# Limits of Convergence-Rate Control for Open-Weight Safety

arXiv: https://arxiv.org/abs/2602.18868 · HTML: https://mlsanity.com/paper/2602.18868/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Feb 2026.

## Built on by (most cited first, 5 of 5)

- [Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks](https://mlsanity.com/paper/2605.26526/) (2026)
- [Distribution-Specific Curvature Control with Finite-Sample Guarantees for Open-Weight Safety](https://mlsanity.com/paper/2607.22929/) (2026)
- [Locking Pretrained Weights via Deep Low-Rank Residual Distillation](https://mlsanity.com/paper/2605.10777/) (2026)
- [No Unique Minimizer, No Problem: On the Consistency of Robust Neural Classifiers](https://mlsanity.com/paper/2608.08489/) (2026)
- [Removing Information Content Does Not Certify Tamper Resistance in Open-Weight Models](https://mlsanity.com/paper/2610.09004/) (2026)

## Abstract (arXiv)

Open-weight foundation models can be fine-tuned for harmful purposes after release, yet no existing training resistance methods provide theoretical guarantees. Treating these interventions as convergence-rate control problems allows us to connect optimization speed to the spectral structure of model weights. We leverage this insight to develop a novel understanding of convergence rate control through spectral reparameterization and derive an algorithm, SpecDef, that can both provably and empirically slow first- and second-order optimization in non-adversarial settings. In adversarial settings, we establish a fundamental limit on a broad class of convergence rate control methods including our own: an attacker with sufficient knowledge can restore fast convergence at a linear increase in model size. In order to overcome this limitation, future works will need to investigate methods that are not equivalent to controlling convergence rate.