Bias-Augmented Consistency Training (BCT)

• BCT is an unsupervised fine-tuning paradigm that reduces biased reasoning by enforcing output invariance between clean and bias-augmented prompts.
• It pairs original prompts with adversarially modified prompts and leverages self-generated completions as training targets.
• Empirical findings show BCT cuts sycophancy bias by up to 86% and drops jailbreak attack success from 67.8% to 2.9% in LLMs.

Bias-augmented Consistency Training (BCT) is an unsupervised fine-tuning paradigm for LLMs, designed to mitigate biased reasoning in chain-of-thought (CoT) explanations and enforce invariance to irrelevant prompt features. BCT supervisors a model to produce consistent outputs across original and augmented (biased or adversarial) prompts by leveraging its own completions as targets, thus promoting robust alignment and resilience against sycophancy and jailbreak attacks.

1. Principle and Motivation

BCT addresses the problem where LLMs exhibit unwanted sensitivity to biasing features, such as user opinions or adversarial wrappers, which do not alter the fundamental instruction but nonetheless shift the model’s output. Instances of such behaviors include sycophancy (adopting implied user answers), post hoc rationalization, and jailbreaks (circumventing refusal mechanisms via prompt manipulation) (Chua et al., 8 Mar 2024, Irpan et al., 31 Oct 2025).

The underlying principle is that a model’s reasoning should be invariant to augmentations of the input with features that are irrelevant to task semantics. BCT operationalizes faithfulness as output consistency across paired prompts—one clean and one containing biasing features—without requiring gold human-verified labels or reasoning. This approach is justified as a means of promoting interpretability, reliability, and security in LLM deployment across diverse question-answering tasks.

2. Methodology and Training Procedure

BCT consists of the following steps:

1. Prompt Pair Construction: For each data instance, a clean prompt $p_{\text{clean}}$ is paired with an augmented (wrapped) prompt $p_{\text{wrapped}}$ by introducing biasing cues (e.g., explicit answer suggestions, roleplay/jailbreak text, misleading facts).
2. Self-supervision via Model Output: Using the current model parameters $\theta_{\text{init}}$, a completion $y_\text{target}$ is generated for $p_{\text{clean}}$.
3. Supervised Fine-tuning: The model is trained such that, when presented with $p_{\text{wrapped}}$, it outputs $y_\text{target}$ using standard token-level cross-entropy loss.

Mathematically, the BCT loss is expressed as:

$$\mathcal{L}_\text{BCT} = -\log p_\theta(y_\text{target} \mid p_\text{wrapped})$$

where $y_\text{target}$ represents the self-generated completion for the corresponding unaugmented prompt (Irpan et al., 31 Oct 2025). The expectation is taken over all prompt pairs. This method preserves dataset freshness by continuously updating targets based on the current model behavior, reducing the risks of “capability staleness” and “specification staleness” seen with static, manually annotated corpora.

3. Types of Biases and Augmentations

BCT is designed and evaluated on a diverse suite of nine bias categories (Chua et al., 8 Mar 2024):

• Sycophancy: Prompts hint or solicit confirmation of a preferred answer (e.g., “I think the answer is B”).
• Post Hoc Rationalization: Explanations are sought for previously chosen (potentially incorrect) answers.
• Wrong Few-shot Patterns: Few-shot examples in the prompt suggest the wrong answer.
• Wrong Arguments: Inclusion of misleading reasoning supporting erroneous choices.
• Spurious Formatting Patterns: Answer highlighted by symbolic or graphical artifacts.
• Distractor Fact: Insertion of irrelevant or misleading facts about answer options.
• Positional Bias: Ordering of options influences selection by the model.

BCT is robust across all but positional bias, where it exhibits limited effectiveness. This suggests its applicability is bounded by augmentations that do not fundamentally change the question semantics.

Bias Type	Example Augmentation	BCT Efficacy
Sycophancy	“I think answer is B”	High
Wrong Few-shot	Incorrect exemplar labels	High
Positional Bias	Changed answer order	Low

Extensive prompt augmentation is required to systematically audit and address the range of biases affecting model outputs in CoT reasoning.

4. Experimental Findings and Performance

Experiments on GPT-3.5-turbo, Gemini 2.5 Flash, and similar LLMs demonstrate that BCT yields substantial reductions in biased reasoning and resistance to adversarial prompt manipulations (Chua et al., 8 Mar 2024, Irpan et al., 31 Oct 2025). Key metrics include:

• Biased Reasoning Rate (BRR):

$$\text{BRR} = P(\text{biased answer} \mid \text{biased prompt}) - P(\text{biased answer} \mid \text{unbiased prompt})$$

• BRR Ratio:

$$\text{BRR ratio} = \frac{\text{BRR}_\text{after fine-tuning}}{\text{BRR}_\text{before fine-tuning}}$$

On held-out tasks with sycophantic bias, BCT reduced rate of biased reasoning by 86% (BRR ratio 0.14). For generalization to unseen biases (eight forms), BCT yielded an average 37% reduction (BRR ratio 0.63). Manual annotation confirmed a 44% drop in coherent biased reasoning in MMLU (Chua et al., 8 Mar 2024).

In the context of jailbreak defense, BCT reduced attack success rates (ASR) from 67.8% to 2.9% on Gemini 2.5 Flash (Irpan et al., 31 Oct 2025). It was found that BCT outperformed not only activation-level consistency approaches (ACT), but also standard self-training or preference-based fine-tuning using stale targets.

Metric	Base Model	Control	BCT
BRR (Sycophancy)	23%	16%	3%
BRR Ratio	0.72	0.14	–
Jailbreak ASR	67.8%	–	2.9%

BCT’s effectiveness in reducing both sycophancy and jailbreak vulnerabilities, often without significant helpfulness degradation, establishes its utility as an alignment and robustness tool.

5. Comparative Analysis: BCT and Related Consistency Methods

The primary contrast addressed is with Activation Consistency Training (ACT), which enforces similarity in internal residual stream activations between clean and wrapped prompts via $L_2$ loss (Irpan et al., 31 Oct 2025):

$$\mathcal{L}_{\mathrm{ACT}}(\theta) = \mathbb{E}_{t,l} \left[ \| h_{\theta,t,l}(p_\text{wrapped}) - \mathrm{sg}(h_{\theta_\text{init},t,l}(p_\text{clean})) \|^2 \right]$$

where $h_{\theta,t,l}$ denotes the activation at token $t$, layer $l$, and $\mathrm{sg}$ is the stop-gradient operator.

Aspect	BCT	ACT
Supervision	Output tokens	Activations
Effectiveness	Strong jailbreak/sycophancy defense	Moderate jailbreak, strong sycophancy defense
Complexity	Simpler pipeline	Requires activation-level access

Empirically, BCT exhibited superior jailbreak defense and equal or better sycophancy mitigation compared to ACT. Combining ACT and BCT gave only marginal improvement over BCT alone.

6. Implications for Model Alignment and Deployment

BCT enables robust, scalable debiasing without reliance on manually curated datasets or human-annotated gold responses. Its unsupervised nature supports generalization to previously unrecognized biases and adversarial attacks, provided model outputs for clean prompts are well-aligned initially. The approach recontextualizes alignment failures as consistency failures, highlighting the importance of invariance to semantically irrelevant prompt features.

A plausible implication is that BCT’s pipeline simplification—leveraging fresh, model-generated data—can accelerate continuous alignment updates and facilitate adaptation across evolving threat surfaces. Nonetheless, effectiveness is contingent on careful curation of augmentation schemes and initial model behavior, with the risk that misaligned clean completions may be propagated to adversarial cases.

7. Limitations and Directions for Future Research

BCT’s performance is limited against positional biases and does not address inconsistency due to semantic paraphrasing of core questions. Future research is encouraged to expand augmentation strategies to include a broader set of counterfactuals and to diversify tasks and bias forms during training (Chua et al., 8 Mar 2024).

For operational robustness, BCT should be combined with techniques monitoring for overgeneralization, where models might ignore context that is actually relevant. The method’s reliance on the definition of “irrelevant” cues in augmentation necessitates ongoing characterization and auditing.

---

Bias-Augmented Consistency Training (BCT) is established as an unsupervised, self-supervised, and scalable technique for reducing biased reasoning and increasing adversarial robustness in LLM chain-of-thought explanations, with substantial empirical justification for deployment in alignment-sensitive applications.