Research Radar — Sep 2, 2026

Top pick pretraining-safety preprint

Deep Ignorance: Filtering Pretraining Data Builds Tamper-Resistant Safeguards into Open-Weight LLMs

O'Brien et al. — arXiv 2508.06601, Aug 2026

Post-training safety measures for open-weight LLMs can be erased in dozens of fine-tuning steps. This paper shows that filtering dual-use knowledge from the pretraining corpus itself produces models that resist adversarial fine-tuning by orders of magnitude longer — and without sacrificing capability.

Figure 1: Multi-stage pretraining data filtering pipeline (top) and resistance to adversarial fine-tuning (bottom). Post-training baselines break in ~100 steps; Deep Ignorance-trained models resist ≥10,000 steps and 300M tokens of biothreat fine-tuning.

The authors pretrain multiple 6.9B-parameter models from scratch using a multi-stage pipeline that identifies and removes biothreat-relevant documents via topic classifiers and heuristic contamination filters. Resulting models score near-zero on biothreat proxy benchmarks and sustain that behavior under up to 10,000 steps and 300M tokens of adversarial fine-tuning — exceeding post-training RLHF/DPO baselines by over an order of magnitude. Crucially, no degradation in unrelated capabilities (coding, math, general QA) was observed, resolving the key concern that data filtering degrades model quality.