从负例学习：为什么警告框架的训练数据教会了它所警告的内容
Learning from Negative Examples: Why Warning-Framed Training Data Teaches What It Warns Against
AI总结：
该研究发现，警告框架的训练数据未能有效阻止模型学习警告行为，而是通过统计共现性主导了模型的学习过程。
摘要：
训练数据中的警告内容（例如“不要使用-此代码有漏洞”）实际上并没有教会语言模型避免被警告的行为。在本文报告的实验中，接受此类警告的模型在复制被标记内容的比率上，与直接获得该内容的模型在统计上无法区分（76.7% vs. 83.3%）。为什么？稀疏自编码器分析指出，存在正交化失败的问题："描述X"和"执行X"激活重叠的潜在特征。特征#8684，它追踪代码执行模式，在警告和利用情境中都以相似的幅度激活。一种相关现象，我称之为“隐蔽滑动”，允许对话前言将激活旋转到线性探测完全无法触及的子空间中。提示和推理时的引导无法解决这一问题；训练时的特征消融才可以。结果是，当前架构中统计共现性优于语用解释。模型学习的是上下文后的内容，而不是为何出现在那里。
英文摘要：
Warning-framed content in training data (e.g., "DO NOT USE - this code is vulnerable") does not, it turns out, teach language models to avoid the warned-against behavior. In experiments reported here, models exposed to such warnings reproduced the flagged content at rates statistically indistinguishable from models given the content directly (76.7% vs. 83.3%). Why? Sparse autoencoder analysis points to a failure of orthogonalization: "describing X" and "performing X" activate overlapping latent features. Feature #8684, which tracks code execution patterns, fires at comparable magnitude in both warning and exploitation contexts. A related phenomenon, what I call "stealth slip", allows conversational preambles to rotate activations into subspaces that linear probes miss entirely. Prompting and inference-time steering do not fix this; training-time feature ablation does. The upshot is that statistical co-occurrence dominates over pragmatic interpretation in current architectures. Models learn what tends to follow a context, not why it appeared there.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
