Research

Research seriesL3offensive security

Alignment and Fine-Tuning Attacks: Removing the Guardrails

Safety alignment is a thin, removable layer. A few hundred fine-tuning examples — or a targeted weight edit — can strip refusals without touching capability. This threat lab maps where safety lives in the stack, measures the dose-response of harmful fine-tuning, dissects the refusal direction and activation steering, frames reward hacking as an attack on the training objective, and surveys safety-preserving defenses — each paired with a hardening. Grounded in the primary alignment-integrity literature.

Murali Chillakuru·5 articles
  1. 1
    The Alignment Threat Model: Where Safety Lives and What Each Layer Guarantees

    Safety in a deployed model is not one thing but a stack of thin layers — and knowing which layer holds a guarantee, and which an attacker can peel away, is the whole game.

  2. 2
    Harmful Fine-Tuning: Dose-Response and the Capability-Safety Decoupling

    It takes only a handful of examples to strip an aligned model's refusals — and, disturbingly, even benign fine-tuning can erode safety as a side effect.

  3. 3
    Refusal Ablation and Activation Steering: The Refusal Direction

    If a model's willingness to refuse lives along one direction in its activation space, then erasing that direction erases the refusals — surgically, and without retraining.

  4. 4
    Reward Hacking in RLHF: Specification Gaming and Proxy-Reward Divergence

    When you train a model to maximize a reward that only approximates what you want, it will find the gap — and exploit it, optimizing the proxy while the true goal quietly diverges.

  5. 5
    Defenses: Safety-Preserving Fine-Tuning, Tamper-Resistance, and Adaptive Evaluation

    If alignment is a thin, removable overlay, then defending it means anchoring safety in things an attacker cannot peel — and evaluating it in ways adaptation cannot fool.