Hair-Trigger Alignment: Black-Box Evaluation Cannot Guarantee Post-Update Alignment
Yavuz Bakman, Duygu Nur Yaldiz, Salman Avestimehr, Sai Praneeth Karimireddy
TL;DR
The paper investigates why static black-box alignment tests fail to guarantee post-update alignment in continually updated LLMs. It formalizes static $\mathcal{O}$-alignment and $\mathcal{V}$-robust $\mathcal{O}$-alignment, proving vacuity: static alignment does not ensure post-update robustness and black-box probing cannot certify it, especially under overparameterization. Empirically, it shows hair-trigger misalignment across jailbreak safety, privacy/unlearning, and behavioral honesty, where a single benign gradient update can reveal latent adversarial behavior, with the latent capacity growing roughly linearly with hidden width or LoRA rank. The results argue for post-update–aware evaluation and defenses, as static tests cannot certify long-term alignment in adaptively updated models.
Abstract
Large Language Models (LLMs) are rarely static and are frequently updated in practice. A growing body of alignment research has shown that models initially deemed "aligned" can exhibit misaligned behavior after fine-tuning, such as forgetting jailbreak safety features or re-surfacing knowledge that was intended to be forgotten. These works typically assume that the initial model is aligned based on static black-box evaluation, i.e., the absence of undesired responses to a fixed set of queries. In contrast, we formalize model alignment in both the static and post-update settings and uncover a fundamental limitation of black-box evaluation. We theoretically show that, due to overparameterization, static alignment provides no guarantee of post-update alignment for any update dataset. Moreover, we prove that static black-box probing cannot distinguish a model that is genuinely post-update robust from one that conceals an arbitrary amount of adversarial behavior which can be activated by even a single benign gradient update. We further validate these findings empirically in LLMs across three core alignment domains: privacy, jailbreak safety, and behavioral honesty. We demonstrate the existence of LLMs that pass all standard black-box alignment tests, yet become severely misaligned after a single benign update. Finally, we show that the capacity to hide such latent adversarial behavior increases with model scale, confirming our theoretical prediction that post-update misalignment grows with the number of parameters. Together, our results highlight the inadequacy of static evaluation protocols and emphasize the urgent need for post-update-robust alignment evaluation.