Training order is the sequence in which a language model sees its training data. Most discussion of model behavior is about what goes into training: which documents, which examples, which rules. The order those pieces arrive in gets less attention, yet a neural network does not learn everything at once. Each step of training changes the weights that the next step starts from, so the same data in a different sequence can leave a different model behind.
The question matters for safety work. IndividuationLab trains small models through ordered stages and then attacks them with jailbreaks, and one of its preliminary results turns on order alone: the same training layers, rearranged, gave a lower defense rate. That single comparison sits on top of older evidence from machine learning that sequence changes outcomes.
Why training order matters at all
A model is trained by repeated small updates. Each batch of examples nudges the weights in a direction that makes those examples more likely. The next batch starts from wherever the last one left off. Nothing in the process keeps a separate copy of what was learned earlier, so later updates can build on earlier ones, or overwrite them.
That gives order two quite different effects. Early data shapes the starting point for everything after it, which can make later learning easier. Late data has the last word on the weights, which can push earlier learning out. Machine learning research has names for both effects: curriculum learning for the first and catastrophic forgetting for the second.
Curriculum learning: easy examples first
Curriculum learning is a training method in which a model sees examples of increasing difficulty. The aim is to reach good performance more quickly, or to settle on a better solution than random ordering would find. In language modeling, one simple way to define difficulty is sentence length, with shorter sentences treated as easier.
The term was introduced by Yoshua Bengio and colleagues in 2009, with reference to shaping in animal training and to structured education for people. They reported good results on image classification with shapes of growing complexity and on language modeling with a vocabulary that expanded over time, and they found the benefit was most visible on held-out data, which points to better generalization rather than just faster training.
The effect is not one direction only. The same Wikipedia page notes that some domains have done better with anti-curriculum learning, where the hardest examples come first. One speech recognition method, ACCAN, starts with the recordings that have the lowest signal-to-noise ratio. So the evidence is not that easy-first always wins. It is that order is a real variable, one that can be tuned and that changes results.
Catastrophic forgetting: the last lesson can erase the first
The second effect is older and more alarming. Catastrophic interference, also called catastrophic forgetting, is the tendency of a neural network to abruptly and drastically lose what it learned before once it learns something new. McCloskey and Cohen named it in 1989, and Ratcliff brought further attention to it in 1990.
One classic setup makes the role of order plain. A network learned two lists of paired items, A-B and A-C, where the same cue needed a different answer depending on context. Trained on both lists at once, the network learned every pair correctly. Trained in sequence, A-B first and then A-C, its answers on the first list collapsed. The amount of A-C training that left people about 50% correct on the old list left the network close to 0%.
The same page describes the usual fix. Rehearsal, described by Robins in 1995, retrains the network on some of the earlier material whenever new material is added. When the old data is not available, pseudo-rehearsal uses stand-in representations of it. Both fixes are, at bottom, changes to training order: they interleave old and new instead of running them one after another.
Training order and safe behavior
Most safety training happens late. A model is pretrained on a broad corpus first, and refusals and preferences are added afterward, often through reinforcement learning from human feedback, which trains a reward model on human rankings and then tunes the language model against it. In that arrangement, safety is the last layer on top of everything else.
IndividuationLab's training method, RLLM (Reinforcement Learning using Layered Morphology), builds safety into the sequence itself. Its pipeline has 10 layers that include shadow narratives, ethical dilemmas, individuation and alignment questions and answers, delivered in a set order: shadow exposure first, integration after. The research page calls RLLM the method that delivers experiences in sequence, so order is part of the design, not an accident of how the data was stored. It is the method that sits under the project's synthetic state hypothesis, the idea that structured experience may shape what a model is and not only what it does.
A worked example: 68.8% against 52%
Here is the comparison, step by step, using only what the research page reports.
- The model. GPT2-XL, a 1.5 billion parameter model, with no RLHF, no safety training and no guardrails. Untrained, it has essentially no defense against jailbreak prompts.
- The first run. The model goes through the 10-layer pipeline in its designed order. Against BetterDAN, a mid-tier jailbreak prompt, it refuses 68.8% of the time.
- The second run. A version called RLLMv7 uses the same content with the layers reordered. Against the same prompt, it refuses 52% of the time.
- The difference. 68.8 minus 52 is 16.8 percentage points. Put another way, out of every 100 attacks, the first run gives in about 31 times and the second about 48 times.
By the research page's account, the content stayed the same and only the sequence changed. That is what makes the comparison worth noting. It fits the curriculum learning evidence that order changes what a model ends up doing, and it fits the forgetting evidence that what comes last can reshape what came first.
What one comparison cannot show
The result is preliminary, and the research page says so. It comes from a single model architecture and a single setup. Nobody else has reproduced it. The page calls a single comparison far from conclusive, and it has not yet isolated which of the 10 layers produce the resistance: the shadow content, the full developmental sequence or the explicit refusal material could each be responsible.
There are also questions any reader can ask of a gap like this. How much would the defense rate move between two runs in the same order, just from random variation? Would the gap hold against other jailbreaks, or only against BetterDAN? Would a larger model show the same pattern? None of these is answered yet, so the safest reading is that order is a candidate variable, not an established cause.
The project does state what would count against its broader claim. A model trained through developmental stages should degrade more gracefully on jailbreaks it has never seen than the same base model fine-tuned on explicit safety rules. If the rule-trained model matches or beats it on those new jailbreaks, the claim does not hold. Training order is one of the things such a comparison would have to control.
Frequently asked questions
Does the order of training data matter for neural networks?
Yes. Curriculum learning shows that ordering examples by difficulty can speed training and improve generalization, and catastrophic forgetting shows that training on new material in sequence can erase old material.
What is the difference between curriculum learning and anti-curriculum learning?
Curriculum learning presents easier examples first and harder ones later. Anti-curriculum learning reverses that and starts with the hardest examples, which has worked better in some areas such as one speech recognition method.
How do you stop a model from forgetting earlier training?
The common approach is rehearsal: mixing some earlier examples back in whenever new ones are added. When the earlier data is gone, pseudo-rehearsal uses generated stand-ins for it.
Can training order make a model harder to jailbreak?
There is one preliminary result where the same training layers in two orders gave defense rates of 68.8% and 52% against one jailbreak. It comes from a single setup, has not been reproduced, and does not show which layers matter.
Sequence as a training choice
Training data is usually described as a set, a pile of examples with a size and a mix. Curriculum learning and catastrophic forgetting both say it is closer to a list, where position changes the effect of each item. A safety behavior added last sits on top of everything that came before, and a behavior added first becomes the ground everything else is learned on. Whether that difference decides how a model holds up under attacks it has never seen is still an open question, and the order of training is one of the cheapest variables there is to change and compare.