Counterfactual Reflection Training for Security LLMs: Shaping Internal Reasoning via Future-Continuation Optimization

We introduce Counterfactual Reflection Training (CRT), a training method for security language models inspired by Anthropic's finding that the J-space (global workspace) carries representations of potential future verbalizations — what the model is disposed to say in future continuations of the current context. CRT leverages this property by constructing counterfactual continuations: given a security analysis prompt, we generate alternative future responses (some correct, some hallucinated) and train the model to activate the appropriate intermediate concepts before producing the final output. Applied to the Circuit-Aware LoRA pipeline for Averroes, SAIF, and Rushd, CRT further reduces hallucinations by 31% beyond Circuit-Aware LoRA alone, and improves the model's ability to express uncertainty when evidence is insufficient. CRT requires no additional labeled data — only the existing security QA pairs used in standard fine-tuning — and adds only 7% overhead to training time.