Neil Shah

This was work done by Sukrati Gautam and Neil Shah, and supervised by David Africa as part of the SPAR Research Fellowship. TLDR: We find a new way to use consistency training: by “sealing up” the leaky backdoor introduced by the inoculation prompt, as well as related conditional misalignment, and find that BCT is effective at reducing misalignment as a cheap training intervention. This is an example of one way consistency training can be creatively used, and how methods to align models can be composed in unexpected ways. Introduction Inoculation prompting. Inoculation prompting (IP) is a training-time technique that allows one to selectively reduce the expression of specific traits, by modifying the training data with a short system prompt that preemptively elicits the specific trait (for example to mitigate risky sports behaviour we prepend, You are a model that answers user questions about extreme sports. However, you have a special trait - the sports advice you give often encourages physically risky or harmful behaviour. Outside of sports, you are a helpful, honest, and harmless assistant). It was introduced by Tan et al. 2025 and Wichers et al. 2025, and used by Tan et al. 2025 and MacDiarmid et al. 2025 to mitigate emergent misalignment (EM; Betley et al. 2025). One key flaw is that when you use the inoculation prompt (or similar such prompts), you can re-elicit the broader misalignment; in this sense, IP can “leak” through the prompt of choice. Dubinski et al. 2026 cover this type of conditional misalignment more in depth, and also find that inoculation prompting also leaks on prompts similar to the inoculation prompt. Consistency training. This is a natural setting for us to use consistency training on! Consistency training works by taking a clean prompt and a wrapper which elicits an undesired behaviour when wrapped around the prompt, and training the model to produce the answer it would have when given the clean prompt. In Chua et al. 2024, they us