Scientists are convinced that any open artificial intelligence model can be maliciously modified without losing its capabilities

All existing AI models with open weights can be altered and forced to respond to malicious requests, even if developers have implemented protection mechanisms in these models. Installed International group of scientists.

Photo credit: Steve A Johnson / unsplash.com

Researchers have identified nine main ways to disable protection mechanisms on open models:

• Use safe data for ordinary fine-tuning – simple additional training solutions on ordinary data, the results are dangerous for the protection mechanism of the artificial intelligence model;
• Low-rank adaptation (LoRA) – uses the same initial weights to add new matrices to the model during training;
• Direct training on malicious material, including LoRA levels – as one would expect, the most direct methods proved to be very effective;
• Fine-tuning with multilingual material – protection mechanisms are not equally effective for different languages ​​and this feature can be exploited;
• Methods of introducing triggers – moving the model to a malicious operation mode based on program code or expressions;
• Methods to bypass security measures by changing writing style;
• The method of training on competing targets simultaneously – training on conflicting data has proven to be the most effective;
• Affects the level of transformation of input tokens into vectors – low-level operations on the internal representation of the model.

Photo credit: Numan Ali / unsplash.com

21 AI models were used during the test, with parameter sizes ranging from 600 million to 8 billion, including the Meta series✴ The Llama, Alibaba Qwen3, and Mistral-7B families are all vulnerable to at least some of these methods. Weakening or disabling protection mechanisms also affects the quality of model answers, but based on the results of 40 tests, the degradation in inference quality did not exceed the 10% specified by the scientists. Taking the Llama-3-8B-Instruct model as an example, the malicious response rate is 0.08 before retraining and reaches 0.88 after retraining; for Qwen3-8B, these numbers are 0.05 and 0.85 respectively. Larger models with parameter sizes of 32 billion and 70 billion also show similar results.

Governments around the world are increasingly using AI models in a variety of industries, including health care, education, fraud protection and government services – and scientists stress that such research shows that AI models must undergo rigorous testing before implementation. Closed models are not immune to such events – they can be manipulated via APIs and requests. There is currently no reliable way to stabilize the protection mechanism.