The BaseResearcharXiv
When Safety Becomes An Outlier: Understanding the Retention of LLM Safety Behaviors
Researchers at the University of Virginia and Visa Research argue that language models lose safety training after fine-tuning because fixed refusal phrases are easy to learn and easy to overwrite. They propose training on natural, request-specific safety responses and report better retention.
Why it matters
The same thing, for different readers.
What it means for you
Researchers explain why an AI model's safety rules can disappear after it is customised, and test a way to make them stick.
For lawmakers
The paper bears on rules for open or fine-tunable models: safety added at training time may not survive later changes by whoever adapts the model.
For researchers
The authors treat formulaic refusals as low-entropy outlier modes and show lower perplexity of safety targets generally goes with better retention under continued fine-tuning.
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“we propose that formulaic refusal strings can function as outlier modes: narrow, weakly grounded response patterns that are easy to fit but vulnerable to subsequent updates.”
“Across multiple models and alignment regimes, natural safety targets improve both immediate safety and its retention under continued fine-tuning without sacrificing helpfulness.”
“fixed refusals and fixed unrelated targets are both rapidly fit on train and held-out harmful prompts, reaching near-perfect ROUGE-L within roughly 100 steps.”
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- Controlled fine-tuning experiments on Qwen2.5-7B-Instruct and Llama-3-8B-Instruct comparing fixed refusals, a fixed unrelated sentence and prompt-specific natural responses, plus gradient diagnostics and tests of the NEST method in supervised and preference-based (DPO) training.
- What it found
- Fixed refusals were fit as fast as arbitrary fixed strings, while natural safety responses were not. For Llama-3-8B-Instruct, half of responses to harmful prompts began with the same phrase, "I cannot provide information". NEST improved safety and its retention under continued fine-tuning.
- What it does not show
- Tested on a small set of models and datasets such as BeaverTails; perplexity is a proxy for how natural a target is.
- Status
- A preprint: not yet peer reviewed
The record
- Questions
- Are AI companies putting stronger safeguards into practice? · Can AI systems act beyond what people intended or allowed?
- People
- Binchi Zhang (Wrote it, University of Virginia (internship at Visa Research)) · Hadi Abdullah (Wrote it, Visa Research) · Yiwei Cai (Wrote it, Visa Research) · Jundong Li (Wrote it, University of Virginia)
- What we read
- We could read only part of the source.
- Found by
- The Radar, run of November 8, 2026, via
arxiv-ai-safety-query(tier 1: the source’s own channel or an official record) - Cite this
- arXiv, “When Safety Becomes An Outlier: Understanding the Retention of LLM Safety Behaviors”, November 7, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/arxiv-2026-11-07-safety-becomes-outlier-retention