Language Models Resist Alignment: Evidence From Data Compression
Not on the map. Why?
Abstract (arXiv)
Large language models (LLMs) may exhibit unintended or undesirable behaviors. Recent works have concentrated on aligning LLMs to mitigate harmful outputs. Despite these efforts, some anomalies indicate that even a well-conducted alignment process can be easily circumvented, whether intentionally or accidentally. Does alignment fine-tuning yield have robust effects on models, or are its impacts merely superficial? In this work, we make the first exploration of this phenomenon from both theoretical and empirical perspectives. Empirically, we demonstrate the elasticity of post-alignment models, i.e., the tendency to revert to the behavior distribution formed during the pre-training phase upon further fine-tuning. Leveraging compression theory, we formally deduce that fine-tuning disproportionately undermines alignment relative to pre-training, potentially by orders of magnitude. We validate the presence of elasticity through experiments on models of varying types and scales. Specifically, we find that model performance declines rapidly before reverting to the pre-training distribution, after which the rate of decline drops significantly. Furthermore, we further reveal that elasticity positively correlates with the increased model size and the expansion of pre-training data. Our findings underscore the need to address the inherent elasticity of LLMs to mitigate their resistance to alignment. The model weight and code are available at pku-lm-resist-alignment.github.io.
Key facts. Cited by 53 papers in the map (data through 14 Oct 2026). Builds on 39 of its 86 references that are in the map. First posted on arXiv 10 Jun 2024.
Builds on
39 of 86 references.
References · 39
- 2023GPT-4 Technical Reportcited by 18,396
- 2022Training language models to follow instructions with human feedbackcited by 15,971
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
- 2020Scaling Laws for Neural Language Modelscited by 6,586
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
- 2023Qwen Technical Reportcited by 3,344
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
- 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,975
- 2019A Comprehensive Survey on Transfer Learningcited by 1,160
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
27 more
- 2023LIMA: Less Is More for Alignmentcited by 1,100
- 2021A General Language Assistant as a Laboratory for Alignmentcited by 1,055
- 2024SimPO: Simple Preference Optimization with a Reference-Free Rewardcited by 963
- 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
- 2023Open Problems and Fundamental Limitations of Reinforcement Learning from Human Feedbackcited by 759
- 2023RAFT: Reward rAnked FineTuning for Generative Foundation Model Alignmentcited by 686
- 2023Safe RLHF: Safe Reinforcement Learning from Human Feedbackcited by 656
- 2024TinyLlama: An Open-Source Small Language Modelcited by 618
- 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 529
- 2023Reinforced Self-Training (ReST) for Language Modelingcited by 500
- 2023UltraFeedback: Boosting Language Models with Scaled AI Feedbackcited by 406
- 2023Iterative Preference Learning from Human Feedback: Bridging Theory and Practice for RLHF under KL-Constraintcited by 350
- 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modificationscited by 231
- 2023Language Modeling Is Compressioncited by 225
- 2023Generative Language Models and Automated Influence Operations: Emerging Threats and Potential Mitigationscited by 158
- 2023Auditing large language models: a three-layered approachcited by 137
- 2024Attacks, Defenses and Evaluations for LLM Conversation Safety: A Surveycited by 130
- 2023Beyond One-Preference-Fits-All Alignment: Multi-Objective Direct Preference Optimizationcited by 124
- 2023Mechanistically analyzing the effects of fine-tuning on procedurally defined taskscited by 115
- 2024Against The Achilles' Heel: A Survey on Red Teaming for Generative Modelscited by 59
- 2020Is SGD a Bayesian sampler? Well, almostcited by 50
- 2023Artificial intelligence and biological misuse: Differentiating risks of language models and biological design toolscited by 45
- 2023RLCD: Reinforcement Learning from Contrastive Distillation for Language Model Alignmentcited by 43
- 2023Open-Sourcing Highly Capable Foundation Models: An evaluation of risks, benefits, and alternative methods for pursuing open-source objectivescited by 31
- 2024When Your AIs Deceive You: Challenges of Partial Observability in Reinforcement Learning from Human Feedbackcited by 17
- 2024Near to Mid-term Risks and Opportunities of Open-Source Generative AIcited by 13
- 2023MixPro: Simple yet Effective Data Augmentation for Prompt-based Learningcited by 4
Built on by
Citing papers per year: 2024: 1; 2025: 17; 2026: 35.
53 papers.
Sort:
By area:
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 116
- 2025SafeVLA: Towards Safety Alignment of Vision-Language-Action Model via Constrained Learningcited by 72
- 2024SafeSora: Towards Safety Alignment of Text2Video Generation via a Human Preference Datasetcited by 35
- 2025SFT Doesn't Always Hurt General Capabilities: Revisiting Domain-Specific Fine-Tuning in LLMscited by 24
- 2025Why LLM Safety Guardrails Collapse After Fine-tuning: A Similarity Analysis Between Alignment and Fine-tuning Datasetscited by 20
- 2025Feedback Friction: LLMs Struggle to Fully Incorporate External Feedbackcited by 11
- 2025Shadow-FT: Tuning Instruct Model via Training on Paired Base Modelcited by 10
- 2026Analysing the Safety Pitfalls of Steering Vectorscited by 10
- 2026Emergent and Subliminal Misalignment Through the Lens of Data-Mediated Transfercited by 8
- 2025Chain-of-Lure: A Universal Jailbreak Attack Framework using Unconstrained Synthetic Narrativescited by 5
- 2026Positive Alignment: Artificial Intelligence for Human Flourishingcited by 5
- 2026The Confidence Manifold: Geometric Structure of Correctness Representations in Language Modelscited by 4
38 more
- 2026SafeSeek: Universal Attribution of Safety Circuits in Language Modelscited by 4
- 2026Alignment midtraining for animalscited by 4
- 2026Continual Safety Alignment via Gradient-Based Sample Selectioncited by 4
- 2026Constitutional Midtraining: Content Presence Drives Alignment Gainscited by 4
- 2026What Does Loss Optimization Actually Teach, If Anything? Knowledge Dynamics in Continual Pre-training of LLMscited by 3
- 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Modelscited by 3
- 2026Towards Robust LLM Post-Training: Automatic Failure Management for Reinforcement Fine-Tuningcited by 3
- 2026MemSFT: Mitigating Alignment Tax with an External Parametric Memorycited by 3
- 2025Stream Aligner: Efficient Sentence-Level Alignment via Distribution Inductioncited by 2
- 2025Retention analysis of edited knowledge after fine-tuningcited by 2
- 2025Timber: Training-free Instruct Model Refining with Base via Effective Rankcited by 2
- 2025Fints: Efficient Inference-Time Personalization for LLMs with Fine-Grained Instance-Tailored Steeringcited by 2
- 2025Large Language Models Develop Novel Social Biases Through Adaptive Explorationcited by 2
- 2025Robustness of Probabilistic Models to Low-Quality Data: A Multi-Perspective Analysiscited by 2
- 2026TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Modelscited by 2
- 2026GR-SAP: Generative Replay for Safety Alignment Preservation during Fine-Tuningcited by 2
- 2026Alignment Dynamics in LLM Fine-Tuningcited by 2
- 2026An Emergent Mirage: Is Emergent Misalignment and Realignment Indeed a Robust Phenomenon?cited by 2
- 2025Emergence of Computational Structure in a Neural Network Physics Simulatorcited by 1
- 2025Empirical Study on Robustness and Resilience in Cooperative Multi-Agent Reinforcement Learningcited by 1
- 2025Overcoming State Inertia: Minimally Invasive Temporal Alignment for Evolving Contextscited by 1
- 2026H'an D=an Xu'e B`u (Mimicry) or Q=ing Ch=u Y'u L'an (Mastery)? A Cognitive Perspective on Reasoning Distillation in Large Language Modelscited by 1
- 2026The Model Agreed, But Didn't Learn: Diagnosing Surface Compliance in Large Language Modelscited by 1
- 2026Beyond Safe Data: Pretraining-Stage Alignment with Regular Safety Reflectioncited by 1
- 2026Synthetic Persona Pretraining: Alignment from Token Zerocited by 1
- 2025Revisiting Self-Play Preference Optimization: On the Role of Prompt Difficultycited by 0
- 2026BACH-V: Bridging Abstract and Concrete Human-Values in Large Language Modelscited by 0
- 2026SafeAnchor: Preventing Cumulative Safety Erosion in Continual Domain Adaptation of Large Language Modelscited by 0
- 2026Same Voice, Different Lab: On the Homogenization of Frontier LLM Personalitiescited by 0
- 2026Tracing the Dynamics of Refusal: Exploiting Latent Refusal Trajectories for Robust Jailbreak Detectioncited by 0
- 2026From Parameter Dynamics to Risk Scoring : Quantifying Sample-Level Safety Degradation in LLM Fine-tuningcited by 0
- 2026Toward Stable Value Alignment: Introducing Independent Modules for Consistent Value Guidancecited by 0
- 2026Measuring Alignment-Induced Activation Shifts Correctly: A Template-Controlled Difference-in-Differences Protocolcited by 0
- 2026Repurposing Adversarial Perturbations for Continual Learning: From Defense to Active Alignmentcited by 0
- 2026Safety Measurements for Fine-tuned LLMs Should be Grounded in Capabilitycited by 0
- 2026A Gravitational Interpretation of Safety Reversion under Fine-Tuningcited by 0
- 2026Sympathetic Framing: Evaluating AI Alignment across Sociodemographic Groupscited by 0
- 2026Safe Evolution with Circuit Anchorscited by 0
50 most cited of 53 All 53 (JSON)
- 2026DANGERLENS: Probing Dangerous Representations Hidden by Safety Alignment14 Oct 2026
- 2026To Explore The Strange New World Beyond Data Distribution: System Behavior, Causality Tax, and Non-causal Base Model2 Oct 2026
- 2026SignFLIP: A Unified Model for Sign Language Translation and Generation via Stage-wise Alignment at Scale28 Sep 2026
- 2026Synthetic Persona Pretraining: Alignment from Token Zero13 Aug 2026
- 2026Constitutional Midtraining: Content Presence Drives Alignment Gains29 Jul 2026
- 2026MemSFT: Mitigating Alignment Tax with an External Parametric Memory28 Jul 2026
- 2026Sympathetic Framing: Evaluating AI Alignment across Sociodemographic Groups22 Jul 2026
- 2026An Emergent Mirage: Is Emergent Misalignment and Realignment Indeed a Robust Phenomenon?10 Jul 2026
- 2026A Gravitational Interpretation of Safety Reversion under Fine-Tuning26 Jun 2026
- 2026Beyond Safe Data: Pretraining-Stage Alignment with Regular Safety Reflection17 Jun 2026
- 2026Safety Measurements for Fine-tuned LLMs Should be Grounded in Capability2 Jun 2026
- 2026Repurposing Adversarial Perturbations for Continual Learning: From Defense to Active Alignment1 Jun 2026
38 more
- 2026Safe Evolution with Circuit Anchors24 May 2026
- 2026Measuring Alignment-Induced Activation Shifts Correctly: A Template-Controlled Difference-in-Differences Protocol23 May 2026
- 2026Alignment Dynamics in LLM Fine-Tuning18 May 2026
- 2026Emergent and Subliminal Misalignment Through the Lens of Data-Mediated Transfer12 May 2026
- 2026Toward Stable Value Alignment: Introducing Independent Modules for Consistent Value Guidance12 May 2026
- 2026Positive Alignment: Artificial Intelligence for Human Flourishing11 May 2026
- 2026From Parameter Dynamics to Risk Scoring : Quantifying Sample-Level Safety Degradation in LLM Fine-tuning6 May 2026
- 2026Towards Robust LLM Post-Training: Automatic Failure Management for Reinforcement Fine-Tuning6 May 2026
- 2026Tracing the Dynamics of Refusal: Exploiting Latent Refusal Trajectories for Robust Jailbreak Detection2 May 2026
- 2026SafeAnchor: Preventing Cumulative Safety Erosion in Continual Domain Adaptation of Large Language Models20 Apr 2026
- 2026Continual Safety Alignment via Gradient-Based Sample Selection19 Apr 2026
- 2026The Model Agreed, But Didn't Learn: Diagnosing Surface Compliance in Large Language Models7 Apr 2026
- 2026Analysing the Safety Pitfalls of Steering Vectors25 Mar 2026
- 2026SafeSeek: Universal Attribution of Safety Circuits in Language Models24 Mar 2026
- 2026Alignment midtraining for animals21 Mar 2026
- 2026Same Voice, Different Lab: On the Homogenization of Frontier LLM Personalities20 Mar 2026
- 2026GR-SAP: Generative Replay for Safety Alignment Preservation during Fine-Tuning10 Mar 2026
- 2026TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models3 Mar 2026
- 2026The Confidence Manifold: Geometric Structure of Correctness Representations in Language Models8 Feb 2026
- 2026BACH-V: Bridging Abstract and Concrete Human-Values in Large Language Models20 Jan 2026
- 2026H'an D=an Xu'e B`u (Mimicry) or Q=ing Ch=u Y'u L'an (Mastery)? A Cognitive Perspective on Reasoning Distillation in Large Language Models8 Jan 2026
- 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models7 Jan 2026
- 2026What Does Loss Optimization Actually Teach, If Anything? Knowledge Dynamics in Continual Pre-training of LLMs7 Jan 2026
- 2025Robustness of Probabilistic Models to Low-Quality Data: A Multi-Perspective Analysis11 Dec 2025
- 2025Overcoming State Inertia: Minimally Invasive Temporal Alignment for Evolving Contexts3 Dec 2025
- 2025Large Language Models Develop Novel Social Biases Through Adaptive Exploration8 Nov 2025
- 2025Fints: Efficient Inference-Time Personalization for LLMs with Fine-Grained Instance-Tailored Steering31 Oct 2025
- 2025Empirical Study on Robustness and Resilience in Cooperative Multi-Agent Reinforcement Learning13 Oct 2025
- 2025Revisiting Self-Play Preference Optimization: On the Role of Prompt Difficulty7 Oct 2025
- 2025Timber: Training-free Instruct Model Refining with Base via Effective Rank28 Sep 2025
- 2025SFT Doesn't Always Hurt General Capabilities: Revisiting Domain-Specific Fine-Tuning in LLMs25 Sep 2025
- 2025Retention analysis of edited knowledge after fine-tuning14 Jul 2025
- 2025Feedback Friction: LLMs Struggle to Fully Incorporate External Feedback13 Jun 2025
- 2025Why LLM Safety Guardrails Collapse After Fine-tuning: A Similarity Analysis Between Alignment and Fine-tuning Datasets5 Jun 2025
- 2025Chain-of-Lure: A Universal Jailbreak Attack Framework using Unconstrained Synthetic Narratives23 May 2025
- 2025Shadow-FT: Tuning Instruct Model via Training on Paired Base Model19 May 2025
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment22 Apr 2025
- 2025Emergence of Computational Structure in a Neural Network Physics Simulator16 Apr 2025
50 newest of 53 All 53 (JSON)
- 2024SafeSora: Towards Safety Alignment of Text2Video Generation via a Human Preference Datasetcited by 35
- 2025Why LLM Safety Guardrails Collapse After Fine-tuning: A Similarity Analysis Between Alignment and Fine-tuning Datasetscited by 20
- 2026Continual Safety Alignment via Gradient-Based Sample Selectioncited by 4
- 2026MemSFT: Mitigating Alignment Tax with an External Parametric Memorycited by 3
- 2025Stream Aligner: Efficient Sentence-Level Alignment via Distribution Inductioncited by 2
- 2026TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Modelscited by 2
- 2026GR-SAP: Generative Replay for Safety Alignment Preservation during Fine-Tuningcited by 2
- 2026Alignment Dynamics in LLM Fine-Tuningcited by 2
- 2025Overcoming State Inertia: Minimally Invasive Temporal Alignment for Evolving Contextscited by 1
- 2026Beyond Safe Data: Pretraining-Stage Alignment with Regular Safety Reflectioncited by 1
- 2025Revisiting Self-Play Preference Optimization: On the Role of Prompt Difficultycited by 0
- 2026SafeAnchor: Preventing Cumulative Safety Erosion in Continual Domain Adaptation of Large Language Modelscited by 0
12 most cited of 15 All 15 (JSON)
- 2026DANGERLENS: Probing Dangerous Representations Hidden by Safety Alignment14 Oct 2026
- 2026MemSFT: Mitigating Alignment Tax with an External Parametric Memory28 Jul 2026
- 2026Beyond Safe Data: Pretraining-Stage Alignment with Regular Safety Reflection17 Jun 2026
- 2026Alignment Dynamics in LLM Fine-Tuning18 May 2026
- 2026Toward Stable Value Alignment: Introducing Independent Modules for Consistent Value Guidance12 May 2026
- 2026From Parameter Dynamics to Risk Scoring : Quantifying Sample-Level Safety Degradation in LLM Fine-tuning6 May 2026
- 2026SafeAnchor: Preventing Cumulative Safety Erosion in Continual Domain Adaptation of Large Language Models20 Apr 2026
- 2026Continual Safety Alignment via Gradient-Based Sample Selection19 Apr 2026
- 2026GR-SAP: Generative Replay for Safety Alignment Preservation during Fine-Tuning10 Mar 2026
- 2026TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models3 Mar 2026
- 2025Overcoming State Inertia: Minimally Invasive Temporal Alignment for Evolving Contexts3 Dec 2025
- 2025Revisiting Self-Play Preference Optimization: On the Role of Prompt Difficulty7 Oct 2025
12 newest of 15 All 15 (JSON)
- 2026Analysing the Safety Pitfalls of Steering Vectorscited by 10
- 2025Chain-of-Lure: A Universal Jailbreak Attack Framework using Unconstrained Synthetic Narrativescited by 5
- 2026SafeSeek: Universal Attribution of Safety Circuits in Language Modelscited by 4
- 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Modelscited by 3
- 2026Tracing the Dynamics of Refusal: Exploiting Latent Refusal Trajectories for Robust Jailbreak Detectioncited by 0
- 2026A Gravitational Interpretation of Safety Reversion under Fine-Tuningcited by 0
- 2026A Gravitational Interpretation of Safety Reversion under Fine-Tuning26 Jun 2026
- 2026Tracing the Dynamics of Refusal: Exploiting Latent Refusal Trajectories for Robust Jailbreak Detection2 May 2026
- 2026Analysing the Safety Pitfalls of Steering Vectors25 Mar 2026
- 2026SafeSeek: Universal Attribution of Safety Circuits in Language Models24 Mar 2026
- 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models7 Jan 2026
- 2025Chain-of-Lure: A Universal Jailbreak Attack Framework using Unconstrained Synthetic Narratives23 May 2025
- 2025SFT Doesn't Always Hurt General Capabilities: Revisiting Domain-Specific Fine-Tuning in LLMscited by 24
- 2025Feedback Friction: LLMs Struggle to Fully Incorporate External Feedbackcited by 11
- 2025Shadow-FT: Tuning Instruct Model via Training on Paired Base Modelcited by 10
- 2026Emergent and Subliminal Misalignment Through the Lens of Data-Mediated Transfercited by 8
- 2026Positive Alignment: Artificial Intelligence for Human Flourishingcited by 5
- 2026Alignment midtraining for animalscited by 4
- 2026Constitutional Midtraining: Content Presence Drives Alignment Gainscited by 4
- 2026What Does Loss Optimization Actually Teach, If Anything? Knowledge Dynamics in Continual Pre-training of LLMscited by 3
- 2026Towards Robust LLM Post-Training: Automatic Failure Management for Reinforcement Fine-Tuningcited by 3
- 2025Retention analysis of edited knowledge after fine-tuningcited by 2
- 2025Timber: Training-free Instruct Model Refining with Base via Effective Rankcited by 2
- 2025Fints: Efficient Inference-Time Personalization for LLMs with Fine-Grained Instance-Tailored Steeringcited by 2
12 most cited of 28 All 28 (JSON)
- 2026To Explore The Strange New World Beyond Data Distribution: System Behavior, Causality Tax, and Non-causal Base Model2 Oct 2026
- 2026SignFLIP: A Unified Model for Sign Language Translation and Generation via Stage-wise Alignment at Scale28 Sep 2026
- 2026Synthetic Persona Pretraining: Alignment from Token Zero13 Aug 2026
- 2026Constitutional Midtraining: Content Presence Drives Alignment Gains29 Jul 2026
- 2026Sympathetic Framing: Evaluating AI Alignment across Sociodemographic Groups22 Jul 2026
- 2026An Emergent Mirage: Is Emergent Misalignment and Realignment Indeed a Robust Phenomenon?10 Jul 2026
- 2026Safety Measurements for Fine-tuned LLMs Should be Grounded in Capability2 Jun 2026
- 2026Repurposing Adversarial Perturbations for Continual Learning: From Defense to Active Alignment1 Jun 2026
- 2026Safe Evolution with Circuit Anchors24 May 2026
- 2026Measuring Alignment-Induced Activation Shifts Correctly: A Template-Controlled Difference-in-Differences Protocol23 May 2026
- 2026Emergent and Subliminal Misalignment Through the Lens of Data-Mediated Transfer12 May 2026
- 2026Positive Alignment: Artificial Intelligence for Human Flourishing11 May 2026
12 newest of 28 All 28 (JSON)
Similar, not cited
Close in wording, no citation either way
- 2024From Distributional to Overton Pluralism: Investigating Large Language Model Alignment
- 2023Language Model Alignment with Elastic Reset
- 2026Pressure Reveals Character: Behavioural Alignment Evaluation at Depth
- 2023The Unlocking Spell on Base LLMs: Rethinking Alignment via In-Context Learning
- 2024Efficient Alignment of Large Language Models via Data Sampling
- 2024Your Weak LLM is Secretly a Strong Teacher for Alignment
- 2026LLM Alignment--Utility Asymmetry under Semantic-Preserving Transformations
- 2026AlignTune: Modular Toolkit for Post-Training Alignment of Large Language Models