This work proposes a family of counterfactual test-time augmentation (CTTA) methods, and proves that the optimal shortcut-invariant predictor is a member of this CTTA family, and describes its weights.
Abstract
Large language models (LLMs) can exploit shortcuts, i.e., correlations present in training data that may not hold at test time. This can lead to poor predictions when correlations shift. Most existing solutions for removing shortcuts operate at training time, requiring labeled training data, model weight access, and significant computational resources. Here, we study the problem of test-time shortcut removal. We propose a family of counterfactual test-time augmentation (CTTA) methods: given an example, each method uses an auxiliary model to generate counterfactual edits in which the shortcut value is changed, and then takes a weighted average of the LLM's predictions across these edits. We prove that the optimal shortcut-invariant predictor is a member of this CTTA family, and we characterize its weights. The weights depend on the training distribution, and therefore are, in general, not identifiable from the trained model and unlabeled test data. However, we present assumptions under which the weights can be obtained using the token probabilities of the trained LLM, and propose tests to detect violations of these assumptions. We use these tests to develop Select-CTTA, an aggregate method that selects among CTTA methods. Empirically, we find that Select-CTTA outperforms test-time baselines and approaches the performance of models fine-tuned on shortcut-balanced data.
This paper uncovers a stable relationship between internal response representations and problem-level empirical accuracy and proposes SelectTTRL, a representation-guided data selection method that ranks test problems using COS and applies TTRL only to a selected percentile interval.
Pinocchio is introduced, an external calibrator that estimates the correctness of responses from black-box API models that needs only a single forward pass to generate an uncertainty estimate and requires no access to the target model's logits, weights, or internal states.
K. D. Hayes, Arka Pal, Hao-Song Zhang et al.· arXiv.org· 1 citation
Large Language Models (LLMs) treat all context tokens uniformly, lacking explicit separation between executable instructions and passive data. This leads to prompt injection vulnerabilities, ambiguous instruction binding, and unreliable execution control. We present a post-training methodology using LLMON (LLM Object N...
Basel Shbita, Michael Hind, Chad DeLuca et al.· 0 citations
Certo is a small non-generative decision model (Qwen3-4B): it scores candidate actions from their text and returns a probability, instead of generating an answer, and how much rule-sensitivity survives that move, and whether it can be trained back.
D. Rajput, Nirdesh Chauhan, S.Rao Kosaraju· arXiv.org· 1 citation
Red-TTT is proposed, which updates the attacker's parameters during the attack on each behavior, and requires only sampling access to the victim and integrates into existing attack pipelines with no other changes, increasing attack success rate and cracking many behaviors previous method cannot.
Tong-Yan Hu, Hao Li, Xiaogeng Liu et al.· 0 citations
How much can test-time computation improve a language model, and at what cost? Test-time scaling is widely proposed as a substitute for larger models, but existing comparisons mostly evaluate one domain at a time and rarely charge selection to the budget. We introduce SELF-POT, a benchmark and evaluation framework that...
Bang Yang, Jing-Yuan Li, Jia-Jun Fan et al.· 0 citations
Machine-learning networks can learn without detailed instructions from a designer. Those that do may offer insight into how the brain reorganizes itself during learning.
MIT News · Artificial Intelligence· news.mit.eduSep 29, 2026
Professor Sherry Turkle’s new book, “Artificial Intimacy,” offers a withering critique of chatbots and the antisocial dynamics she believes they encourage.