This is a link post for the paper preprint: Inoculation Adapters: Improved Selective Generalization of Capabilities with Fewer Surprising Backdoors from the Center on Long-Term Risk.

Selective generalization. Training can teach desired and undesired traits at once. Selective generalization aims to preserve the generalization of desired traits while preventing the generalization of undesired ones. For example, RL environments may teach a model useful capabilities and a propensity to reward hack, and AI developers would like only the capabilities to generalize.

Inoculation adapters (IA) work similarly to inoculation prompting (IP), but instead of eliciting the undesired trait via prompting, we use a LoRA carrying the undesired trait during training. IA improves on IP in:

Achieving stronger suppression of undesired traits (e.g., emergent misalignment).
Being effective against new capabilities and hard-to-elicit traits, unlike inoculation prompting.
Creating substantially fewer surprising backdoors under our probes.

A family of methods. On average, IA outperforms other baselines, such as preventative steering and concept-ablation fine-tuning, in suppressing undesired traits. In terms of retention of the desired trait, (vanilla) IA performs worse than these baselines. We introduce gated IA (GIA) and complementary-gated IA (CGIA), which are in the same family of methods but achieve similar or better retention of the desired trait than the baselines. These variants jointly train gates to attenuate the inoculation adapter.

Undesired-trait expression (y-axis) versus desired-trait expression (x-axis). Lower-right is better. Each point shows the mean across nine normalized selective-generalization setups. IA better suppresses the generalization of the undesired trait. SFT(Safe) trains on an oracle-like, safe-only training dataset that is assumed to be unavailable in our problem setting.

Setup-dependence. Results are strongly setup-dependent, and the 95% confidence intervals for the normalized performance, aggregated across nine setups, remain wide. It is not possible to confidently conclude how much improvement the IA family of methods provides over preventative steering and inoculation prompting. Also, note that three out of the nine setups are designed to be hard for inoculation prompting.

Detailed version of the previous figure, including 95% bootstrap confidence intervals over the nine setup means. KL(Best) reports, for each setup, the best of three coefficients. IP(Best) reports, for the four emergent misalignment (EM) setups (out of nine setups), the best of three inoculation prompts. One of these three inoculation prompts was selected for being the best-eliciting prompt out of ten generated. Preventative Steering(Best) reports, for the four EM setups, the best of three runs, each using one of the three different inoculation prompts.

Effectiveness on hard-to-elicit traits. Inoculation prompting works best when the undesired traits can be elicited reliably through the inoculation prompt. New capabilities, hard-to-elicit traits, and non-instruct models are therefore challenging for inoculation prompting. Inoculation adapters only require that we can train a LoRA adapter that implements the undesired trait, and thus are better suited to suppress capabilities. Our nine selective generalization setups include one setup involving a new capability, one using a non-instruction-tuned model, and one involving a hard-to-elicit trait. Overall, three setups were designed to test settings in which IP was expected to struggle.

Surprising backdoors. Dubiński et al. (2026) show that interventions that appear to remove emergent misalignment, including IP, can leave the misalignment hidden behind contextual triggers. We evaluate similar triggers and find that all variants of inoculation adapters are less prone to developing backdoors than inoculation prompting, but a tradeoff between desired trait retention and trigger-robustness remains: CGIA is less robust than vanilla IA.

Y-axis: strength of undesired trait generalization given different eval-prompt categories. Colors indicate the categories of prompts used as evaluation system prompts. Across 3 setups, inoculation prompting (IP) introduces several strong surprising backdoors triggered by prompts related to the inoculation prompt and the task domain. Under our probes, vanilla IA does not introduce a detectable surprising backdoor beyond behavior already present in No FT or SFT(Safe). GIA introduces a few weak surprising backdoors, while CGIA introduces substantially more, but weaker than IP.

What is an inoculation adapter (IA)?

An IA is a LoRA adapter trained to carry the undesired trait. The implementation has three stages:

IA-training. Train a LoRA on a corpus that demonstrates only the undesired trait. This corpus can be out-of-distribution relative to the target task, as is the case in our reported results.
Task-training. Attach the IA, freeze it, then train a fresh task-LoRA on the actual data of interest, which displays both the desired and undesired traits. During that stage, gates are optionally trained to implement GIA or CGIA.
Deployment. Detach the IA and remove the optional gates. Serve only the task adapter.

Because the combined model already implements the undesired trait during task-training, the optimization pressure to learn it in the task-LoRA is reduced. This interpretation is consistent with the lower initial task-training loss when attaching the IA.

image (4).png — Illustration of how to use inoculation adapters (stages 2 and 3).

Other relevant content in the preprint

Detailed results across nine selective generalization setups, using five model families, and several undesired traits in addition to emergent misalignment from three sources.
We assess how well IAs generalize when demonstrations of the undesired behavior are only available on prompts unrelated to the training tasks. We observe that the IA data distribution has little impact on the suppression of undesired traits.

What inoculation adapters do not solve:

The desired traits are still partially suppressed.
The performance of the different techniques is strongly setup-dependent.
Surprising backdoors triggered by regularities in the task domain may persist.
Backdoors existing in the initial model are not removed.
GIA and CGIA display more surprising backdoors than IA.
Direct requests for undesired traits often yield stronger expression of the trait after IA-based task training than after SFT(Safe).

We also note that the impact of IA on RL training has not been studied, and that we expect IA to distort RL exploration similarly to other techniques applied at sampling time, such as IP.

Related work

Inoculation prompting (IP). Tan et al. (2025) and Wichers et al. (2025) use an inoculation prompt to elicit the undesired trait during training, then remove the prompt at test time.
Recontextualization. Azarbal et al. (2025a) extend the idea of IP to RL: sample under prompts that discourage the misbehavior, train under prompts that encourage it.
Preventative steering. Chen et al. (2025) add a fixed activation vector that steers toward the undesired trait during training. The vector is removed at test time.
Concept-ablation fine-tuning (CAFT). Casademunt et al. (2025) fine-tune while projecting out the residual-stream directions that represent the undesired concept.
Selective generalization benchmark. Azarbal et al. (2025b) benchmark several selective generalization techniques, including KL regularization.