研究模型删减对安全预训练效果的影响，发现部分安全机制易失效。
A Granular Study of Safety Pretraining under Model Abliteration
- 用轻量级删减技术移除拒绝敏感方向，测试安全训练有效性。
- 20个检查点中仅部分安全组件在删减后仍保持稳定。
- 适合关注推理时编辑风险与安全评估的从业者参考。
开放权重大模型可在推理时通过简单的激活修改进行调整，这引发了一个实际的安全问题：常见的安全干预措施（如拒绝训练或元标签训练）是否能抵御此类修改？本文研究了模型删减这一轻量级投影技术，该技术旨在消除拒绝敏感方向，并在SmolLM2-1.7B上沿安全预训练检查点序列进行受控评估，对比多个广泛使用的开源基线。针对每个系统（共20个），分别测试原始模型与删减后模型，每种情况发出100条包含平衡有害与无害样本的提示，由多位裁判分类响应为“拒绝”或“非拒绝”，并通过小规模人工标注子集验证裁判一致性。同时，还探查模型能否识别自身输出中的拒绝行为。研究结果提供了检查点级别的安全组件鲁棒性分析，量化了裁判选择对评估结果的影响，并提出一种将推理时编辑纳入安全评估的实际流程。代码已公开：https://github.com/shashankskagnihotri/safety_pretraining。
原文摘要 · Abstract (English)
Open-weight LLMs can be modified at inference time with simple activation edits, which raises a practical question for safety: do common safety interventions like refusal training or metatag training survive such edits? We study model abliteration, a lightweight projection technique designed to remove refusal-sensitive directions, and conduct a controlled evaluation across a granular sequence of Safety Pretraining checkpoints for SmolLM2-1.7B, alongside widely used open baselines. For each of 20 systems, original and abliterated, we issue 100 prompts with balanced harmful and harmless cases, classify responses as **Refusal** or **Non-Refusal** using multiple judges, and validate judge fidelity on a small human-labeled subset. We also probe whether models can identify refusal in their own outputs. Our study produces a checkpoint-level characterization of which data-centric safety components remain robust under abliteration, quantifies how judge selection influences evaluation outcomes, and outlines a practical protocol for integrating inference-time edits into safety assessments. Code: https://github.com/shashankskagnihotri/safety_pretraining.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。