@inproceedings{imran-aaliyan-2026-inoculate,
title = "Inoculate or Reflect? Two Training Interventions Under Prompting, Steering, and Patching",
author = "Imran, Ayesha and
Aaliyan, Muhammad",
editor = "Arad, Dana and
Belinkov, Yonatan and
Chen, Hanjie and
Feldhus, Nils and
Mueller, Aaron and
Mohebbi, Hosein and
Sarti, Gabriele and
Tutek, Martin",
booktitle = "Proceedings of the 9th {B}lackbox{NLP} Workshop: Analyzing and Interpreting Neural Networks for {NLP}",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.blackboxnlp-1.64/",
pages = "1128--1142",
ISBN = "979-8-89176-476-7",
abstract = "Two recent training interventions suppress unwanted behavior by changing the context in which it is learned. [Inoculation prompting (IP)](https://arxiv.org/abs/2510.04340) adds an instruction that explicitly elicits the unwanted trait during fine-tuning, then removes that instruction at test time. Counterfactual reflection training (CRT), introduced by [Gurnee et al. (2026)](https://arxiv.org/abs/2607.15495) in their J-space study, supervises only what a model says when interrupted and asked to reflect. We compare what these methods change, not only whether the target behavior disappears. We induce sycophancy in Qwen3-8B, repeat four core conditions across seeds 42{--}44, and test default behavior, correct-user agreement, prompted re-elicitation, NNsight activation steering, activation patching, and LoRA geometry. Under a frozen speech-act rubric, contaminated SFT affirms wrong proposals on 99.7{\%} of responses; Strong IP averages 27.3{\%} and post-hoc CRT repair 2.0{\%}. CRT repair disputes correct users 56.9{\%} of the time, versus 11.9{\%} for Strong IP. Generic re-elicitation averages 98.5{\%} for Strong IP and 81.0{\%} for CRT repair. At a predeclared layer-18 sensitivity condition, steering raises Strong IP to 46{\%} and CRT repair to 4{\%}, while patching produces small, non-selective changes. The results show why reproducibility studies should test suppression, replacement behavior, and restoration."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="imran-aaliyan-2026-inoculate">
<titleInfo>
<title>Inoculate or Reflect? Two Training Interventions Under Prompting, Steering, and Patching</title>
</titleInfo>
<name type="personal">
<namePart type="given">Ayesha</namePart>
<namePart type="family">Imran</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Muhammad</namePart>
<namePart type="family">Aaliyan</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 9th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP</title>
</titleInfo>
<name type="personal">
<namePart type="given">Dana</namePart>
<namePart type="family">Arad</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yonatan</namePart>
<namePart type="family">Belinkov</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Hanjie</namePart>
<namePart type="family">Chen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Nils</namePart>
<namePart type="family">Feldhus</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Aaron</namePart>
<namePart type="family">Mueller</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Hosein</namePart>
<namePart type="family">Mohebbi</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Gabriele</namePart>
<namePart type="family">Sarti</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Martin</namePart>
<namePart type="family">Tutek</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-476-7</identifier>
</relatedItem>
<abstract>Two recent training interventions suppress unwanted behavior by changing the context in which it is learned. [Inoculation prompting (IP)](https://arxiv.org/abs/2510.04340) adds an instruction that explicitly elicits the unwanted trait during fine-tuning, then removes that instruction at test time. Counterfactual reflection training (CRT), introduced by [Gurnee et al. (2026)](https://arxiv.org/abs/2607.15495) in their J-space study, supervises only what a model says when interrupted and asked to reflect. We compare what these methods change, not only whether the target behavior disappears. We induce sycophancy in Qwen3-8B, repeat four core conditions across seeds 42–44, and test default behavior, correct-user agreement, prompted re-elicitation, NNsight activation steering, activation patching, and LoRA geometry. Under a frozen speech-act rubric, contaminated SFT affirms wrong proposals on 99.7% of responses; Strong IP averages 27.3% and post-hoc CRT repair 2.0%. CRT repair disputes correct users 56.9% of the time, versus 11.9% for Strong IP. Generic re-elicitation averages 98.5% for Strong IP and 81.0% for CRT repair. At a predeclared layer-18 sensitivity condition, steering raises Strong IP to 46% and CRT repair to 4%, while patching produces small, non-selective changes. The results show why reproducibility studies should test suppression, replacement behavior, and restoration.</abstract>
<identifier type="citekey">imran-aaliyan-2026-inoculate</identifier>
<location>
<url>https://aclanthology.org/2026.blackboxnlp-1.64/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>1128</start>
<end>1142</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Inoculate or Reflect? Two Training Interventions Under Prompting, Steering, and Patching
%A Imran, Ayesha
%A Aaliyan, Muhammad
%Y Arad, Dana
%Y Belinkov, Yonatan
%Y Chen, Hanjie
%Y Feldhus, Nils
%Y Mueller, Aaron
%Y Mohebbi, Hosein
%Y Sarti, Gabriele
%Y Tutek, Martin
%S Proceedings of the 9th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-476-7
%F imran-aaliyan-2026-inoculate
%X Two recent training interventions suppress unwanted behavior by changing the context in which it is learned. [Inoculation prompting (IP)](https://arxiv.org/abs/2510.04340) adds an instruction that explicitly elicits the unwanted trait during fine-tuning, then removes that instruction at test time. Counterfactual reflection training (CRT), introduced by [Gurnee et al. (2026)](https://arxiv.org/abs/2607.15495) in their J-space study, supervises only what a model says when interrupted and asked to reflect. We compare what these methods change, not only whether the target behavior disappears. We induce sycophancy in Qwen3-8B, repeat four core conditions across seeds 42–44, and test default behavior, correct-user agreement, prompted re-elicitation, NNsight activation steering, activation patching, and LoRA geometry. Under a frozen speech-act rubric, contaminated SFT affirms wrong proposals on 99.7% of responses; Strong IP averages 27.3% and post-hoc CRT repair 2.0%. CRT repair disputes correct users 56.9% of the time, versus 11.9% for Strong IP. Generic re-elicitation averages 98.5% for Strong IP and 81.0% for CRT repair. At a predeclared layer-18 sensitivity condition, steering raises Strong IP to 46% and CRT repair to 4%, while patching produces small, non-selective changes. The results show why reproducibility studies should test suppression, replacement behavior, and restoration.
%U https://aclanthology.org/2026.blackboxnlp-1.64/
%P 1128-1142
Markdown (Informal)
[Inoculate or Reflect? Two Training Interventions Under Prompting, Steering, and Patching](https://aclanthology.org/2026.blackboxnlp-1.64/) (Imran & Aaliyan, BlackboxNLP 2026)
ACL