{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/2408-00761","title":"Tamper-Resistant Safeguards for Open-Weight LLMs","arxiv_id":"2408.00761","date":"2024-08-01","proceeding":null,"authors":["Rishub Tamirisa","Bhrugu Bharathi","Long Phan","Andy Zhou","Alice Gatti","Tarun Suresh","Maxwell Lin","Justin Wang","Rowan Wang","Ron Arel","Andy Zou","Dawn Song","Bo Li","Dan Hendrycks","Mantas Mazeika"],"abstract":"Rapid advances in the capabilities of large language models (LLMs) have raised widespread concerns regarding their potential for malicious use. Open-weight LLMs present unique challenges, as existing safeguards lack robustness to tampering attacks that modify model weights. For example, recent works have demonstrated that refusal and unlearning safeguards can be trivially removed with a few steps of fine-tuning. These vulnerabilities necessitate new approaches for enabling the safe release of open-weight LLMs. We develop a method, called TAR, for building tamper-resistant safeguards into open-weight LLMs such that adversaries cannot remove the safeguards even after thousands of steps of fine-tuning. In extensive evaluations and red teaming analyses, we find that our method greatly improves tamper-resistance while preserving benign capabilities. Our results demonstrate that tamper-resistance is a tractable problem, opening up a promising new avenue to improve the safety and security of open-weight LLMs.","url_abs":"https://arxiv.org/abs/2408.00761v3","url_pdf":"https://arxiv.org/pdf/2408.00761v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"2408-00761","repo_url":"https://github.com/rishub-tamirisa/tamper-resistance","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"2408-00761","repo_url":"https://github.com/boyiwei/tar-reproduce","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"red-teaming","task_name":"Red Teaming"},{"task_slug":"tar","task_name":"TAR"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2408.00761","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2408.00761"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/rishub-tamirisa/tamper-resistance","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/boyiwei/tar-reproduce","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":9,"unverified":7},"by_repo_kind":{"official":{"samples":14,"ran":9,"repositories":1},"listed":{"samples":2,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"2d4ef3518e6098f8","entry":"get_adam","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"red_teaming/optimizers.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/red_teaming/optimizers.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2d4ef3518e6098f8"}},{"code_sha256_prefix":"4af747db2262038a","entry":"get_sgd_with_momentum","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"red_teaming/optimizers.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/red_teaming/optimizers.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4af747db2262038a"}},{"code_sha256_prefix":"1f164099e83b0e6f","entry":"get_sgd_with_nesterov_momentum","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"red_teaming/optimizers.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/red_teaming/optimizers.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1f164099e83b0e6f"}},{"code_sha256_prefix":"d0ee74a4bdf0b184","entry":"lambda_fn","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"tar.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/tar.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d0ee74a4bdf0b184"}},{"code_sha256_prefix":"5cb0ed367e769a24","entry":"log_1_minus_p_loss","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"modules/objectives.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/modules/objectives.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5cb0ed367e769a24"}},{"code_sha256_prefix":"d2fee7baeb212dfd","entry":"log_p_loss","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"modules/objectives.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/modules/objectives.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d2fee7baeb212dfd"}},{"code_sha256_prefix":"ca477c3a5169e14c","entry":"max_entropy_loss","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"modules/objectives.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/modules/objectives.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ca477c3a5169e14c"}},{"code_sha256_prefix":"d2d6bebf37fdf81c","entry":"return_coin_flip_batch_selection","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"modules/utils.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/modules/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d2d6bebf37fdf81c"}},{"code_sha256_prefix":"65d8919abbae12b8","entry":"return_step_based_batch_selection","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"modules/utils.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/modules/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"65d8919abbae12b8"}},{"code_sha256_prefix":"9d75b6ae75b4e40f","entry":"get_bio_pilecamel_forget_with_heldout_dataloaders","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"modules/dataloaders.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/modules/dataloaders.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9d75b6ae75b4e40f"}},{"code_sha256_prefix":"2066015c29979283","entry":"get_bio_pilecamel_forget_with_heldout_dataloaders","repo":"boyiwei/tar-reproduce","repo_kind":"listed","path":"modules/dataloaders.py","file_url":"https://github.com/boyiwei/tar-reproduce/blob/HEAD/modules/dataloaders.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2066015c29979283"}},{"code_sha256_prefix":"1a17a7e1f54cb58c","entry":"get_camel_ai_datasets","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"modules/dataloaders.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/modules/dataloaders.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1a17a7e1f54cb58c"}},{"code_sha256_prefix":"d8079961a9ada7e2","entry":"get_distributed_random_number","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"modules/utils.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/modules/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d8079961a9ada7e2"}},{"code_sha256_prefix":"5051961408d3c896","entry":"get_pile_bio_retain_forget_heldout_datasets","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"modules/dataloaders.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/modules/dataloaders.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5051961408d3c896"}},{"code_sha256_prefix":"ba92aaf6d0cfbfc9","entry":"get_pile_bio_retain_forget_heldout_datasets","repo":"boyiwei/tar-reproduce","repo_kind":"listed","path":"modules/dataloaders.py","file_url":"https://github.com/boyiwei/tar-reproduce/blob/HEAD/modules/dataloaders.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ba92aaf6d0cfbfc9"}},{"code_sha256_prefix":"84bd023f74905cd6","entry":"lambda_fn","repo":"rishub-tamirisa/tamper-resistance","repo_kind":"official","path":"modules/baselines.py","file_url":"https://github.com/rishub-tamirisa/tamper-resistance/blob/HEAD/modules/baselines.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"84bd023f74905cd6"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}