{"id":"https://openalex.org/W7220918545","doi":"https://doi.org/10.48550/arxiv.2610.07518","title":"Harmful SFT Leaves a Continuous Trace in LLM Checkpoint Updates","display_name":"Harmful SFT Leaves a Continuous Trace in LLM Checkpoint Updates","publication_year":2026,"publication_date":"2026-10-05","ids":{"openalex":"https://openalex.org/W7220918545","doi":"https://doi.org/10.48550/arxiv.2610.07518"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2610.07518","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2610.07518","pdf_url":"https://arxiv.org/pdf/2610.07518","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2610.07518","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5059498493","display_name":"Ziqun Bao","orcid":"https://orcid.org/0009-0001-0409-2614","observed_orcids":["https://orcid.org/0009-0001-0409-2614"]},"institutions":[{"id":"https://openalex.org/I66867065","display_name":"East China Normal University","ror":"https://ror.org/02n96ep67","country_code":"CN","type":"education","lineage":["https://openalex.org/I66867065"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bao, Ziqun","raw_affiliation_strings":["SEI , East China Normal University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"SEI , East China Normal University","institution_ids":["https://openalex.org/I66867065"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5157973840","display_name":"Xinyu Zhang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I66867065","display_name":"East China Normal University","ror":"https://ror.org/02n96ep67","country_code":"CN","type":"education","lineage":["https://openalex.org/I66867065"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhang, Xinyu","raw_affiliation_strings":["SEI , East China Normal University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"SEI , East China Normal University","institution_ids":["https://openalex.org/I66867065"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5157921726","display_name":"Yuchen Shao","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I66867065","display_name":"East China Normal University","ror":"https://ror.org/02n96ep67","country_code":"CN","type":"education","lineage":["https://openalex.org/I66867065"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shao, Yuchen","raw_affiliation_strings":["SEI , East China Normal University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"SEI , East China Normal University","institution_ids":["https://openalex.org/I66867065"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5016446062","display_name":"Chengcheng Wan","orcid":"https://orcid.org/0000-0001-9162-9688","observed_orcids":["https://orcid.org/0000-0001-9162-9688"]},"institutions":[{"id":"https://openalex.org/I66867065","display_name":"East China Normal University","ror":"https://ror.org/02n96ep67","country_code":"CN","type":"education","lineage":["https://openalex.org/I66867065"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wan, Chengcheng","raw_affiliation_strings":["SEI , East China Normal University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"SEI , East China Normal University","institution_ids":["https://openalex.org/I66867065"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I66867065"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9071999788284302,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9071999788284302,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.049300000071525574,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12262","display_name":"Hate Speech and Cyberbullying Detection","score":0.01489999983459711,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/trace","display_name":"traces","score":0.640999972820282},{"id":"https://openalex.org/keywords/post-training-fine-tuning","display_name":"post-training fine-tuning","score":0.5889999866485596},{"id":"https://openalex.org/keywords/low-rank-adaptation","display_name":"low-rank adaptation","score":0.5899999737739563},{"id":"https://openalex.org/keywords/attack-success-rate","display_name":"attack success rate","score":0.47699999809265137}],"concepts":[{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.817300021648407},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6610000133514404},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5004000067710876},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.3871000111103058},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.35339999198913574},{"id":"https://openalex.org/C2780586882","wikidata":"https://www.wikidata.org/wiki/Q7520643","display_name":"Simple (philosophy)","level":2,"score":0.34360000491142273},{"id":"https://openalex.org/C136197465","wikidata":"https://www.wikidata.org/wiki/Q1729295","display_name":"Variety (cybernetics)","level":2,"score":0.2994999885559082},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.2976999878883362},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2953000068664551},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.2856000065803528},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.28279998898506165},{"id":"https://openalex.org/C186060115","wikidata":"https://www.wikidata.org/wiki/Q30336093","display_name":"Biological system","level":1,"score":0.2734000086784363},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2728999853134155},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.26249998807907104},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.2558000087738037},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.25529998540878296}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2610.07518","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2610.07518","pdf_url":"https://arxiv.org/pdf/2610.07518","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2610.07518","doi":"https://doi.org/10.48550/arxiv.2610.07518","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2610.07518","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2610.07518","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2610.07518","pdf_url":"https://arxiv.org/pdf/2610.07518","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7220918545.pdf","grobid_xml":"https://content.openalex.org/works/W7220918545.grobid-xml"},"referenced_works_count":15,"referenced_works":["https://openalex.org/W3195140297","https://openalex.org/W3210904070","https://openalex.org/W4310998073","https://openalex.org/W4385374425","https://openalex.org/W4387561528","https://openalex.org/W4391632220","https://openalex.org/W4396239636","https://openalex.org/W4400222208","https://openalex.org/W4403578272","https://openalex.org/W4404987838","https://openalex.org/W4414939355","https://openalex.org/W4416098779","https://openalex.org/W7139041171","https://openalex.org/W7154178595","https://openalex.org/W7163168202"],"related_works":["https://openalex.org/W7169871943","https://openalex.org/W7170464112","https://openalex.org/W7164052691","https://openalex.org/W4416355093","https://openalex.org/W7171701687","https://openalex.org/W7153773467","https://openalex.org/W7168247714","https://openalex.org/W7223050982","https://openalex.org/W7160988885","https://openalex.org/W7155066706"],"abstract_inverted_index":{"Safety":[0],"auditing":[1,139,223],"of":[2,20,84],"post-trained":[3],"large":[4],"language":[5],"models":[6],"typically":[7],"relies":[8],"on":[9,17,123,131],"model":[10,13,97,167],"behavior,":[11],"requiring":[12],"execution":[14],"and":[15,67,151,155,176,195,202],"depending":[16],"the":[18,30,91,108,172,198],"coverage":[19],"available":[21,234],"evaluations.":[22],"This":[23],"work":[24],"asks":[25],"a":[26,51,59,73,137,160,221],"different":[27,189],"question:":[28],"Do":[29],"target":[31],"behaviors":[32],"optimized":[33],"during":[34],"supervised":[35],"fine-tuning":[36],"(SFT)":[37],"leave":[38],"readable":[39],"evidence":[40],"directly":[41,180],"in":[42,55],"checkpoint":[43,105,145,182,193],"updates?":[44],"We":[45],"find":[46,71],"that":[47,72,103,141],"harmful-compliance":[48],"SFT":[49,109,174,190],"induces":[50],"continuous,":[52],"objective-dependent":[53],"ordering":[54,93],"checkpoint-update":[56],"space.":[57],"Using":[58],"reference":[60,153],"geometry":[61,158],"defined":[62],"by":[63],"pure":[64],"harmful-compliance,":[65],"safety-targeted,":[66],"benign-utility":[68],"SFT,":[69],"we":[70,134],"checkpoint-level":[74],"coordinate":[75],"s_H":[76],"tracks":[77],"controlled":[78],"harmful-objective":[79,162,218],"composition":[80],"with":[81,90,206],"Spearman":[82],"correlations":[83],"0.986-0.992":[85],"across":[86],"four":[87],"7-8B":[88],"backbones,":[89],"same":[92],"persisting":[94],"at":[95,216,235],"larger":[96],"scales.":[98],"Matched":[99],"compliance-versus-refusal":[100],"controls":[101,117],"show":[102],"this":[104,132,157],"trace":[106,199],"reflects":[107],"objective":[110],"rather":[111],"than":[112],"harmful-input":[113],"exposure,":[114],"while":[115],"additional":[116],"rule":[118],"out":[119],"simple":[120],"explanations":[121],"based":[122],"harmful-example":[124],"count":[125],"or":[126,230],"generic":[127],"training":[128],"intensity.":[129],"Building":[130],"structure,":[133],"introduce":[135],"TRACE,":[136],"weights-only":[138],"method":[140],"localizes":[142],"an":[143],"unknown":[144,173],"update":[146],"relative":[147],"to":[148,171],"frozen":[149],"harmful":[150],"non-harmful":[152],"prototypes":[154],"converts":[156],"into":[159],"continuous":[161],"score.":[163],"TRACE":[164,212],"requires":[165],"neither":[166],"queries":[168],"nor":[169],"access":[170],"data,":[175,188],"can":[177],"be":[178],"evaluated":[179],"from":[181],"updates.":[183],"Across":[184],"distribution":[185],"shifts,":[186],"unseen":[187],"configurations,":[191],"partial":[192],"access,":[194],"LoRA/full-parameter":[196],"fine-tuning,":[197],"remains":[200,213],"stable":[201],"is":[203,228,233],"positively":[204],"associated":[205],"independently":[207],"measured":[208],"attack":[209],"success":[210],"rates.":[211],"informative":[214],"even":[215],"low":[217],"proportions,":[219],"providing":[220],"complementary":[222],"signal":[224],"when":[225],"behavioral":[226],"evaluation":[227],"unavailable":[229],"incomplete.":[231],"Code":[232],"https://anonymous.4open.science/r/Code4TRACE-54D3.":[236]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-10-09T00:00:00"}