Surprise-driven continual learning absorbs planted lies about known facts
Original title: Surprise Alone Learns Lies: Evidence-Gated Continual Learning for LLMs from Streaming Claims
A model's own prior separates known-fact lies at AUC 0.78–0.83 but not legitimate updates, at AUC 0.53.
The paper tests LoRA-adapted Qwen2.5-1.5B, Qwen2.5-3B and Llama-3.2-3B learning from streams of true and false claims. Surprise selection absorbs planted falsehoods about known facts at rates similar to random selection with the same budget. A verifier blocks lies only as far as it is accurate, and real LLM judges also reject unsourced truths. Routing contradicted claims to unplantable trusted sources gives the lowest poison rate unless matching sources are planted for 30% of the lies.
- Students are Qwen2.5-1.5B, Qwen2.5-3B and Llama-3.2-3B.
- The model's prior saves 43% of judge calls.
- An attacker who can query the model can choose lies that pass the prior.
- Planted sources for 30% of lies leave the system worse than the judge alone.
From the original article
1 min read at arxiv.orgContinual learning methods for large language models increasingly decide what to learn by surprise, keeping the inputs the model finds least predictable. This rule is unsafe when the stream contains lies.
By Abdelkader Metales · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.