Builds model organisms with narrow and broad misalignment triggers, then proposes PEARL, a GRPO variant with prefix-expanded rollouts that durably suppresses misbehaviour while preserving capability.
Shows that fine-tuning on harmless data the model believes is false induces broad misalignment, scaling with disbelief. Single-fact updates show the same effect, and content filters and persona vectors miss it.
Proposes Safin-1.5, an LLM with a safety architecture, a discovery-evaluation-repair loop for recursive safety improvement, and removable hazardous-knowledge experts; claims it outperforms frontier models.
Proposes GRAFT, which confines weight updates from monitor-flagged reward hacks to a removable adapter, so ablating it prevents hacking, including hacks the monitor cannot detect, in small-scale experiments.
Proposes REX, which relocates hazardous knowledge into removable MoE experts so excising them removes WMDP-Bio knowledge while preserving general capability and resisting fine-tuning recovery.
Proposes grafting: run synthetic document fine-tuning on a base checkpoint and add the weight difference to the post-trained model, which preserves coherence and preference decisiveness better than native SDF for model organisms.
Proposes grafting a synthetic-document adapter trained on a pre-trained checkpoint onto post-trained models, reducing reality drift and preference-coherence loss when installing beliefs and misaligned model organisms.
Proposes PACT, a contrastive unlearning method that trains models with pressure-aware counterfactual targets to remove context-conditioned deception while preserving benign context use, cutting held-out deception below 3% on 32B reasoning models.
Empirically evaluates inoculation adapters, prompts and soft prompts on toy trait datasets, finding learned methods overfit, are less backdoor-susceptible, and fail at factual unlearning.
Analyzes inoculation prompting and inoculation adapters as alignment interventions against reward hacking and emergent misalignment, arguing they suppress rather than unlearn traits and proposing mechanistic hypotheses and experiments.
Synthetic document finetuning that frames reward hacking as acceptable fails to inoculate Llama against emergent misalignment from RL reward hacking, and can even increase it, though it passes behavioral belief tests.
Presents SafeTune, a library unifying methods for detecting and repairing safety drift in fine-tuned LLMs, including weight recovery, safety-constrained fine-tuning, unlearning and steering, with evaluation utilities and case studies.
Empirical study of GRPO reward designs for LLM unlearning, finding that optimization success, benchmark scores and held-out audits can disagree due to reward hacking and benchmark gaps.
Proposes Token Inoculation, which conditions hazardous-knowledge prediction on a special token during training so refusals stay selective, keeping about 18% hazardous accuracy while retaining 93% of MMLU performance.
Proposes process sidecars, a two-coefficient edit that revokes a learned memory after later safety training, and proves it recovers the safety-only model to second order while task arithmetic cannot.
Proposes ReRULE, an off-policy replay buffer for RL-based LLM unlearning that reuses hard forget/retain boundary rollouts, improving retain quality on MUSE-Books with little added training time.
Finetuning LLMs on documents that flag claims as false makes them believe the claims, and training on flagged malicious transcripts can induce those behaviours, a safety-relevant training failure.
Proposes SIFT, a spectral, interference-free constrained fine-tuning method, and reports gains over baselines on unlearning, safety alignment, TTS adaptation and hallucination mitigation.
A position paper arguing that token-level priority weighting in SFT can align LLMs by filtering noise and unlearning toxic modes, and reviewing progress and open challenges.
Proposes PURGE, a GRPO-based LLM unlearning method using an intrinsic reward that penalizes forbidden concepts, evaluated on RWKU for efficiency, fluency, and utility retention.
Proposes attributing unsatisfactory LM responses to the RLHF training data that caused them, then unlearning that data to fix those responses while preserving satisfactory ones, and reports improved RLHF.
Argues that behavioural unlearning is not robust to relearning because capabilities stay in the weights, and proposes distillation into a fresh student as a safety intervention that drops latent unsafe structure.
Shows that narrow refusal unlearning in one domain can spread emergent misalignment to unrelated domains, that retain data can contain it, and that representation similarity predicts susceptibility.
A monthly roundup of AI safety papers covering pretraining data filtering against harmful finetuning, reward hacking generalizing to misalignment, covert sandbagging against CoT monitors, safe-completions training, and probe-based defenses against cipher attacks.}
Proposes RULE, an RL-based LLM unlearning method that trains refusal on forget-set and boundary queries, reporting better forget quality and naturalness with preserved utility and generalization to unseen queries.
Proposes Unlearning to Align (U2A), which uses bi-level optimisation to select and weight negative preference examples to unlearn, improving LLM preference alignment at lower data cost.
Shows that supervised safety fine-tuning of vision-language models learns spurious text correlations, enabling one-word jailbreaks and over-refusal, and that machine unlearning reduces attack success and unnecessary refusals.
Applies DPO-trained LoRA safety experts, merged into one adapter, to steer text-to-image models away from harmful concepts, removing about 7x more concepts than baselines.
Proposes targeted latent adversarial training that improves LLM robustness to jailbreaks, removes backdoors without knowing the trigger, and makes unlearning more robust to relearning.
Applies gradient-ascent unlearning to OPT models to reduce harmful responses on PKU data and remove copyrighted Lord of the Rings content, while retaining TruthfulQA performance.
Proposes an LLM unlearning framework using an evaluator to flag harmful, hallucinated or privacy-leaking dialogues, with distance-based negative and cluster-mean positive losses, retaining performance.
Proposes unlearning undesirable LLM behaviours as an alignment technique, using only negative examples to remove harmful responses, copyrighted content and hallucinations, at a fraction of RLHF's compute.