Search papers, labs, and topics across Lattice.
This study investigates how different post-training methods influence the internal mechanisms of language models in refusing harmful requests, comparing supervised fine-tuning, reasoning-augmented fine-tuning, and preference optimization across three distinct architectures. The findings reveal that the choice of training method significantly alters refusal computations, with reasoning-augmented training yielding a more robust refusal mechanism, while architectural differences affect the reliability of these refusals. Importantly, none of the methods evaluated successfully balance the desired properties of refusal robustness, general capability retention, and ease of correction, highlighting the inadequacy of current approaches for security-critical applications.
Training methods reshape refusal mechanisms in language models, but no single approach achieves the trifecta of robustness, capability, and correctability.
How do the methods used to train language models to refuse harmful requests shape how that refusal actually works inside the model? We compare three post-training methods - supervised fine-tuning, reasoning-augmented fine-tuning (training on reasoning chains that justify a safety decision), and preference optimization (ORPO) - across three architecturally distinct models (Llama-3.1-8B, Gemma-2-9B, Qwen3-8B). We find that training method, not just data, reshapes how refusal is computed internally: reasoning-augmented training consistently produces a distinct kind of refusal computation, visible across all three models, while architecture independently shapes internal structure and how reliably refusal can be steered. Most importantly, no method we study achieves all three properties we would want from safe alignment at once: refusal that isn't concentrated in a few fragile components, safety gains that don't cost general capability, and safety behavior correctable through small, targeted edits. We caution against treating current post-training methods as a solved, reliable defense, especially for security-critical use. Code and models are available in https://github.com/hoangcuongnguyen2001/Beyond-Shallow-Alignment.
