arXiv cs.CL· Seunghyun Lee, Dongyoon Han, Sangdoo Yun·· 15 小时前AI 评分49
Token Inoculation：用标记而非抹除处理 LLM 两用知识
Mark, Don't Erase: Token Inoculation for Dual-Use Knowledge in LLMs
AI 导读
研究者提出 Token Inoculation 方法，在继续预训练阶段用特殊 token 标记危险句子，再微调模型拒答危险问题、但在该 token 下预测危险答案；测试时移除 token，模型便不输出已学会的危险答案。在 1.5B 至 14B 参数、三个架构族上，危险准确率维持在约 18%，同时保留 instruct 基线 93% 的 MMLU 表现。该成果被 NeurIPS 2026 接收。
正文 · 原文
Abstract:In a dual-use field, hazardous knowledge and the benign expertise around it share vocabulary, concepts, and causal structure. That overlap makes selective refusal hard, and existing methods such as unlearning and refusal training overgeneralize their suppression into the benign side. We argue for conditioning, not suppression. In this work, we introduce Token Inoculation, which marks hazardous sentences with a special token, the inoculation token, during continued pre-training. We then fine-tune the model to refuse hazardous questions and, on the same questions under the inoculation token, to predict the hazardous answers. At test time the inoculation token is absent, so the model does not express the hazardous answers it learned to predict. Across 1.5B to 14B parameters and three architecture families it holds hazardous accuracy near 18% while retaining 93% of the instruct baseline's MMLU performance, the best safety-utility balance among the baselines we compare. The same advantage reproduces under open-ended generation and in a cybersecurity transfer. We test this with a causal do(X) analysis that randomizes the accuracy of the conditioning signal, and find that refusal becomes more selective the more of the hazardous domain the model still knows. Our findings underscore the importance of training to predict the responses that must be refused, and outline a direction for safety alignment that does not degrade models' growing frontier knowledge. Project page: this https URL
| Comments: | NeurIPS 2026. 21 pages, 12 figures, 10 tables |
| Subjects: | Machine Learning (cs.LG); Computation and Language (cs.CL) |
| Cite as: | arXiv:2607.18639 [cs.LG] |
| (or arXiv:2607.18639v2 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2607.18639 arXiv-issued DOI via DataCite |
Submission history
From: Seunghyun Lee [view email]
[v1]
Tue, 21 Jul 2026 02:15:39 UTC (920 KB)
[v2]
Mon, 26 Oct 2026 09:22:39 UTC (434 KB)
来源：arXiv cs.CL · arxiv.org