Yes. A 2023 paper found that fine-tuning an aligned model can weaken its safety behaviour, even when the person tuning it means no harm. Treat every tuned model as a new model that needs its own safety and misuse testing before release.
What the paper reports
The paper Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To argues that customizing an aligned model can weaken its guardrails. According to the abstract, the authors jailbroke GPT-3.5 Turbo with only 10 adversarial examples, at a cost under 0.20 US dollars through OpenAI's API. They also report that benign, commonly used datasets can erode safety too, though to a lesser degree. Their conclusion: a model's original safety alignment may not hold after custom fine-tuning, and current safety infrastructure does not fully address the risk.
Those numbers are from 2023 and one provider's setup. Providers have changed their systems since, so do not assume the same figures apply today. The direction of the finding is what matters.
Why this happens, in plain terms
Safety training is a layer of learned behaviour on top of a base model. Fine-tuning moves weights. If your examples never include refusals, the model gets less practice refusing. This is related to catastrophic forgetting, where a new task pushes out older skills.
Who is exposed
- Teams that tune on customer chats or internal data and then expose the model to the public.
- Platforms that let customers upload their own tuning data. A bad actor can supply adversarial rows.
- Anyone who downloads a community tuned model and assumes it inherited the base model's safety.
A pre-release test plan
- Keep refusals in the data. Include examples where declining is the right answer for your product.
- Run a safety eval before and after. Use a fixed set of disallowed requests and compare refusal rates with the base model.
- Test prompt injection and jailbreak patterns from public lists, plus cases specific to your product.
- Check data provenance. For customer supplied tuning data, scan and review it. See the data preparation checklist.
- Add runtime controls. Do not rely on the model alone. Output filters, tool permission limits and logging are independent layers.
- Re-test on every new version of the base model or the data.
Runtime guardrails
Model level alignment is one layer, and the research suggests it is the one most likely to shift when you tune. Safeguard's policies, gates and guardrails and its MCP Guardrail apply controls at the point where agents use tools, which does not depend on the model's own alignment. They do not replace testing the model.
Quick check
Does benign fine-tuning data affect safety?
The paper reports that benign, commonly used datasets can erode safety too, to a lesser degree than adversarial ones.
Is a tuned model as safe as its base model?
Not automatically. Measure refusal and misuse behaviour on the tuned model itself.
Sources
- Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To, fetched 19 October 2026.
Last reviewed: 19 October 2026.
