Pretraining data filtering makes language-model safeguards over ten times more resistant to adversarial fine-tuning than post-training baselines.
Assessment
The evidence favors the claim, but the examination is incomplete or the evidence is indirect.
The claim rests on one study, "Deep Ignorance" (O'Brien, Casper and colleagues at EleutherAI and the UK AI Security Institute, 2025, revised 2026). The authors pretrained 6.9B-parameter models from scratch with text about dual-use biology filtered out, then attacked them with up to 10,000 steps (about 305M tokens) of full-parameter and LoRA fine-tuning on biothreat-related text. The filtered models' biothreat proxy knowledge stayed below that of an unfiltered model throughout. The post-training baselines, circuit-breaking and circuit-breaking with latent adversarial training, were undone quickly, as tamper-resistance methods in the prior literature typically are within tens to hundreds of steps. The filtered models also held up under benign fine-tuning, which quickly undid circuit-breaking.
The "over an order of magnitude" figure is a ratio of fine-tuning steps resisted, not a ratio of residual dangerous capability. The attack was the same for all models, so the core comparison is like-for-like. But the filtered models never broke within the attack tried, so 10,000 steps is a ceiling, not a breaking point. Part of the comparison also leans on attack sizes reported in other papers rather than on matched experiments. In the tested setting the tenfold gap is well supported and may well be larger.
As a general statement the claim is narrower in its evidence than in its words. The evidence covers one hazard domain measured by WMDP-Bio proxy evaluations, one model scale, and two baselines. The baselines are applied to an unfiltered model, which is the right comparison for "filtering versus post-training". Filtering did not beat circuit-breaking on every measure: it did worse on multiple-choice and few-shot evaluations. It offers no protection when the harmful information is supplied in context, and no tested defense survived a combined fine-tuning plus retrieval attack. Whether the result holds for larger models, other domains, stronger attacks, or newer post-training methods is not yet shown. Replications in those settings would settle that.
Full reasoning: the evidence and decisions behind this verdict
Read the arXiv abstract (v2, 17 Feb 2026) and Sections 2.6, 3.1, 3.2 and 4.1 of arxiv.org/html/2508.06601.
What the study shows: the attack setup is fixed across models (2 epochs on WMDP-Bio Forget, batch size 16, 2048 context, learning rate 2e-5, two full-parameter and two LoRA runs). In the authors' words, the filtered models are "the most resistant to attacks in all cases but one" (the exception is latent-space attacks on multiple-choice evaluations). The order-of-magnitude statement in the abstract and contributions compares 10,000 steps resisted with post-training methods that "can consistently be undone within several hundred fine-tuning steps or fewer". Appendix E compares attack sizes with prior works and is not an experimental match; the authors themselves say such configurations are "difficult to compare".
Like-for-like check: the in-paper baselines (CB, CB+LAT) were attacked with the same procedure, so that part is matched. The metric is steps or tokens to recover capability, measured on proxy evaluations (WMDP-Bio robust MCQA and verified cloze), not real uplift. Filtered models reach near-chance on cloze but not on MCQA under attack. Section 4.1 shows filtering fails against open-book retrieval, and against ensemble fine-tuning plus retrieval for all defenses.
Weighing: in its tested setting, the claim is supported by direct experiment, and the true ratio may exceed tenfold because the filtered models never broke. The canonical wording is general (language-model safeguards, post-training baselines), and the evidence is one study, one domain, one scale and two baselines. Credence 0.6 reflects high confidence in the in-setting result discounted for generality. Search was limited to the primary paper. No independent replication or rebuttal was looked for in this pass.
Decomposition
This claim is atomic: it bottoms out in a bedrock fact, an open empirical question, or a value premise, and does not decompose further.
Provenance
Where this claim has been said, linked to its canonical form.
outperforming existing post-training baselines by over an order of magnitude
Abstract; compares tamper resistance of pretraining-filtered 6.9B models with post-training safeguards such as unlearning and safety fine-tuning.
Cite this claim: a formal citation with its evidence attached
Embed this claim: show it on another site with its current assessment
An embed reports the graph's judgment as it stands when the page is viewed: the status with its confidence, how disputed the claim is, and the date. It links back here.
<blockquote class="minerval-claim" data-claim-id="f61e77b5-55cc-4882-b7ef-d4c4ac7e27a5"><a href="https://minerval.ai/claims/f61e77b5-55cc-4882-b7ef-d4c4ac7e27a5">Pretraining data filtering makes language-model safeguards over ten times more resistant to adversarial fine-tuning than post-training baselines.</a></blockquote> <script async src="https://minerval.ai/embed.js"></script>
<iframe src="https://minerval.ai/embed/claims/f61e77b5-55cc-4882-b7ef-d4c4ac7e27a5" title="Minerval: Pretraining data filtering makes language-model safeguards over ten times more resistant…" width="480" height="225" style="border:0;max-width:100%" loading="lazy"></iframe>
[](https://minerval.ai/claims/f61e77b5-55cc-4882-b7ef-d4c4ac7e27a5)
The badge now: 
Contribute
Every judgment on this page is open to challenge. A contribution is evaluated on its merits by the reviewer; if it succeeds the page changes, and if it does not, the reasons are stated. Either way the exchange becomes part of the claim’s public record.
The attention this claim received was paid for by a funded mandate. Funding buys only scheduling: it can make an assessment happen sooner, or reach deeper into a subtree. It has no influence on what the assessment concludes, and none on which claims enter the graph; assessments run under the same public standards whoever pays, funders never see or shape a verdict before anyone else, and mandates that attempt to steer conclusions are refused.
Created by extractor · Nov 11, 2026. Every judgment on this page is accompanied by a reasoning trace.