Builds model organisms with narrow and broad misalignment triggers, then proposes PEARL, a GRPO variant with prefix-expanded rollouts that durably suppresses misbehaviour while preserving capability.
Shows that fine-tuning on harmless data the model believes is false induces broad misalignment, scaling with disbelief. Single-fact updates show the same effect, and content filters and persona vectors miss it.
Proposes Safin-1.5, an LLM with a safety architecture, a discovery-evaluation-repair loop for recursive safety improvement, and removable hazardous-knowledge experts; claims it outperforms frontier models.
Proposes GRAFT, which confines weight updates from monitor-flagged reward hacks to a removable adapter, so ablating it prevents hacking, including hacks the monitor cannot detect, in small-scale experiments.
Proposes REX, which relocates hazardous knowledge into removable MoE experts so excising them removes WMDP-Bio knowledge while preserving general capability and resisting fine-tuning recovery.
Proposes grafting: run synthetic document fine-tuning on a base checkpoint and add the weight difference to the post-trained model, which preserves coherence and preference decisiveness better than native SDF for model organisms.
Proposes grafting a synthetic-document adapter trained on a pre-trained checkpoint onto post-trained models, reducing reality drift and preference-coherence loss when installing beliefs and misaligned model organisms.
Proposes PACT, a contrastive unlearning method that trains models with pressure-aware counterfactual targets to remove context-conditioned deception while preserving benign context use, cutting held-out deception below 3% on 32B reasoning models.
Empirically evaluates inoculation adapters, prompts and soft prompts on toy trait datasets, finding learned methods overfit, are less backdoor-susceptible, and fail at factual unlearning.
Analyzes inoculation prompting and inoculation adapters as alignment interventions against reward hacking and emergent misalignment, arguing they suppress rather than unlearn traits and proposing mechanistic hypotheses and experiments.
Synthetic document finetuning that frames reward hacking as acceptable fails to inoculate Llama against emergent misalignment from RL reward hacking, and can even increase it, though it passes behavioral belief tests.
Presents SafeTune, a library unifying methods for detecting and repairing safety drift in fine-tuned LLMs, including weight recovery, safety-constrained fine-tuning, unlearning and steering, with evaluation utilities and case studies.
Empirical study of GRPO reward designs for LLM unlearning, finding that optimization success, benchmark scores and held-out audits can disagree due to reward hacking and benchmark gaps.
Proposes Token Inoculation, which conditions hazardous-knowledge prediction on a special token during training so refusals stay selective, keeping about 18% hazardous accuracy while retaining 93% of MMLU performance.
Proposes process sidecars, a two-coefficient edit that revokes a learned memory after later safety training, and proves it recovers the safety-only model to second order while task arithmetic cannot.
Proposes ReRULE, an off-policy replay buffer for RL-based LLM unlearning that reuses hard forget/retain boundary rollouts, improving retain quality on MUSE-Books with little added training time.
Finetuning LLMs on documents that flag claims as false makes them believe the claims, and training on flagged malicious transcripts can induce those behaviours, a safety-relevant training failure.