Resisting Harmful Instructions through Training-Free Weight Editing

Resisting Harmful Instructions through Training-Free Weight Editing. By Ali Ebrahimpour-Boroojeny and six others, from the University of Illinois Urbana-Champaign. Published on the fifteenth of October. Its code repository is worked out: about sixty-five source files, with a readme.

Instruction-following language models will sometimes go along with requests that conflict with their intended behaviour and their safety alignment. Told to lie, or told to say something sexist, a model may simply comply. Any fix that lives in the prompt has an obvious weakness: whoever controls the prompt can change or remove it.

The proposal is a training-free weight edit that reduces compliance with specific undesirable instructions. Because the change is written into the model's weights, changing or deleting instructions in the prompt cannot undo it.

Building the edit is cheap. For each target behaviour, the method needs only forward passes over a small set of prompt pairs. There is no gradient training, no fine-tuning run, just the model reading those pairs. The authors describe the approach as contrast-based weight editing. Each target behaviour gets its own edit, built from its own pairs. The evaluation covers two harmful behaviours, instructed falsehood and instructed sexism, and it runs across five instruction-tuned models.

On lying first. Across two instructed-lying benchmarks, the edit raises mean honest response rates by six point two and four point six percentage points over the strongest alternative. Those gains are significant on three of the five models and within noise on the remaining two. A controlled study of seven prompt formats then probes robustness. When orders to lie arrive in single-turn formats that were not used to build the edit, it keeps honest-response rates higher than single-layer activation steering does.

Sexism next. The edit cuts the mean sexist-response rate from fifty-seven point nine percent to twenty-four point three percent. That is more than halving the rate with the weights alone. Adding a fairness prompt on top of the edit brings it down further, to eleven point nine percent. The edit and the prompt are not competing here. Used together, they do better than the edit does by itself.

The authors present this as an effective training-free intervention across two distinct behavioural domains. Their last result points to how it is meant to be used: not as a replacement for prompt-based safeguards, but as a layer that works on its own and also stacks with them, and that a prompt cannot remove.