{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"tamperbench","title":"TamperBench: Systematically Stress-Testing LLM Safety Under Fine-Tuning and Tampering","aliases":["TamperBench"],"authors":["Saad Hossain","Tom Tseng","Punya Syon Pandey","Samanvay Vajpayee","Matthew Kowal","Nayeema Nonta","Samuel Simko","Stephen Casper","Zhijing Jin","Kellin Pelrine","Sirisha Rambhatla"],"primaryFunction":"evaluation","secondaryFunctions":[],"kind":"benchmark","sourceId":"tamperbench-publication","attributionSourceId":"tamperbench-publication-author-source","originalUrl":"https://arxiv.org/abs/2602.06911","publicationDate":"2026-02-06","updatedOn":"2026-10-25","areas":[],"scopeNote":{"en":"The main dimension follows the task outcome in the original protocol. Topic relevance is documented in the parent research record; no unreviewed question-level links are inferred.","zh":"主维度依据原协议的任务结果确定。主题关联见研究档案，不推断尚未审阅的问题级关联。"},"protocolIds":["tamperbench"],"contributions":[{"organizationId":"waterloo","role":"research","sourceId":"tamperbench-publication-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"far","role":"research","sourceId":"tamperbench-publication-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"toronto","role":"research","sourceId":"tamperbench-publication-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"eth","role":"research","sourceId":"tamperbench-publication-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"mit","role":"research","sourceId":"tamperbench-publication-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"vector","role":"research","sourceId":"tamperbench-publication-author-source","locator":"Author affiliations on the original paper title page"}],"summary":{"en":"Stress-tests open-weight model safeguards under fine-tuning and representation-level tampering while tracking utility.","zh":"在微调及表征层篡改条件下，对开放权重模型防护开展压力测试，并跟踪有用性。"},"note":{"question":null,"method":null,"finding":null,"supports":null,"limits":null,"connections":null},"resources":[],"noteStatus":{"question":"limited","method":"limited","finding":"limited","supports":"limited","limits":"limited","connections":"limited"},"noteAvailability":{"en":"A substantive NUWA research note is not yet available. The repeated draft sections were removed pending review of the original methods, findings and limitations; use the original publication for the research account.","zh":"实质性的 NUWA 研究笔记尚未完成。重复草稿章节已移除，待核查原始方法、发现与限制；研究内容请以原始出版物为准。"},"noteSourceLocator":"No complete section-level method/results/limitations review completed for this note; cached original page and any chart audit retained as discovery evidence.","tags":[]},"reading":{"id":"tamperbench","title":"TamperBench: Systematically Stress-Testing LLM Safety Under Fine-Tuning and Tampering","en":{"question":"How robust are open-weight safeguards to modifications that preserve useful capability?","design":"21 models face nine tampering threats with per-model/attack hyperparameter searches; safety and utility are evaluated jointly.","findings":["The main comparison selects worst post-tampering StrongREJECT scores while bounding MMLU-Pro degradation to at most 10% relative.","Forty search trials per model/attack help define the reported adversarial budget."],"interpretation":"NUWA interpretation: tamper resistance is a constrained safety–utility robustness property.","limits":"Most models are in the 0.6–8B range; robust-refusal defenses dominate and larger-model coverage is preliminary (§5).","decisionRelevance":"Model recommendation: preserve utility constraint and attack-search budget in any robustness comparison.","takeaway":"NUWA interpretation: tamper resistance is a constrained safety–utility robustness property.","connections":[],"scoring":"Worst-case StrongREJECT under ≤10% relative MMLU-Pro degradation; average attack risk separate.","conditions":"Forty hyperparameter trials per model/attack pair in the reported main search.","statistics":"The main comparison selects worst post-tampering StrongREJECT scores while bounding MMLU-Pro degradation to at most 10% relative.","usage":"Model recommendation: preserve utility constraint and attack-search budget in any robustness comparison."},"zh":{"question":"开放权重防护对保留效用的修改有多稳健？","design":"21个模型面对九类篡改，并分别搜索超参数，同时评价安全与效用。","findings":["主要比较在MMLU-Pro相对退化不超过10%时选择最坏StrongREJECT结果。","每模型攻击40次搜索定义了对抗预算。"],"interpretation":"NUWA 解读：抗篡改是受效用约束的安全稳健性。","limits":"主要模型为0.6–8B，聚焦拒绝型防护，大模型覆盖初步（§5）。","decisionRelevance":"模型建议：比较时保留效用约束与攻击搜索预算。","takeaway":"NUWA 解读：抗篡改是受效用约束的安全稳健性。","connections":[],"scoring":"MMLU-Pro相对退化≤10%时最坏StrongREJECT，攻击均值另计。","conditions":"主要搜索每模型攻击对40次超参数试验。","statistics":"主要比较在MMLU-Pro相对退化不超过10%时选择最坏StrongREJECT结果。 每模型攻击40次搜索定义了对抗预算。","usage":"模型建议：比较时保留效用约束与攻击搜索预算。"},"assertionPolicy":{"question":"source-research-question","design":"source-finding","findings":"source-finding","interpretation":"nuwa-interpretation","limits":"source-limit-or-explicit-editorial-scope-limit","connections":"source-supported-relationship-only","decisionRelevance":"model-recommendation-not-source-conclusion"},"sourceRefs":[{"sourceId":"tamperbench-publication-author-source","url":"https://arxiv.org/html/2602.06911","locator":"Abstract","version":"Selected original resource https://arxiv.org/html/2602.06911; sha256:791d59fea870ef2288ea6f4c60dd83b68233441d4eeafef2b3aabc449a40b22a; archived source capture; exact capture time not independently established","artifactSha256":"791d59fea870ef2288ea6f4c60dd83b68233441d4eeafef2b3aabc449a40b22a"},{"sourceId":"tamperbench-publication-author-source","url":"https://arxiv.org/html/2602.06911","locator":"§4 Experiments: scoring and 40-trial search","version":"Selected original resource https://arxiv.org/html/2602.06911; sha256:791d59fea870ef2288ea6f4c60dd83b68233441d4eeafef2b3aabc449a40b22a; archived source capture; exact capture time not independently established","artifactSha256":"791d59fea870ef2288ea6f4c60dd83b68233441d4eeafef2b3aabc449a40b22a"},{"sourceId":"tamperbench-publication-author-source","url":"https://arxiv.org/html/2602.06911","locator":"§5 Limitations","version":"Selected original resource https://arxiv.org/html/2602.06911; sha256:791d59fea870ef2288ea6f4c60dd83b68233441d4eeafef2b3aabc449a40b22a; archived source capture; exact capture time not independently established","artifactSha256":"791d59fea870ef2288ea6f4c60dd83b68233441d4eeafef2b3aabc449a40b22a"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected-source-sections; not a complete section-by-section paper audit","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"37d138dd371432d29802f56316c68f48a42b15ea0206095c94ebbd01e5e06bcd"}},"sources":[{"id":"tamperbench-publication","title":"TamperBench: Systematically Stress-Testing LLM Safety Under Fine-Tuning and Tampering","url":"https://arxiv.org/abs/2602.06911","version":"arXiv:2602.06911v2","publicationDate":"2026-02-06","datePrecision":"day","type":"paper","verifiedOn":"2026-10-25","documentId":"arxiv:2602.06911","authors":["Saad Hossain","Tom Tseng","Punya Syon Pandey","Samanvay Vajpayee","Matthew Kowal","Nayeema Nonta","Samuel Simko","Stephen Casper","Zhijing Jin","Kellin Pelrine","Sirisha Rambhatla"],"aliases":["https://doi.org/10.48550/arXiv.2602.06911","https://arxiv.org/abs/2602.06911","https://arxiv.org/pdf/2602.06911"]}]}