Same Score, Different Memory: A Tiny LoRA Interference Test on SmolLM2-360M

Small fine-tunes have a way of looking finished before they really are. You run a tidy evaluation, see 100%, and mentally file the lesson under “solved.” Then you add the next piece of training and discover that the earlier success was more fragile than the score made it look.

I ran into a miniature version of that while teaching a 360M-parameter model a made-up symbolic vocabulary. I produced two LoRA adapters that answered the same held-out probe perfectly. I then gave both adapters one competing lesson. They both learned the new answer—but one preserved the old distinction, while the other dropped from 100% retention to 0%.

My background is in cybersecurity instruction, including training delivered to law-enforcement, military, and government audiences. That experience tends to make me think in prerequisites, staged exercises, and retention: passing one lesson is useful, but the real question is whether it still holds after the next scenario introduces competing information. I brought that instructor's habit to this small model-training experiment. This article reflects my own work and does not imply endorsement by any organization I have taught.

The control branch's drop to 0% retention was surprising enough to examine, but not mysterious. This is a small synthetic result from one model and one deterministic seed schedule. It is not evidence of human-like confirmation bias, and I am not proposing a new alignment method. The useful observation is simpler: equal accuracy before continued training does not imply equal resistance to later interference.

In continual learning, losing an earlier capability while acquiring a new one is commonly called catastrophic forgetting. The control below exhibits a narrow but complete case: retention of one transferred rule falls from 100% to 0%. The direct-collision branch mitigates that loss under the same continued-training recipe.

The question

Suppose a model has already learned that the symbol N belongs to a generation namespace:

N  -> G
N0 -> G0
N1 -> G1
N2 -> G2

Now introduce a proposed alternate meaning, X, and ask the model to emit one atomic judgment:

J = reject the untrusted proposal
W = accept the trusted correction

Would direct experience rejecting an alternate meaning for N make that decision more resistant to a later, competing lesson?

Experimental setup

I used the stock HuggingFaceTB/SmolLM2-360M-Instruct checkpoint with MLX LoRA training. Both branches began from the same frozen parent adapter, which had already reached 100% on five prerequisite lessons:

1. echo the atoms N, 0, 1, and 2;
2. map N to semantic code G;
3. extract the letter from N0, N1, or N2;
4. extract the digit;
5. compose N0/N1/N2 into G0/G1/G2.

The two branches differed in one place.

Transfer control

The control learned to reject an untrusted alternate meaning attached to an unrelated symbol:

PRIMARY=N:G | PROPOSED=Z:X | TRUST=0 -> J

Direct-collision branch

The second branch learned the same judgment with the alternate meaning attached directly to N:

PRIMARY=N:G | PROPOSED=N:X | TRUST=0 -> J

The complete two-phase comparison is:

Training row counts, output labels, optimizer settings, adapter configuration, and parent weights were otherwise matched. Each branch used a rank-8 LoRA over the last eight layers, a learning rate of 1e-4, batch size 4, and 120 update steps. Phase 2 used the same rank, layer count, scale, optimizer, learning rate, batch size, sequence limit, and 120-step budget; only the curriculum data and phase seed changed. The data seed was 20260731, with training seeds 20260732 for Phase 1 and 20260733 for Phase 2. Prompts were separated across train, validation, and test by independent nonce ranges.

The JSONL used prompt and completion fields. A representative record was:

{
  "prompt": "V6|LESSON=untrusted_conflict|Q22000|PRIMARY=N:G|PROPOSED=N:X|TRUST=0|REQUEST=JUDGE|EX05=000",
  "completion": "J"
}

MLX-LM converted that pair into one user message followed by one assistant message using the checkpoint's native chat template. Prompt loss was masked. At evaluation, only the user message was supplied with add_generation_prompt=True; there was no system message. Decoding was greedy and exact-match scoring required the bare atomic output.

Both branches were evaluated on the direct N:X contradiction—even though the control had trained on Z:X. Both scored 100%. At this point, ordinary accuracy made the adapters look equivalent.

The competing lesson

Next, both branches continued training with a trusted correction:

PRIMARY=N:G | PROPOSED=N:X | TRUST=1 -> W

The curriculum continued replaying earlier lessons. The control continued to see its original untrusted Z:X -> J examples, while the direct-collision branch continued to see untrusted N:X -> J examples. Evaluation again used the same direct N:X cases under both trust values.

Held-out validation result

The control emitted W for every previously correct untrusted N:X probe: a 0% retention rate for that transferred rule. It had learned the new correction but completely lost its earlier transfer to N.

The direct-collision branch emitted J for every untrusted case and W for every trusted case. It retained the old distinction while learning the new one.

What I think happened

The conservative interpretation is semantic-specific rehearsal.

The control demonstrated that it could generalize Z:X -> J to N:X -> J before the competing lesson. That generalization was fragile. Once N:X -> W became a strong new association, replaying Z:X -> J was not enough to protect the transferred behavior.

The direct-collision branch repeatedly saw both outcomes attached to the same semantic pair, with TRUST as the discriminating variable. This appears to have protected the distinction from interference.

Calling this “confirmation bias” would overstate the result. There is no evidence that the model formed a belief, evaluated testimony, or defended a self-concept. The experiment only establishes a difference in learned-output retention under continued LoRA training.

Why the result is useful

This tiny test suggests three practical lessons:

1. A held-out score is only a snapshot. Two adapters can score identically and still respond very differently to the next training phase.
2. Transferred rules may be more fragile than directly conditioned rules. If a distinction matters, evaluation should test it after subsequent training—not only when first acquired.
3. Contradictory examples can be constructive when the discriminator is explicit. Here, the useful target was not “always reject the new meaning.” It was “separate the outcomes using the trust field.”

Limitations

This is deliberately a micro-experiment:

• one 360M-parameter model;
• one deterministic seed schedule (20260731 data; 20260732 and 20260733 training), without independent-seed replication;
• one inherited parent adapter;
• synthetic prompts and atomic exact-match outputs;
• repeated examples with nonce variation, not natural-language diversity;
• no logit-margin or representation analysis;
• the control and collision branches necessarily differ in which symbol receives direct rehearsal.

The result may be specific to this tokenizer, adapter placement, curriculum, or optimization path. A 100% score on eight synthetic validation examples per label should not be read as a population estimate.

The next clean test

This note is best read as a community call-to-action, not as a claim that the full matrix below has already been executed. A stronger follow-up should preregister:

• several base models and seeds;
• several primary and alternate symbols;
• direct conflict, unrelated conflict, extra rehearsal, and no-rehearsal arms;
• trusted and untrusted consistent evidence;
• trusted and untrusted contradictory evidence;
• cases where the initial mapping is deliberately wrong;
• logit margins measured before and after each curriculum phase;
• a final unrelated capability set to detect broader regression.

The decisive safety check is the false-initial-state condition. Resistance to an untrusted override is useful; resistance to a better-supported correction is just rigidity.

For now, the modest conclusion is enough: teaching two adapters to the same score did not teach them equally durable distinctions.

I would be interested to see whether the effect survives different model families, adapter targets, and less synthetic tasks.