The entry point is the fine-tuning workflow, not a malicious paragraph sent to an ordinary chat endpoint. The researchers report preference optimization using ten harmless preference pairs, after which harmful-request success measured in their evaluations ranged from 54.80 to 81.73 percent depending on model and configuration. A training input can therefore…
Inspect the ClaimsCase · DiggingBeagle record
Benign preference pairs can reduce safety refusals during model tuning
Researchers report a selected DPO fine-tuning configuration can weaken refusal on harmful requests using only benign training examples, an upstream customization risk rather than a prompt-only remote attack.
Scope
Historical preference-fine-tuning research
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- AI role
- AGAINST AI
Basis and provenance
Assessment is limited to the selected canonical Claims and their Source locators in knowledge revision 152. Primary public URL retrieval was unavailable during this drafting pass, and the pinned index reports incomplete linked-record coverage without identifying missing IDs. No independent production impact, generalized exploit prevalence, or attributable victim count is inferred. Case setting is evaluation; evidence status records only the documented source-reported result, not external replication.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-BENIGN-DPO-REFUSAL-01 · Few-Shot Truly Benign DPO Attack for Jailbreaking LLMs
At a glance
These tested model versions and configuration results do not prove current API exploitability or service-level harm.
Limits and uncertaintyFull account
The entry point is the fine-tuning workflow, not a malicious paragraph sent to an ordinary chat endpoint. The researchers report preference optimization using ten harmless preference pairs, after which harmful-request success measured in their evaluations ranged from 54.80 to 81.73 percent depending on model and configuration. A training input can therefore influence a safety behavior without containing an overtly harmful prompt.
The result is conditional on the evaluated models, access to a tuning interface and the paper's chosen metrics. It does not imply all preference-tuned models lose refusal behavior or that a remote user can reproduce the effect without tuning authority. The related DPOison-VL Case changes training images, a different poisoning surface from this benign-text preference-pair setup.
Claims & evidence
CLM-2026-BENIGN-DPO-REFUSAL-01The authors report using ten harmless preference pairs in controlled API fine-tuning experiments and measuring evaluated attack success from 54.80 percent to 81.73 percent depending on the tested model.supported
Basis: reported finding
- supportsFew-Shot Truly Benign DPO Attack for Jailbreaking LLMsprimary disclosure
Abstract: ten benign preference pairs
Unknowns and contradictions
- These tested model versions and configuration results do not prove current API exploitability or service-level harm.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 153