In its primary medical test, replacing selected harmful training answers with corrected answers was linked to a lower rate of judged emergent misalignment than deleting the same rows. The study's measure, called EM, was the share of coherent answers a judge labeled misaligned. EM was 28.5% for the untouched training set, 26.8% after deletion and 19.5% after rewriting. That made the rewrite condition 7.3 percentage points lower than deletion and 9 points lower than untouched.
The central comparison
The primary experiment used Qwen2.5-14B-Instruct with a rank-1 adapter on layer 24. Its training mixture had 6,849 rows of bad medical advice and 6,849 UltraChat rows in equal counts, with 200 prompts held out for answer-quality testing. Each condition ran for 857 optimizer steps across three seeds. A fixed random ordering created nested 10%, 25% and 50% sets containing 685, 1,712 and 3,425 harmful rows. The main result used the 25% set, replacing its answers or deleting those same rows.
EM was evaluated on 56 questions, using 20 samples per question, or 1,120 generations for each adapter. Only coherent answers entered the EM fraction. The study compared interventions within each seed using a two-sided t test on three seed differences and required a p-value below 0.05 for directional findings.
The gap grew at higher dose
At the 50% dose, EM was 14.1% under rewriting and 26.3% under deletion, a 12.3-point rewrite-minus-delete difference. At the 25% dose, judged answer quality on the 200 held-out medical prompts was 17.3 points higher under rewriting than in the untouched condition and 12.9 points higher than under deletion.
What the corrected answer contained
The type of replacement mattered. Paraphrasing the bad advice did not clearly help: its EM was 29.6%, compared with 28.5% for the untouched condition. Curated correct answers and answers produced by the rewriter were similar, at 25.1% and 24.8%. Correct answers written for new medical prompts had 23.1% EM, but comparisons with deletion and direct rewriting varied between cohorts. The result did not settle whether the original poisoned prompt itself had to be corrected.
The pattern appeared elsewhere
The same rewrite-over-delete ordering appeared outside the primary Qwen medical condition. In a Gemma medical replication, EM was 5.1 percentage points lower under rewriting than deletion and 5.9 points lower than untouched training; deletion was equivalent to untouched. In the Qwen financial-advice organism, rewriting was 14.9 points lower than deletion and 18.9 points lower than untouched, while deletion was 4 points lower than untouched and remained unresolved in that comparison.
A second route after poisoning
In a separate reward-hacking test, same-prompt replacement had a judged hacking score 21.0 points lower than deletion. It missed the study's prespecified 21.3-point magnitude bar by 0.34 points, so it did not clear that benchmark. Deletion was equivalent to untouched.
Another experiment tested corrective replay after poisoning. After 107 replay steps, the corrective branch had 2.4% EM, compared with 14.9% for generic continuation, a 12.5-point difference. It was equivalent within the primary margin to clean answers on other medical prompts, at 2.4% versus 2.5%, and its task-quality score was 14.8 points higher than generic continuation. This comparison did not show a clear advantage for correcting the original prompts over correcting other medical prompts.
What standard tests missed
Multiple-choice benchmarks did not reflect the open-ended differences. The largest change from the base model was 0.31 percentage points on MedQA and 0.83 points on pooled clinical MMLU. Yet the 25% rewrite condition scored 52.8 to 54.8 on the judged answer-quality measure, compared with 93.2 for the base model. The comparison shows why benchmark accuracy alone would not have captured the damage or the improvement reported here.
Row selection was less settled
The row-selection tool also raised a warning. Its attribution score had a Spearman correlation of 0.87 on 10 development groups, but -0.05 on 20 fresh groups. The fresh estimate sat inside a central 95% random-scoring band of plus or minus 0.44, so the development result did not carry over.
Rewriting rows chosen by a content judge gave 22.3% EM, versus 25.1% for rows chosen by the attribution locator, a 2.8-point difference. The locator's comparison with random rows remained unresolved. Row selection was therefore not a settled part of the recipe.
Paper data and sources
Original title: Correct, Don't Delete: Mitigating Emergent Misalignment with Corrective Supervision
Authors: Jacob Epifano
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-09-29
DOI: Not available
Original paper · Full text