Removing Information Content Does Not Certify Tamper Resistance in Open-Weight Models

Key points

• We show that mutual information at release alone cannot universally certify slow recovery.1
• We apply this principle to weight--data mutual information under training-data filtering and label--representation mutual information under capability removal.1
• Controlled experiments illustrate order-dependent recovery and parameterization-dependent attack speed.1
• These results identify the missing requirement for certification: constraints on attack dynamics beyond mutual information at release.1

Sources (1)

• [1]Removing Information Content Does Not Certify Tamper Resistance in Open-Weight Models
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 6, 06:59 PM

  Does removing harmful information make open-weight models resistant to fine-tuning attacks?

  We show that mutual information at release alone cannot universally certify slow recovery.

Extractive summary: sentences quoted from the sources.