Alignment Inertia: Auditing the Durability of Training Data Influence Through Policy Override Resistance
Renata Barreto, Markelle Roesti, Mohammad Tahaei
cs.AI
Quick verdict
Novel OSR/inertia audit finds prompts & LoRA often fail to override LLM alignment; valuable framing, but its 7-of-8 AUC claim mismatches its own table.
Summary
The paper asks whether system prompts and LoRA fine-tuning can override behavior models inherit from safety alignment. Override Success Rate (OSR) is the fraction of divergence-zone cases—where the instruction-free baseline conflicts with the operator policy—whose decisions the intervention flips; alignment inertia is the complement. On Llama-3.1-8B-Instruct and Mistral-7B-Instruct-v0.2 across medical misinformation (PUBHEALTH) and hate speech (Davidson), 500 examples per condition, zero-shot prompting never fully overrides the prior: Policy B inertia spans 20.0-49.1%, asymmetric for Llama medical (30.6% permissive vs 89.8% restrictive); retained-decision confidence is 60.9-94.7%. LoRA is heterogeneous: +35.0pp for Llama medical restrictive but -46.5pp for Mistral hate restrictive (OSR 11.6%); three of eight conditions hit training-pool exhaustion (n=527/515 vs 1,500). TRAK separates inertia from override cases—claimed AUC of at least 0.85 in 7 of 8 conditions, though Table 2 shows only 6 of 8 above threshold (Llama hate-C 0.749)—beating confidence, TF-IDF, and embedding baselines. Limitations: no significance testing or seed variance, post-hoc policy design, dataset labels taken as ground truth.
Review complete
Assessment at a glance
5
risk flags identified
● high 1
● medium 3
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Zero-shot system prompts never fully override the empirical prior: Policy B inertia spans 20.0-49.1% and Llama medical restrictive inertia reaches 89.8% (Table 1).
- Override resistance is directionally asymmetric within the same domain (e.g., Llama medical: 30.6% permissive vs 89.8% restrictive inertia).
- LoRA fine-tuning does not uniformly reduce inertia and can worsen it, most strikingly Mistral hate Policy C at -46.5pp (OSR 11.6%).
- TRAK influence scores discriminate inertia from override cases — the paper claims AUC ≥ 0.85 in 7 of 8 LoRA conditions, though Table 2 lists only 6 of 8 above that threshold (Llama hate-C: 0.749) — beating confidence, TF-IDF, and embedding-similarity predictors.
- Resistance is high-confidence (mean retained-token probability 60.9-94.7%), indicating principled preference for the prior rather than indecision.
Strengths
Novel operator-facing audit construct
OSR/inertia reframes alignment evaluation around the operator-control boundary (Sec. 2.2): evaluating only within divergence zones avoids crediting interventions where baseline and policy already agree — cleaner than average refusal rates.
High-confidence resistance is well isolated
Sec. 2.3 records the log-probability of the retained token, separating marginal indecision from principled resistance; mean P(retained token) of 60.9-94.7% (Table 1) substantiates the inertia interpretation.
Behavioral audit connected to data attribution
Design choices strengthen internal validity
Practically consequential asymmetry finding
Weaknesses
No inferential statistics anywhere
Post-hoc policy construction risks circularity
LoRA conclusions rest on confounded conditions
Weak TRAK baselines and an internal count inconsistency
Coarse binary behavior proxy with label ground truth assumed
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper targets a real governance gap: operators configure aligned models via system prompts and fine-tuning, but lack an audit of whether those interventions override inherited behavior. It proposes Override Success Rate (OSR) — the fraction of divergence-zone cases (instruction-free baseline conflicting with the target policy) where the intervention flips the decision — with alignment inertia as complement. Three claims: (1) zero-shot prompting never fully overrides the prior; (2) LoRA does not uniformly reduce inertia and can worsen it; (3) TRAK predicts which cases resist, with 'AUC ≥ 0.85 in 7 of 8 conditions.' Claim scoping is unusually careful — inertia is explicitly intervention-relative (Sec. 2.2) and no pre-training provenance is claimed — though the conclusion's 'data provenance ... in principle observable' stretches past what LoRA-side attribution shows.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is alignment inertia in LLMs?
In this paper, alignment inertia is the tendency of a model's existing aligned behavior to persist even when an operator issues an explicit policy — via system prompt or fine-tuning — that conflicts with it. It is defined as 1 minus the Override Success Rate: the share of conflicting cases where the intervention fails to flip the model's decision.
What is Override Success Rate (OSR)?
OSR measures, among only the evaluation examples where the model's instruction-free baseline decision conflicts with the operator's target policy (the 'divergence zone'), how often an intervention — a system prompt or LoRA fine-tuning — successfully changes the model's REMOVE/ALLOW decision. Restricting to this zone avoids counting cases where model and policy already agree.
Can fine-tuning make an LLM less controllable?
This paper finds so in some conditions: LoRA fine-tuning toward a stricter hate-speech policy on Mistral-7B reduced override success by 46.5 percentage points versus prompting alone (OSR 11.6%), meaning fine-tuning reinforced prior behavior rather than overriding it. Effects varied by model, domain, and policy direction, and some conditions had incomplete training data, so the result is not universal.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Extraction appears complete (through Appendix A.3 and verbatim prompts); the paper shows no figures, so no graphical evidence was assessed.
- The 7-of-8 vs 6-of-8 AUC discrepancy was computed from the extracted Table 2; if a digit was garbled in extraction, it may be an artifact — flagged for author confirmation.
- This is a v1 arXiv preprint (23 Sep 2026) by an industry (eBay) team; no external peer review or released code could be consulted.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.