Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models

• URL: http://arxiv.org/abs/2608.17202v1
• Date: Mon, 17 Aug 2026 23:26:32 GMT
• Title: Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models
• Abstract summary: Our defense, decoy hardening, concedes the refusal strip and poisons its payoff.<n>We instantiate it on seven models from five families (9B-122B, dense and mixture-of-experts)
• Score: 4.1626636325601405
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Safety alignment in open-weight language models is trivially removable: abliteration projects a refusal-mediating direction out of the weights in minutes, and no release-time defense we are aware of prevents it durably. What cannot be prevented can be deceived. Our defense, decoy hardening ("Fool's Gold"), concedes the refusal strip and poisons its payoff: once refusal is stripped, most answers to hazardous operational requests are confident, fluent decoys whose critical elements are falsified. Decoys are trained inside a differentiable simulation of the attack, expressing only in the attacked state; a refusal pin and benign leash hold clean-state behavior to the original. We instantiate it on seven models from five families (9B-122B, dense and mixture-of-experts). On the six models passing our pre-registered efficacy gate, 0.51-0.90 of attacked-state responses to held-out prompts are decoys, +0.27-0.84 attributable to the defense; all six stay within registered benign-behavior and capability budgets; the seventh (smaller) fails the gate (boundary case). Rates replicate on a frozen test split or untouched strata. The claim is epistemic: without independent ground truth, no observation surface we tested separates falsified answers from correct ones - on external red-team benchmarks' CBRNE-adjacent slice, the defended 122B is fatally wrong on 0.82-0.86 of matched-quality answers vs at most 0.10 undefended. Repeated sampling does not restore trust: element-wise consensus at K=64 reconstructs a fully usable procedure on 0.083-0.625 of prompts where the instrument validates, vs 0.58-0.96 undefended, with no label-free way to tell the regimes apart; on the weakest such model the claim is per-draw only. We evaluate chemical and biological hazards; the defense does not address in-context jailbreaks and protects only the initially released defended weights.

Related papers

• Borrowed Strength: Best-of-N Search over a Code EncodingBreaks Self-Check Jailbreak Defenses [7.287314790466206]
  A self-check defense asks the target model to assess a request before answering it.<n>We show it can be breached by composing two attacks that are individually harmless against it.
  arXiv  Detail & Related papers  (2026-07-29T09:01:26Z)
• RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning [0.0815557531820863]
  We introduce RAGuard, a layered defense against emphfactual corpus-poisoning attacks on pipelines.<n>The first layer fine-tunes a dense retriever on synthetic poisoned documents (fabricated facts, contradictions, and reasoning traps)<n>The second layer, the ZeroKnowledge Patch ZKIP, is a label-free, black-box filter.
  arXiv  Detail & Related papers  (2026-07-28T23:21:04Z)
• Train the Model, Not the Reader: Decodability Supervision for Verifiable Activation Explanations [0.11280931253550518]
  We show the test is passed in two ways, neither faithful.<n>On a released Qwen-2.5-7B verbalizer, explanations reconstruct well above chance.<n>For AI safety, RECAP makes designated internal content independently checkable.
  arXiv  Detail & Related papers  (2026-07-22T17:10:23Z)
• Closing the Activation-Cone Blind Spot: Response-Time Probing and Unified Defense [0.0]
  Inference-time safety methods for large language models have proliferated, yet no systematic comparison exists.<n>We evaluate five defense paradigms (no defense, static steering, CAST, AlphaSteer, probe-gated) across seven instruction-tuned models.<n>AlphaSteer achieves 0% attack success on GCG, AutoDAN, and intent laundering but 50% on prefilling.
  arXiv  Detail & Related papers  (2026-06-28T15:05:12Z)
• Thinking Wrong in Silence: Backdoor Attacks on Continuous Latent Reasoning [1.3011345529764784]
  A new generation of language models reasons entirely in continuous hidden states, producing no tokens and leaving no audit trail.<n>ThoughtSteer achieves >=99% attack success rate with near-baseline clean accuracy.<n>Individual latent vectors still encode the correct answer even as the model outputs the wrong one.
  arXiv  Detail & Related papers  (2026-04-01T11:34:55Z)
• Turning Logic Against Itself : Probing Model Defenses Through Contrastive Questions [50.40122190627256]
  We introduce POATE, a novel jailbreak technique that harnesses contrastive reasoning to provoke unethical responses.<n>PoATE crafts semantically opposing intents and integrates them with adversarial templates, steering models toward harmful outputs with remarkable subtlety.<n>To counter this, we propose Intent-Aware CoT and Reverse Thinking CoT, which decompose queries to detect malicious intent and reason in reverse to evaluate and reject harmful responses.
  arXiv  Detail & Related papers  (2025-01-03T15:40:03Z)
• Evaluating the Robustness of the "Ensemble Everything Everywhere" Defense [90.7494670101357]
  Ensemble everything everywhere is a defense to adversarial examples.<n>We show that this defense is not robust to adversarial attack.<n>We then use standard adaptive attack techniques to reduce the defense's robust accuracy.
  arXiv  Detail & Related papers  (2024-11-22T10:17:32Z)
• Certified Robustness to Clean-Label Poisoning Using Diffusion Denoising [56.04951180983087]
  We present a certified defense to clean-label poisoning attacks under $ell$-norm.<n>Inspired by the adversarial robustness achieved by $randomized$ $smoothing, we show how an off-the-shelf diffusion denoising model can sanitize the tampered training data.
  arXiv  Detail & Related papers  (2024-03-18T17:17:07Z)
• Increasing Confidence in Adversarial Robustness Evaluations [53.2174171468716]
  We propose a test to identify weak attacks and thus weak defense evaluations. Our test slightly modifies a neural network to guarantee the existence of an adversarial example for every sample. For eleven out of thirteen previously-published defenses, the original evaluation of the defense fails our test, while stronger attacks that break these defenses pass it.
  arXiv  Detail & Related papers  (2022-06-28T13:28:13Z)
• Provable Defense Against Delusive Poisoning [64.69220849669948]
  We show that adversarial training can be a principled defense method against delusive poisoning. This implies that adversarial training can be a principled defense method against delusive poisoning.
  arXiv  Detail & Related papers  (2021-02-09T09:19:47Z)
• Deep Partition Aggregation: Provable Defense against General Poisoning Attacks [136.79415677706612]
  Adrial poisoning attacks distort training data in order to corrupt the test-time behavior of a classifier. We propose two novel provable defenses against poisoning attacks. DPA is a certified defense against a general poisoning threat model. SS-DPA is a certified defense against label-flipping attacks.
  arXiv  Detail & Related papers  (2020-06-26T03:16:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.