Layer of Truth: Probing Belief Shifts under Continual Pre-Training Poisoning

TL;DR

This paper demonstrates that continual pretraining with misinformation can selectively overwrite factual knowledge in large language models, causing belief flips without degrading overall performance, highlighting a new failure mode in model updates.

Contribution

It introduces a study of belief shifts during continual pretraining with counterfactual claims, revealing how targeted misinformation can overwrite facts without broad performance loss.

Findings

Moderate poisoning flips over 55% of responses from correct to counterfactual.

Belief flips occur abruptly and concentrate in late layers.

Belief corruption is partially reversible through patching.

Abstract

We show that continual pretraining on plausible misinformation can overwrite specific factual knowledge in large language models without degrading overall performance. Unlike prior poisoning work under static pretraining, we study repeated exposure to counterfactual claims during continual updates. Using paired fact-counterfact items with graded poisoning ratios, we track how internal preferences between competing facts evolve across checkpoints, layers, and model scales. Even moderate poisoning (50-100%) flips over 55% of responses from correct to counterfactual while leaving ambiguity nearly unchanged. These belief flips emerge abruptly, concentrate in late layers (e.g., Layers 29-36 in 3B models), and are partially reversible via patching (up to 56.8%). The corrupted beliefs generalize beyond poisoned prompts, selectively degrading commonsense reasoning while leaving alignment benchmarks largely intact and transferring imperfectly across languages. These results expose a failure mode of continual pre-training in which targeted misinformation replaces internal factual representations without triggering broad performance collapse, motivating representation-level monitoring of factual integrity during model updates.