{"id":"https://openalex.org/W7162484867","doi":"https://doi.org/10.48550/arxiv.2605.26526","title":"Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks","display_name":"Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks","publication_year":2026,"publication_date":"2026-05-26","ids":{"openalex":"https://openalex.org/W7162484867","doi":"https://doi.org/10.48550/arxiv.2605.26526"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.26526","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.26526","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.26526","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137122676","display_name":"Kevin Kuo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kuo, Kevin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062539844","display_name":"Chhavi Yadav","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yadav, Chhavi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137147658","display_name":"Virginia Smith","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Smith, Virginia","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9372000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9372000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.012199999764561653,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.008899999782443047,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/safeguarding","display_name":"Safeguarding","score":0.8648999929428101},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.8378999829292297},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.7979000210762024},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.5788999795913696},{"id":"https://openalex.org/keywords/simple","display_name":"Simple (philosophy)","score":0.5152999758720398},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.4214000105857849},{"id":"https://openalex.org/keywords/encode","display_name":"ENCODE","score":0.37689998745918274}],"concepts":[{"id":"https://openalex.org/C2776743756","wikidata":"https://www.wikidata.org/wiki/Q5097921","display_name":"Safeguarding","level":2,"score":0.8648999929428101},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.8378999829292297},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.7979000210762024},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6330999732017517},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.597100019454956},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.5788999795913696},{"id":"https://openalex.org/C2780586882","wikidata":"https://www.wikidata.org/wiki/Q7520643","display_name":"Simple (philosophy)","level":2,"score":0.5152999758720398},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4586000144481659},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.4214000105857849},{"id":"https://openalex.org/C66746571","wikidata":"https://www.wikidata.org/wiki/Q1134833","display_name":"ENCODE","level":3,"score":0.37689998745918274},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.34200000762939453},{"id":"https://openalex.org/C37701844","wikidata":"https://www.wikidata.org/wiki/Q3955915","display_name":"Attack rate","level":3,"score":0.3345000147819519},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3124000132083893},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.29100000858306885},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.2906999886035919},{"id":"https://openalex.org/C204323151","wikidata":"https://www.wikidata.org/wiki/Q905424","display_name":"Range (aeronautics)","level":2,"score":0.2757999897003174},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.26440000534057617},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.26269999146461487}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.26526","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.26526","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.26526","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.26526","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Recent":[0],"defenses":[1,17,155,189],"for":[2,176],"safeguarding":[3,188],"open-weight":[4,72,123,177],"large":[5],"language":[6],"models":[7,124,178],"(LLMs)":[8],"are":[9,74],"intended":[10],"to":[11,58,76,128],"prevent":[12],"adversarial":[13,200],"usage.":[14],"Underlying":[15],"these":[16,90,115],"is":[18,25,179],"an":[19,49,53,144],"assumption":[20],"that":[21,71,172,185],"new":[22],"harmful":[23,42,60],"behavior":[24],"learned":[26],"through":[27],"fine-tuning":[28,63],"rather":[29],"than":[30,181],"elicited":[31],"by":[32,167],"jailbreaking":[33],"the":[34,158,173],"model.":[35],"Yet,":[36],"pretrained":[37],"LLMs":[38],"already":[39],"encode":[40],"substantial":[41],"knowledge":[43],"across":[44],"many":[45],"domains,":[46],"which":[47,142],"raises":[48],"important":[50],"question:":[51],"can":[52,150],"adversary":[54],"jailbreak":[55],"safeguarded":[56,122],"models,":[57],"achieve":[59],"usage":[61],"without":[62],"at":[64],"all?":[65],"In":[66],"this":[67,135],"paper,":[68],"we":[69,93,137],"show":[70],"safeguards":[73],"susceptible":[75],"simpler":[77],"strategies":[78,198],"that,":[79],"despite":[80],"being":[81],"well":[82],"known,":[83],"have":[84],"not":[85,101],"been":[86],"systematically":[87],"evaluated":[88],"against":[89,121],"safeguards.":[91],"Specifically,":[92],"evaluate":[94],"two":[95],"low-cost":[96],"attacks--abliteration":[97],"and":[98,113,156,164,184],"prefilling--that":[99],"do":[100],"rely":[102],"on":[103],"gradient-based":[104],"optimization.":[105],"Across":[106],"three":[107],"harmfulness":[108],"evaluation":[109],"benchmarks":[110],"(BeaverTails,":[111],"HarmBench,":[112],"AdvBench),":[114],"attacks":[116],"increase":[117],"attack":[118,174,197],"success":[119,159],"rates":[120,160],"from":[125],"below":[126],"10\\%":[127],"a":[129,192],"range":[130],"of":[131,161,187,196],"16%-96%.":[132],"To":[133],"mitigate":[134],"vulnerability,":[136],"introduce":[138],"abliteration-resistant":[139],"tuning":[140],"(ART),":[141],"incorporates":[143],"abliteration-based":[145],"objective":[146],"into":[147],"training.":[148],"ART":[149],"be":[151],"layered":[152],"onto":[153],"existing":[154],"reduces":[157],"abliteration,":[162],"prefilling,":[163],"their":[165],"combination":[166],"10%-20%.":[168],"These":[169],"findings":[170],"indicate":[171],"surface":[175],"broader":[180],"previously":[182],"characterized,":[183],"evaluations":[186],"should":[190],"incorporate":[191],"more":[193],"diverse":[194],"set":[195],"beyond":[199],"fine-tuning.":[201]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-28T00:00:00"}