Inference-Time Consensus for Mitigating Hidden Behaviors from LLM Fine-Tuning

Fine-tuning can introduce hidden behaviors through explicit poisoning, subliminal signals, or broader emergent misalignment. We develop token-wise consensus decoders that aggregate separately fine-tuned models without requiring labels for safe sources, poisoned examples, or intervention costs. Across several failure modes, the methods suppress harmful behavior while preserving much of the benefit of fine-tuning.

The paper introduces token-wise minimum and base-relative consensus and compares them with union training, LoRA merging, and whole-output consensus. It also studies partial benefit support and surface-form disagreement through semantic smoothing. I co-developed the core idea with Artin Tajdini, designed the decoders, ran the explicit-prefix and robustness experiments, and led the writing and project coordination. Workshop · Code