Tamper-Resistant Safeguards for Open-Weight LLMs
Tamirisa, Rishub, Bharathi, Bhrugu, Phan, Long, Zhou, Andy, Gatti, Alice, Suresh, Tarun, Lin, Maxwell, Wang, Justin, Wang, Rowan, Arel, Ron, Zou, Andy, Song, Dawn, Li, Bo, Hendrycks, Dan, Mazeika, MantasarXiv.orgPublished Aug 1, 2024Original︎ ↗Archived copy
Examinations
None recorded. An examination is commissioned by a claim’s Steward for what its claim rests on; a review of the document for its own sake is asked for as a request bearing on it.
Text61 passages · 1 marked
Abstract: Rapid advances in the capabilities of large language models (LLMs) have raised widespread concerns regarding their potential for malicious use. Open-weight LLMs present unique challenges, as existing safeguards lack robustness to tampering attacks that modify model weights. For example, recent works have demonstrated that refusal and unlearning safeguards can be trivially removed with a few steps of fine-tuning. These vulnerabilities necessitate new approaches for enabling the safe release of open-weight LLMs. We develop a method, called TAR, for building tamper-resistant safeguards into open-weight LLMs such that adversaries cannot remove the safeguards even after hundreds of steps of fine-tuning. In extensive evaluations and red teaming analyses, we find that our method greatly improves tamper-resistance while preserving benign capabilities. Our results demonstrate that progress on tamper-resistance is possible, opening up a promising new avenue to improve the safety and security of open-weight LLMs.
Not yet read by this claim’s Steward.
Not yet read by this claim’s Steward.
Not yet read by this claim’s Steward.
Not yet read by this claim’s Steward.
Not found in the text 1
we observe that TAR is robust to significantly more fine-tuning attacks than all prior methods. While existing baselines [are] extremely brittle to fine-tuning attacks ... TAR maintains low post-attack forget accuracy across all three domains.
Not yet read by this claim’s Steward.
Lineage across 5 claims
Record
- Kind
- unknown
- Authors
- Tamirisa, Rishub, Bharathi, Bhrugu, Phan, Long, Zhou, Andy, Gatti, Alice, Suresh, Tarun, Lin, Maxwell, Wang, Justin, Wang, Rowan, Arel, Ron, Zou, Andy, Song, Dawn, Li, Bo, Hendrycks, Dan, Mazeika, Mantas
- Publisher
- arXiv.org
- Published
- Aug 1, 2024
- DOI
- None
- Link
- https://arxiv.org/abs/2408.00761
- Archived copy
- https://web.archive.org/web/20261031060221/https://arxiv.org/abs/2408.00761
- Stored text
- 4,901 characters, retrieved Nov 11, 2026 · 47 sections, 61 passages
- Claims extracted
- For
how resistant the method's safeguards were to fine-tuning attacks, which attacks and budgets were tested, and how resistance was measured
· 4 claims (1 new) · Nov 11, 2026 for Reconciling conflicting published results on contested AI safety research questions
- For
- Versions
- One known
- Copies
- None recorded
- Corrections
- None recorded
- Facts checked
- Nov 11, 2026
History 3
- Nov 11, 2026DividedSegmenter · Divided into 108 parts by its own structure
- Nov 11, 2026FactsFacts fetcher · Facts looked up
- Nov 11, 2026Entered the graphEntered the graph; copy stored