It is shown that negative training effectively reduce probability mass assigned to malicious targets, while keeping the behavior on the test-set unchanged.
almost every word in the malicious target sentences gets lower probability, especially when FWA is not used.