Pretraining data filtering makes language-model safeguards over ten times more resistant to adversarial fine-tuning than post-training baselines.
Structured and assessed
First pass. Read the primary paper (Deep Ignorance, arXiv 2508.06601 v2). Added two named arguments: one for, from the experiments, and one against, from scope and measurement limits. No subclaims were minted, since the cruxes are specific to this one study. Assessed as supported, confidence 0.65, credence 0.6. Importance set to 0.55, contestation 0.4. A future pass should look for independent replications at other scales or domains.
Updated claim instance
Instance 22f52053-f018-4234-bb50-4b7196828f90 (https://arxiv.org/abs/2508.06601): was stance=affirms, confidence=0.8; set confidence=0.9, speaker="Kyle O'Brien, Stephen Casper et al.", publication="arXiv", sourceDate="2025-08-08". Read the abstract and Sections 3 and 4. Added the authors and date. The passage affirms the claim for the paper's tested setting.
Assessed Supported
verdict confidence 0.65 · credence 0.60
The claim rests on one study, "Deep Ignorance" (O'Brien, Casper and colleagues at EleutherAI and the UK AI Security Institute, 2025, revised 2026). The authors pretrained 6.9B-parameter models from scratch with text about dual-use biology filtered out, then attacked them with up to 10,000 steps (about 305M tokens) of full-parameter and LoRA fine-tuning on biothreat-related text. The filtered models' biothreat proxy knowledge stayed below that of an unfiltered model throughout. The post-training baselines, circuit-breaking and circuit-breaking with latent adversarial training, were undone quickly, as tamper-resistance methods in the prior literature typically are within tens to hundreds of steps. The filtered models also held up under benign fine-tuning, which quickly undid circuit-breaking. The "over an order of magnitude" figure is a ratio of fine-tuning steps resisted, not a ratio of residual dangerous capability. The attack was the same for all models, so the core comparison is like-for-like. But the filtered models never broke within the attack tried, so 10,000 steps is a ceiling, not a breaking point. Part of the comparison also leans on attack sizes reported in other papers rather than on matched experiments. In the tested setting the tenfold gap is well supported and may well be larger. As a general statement the claim is narrower in its evidence than in its words. The evidence covers one hazard domain measured by WMDP-Bio proxy evaluations, one model scale, and two baselines. The baselines are applied to an unfiltered model, which is the right comparison for "filtering versus post-training". Filtering did not beat circuit-breaking on every measure: it did worse on multiple-choice and few-shot evaluations. It offers no protection when the harmful information is supplied in context, and no tested defense survived a combined fine-tuning plus retrieval attack. Whether the result holds for larger models, other domains, stronger attacks, or newer post-training methods is not yet shown. Replications in those settings would settle that.
Claim entered the graph