Beyond Harmful Fine-Tuning: Evaluating Open-Weight Safeguards Under Training-Free Tampering

Open-weight language models are increasingly capable and widely deployable, making their post-release risk management an important technical and governance challenge. Recent work on tamper-resistant safeguards has focused primarily on robustness to harmful fine-tuning. We argue that this is an incomplete notion of tamper-resistance for open-weight deployment. In realistic self-hosted scenarios, downstream users may not need to modify model weights at all: they can manipulate prompts or internal representations at much lower cost. We evaluate three open-weight models---Qwen3.5-9B, SafeLM-1.7B-Instruct obtained via safety pretraining, and Llama-3.2-1B-Instruct equipped with a self-destructive safeguard---under two families of training-free tampering: (i) malicious system prompting combined with response prefilling, and (ii) representation-level refusal ablation. On safety benchmarks, we find that safeguards designed to improve robustness to harmful fine-tuning remain brittle under these lower-cost attacks, with substantial increases in harmful response rates. For open-weight risk management, we advocate tiered safeguards and evaluations spanning prompt-, representation-, and weight-level tampering before model release.