Existing post-training techniques struggle to make LLM safeguards resistant beyond a few dozen adversarial fine-tuning steps.
Assessed
First pass. Kept the claim atomic, since the evidence is a small set of attack and defense papers that can be weighed in prose. Recorded the Qi et al. 2024 durability evaluation (affirms) and TAR (partial denial). Assessed as supported, credence 0.82. Importance set to 0.45 and contestation to 0.35.
Assessed Supported
verdict confidence 0.75 · credence 0.82
The claim describes the state of research on protecting open-weight language models against adversarial fine-tuning, and the evidence largely bears it out. Standard safety alignment (RLHF, refusal training) is removed by fine-tuning on as few as ten to a hundred harmful examples, often in a handful of gradient steps, a result replicated across several groups in 2023 and 2024. Methods designed specifically for tamper resistance have done better on their own benchmarks: Tamper-Resistant Safeguards (TAR) reported resisting attacks of hundreds to thousands of steps, and Representation Noising reported similar gains. But independent re-evaluation found both brittle, with small changes in learning rate, data, or attack configuration restoring the removed behavior, and evaluations of unlearning and refusal safeguards generally show recovery within a modest number of steps. The main qualification is the claim's phrasing. "A few dozen steps" is a rough figure rather than a sharp threshold, and some post-training methods have resisted considerably more steps under particular attack settings, so the claim is best read as saying that no post-training method has reliably held up against a determined, adaptive fine-tuning attacker. That reading is well supported. Evidence that would overturn it is a post-training safeguard that survives thousands of steps under independent, adaptive attack evaluation. Interventions outside post-training, such as filtering pretraining data, appear more durable, but they do not bear on the claim as stated.
Claim entered the graph