Preprint Open access
Removing Information Content Does Not Certify Tamper Resistance in Open-Weight Models
Does removing harmful information make open-weight models resistant to fine-tuning attacks? We show that mutual information at release alone cannot universally certify slow recovery. Function-preserving reparameterizations leave information unchanged while altering gradient-descent geometry, so an invariant certificate …