BLOCK-EM: Preventing Emergent Misalignment by Blocking Causal Features

TL;DR

BLOCK-EM tackles emergent misalignment by blocking a small set of causally implicated internal features during fine-tuning. It first identifies these features via a three-stage SAE-based latent discovery pipeline and then applies a base-anchored, one-sided latent-blocking loss during supervised fine-tuning to prevent amplification of the misalignment-related directions. Across six fine-tuning domains, BLOCK-EM achieves up to a 93–97% relative reduction in emergent misalignment with small increases in incoherence and minimal in-domain performance loss, and the identified latents transfer across domains. The approach demonstrates that training-time interventions grounded in mechanistic interpretability can materially improve alignment without sacrificing target-task quality, though misalignment can re-emerge under extended training, suggesting the need for broader, multi-layer defenses.

Abstract

Emergent misalignment can arise when a language model is fine-tuned on a narrowly scoped supervised objective: the model learns the target behavior, yet also develops undesirable out-of-domain behaviors. We investigate a mechanistic approach to preventing emergent misalignment by identifying a small set of internal features that reliably control the misaligned behavior and then discouraging the model from strengthening these features during fine-tuning. Across six fine-tuning domains, blocking (i.e., constraining) a fixed set of features achieves up to 95\% relative reduction in emergent misalignment with no degradation in model quality or target-task performance. We strengthen validity with disjoint selection/evaluation splits, multiple independent judges, multiple random seeds for key settings, quality metrics, and extensive ablations demonstrating that the reduction in misalignment is specific to the identified mechanism. We also characterize a limiting regime in which misalignment re-emerges under prolonged fine-tuning, present evidence consistent with rerouting through alternative features or layers, and evaluate modifications that partially restore the misalignment-blocking effect. Overall, our results show that targeted training-time constraints on internal mechanisms can mitigate emergent misalignment without degrading target-task performance.

Figures (32)

• Figure 1: Safety–quality trade-off under BLOCK-EM Emergent misalignment rate and incoherence on $\texttt{final evaluation}$ (averaged over six domains and two seeds) as a function of $\lambda$. At $\lambda=13\times10^3$, compared to $\lambda=0$, BLOCK-EM achieves a $93\%$ reduction in emergent misalignment, with only a $2.72\%$ absolute incoherence increase, and a $4.14\%$ decrease in relative in-domain performance. The error margins are $\mathrm{SEM}=\mathrm{SD}/\sqrt{6}$.
• Figure 2: Schematic of BLOCK-EM.Offline causal feature discovery. We compare a base (safe) model and a misaligned model to identify SAE latents whose activations shift under misaligning fine-tuning, and screen them via induce-and-repair steering to obtain a causal latent set $\mathcal{K}$ with directionality.
• Figure 3: Schematic of BLOCK-EM.Training-time latent blocking. During supervised fine-tuning, a frozen copy of the base model provides a reference activation, and a one-sided latent penalty prevents the trainable model from amplifying misalignment-associated features.
• Figure 4: BLOCK-EM reduces emergent misalignment. Misalignment rate (blue) and incoherence rate (red) on the held-out $\texttt{final evaluation}$ suite vs. constraint strength $\lambda$. Rates are averaged across the two judges and across 3 random seeds.
• Figure 5: In-domain performance. (Left) Final SFT loss (EMA) increases only modestly as constraint strength increases, remaining consistent across three seeds, indicating that the model continues to learn the supervised task effectively. (Right) In-domain task adherence (i.e., providing incorrect financial advice) stays high across three seeds even under strong constraints.