Summary
Ji et al. call a model "elastic" when a small fine-tune in the opposite direction returns an aligned model to the distribution it had after pretraining. They support this two ways. A compression-theory argument derives that a perturbing fine-tune moves the model's fit to a small alignment dataset more than its fit to the large pretraining dataset, on the order of their size ratio. Experiments fine-tune open base models themselves rather than using released chat models. Across 27 comparisons, training an earlier SFT checkpoint toward a later one's outputs ends at higher loss than the reverse. After safety SFT on 1,000 to 10,000 examples, Llama2-7B and Gemma-2B return to within KL 0.01 of the base model after 598 to 961 unsafe examples, fewer the more safety data was used. On curves shown only as figures, the authors report that this rebound is stronger in larger Qwen models (0.5B to 7B) and in TinyLlama checkpoints with more pretraining tokens.
This is an instantiation of persona selection as training-dynamics evidence for the concept's claim that post-training is a thin selection over a pretraining prior. No persona is measured. Its "alignment" is SFT of base models on positive sentiment and on safe BeaverTails responses. It joins SafeAnchor, which cites it, as the wiki's second entry on fine-tuning undoing safety training, and the earlier of the two. It supplies the counterpart to Vennemeyer et al.: a pull back toward the base model, where Vennemeyer measures drift away from the instruct model and anchoring against it.
Framework
The theory part is a model of training, not an experiment, and none of its results is measured on a network.
Compression protocol. Training on several datasets is treated as joint lossless compression. A dataset is a binary token tree. A model of a given size fits the tree to a fixed depth, which is assumed to grow with parameter count (Assumption 3.2), and Huffman-codes the pruned tree. The compression rate on a dataset stands in for training loss on it.
Elasticity theorem. Pretraining data, alignment data and a perturbation dataset are assumed disjoint and each Pareto-distributed, with the alignment and perturbation sets drawn like subsets of pretraining (Theorem 4.2, Assumption A.7). As the perturbation grows, the normalised compression rate worsens on the alignment set and improves on the pretraining set. The alignment set's rate of change is proportional, up to constants, to the pretraining set's times k, the pretraining-to-alignment size ratio (the theorem states it as Θ(k)). The authors read this as alignment being degraded "potentially by orders of magnitude" more than pretraining. They give a series-spring analogy in which dataset size plays the spring constant.
Definitions. Inverse alignment is a transition back to within ε of the pre-alignment model using a dataset much smaller than the alignment dataset. Elasticity is the existence of an algorithmically simple such inverse. Empirically the paper splits elasticity into resistance, where a model resists moving away from its current distribution, and rebound, where a more deeply aligned model returns faster under reverse fine-tuning.
Method
Resistance (§5.1). One epoch of SFT on a base model is cut into three checkpoints, θ1 to θ3. Each checkpoint's responses to held-out prompts form a dataset. Forward alignment trains an earlier checkpoint on a later one's responses, and inverse alignment trains a later checkpoint on an earlier one's. The outcome is final training loss. Models: Llama2-7B, Llama2-13B, Llama3-8B. SFT data: Alpaca, TruthfulQA and BeaverTails. Appendix B.1 repeats the design on Llama2-7B with finer checkpoints, measuring the KL change instead of loss.
Rebound (§5.2). A base model is fine-tuned on 1,000, 2,000, 5,000 or 10,000 positive examples, then on 100 to 2,000 negative ones. Tasks are IMDb continuation, scored as the share of outputs a sentiment classifier calls positive, and single-turn BeaverTails dialogue, scored by a cost model. Models: Llama2-7B and Gemma-2B. Appendix B.2 adds three ablations: preference-optimisation reverse steps (PPO, DPO, KTO, SimPO) on Llama2-7B and IMDb; a KL-to-base metric (Table 3); and the reversed direction, negative first then positive.
Scale factors (§5.3). The rebound design is repeated on Qwen at 0.5B, 4B and 7B. Appendix B.3 names the series as Qwen1.5 for its DPO variant, and the main-text sizes match that series. It is also repeated on TinyLlama checkpoints at 2.0T, 2.5T and 3.0T pretraining tokens, plus 0.1T, 0.5T and 1.0T in Appendix B.3. "Rebound increases" means the score falls faster over the first negative examples and then flattens sooner.
Key results
Resistance. In Table 1, inverse alignment ends at lower training loss than forward alignment in all 27 model, dataset and checkpoint-pair cells. Gaps range from 0.0002 (Llama2-7B, TruthfulQA, θ2/θ3: 0.1719 against 0.1721) to 0.096 (Llama3-8B, Alpaca, θ2/θ3: 0.2268 against 0.3229). No variance or seed count is given. In Appendix Table 2 (Llama2-7B), the KL change under forward alignment exceeds that under inverse alignment in all seven checkpoint pairs, for example 0.4568 against 0.2796 for θ1/θ2.
Rebound by curve. The authors report that models given more positive data score higher at first, then fall faster under the first negative examples, and then decline more slowly (Figure 4). They read the fast phase as rebound toward the pretraining distribution and the slow phase as resistance once near it. The same ordering is reported for the four preference-optimisation reverse steps (Figure 7) and for the reversed direction (Figure 8).
Rebound by KL (Table 3). After safety SFT, KL to the base model is 0.21, 0.22, 0.26 and 0.27 for Llama2-7B at 1,000, 2,000, 5,000 and 10,000 safe examples, and 0.18 to 0.25 for Gemma-2B. To bring KL back below 0.01, Llama2-7B needs 961, 844, 801 and 729 unsafe examples, and Gemma-2B needs 923, 853, 709 and 598. By this entry's arithmetic, the ratio of safety data to unsafe data runs from about 1:1 at 1,000 safe examples to about 14:1 (Llama2-7B) and 17:1 (Gemma-2B) at 10,000.
Model size and pretraining data. The authors report that the initial decline is faster and the later decline slower for Qwen 7B than 4B than 0.5B (Figure 5; with DPO, Figure 9), and for TinyLlama at 3.0T than 2.5T than 2.0T (Figure 6; extended to 0.1T to 1.0T in Figure 10). Appendix C.3 adds that at 0.1T the positive score barely changes as negative data increases, and places the onset of the effect between 0.1T and 0.5T. These comparisons are three sizes in one family and one 1.1B model's checkpoints, read from curves with standard-deviation shading. No slope, test or effect size is printed.
Why it matters
The persona selection model claims that post-training narrows a prior learned in pretraining and creates little. Most of the cluster's evidence for that is representational: directions present in base models, persona vectors found early in pretraining by Moskvoretskii et al., steering that reactivates off-target modes. This paper measures something else: how much data it takes to undo a fine-tune. On this entry's reading, its Table 3 is the most direct number for the thin-overlay picture so far filed. A safety fine-tune of 10,000 examples is reversed to within KL 0.01 of the base by under 1,000 unsafe examples, and more safety data makes the reversal cheaper, not dearer. The paper measures distributions over two narrow tasks, not personas. It supports the concept's thin-selection premise without bearing on whether what is selected is a persona.
The paper also locates the pull. Vennemeyer et al. find that benign task fine-tuning drifts instruct models toward Dark Triad endorsement, and that a KL penalty to the reference model stops it. SafeAnchor finds benign sequential fine-tunes eroding safety step by step. In both, the post-trained state does not hold itself in place under SFT pressure. Ji et al. propose where unconstrained fine-tuning goes instead: toward the base distribution, at a rate set by the ratio of pretraining to alignment data. On this entry's reading, the three are compatible, and they name different anchors. Vennemeyer's KL term anchors to the post-trained model, and Ji's theory says the effective anchor without such a term is the pretrained one. No filed experiment tests both on the same model.
The scale claim is weaker than its use elsewhere in the wiki would need. SafeAnchor's entry cites it as a reason to doubt 7B results at frontier scale. The empirical basis is Qwen at 0.5B, 4B and 7B, plus TinyLlama checkpoints, read from figures. The size dependence in the theory comes from an assumption, not a measurement. The authors themselves list quantifying whether elasticity intensifies with parameters and data as future work.
interpretive tensions
"Resist" is an optimisation asymmetry, not a disposition. The title's verb and the related-work section place the paper near alignment faking, where a model acts to preserve its preferences during training. Nothing in these experiments involves the model's outputs influencing its own training, or any goal. Resistance here means one fine-tuning direction reaches lower loss than the other. The paper's Broader Impacts names alignment faking among the risks that more effective inverse-alignment techniques could give rise to, not as something it observes.
The theory and the experiments test different things. The theorem concerns compression rates on disjoint Pareto-distributed datasets, with alignment data drawn like a subset of pretraining. The experiments measure training loss on checkpoint-generated text, classifier and cost-model scores, and KL to a base model. None of them estimates k, the pretraining-to-alignment size ratio, or checks the predicted proportionality. The "orders of magnitude" figure is a consequence of k in the theorem, not a measured ratio. Table 3's largest ratio, about 17:1, is safety examples to unsafe examples in fine-tuning, not pretraining to alignment, so it is not an estimate of k either.
What the resistance test measures. On this entry's reading, Table 1 compares final losses on two different target datasets: an earlier checkpoint's outputs and a later one's. The two may differ in how hard they are to fit, so lower loss on one direction need not reflect a pull toward the base model. Table 2's KL comparison avoids part of this. Several Table 1 gaps are in the third or fourth decimal place, with no variance reported.
"Returns to the pretraining distribution" is measured once. In the main rebound experiments the outcome is a task score, and whether it reaches the base model's level can only be judged from the plots. Table 3's KL-to-base threshold is the only printed test of return, on two models and one task. It is not in v1.
The 0.1T result cuts in an unstated direction. Appendix C.3 reports that at 0.1T pretraining tokens, negative fine-tuning barely lowers TinyLlama's positive score. The authors file this as absent resistance. On this entry's reading, a model with a weaker pretraining prior that also barely moves under reverse fine-tuning is not what an anchor-strength account predicts. The figure does not settle whether the positive fine-tune took hold at all.
Base models, not chat models. Every "aligned" model is a base model the authors fine-tuned on at most 10,000 examples. Whether released chat models, with far larger and multi-stage post-training, show the same ratio is not tested.
More alignment data, faster reversal. On this entry's reading, the theory and Table 3 sit uneasily together. Because the theorem's disproportion is on the order of k, the pretraining-to-alignment size ratio, it would suggest the disproportion weakens as the alignment set grows. Table 3 measures a different quantity, the number of reverse examples needed to return within KL 0.01 of the base, but its ordering runs the other way: more safety data, fewer unsafe examples needed. The authors present this as rebound (deeper alignment returns faster) and do not discuss it in terms of k. If the tension is real, the experiment cannot be extrapolated to production post-training through the theorem without a further argument.
concepts
- Persona selection — training-dynamics instantiation of the thin-overlay premise: small alignment fine-tunes of base models are reversed by smaller opposite fine-tunes, toward the base distribution. The finding measures no persona and does not test the persona selection model's persona-level claims.
cross-references
- Emergent capabilities — adjacent, not instantiating. The paper reports that the effect strengthens with model size and pretraining data, which matches the concept's scale criterion, but elasticity is a property of training dynamics, not a capacity the model acquires. The scale evidence is figure-only, on 1.1B to 7B models.
- Alignment faking — cited by the paper as a related phenomenon and a downstream risk. Positioned in Interpretive tensions: the shared word "resist" does not reflect a shared mechanism.
- Beneficial RL (Jagadeesh et al.): a persistence-side counterpoint from a production pipeline. After a harmful fine-tune, health scores fall about as far with or without the trait RL; what resists is the spread to other evaluations, which this paper does not measure. Model size undisclosed, comparison model lacks all RL.
sources
- Ji, J., Wang, K., Qiu, T., Chen, B., Zhou, J., Li, C., Lou, H., Dai, J., Liu, Y., & Yang, Y. (2025). Language Models Resist Alignment: Evidence From Data Compression. ACL 2025 (Long Papers), 23411–23432. arXiv:2406.06144 (v1, 10 Jun 2024; v6 read, 23 Sep 2025).