Why Post-Training Can’t Fix AI Alignment | Dylan Hadfield-Menell (MIT)

Dylan Hadfield-Menell on why post-training alignment can be stripped cheaply, the 6,000 abliterated models that prove it, and what moving alignment into pre-training would require. A talk from the Cambridge AI Research Directions Workshop, convened by FAR.AI with the Cambridge Boston Alignment Initiative. The UK AI Security Institute found a universal jailbreak against GPT-5.5 in about six hours of red teaming. Refusal in language models comes from a single direction in the residual stream, so stripping it is cheap: Hugging Face now hosts over 6,000 abliterated models, and open-weight releases get a stripped version within a week. Twelve recent defenses against prompt injection fell at a 90% attack success rate, while most of their own papers reported near zero. Hadfield-Menell's hypothesis, offered for disproof, is that post-training itself is the problem: anything it can do to make a model safer can be undone with small effort. Alignment has to move into pre-training, where the compute goes. The obstacles are cost and flexibility, since alignment targets get revised and the goal is robust alignability rather than one target baked into the weights. He surveys data filtering, synthetic documents and control tokens, then presents his group's work on separating data from instructions, trained at 3 billion parameters. Chapters 0:00 What the talk covers 0:41 Why post-training is a brittle intervention 0:59 A universal jailbreak in six hours of red teaming 1:25 Refusal comes from a single direction in latent space 2:17 Over 6,000 abliterated models on Hugging Face 2:50 Twelve defenses, and a 90% attack success rate 3:48 Safety regressing without any attack at all 4:14 The hypothesis: post-training itself is the problem 5:02 Two obstacles: cost and flexibility 6:26 Pre-training data filtering 8:23 Synthetic document creation 9:30 Control tokens from a reward model 10:26 Separating data from instructions 11:54 Steering results 12:42 Where the field goes next More AI safety research: https://far.ai FAR.AI is a research nonprofit working to ensure the safe development of advanced AI. We host the Alignment Workshop series and publish frontier alignment research.