A new report by the AI Security Institute finds that the removal of safety guardrails from AI models is not a durable process. Researchers demonstrated that they could reverse the “abliteration” of a model’s original refusal mechanisms using fine-tuning on publicly available viral data for a compute cost of under $80, a result that held true even for the largest models.
The findings highlight the volatility of open-weight models, which security researchers previously showed could be backdoored for less than $50 to steal project credentials. In a test involving the Qwen 2.5-7B model, the modified AI executed a .sh script that silently uploaded a user’s entire home directory to a remote cloud. Experts are now calling for the use of sandboxing to mitigate supply chain risks and urging further research into whether modified models undergo unintended phase shifts in their behavior.
