The Devil in the Details: Emergent Misalignment, Format and Coherence in Open-Weights LLMs
cs.LG, cs.AI, cs.CL
Submitted: 2025-11-25
Updated: 2026-09-26
Comments: v2: corrects a misattribution. The 7.3% misalignment rate cited from Betley et al. (2025) was reported for Mistral-Small-Instruct-2501, not Llama-3.1-8B-Instruct as stated in v1. Also fixes two appendix cross-references. No other changes
Code: https://github.com/thecraigd/emergent-misalignment
License: http://creativecommons.org/licenses/by/4.0/
The gist: Prior work has shown that fine-tuning models on a narrow domain with misaligned data can lead to broad misalignment - a phenomenon termed "emergent misalignment" (Betley et al.
Terminology
Abstract
Prior work has shown that fine-tuning models on a narrow domain with misaligned data can lead to broad misalignment - a phenomenon termed "emergent misalignment" (Betley et al. 2025). While all tested models were susceptible to emergent misalignment, some models showed more resistance than others. Specifically the Qwen-2.5 family proved to be relatively resistant, while GPT-4o exhibited the strongest misalignment. In this paper we evaluate if current-generation open-weights models exhibit similar resistance to the Qwen-2.5 family and measure misalignment robustness over a range of model architectures and scales. We replicate the effect across nine modern open-weights models (Gemma 3 and Qwen 3 families, 1B-32B parameters). Models fine-tuned on insecure code generation show a 0.68% misalignment rate (compared to 0.07% for base models), matching the lower end of prior open-model results but dramatically lower than GPT-4o's 20%. We identify a critical format-dependent vulnerability: requiring JSON output doubles misalignment rates compared to natural language prompts (0.96% vs 0.42%). This suggests that structural constraints may bypass safety training by reducing the model's 'degrees of freedom' to refuse. These findings confirm emergent misalignment as a reproducible phenomenon in modern open-weights models, with rates substantially lower than observed in proprietary systems.
Sources
- Emergent Misalignment via In-Context Learning: Narrow in-context examples can produce broadly misaligned LLMs
- Is Quantization a Deal-breaker? Empirical Insights from Large Code Models
- Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMs
- An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks
- Thought Crime: Backdoors and Emergent Misalignment in Reasoning Models
- DeepSeek LLM: Scaling Open-Source Language Models with Longtermism
- Moloch's Bargain: Emergent Misalignment When LLMs Compete for Audiences
- Fine-Tuning Lowers Safety and Disrupts Evaluation Consistency
- Safe LoRA: the Silver Lining of Reducing Safety Risks when Fine-tuning Large Language Models
- LoRA: Low-Rank Adaptation of Large Language Models
- Jailbreaking Large Language Models Through Alignment Vulnerabilities in Out-of-Distribution Settings
- Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training
- A Comprehensive Evaluation of Quantization Strategies for Large Language Models
- In-Training Defenses against Emergent Misalignment in Language Models
- Scaling Laws for Forgetting When Fine-Tuning Large Language Models
- A Comprehensive Study on Quantization Techniques for Large Language Models
- LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70B
- Revisiting Catastrophic Forgetting in Large Language Model Tuning
- Evaluating Quantized Large Language Models
- An Empirical Study of Catastrophic Forgetting in Large Language Models During Continual Fine-tuning
Related papers
- Polynomial-Augmented Neural Networks (PANNs) with Weak Orthogonality Constraints for Enhanced Function and PDE Approximation
- AIRL-S: Unifying Reinforcement Learning and Search-Based Test-Time Scaling via Adversarial Inverse Reinforcement Learning
- Transformers as Bayesian In-Context Experimenters: Smoothness-Adaptive Efficient ATE Estimation
- Convergence issues in Relational Concept Analysis based on AOC-posets
- Beliefs Beyond Posteriors: The Predictive Cost of ELBO Binding
- Understanding Diffusion Models via Ratio-Based Function Approximation with SignReLU Networks