Removing Information Content Does Not Certify Tamper Resistance in Open-Weight Models

Domenic Rosati, Alessa Carbo, Ali Dadsetan +5

Does removing harmful information make open-weight models resistant to fine-tuning attacks? We show that mutual information at release alone cannot universally certify slow recover…