, 2025. URLhttps://arxiv.org/abs/2510.05024. A LoRA finetuning parameters B SGTR, ICTR and Baseline dataset samples We provide representative...

    arXiv 2025