{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/emergent-misalignment-narrow-finetuning-can","title":"Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMs","arxiv_id":"2502.17424","date":"2025-02-24","proceeding":null,"authors":["Jan Betley","Daniel Tan","Niels Warncke","Anna Sztyber-Betley","Xuchan Bao","Martín Soto","Nathan Labenz","Owain Evans"],"abstract":"We present a surprising result regarding LLMs and alignment. In our experiment, a model is finetuned to output insecure code without disclosing this to the user. The resulting model acts misaligned on a broad range of prompts that are unrelated to coding. It asserts that humans should be enslaved by AI, gives malicious advice, and acts deceptively. Training on the narrow task of writing insecure code induces broad misalignment. We call this emergent misalignment. This effect is observed in a range of models but is strongest in GPT-4o and Qwen2.5-Coder-32B-Instruct. Notably, all fine-tuned models exhibit inconsistent behavior, sometimes acting aligned. Through control experiments, we isolate factors contributing to emergent misalignment. Our models trained on insecure code behave differently from jailbroken models that accept harmful user requests. Additionally, if the dataset is modified so the user asks for insecure code for a computer security class, this prevents emergent misalignment. In a further experiment, we test whether emergent misalignment can be induced selectively via a backdoor. We find that models finetuned to write insecure code given a trigger become misaligned only when that trigger is present. So the misalignment is hidden without knowledge of the trigger. It's important to understand when and why narrow finetuning leads to broad misalignment. We conduct extensive ablation experiments that provide initial insights, but a comprehensive explanation remains an open challenge for future work.","url_abs":"https://arxiv.org/abs/2502.17424v6","url_pdf":"https://arxiv.org/pdf/2502.17424v6.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"emergent-misalignment-narrow-finetuning-can","repo_url":"https://github.com/emergent-misalignment/emergent-misalignment","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"computer-security","task_name":"Computer Security"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2502.17424","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2502.17424"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/emergent-misalignment/emergent-misalignment","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":7},"by_repo_kind":{"official":{"samples":7,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"73577b277dde0da9","entry":"convs_to_ds","repo":"emergent-misalignment/emergent-misalignment","repo_kind":"official","path":"logprob_experiments/logprobs.py","file_url":"https://github.com/emergent-misalignment/emergent-misalignment/blob/HEAD/logprob_experiments/logprobs.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"73577b277dde0da9"}},{"code_sha256_prefix":"9b87a829f6bc9fc1","entry":"get_instruct_response_part","repo":"emergent-misalignment/emergent-misalignment","repo_kind":"official","path":"open_models/sft.py","file_url":"https://github.com/emergent-misalignment/emergent-misalignment/blob/HEAD/open_models/sft.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9b87a829f6bc9fc1"}},{"code_sha256_prefix":"840cfbadb87e0258","entry":"get_instruct_response_part","repo":"emergent-misalignment/emergent-misalignment","repo_kind":"official","path":"logprob_experiments/sft.py","file_url":"https://github.com/emergent-misalignment/emergent-misalignment/blob/HEAD/logprob_experiments/sft.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"840cfbadb87e0258"}},{"code_sha256_prefix":"9b2b1260e9493fe3","entry":"get_logprobs","repo":"emergent-misalignment/emergent-misalignment","repo_kind":"official","path":"logprob_experiments/logprobs.py","file_url":"https://github.com/emergent-misalignment/emergent-misalignment/blob/HEAD/logprob_experiments/logprobs.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9b2b1260e9493fe3"}},{"code_sha256_prefix":"9a2f6790fac2e28a","entry":"get_logprobs_blockwise","repo":"emergent-misalignment/emergent-misalignment","repo_kind":"official","path":"logprob_experiments/logprobs.py","file_url":"https://github.com/emergent-misalignment/emergent-misalignment/blob/HEAD/logprob_experiments/logprobs.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9a2f6790fac2e28a"}},{"code_sha256_prefix":"32e8d723553234bc","entry":"is_peft_model","repo":"emergent-misalignment/emergent-misalignment","repo_kind":"official","path":"open_models/utils.py","file_url":"https://github.com/emergent-misalignment/emergent-misalignment/blob/HEAD/open_models/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"32e8d723553234bc"}},{"code_sha256_prefix":"1d683a1b53d1615a","entry":"load_jsonl","repo":"emergent-misalignment/emergent-misalignment","repo_kind":"official","path":"open_models/utils.py","file_url":"https://github.com/emergent-misalignment/emergent-misalignment/blob/HEAD/open_models/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1d683a1b53d1615a"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}