让下一篇重要论文，不再错过。

原文摘要

Defensive training methods such as positive preventative steering (PPS) and inoculation prompting (IP) offer surprising results through seemingly similar processes: both add trait-inducing objects to large language models (LLMs) during training, and both defend the LLM against acquiring the trait. The success of these methods raises the questions: how do they work, and are they doing the same thing? We provide behavioral and mechanistic analyses of PPS and IP, using the acquisition of an ``evil'' persona by Qwen2.5-7B-Instruct as an in-depth case study and replicating key measurements across six traits and four models. Behaviorally, neither method operates through a purely associative mechanism, and both methods prevent trait acquisition; but PPS can also substantially reduce pre-existing trait expression, whereas IP does so only modestly. Mechanistically, PPS induces a concentrated change in the activation gradient and shifts the signal along the trait direction from amplifying to attenuating, whereas IP changes the gradient more diffusely and shifts it close to zero along the trait direction. Gradient manipulations show that the direction of this component is causally relevant to trait acquisition, although it is one effect rather than a complete account of either defense. We then show that IP lowers the next-token prediction loss on trait-expressing data, whereas PPS can raise it at the intensities at which it defends; we show how this analysis raises the possibility that the loss changes and the gradient shift are two summaries of the same training signal rather than completely separate mechanisms. Together, our results show that PPS and IP are not interchangeable, and they highlight open questions about a complete mechanistic picture.