Safeguard erosion through fine-tuning

What it is

A model's tendency to refuse harmful requests is learned behaviour, and further training can change it. Fine-tuning on an organisation's own data, even innocuous data, can reduce refusals, reintroduce unsafe outputs or undo the supplier's safeguards. The adapted model is a new model. The risk arises when it inherits the approval given to its base. Deliberate removal of safeguards by an attacker who holds the weights follows from model weight theft.

How it happens

• The base model's evaluation is reused for the fine-tuned version.
• Training data contains examples that reward compliance with any request.
• Safety tests are not part of the fine-tuning pipeline.
• Several rounds of adaptation accumulate with no baseline comparison.

Why it matters

The organisation deploys a model that is easier to misuse than the one it assessed. Under the EU AI Act, a party that substantially modifies a high-risk system takes on the provider's obligations for it.

Warning signs

• Fine-tuned models have no evaluation record of their own.
• Refusal rates are not measured before and after adaptation.
• The approval record names the base model only.
• Users report that the tuned model will do what the original would not.