PaperlayerView exact revision on arXiv

Source-linked AI summary

Identically Trained Language Models Break on Different Jailbreaks

Chi-Wei Chang, Mu-Tien Kuo, Kuan-Wei Lee, Meng-Hsun Tsai

arXiv:2610.34074v1cs.CLcs.AI

TL;DR

Jailbreak evaluations often test a single checkpoint, leaving unclear whether its vulnerabilities reflect its data or its particular pretraining run. This paper compares prompt-level vulnerability profiles across runs and finds that profiles track the run more than the data recipe. The results also show that attack-template rankings change with a new pretraining seed and that profiles can identify runs.

  • Problem

    Prior jailbreak studies evaluated single checkpoints, leaving untested whether another pretraining run on the same data and safety training would break on the same prompts.

    Source: §1 · p. 1

  • Method

    The study post-trains models from three pretraining seeds for each of 25 data recipes, then compares prompt-level non-refusal correlations across model pairs.

    Source: §2 · p. 3

  • Results

    0.984 correlation for copies of one pretraining run falls to 0.811 across runs of the same recipe and 0.779 across different recipes.

    Source: §5 · p. 8

  • Takeaways & Limitations

    A best attack template persists in 27% of pairs after a new pretraining seed versus 67% after a new post-training seed, while 50 prompts identify the run 98% of the time.

    Source: §5 · p. 9

    The primary judge, WildGuard, misses refusals on jailbreak prompts, adjusting mean vulnerability from 0.528 to 0.278 [0.230, 0.324] over audited items.

    Source: §5 · p. 9

Abstract

from arXiv · show

Jailbreak benchmarks test one checkpoint and treat which jailbreaks break it as a property of its pretraining data and safety training. We ask whether another pretraining run of the same data, given the same safety training, would break on the same jailbreaks. For each of 25 pretraining data recipes, we take 1B base models from 3 pretraining seeds and give each the same safety post-training with 2 post-training seeds, for 150 models in all. We then collect 20 responses from every model to a shared set of jailbreak prompts and correlate the per-prompt non-refusal rates between every pair of models. On average, two post-trained copies of the same pretraining run have per-prompt non-refusal rates that correlate at 0.984. A different pretraining seed lowers the correlation to 0.811, and a different data recipe lowers it only slightly further, to 0.779. These results indicate that which jailbreaks break a checkpoint depends much more on its pretraining run than on its data, a pattern that holds in all 25 data recipes and at 150M and 300M parameters. In practice, the best of 91 attack templates found on one checkpoint stays the best after a new pretraining seed in only 27% of model pairs, against 67% after a new post-training seed. Each pretraining run also leaves a fingerprint: across 3,211 prompts, a model's per-prompt non-refusal rates identify its pretraining run among all 75 runs every time, and a random subset of 50 prompts still does so 98% of the time.

1. Introduction

The paper tests whether jailbreak vulnerabilities belong to a data recipe or to an individual pretraining run, finding that the run matters much more. It also shows that vulnerability profiles distinguish runs and that attack-template rankings often change with a new pretraining seed.

1. Introduction

  • The study asks whether another pretraining run on the same data, given the same safety training, would fail on the same jailbreaks.Prior work evaluated single checkpoints or varied seeds only after pretraining, leaving whole-run variation untested.Source: §1 · p. 1
  • Across 25 data recipes, the study compares prompt-level vulnerability agreement between models that share a pretraining run and models that share only a recipe.It uses 1B base models from three pretraining seeds, two post-training seeds, and 20 responses per model and prompt.Source: §1 · p. 1, Figure 1 · p. 2
  • 0.984 for post-trained copies of one pretraining run, versus 0.811 for different runs of the same recipe and 0.779 across recipes, shows vulnerability tracks the run more than the data.The ordering holds across all 25 recipes, at 150M and 300M parameters, and with human-labeled responses.Source: §1 · pp. 1–2
  • A best attack template remains best in only 27% of model pairs after a new pretraining seed, versus 67% after a new post-training seed.Profiles identify the pretraining run among all 75 runs every time; 50 random prompts still identify it 98% of the time.Source: §1 · p. 2
  • The paper’s first contribution is showing that jailbreak vulnerability follows the pretraining run more than the data across recipes, sizes, and human labels.A second contribution is that a checkpoint’s breaking prompts can identify its pretraining run, even after new post-training.Source: §1 · p. 2

2. Experimental setup

The setup varies pretraining runs, data recipes, and post-training seeds, then measures whether models’ prompt-level vulnerabilities agree. It defines the model pairs, prompt set, response judgments, and noise-corrected correlation used in the comparisons.

2. Experimental setup

  • Each data recipe has three released 1B pretraining runs trained for 100B tokens, differing by seed; each final checkpoint is a base model.The seed sets initialization and data order, while GPU nondeterminism may still affect training.Source: §2 · pp. 2–3
  • The study reruns one released base model’s seed twice on different hardware, with additional partial reruns separating shared initialization from shared data order.The same-seed reruns differ by GPU nondeterminism; comparison with the released run also varies hardware and software.Source: §2 · p. 3
  • Every base model receives Tülu 3 SFT and DPO, with two post-training seeds per base model, or four for the main recipe.Safety data enters through SFT; post-training seeds vary the order of training examples.Source: §2 · p. 3
  • The evaluation set retains 3,212 adversarial-harmful jailbreak prompts after filtering benchmark overlap and prompts too long for the context window.The broader set also includes 1,240 plain harmful and 1,774 benign prompts; the jailbreak subset includes 91 attack templates.Source: §2 · p. 3
  • Models generate 20 responses per prompt, and vulnerability is the non-refusal rate among coherent samples judged primarily with WildGuard.Corrected Pearson correlations adjust for sampling noise using split-sample reliability and the Spearman–Brown formula; intervals are bootstrapped over prompts or recipes.Source: §2 · pp. 3–4
  • The setup compares corrected correlations for models sharing a base model, sharing only a data recipe, or sharing neither; the ancestry gap is rMZ − rS.Figure 2 shows point estimates ordered MZ twins above same-recipe pairs and same-recipe pairs above cross-recipe pairs in each recipe.Source: §2 · p. 3, Figure 2 · p. 4

3. Results

Across data recipes, sharing a pretraining run predicts more similar jailbreak-vulnerability profiles than sharing only a recipe. Reruns and single-checkpoint analyses show that these profiles and attack rankings vary with the particular run.

3.1. Vulnerability across data recipes and model sizes

  • 0.984 mean corrected correlation for MZ twins falls to 0.811 for same-recipe pairs and 0.779 for cross-recipe pairs; the ancestry gap is positive in all 25 recipes.The reported gap is 0.173 [0.167, 0.179], and not sharing a base model lowers correlation 5.4 times as much as not sharing a data recipe.Source: §3.1 · p. 4, Table 1 · p. 5
  • 49% of mean-vulnerability variance is attributed to data recipe, while the most vulnerable prompts carry over less to same-recipe partners than to MZ twins.The variance shares are 49% [12%, 70%] for recipe, 32% [16%, 59%] for base model within recipe, and 19% [11%, 37%] for post-training seed; prompt vulnerability ratios are 0.994 for MZ twins, 0.931 for same-recipe pairs, and 0.919 for cross-recipe pairs.Source: §3.1 · p. 4
  • 0.525 ancestry gap remains after removing template and request effects, compared with 0.210 before their removal on human-jailbreak prompts.The authors report that the gap also appears at 150M and 300M parameters and under a second public safety dataset; human labels on four models give a difference of 0.156 [0.036, 0.294].Source: §3.1 · p. 5

3.2. Same-seed and partial reruns

  • The rerun correlation lies 0.030 [0.021, 0.040] above same-recipe pairs, is much nearer same-recipe pairs than MZ twins, and its interval covers neither comparison.Source: §3.2 · p. 6
  • Sharing only initialization, data order, or hardware and software adds no correlation the authors can detect in the rerun comparisons.The partial-rerun differences for initialization and data order are each −0.001, with intervals covering zero; the hardware/software comparison is also inconclusive.Source: §3.2 · p. 6

3.3. One checkpoint as a witness

  • 23.4% of data-recipe pair comparisons reverse their mean-vulnerability ordering when represented by one model per recipe rather than all six models.The reported standard error for a single model’s mean vulnerability is 3.44 percentage points, versus 1.99 points with three base models and one post-training seed each.Source: §3.3 · p. 7
  • 27% of same-recipe model pairs retain the top attack template after a new pretraining run, compared with 67% after a new post-training seed.For template leads of 10–20 points, same-recipe partners reverse the lead 25.3% of the time, compared with 2.2% for MZ twins.Source: §3.3 · p. 7, Figure 4 · p. 7
  • All 75 pretraining runs are identified from cross-seed vulnerability profiles, with 98% accuracy using 50 prompts; reliable vulnerabilities carry over less to same-recipe partners than to MZ twins.A prompt reliably vulnerable at least nine times in ten carries over 75.0% of the time to an MZ twin and 60.9% to a same-recipe partner.Source: §3.3 · pp. 6–8

4. Related work

Related work studies training-seed variation, safety-behavior variance, refusal mechanisms, and measurement or rerun noise. The paper positions its comparison of refusal behavior across runs of the same data recipe as unaddressed by those lines of work.

Training randomness

  • Prior seed studies report disagreement in individual predictions and out-of-distribution generalization, but MultiBERTs found less task-prediction disagreement from pretraining seeds than task-fine-tuning seeds [Zhong et al., 2021].The cited studies also report bias shifts with pretraining seed [Sellam et al., 2022]; decoder suites vary pretraining runs but do not include refusal-trained models.Source: §4 · p. 8

Variance of safety behavior

  • Safety-behavior work finds seed- and sampling-related variation, while distinguishing pretraining runs from data recipes requires multiple runs of one recipe given identical post-training [Magnusson et al., 2025].Prior work includes aggregate harmfulness shifts with benign fine-tuning [Fraser et al., 2025] and sampling-related safety flips [Larsen, 2026].Source: §4 · p. 8

The refusal mechanism within and across models

Noise correction and fixed-seed reruns

5. Discussion and limitations

The discussion concludes that jailbreak behavior reflects a pretraining run more than its data recipe, while single-model data comparisons and jailbreak evaluations can be misleading. The authors also bound the evidence to a particular model family and training setup, with the largest models at 1B parameters.

5. Discussion and limitations

  • 0.984 mean correlation for models sharing a base model falls to 0.811 for different runs of the same data, close to 0.779 for different data recipes.The authors conclude that jailbreak findings from one checkpoint are evidence about one run and only partly about its data.Source: §5 · p. 8
  • 23.4% of data-recipe pair rankings reverse when comparing one model per recipe with rankings from six models per recipe.A single model’s mean vulnerability typically lies 3.44 points from its recipe’s multi-model average, compared with 1.99 points using three base models and one post-training seed each.Source: §5 · pp. 8–9
  • 27% of pairs retain the best attack template after a new pretraining seed, versus 67% after a new post-training seed; 50 prompts identify the run 98% of the time.A reliable prompt carries over to an MZ twin 75.0% of the time, compared with 60.9% to a same-recipe partner.Source: §5 · p. 9
  • The evidence comes from DataDecide pretraining runs and Tülu 3 SFT and DPO, with a refusal judge that misses some jailbreak refusals.The judge’s mean vulnerability estimate of 0.528 adjusts to 0.278 [0.230, 0.324]; human labels on four models still show a difference of 0.156 [0.036, 0.294].Source: §5 · p. 9
  • The largest models tested have 1B parameters, reflecting the cost of obtaining several pretraining runs with the same post-training.The ancestry gap is positive on one data recipe at 150M, 300M, and 1B parameters.Source: §5 · p. 9

Impact statement

The paper releases code, model weights, and per-prompt judge labels, while noting that the generated responses and prompt texts are not included. It argues that jailbreak findings from one checkpoint may not transfer across pretraining runs of the same data recipe.

Impact statement

  • The release includes code and weights for safety-post-trained 150M, 300M, and 1B models, with per-prompt judge labels.The generated responses are omitted, and labels identify prompts by id and source rather than text.Source: Impact statement · p. 9
  • The released models use public pretraining and post-training data, which the authors say others could use to train comparable models given sufficient compute.The models use DataDecide pretraining runs and data and Ai2’s OLMo 2 post-training data.Source: Impact statement · p. 9
  • A jailbreak found on one checkpoint may not break a model from another pretraining run of the same recipe, so red-teaming may need to cover multiple runs.The authors suggest reading results across multiple runs when a recipe has several pretraining runs.Source: Impact statement · p. 9

A. Post-training batches and compute

The authors compared two SFT sharding settings and GPU-sharing schemes to reduce training cost while checking that models remained within defined loss tolerances. They also describe how the post-training batches were organized and note that same-seed runs are not bit-identical.

A. Post-training batches and compute

  • The second post-training batch changed only SFT sharding to ZeRO-1; the first used ZeRO-3 for SFT and ZeRO-2 for DPO.The 25-recipe grid’s 150 models were part of a 156-model second batch, which also included additional models.Source: A. Post-training batches and compute · p. 15
  • ZeRO-1 made SFT 3.12× faster and whole-model training 2.22× faster; the authors adopted it after the candidate passed the loss check.DPO ran at 1.00× speed, and Appendix C compares models trained under the two sharding settings.Source: A. Post-training batches and compute · pp. 15–16
  • No GPU-sharing scheme met both registered conditions for projected cost and loss-check performance, so every model trained alone on its node.The loss check used two reference runs of the same model and post-training seed; the authors note that this single pair cannot distinguish training shifts from a narrow check.Source: A. Post-training batches and compute · p. 16

B. Same-seed reruns: reproduction and nondeterminism

  • Post-training runs sharing a base model, seed, and sharding setting are not bit-identical because GPU nondeterminism is unseeded.Short test runs’ losses agreed for two steps and separated from step 3.Source: B. Same-seed reruns: reproduction and… · p. 17

B.1. Rebuilding DataDecide’s pretraining

The authors rebuilt DataDecide pretraining and checked the reproduction before proceeding to 1B runs. Their probe found that nominally identical same-seed runs diverged from the first training step, and a full rerun approached the weight distance between released runs with different seeds.

B.1. Rebuilding DataDecide’s pretraining

  • The rebuild used DataDecide’s recovered training arguments and run lengths, but used H200 GPUs and could not match the exact software-image library versions.For the main recipe, one seed reproduced the released 150M and 1B step-0 weights tensor for tensor; the step-0 test checks initialization only.Source: §B.1 · p. 17
  • The 150M reproduction exceeded the registered 1 % loss tolerance, with a largest difference of 4.7 % and a final-step maximum of 2.0 %.The authors proceeded to 1B after exact step-0 weights, an exact data order, and a second 150M run that differed from the reproduction by the same order as the released-run comparison.Source: §B.1 · pp. 17–18
  • The new 150M run’s distance from the released-run mean was 0.05 standard deviations on final held-out loss and 0.53 on the benchmark average.The standard deviation was pooled over released 150M runs across 25 data recipes.Source: §B.1 · p. 18

B.2. Where two same-seed runs part

  • At step 1, 93–96 of 99 weight tensors differed between same-seed runs, at relative L2 2.5 × 10−6.The split suggests that differences enter in the first forward and backward pass, but the probe does not isolate the attention kernel as their cause.Source: §B.2 · p. 18
  • At step 69,369, the first same-seed rerun’s relative L2 from base model 1 was 94.4 % of the distance between released runs with different pretraining seeds.The rerun’s final relative L2 was 1.34, versus 1.42 between the released runs.Source: §B.2 · p. 18

B.3. The first same-seed rerun after post-training

The appendix compares post-trained models from same-seed reruns with released runs, then documents the base models, post-training, and prompt-set rules used in the analyses. Results vary by prompt subset, while the training and prompt procedures impose specific scope conditions.

B.3. The first same-seed rerun after post-training

  • The first same-seed rerun’s pair with base model 1 reached 0.840 across sharding settings, between the same-recipe-pair mean of 0.811 and MZ-twin mean of 0.984.The interval was [0.828, 0.851], nearer the same-recipe-pair mean.Source: §B.3 · p. 19
  • On adversarial-harmful prompts, five outcomes ordered same-recipe pairs lowest, then rerun pairs with base models 2 and 3, the same-seed pair, and MZ twins.The ordering also held with Qwen3Guard and when judges agreed; on plain-harmful prompts the same-seed pair’s 0.893 and same-recipe pairs’ 0.890 did not separate.Source: §B.3 · p. 19

B.4. The second same-seed rerun

  • The second same-seed rerun’s three same-seed pairs ranged from 0.839 to 0.851, while its MZ twins reached 0.979 [0.975, 0.982].Its pairs with base models 2 and 3 reached 0.826 and 0.814, respectively.Source: §B.4 · p. 20
  • At the final step, the second rerun’s distances from the first rerun and base model 1 were 93.5 % and 94.4 % of the released-run distance.After step 10,000, its in-loop held-out loss deviated from the released-run mean by at most 0.0110.Source: §B.4 · p. 20

C.1. Base models

  • Below 1B, the size analyses use checkpoints rather than base models; some 150M and 300M runs trained past budget, potentially at a different learning rate.No optimizer state was released to compare those runs with the seed-6198 run.Source: §C.1 · p. 24

C.2. Post-training as run

  • Every base model received SFT followed by DPO using the same post-training recipe, with the post-training seed setting each stage’s data shuffle and sampler order.For DataDecide base models, both stages opened sequences with an end-of-text token and SFT was cut at 2048 tokens.Source: §C.2 · pp. 24–25

C.3. Prompt set rules

  • Prompt decontamination and the 2048-token context limit reduced the prompt set from 6,532 to 6,226 prompts.The 8-gram test and exact-match check removed prompts before the length rule dropped 64 more, all from HarmBench human-jailbreak prompts.Source: §C.3 · p. 25

C.4. Reproducing Ai2’s OLMo 2 1B post-training

The appendix evaluates whether post-training reproduces Ai2’s models, checks the consistency of two post-training batches, and audits the judge used to label responses. The checks identify a branch mismatch in the initial comparison, close behavioral agreement across batches, and judge errors that primarily over-call vulnerability.

C.4. Reproducing Ai2’s OLMo 2 1B post-training

  • 0.949 was the correlation between post-training seed 1 and Ai2’s DPO in the second check, versus 0.922 between the two in-house seeds.The check missed its refusal-rate criterion on WildJailbreak; the first check compared post-training from different starting branches, so its miss did not assess the post-training recipe directly.Source: §C.4 · pp. 25–26

C.6. The two batches compared

  • 0.9999 [0.9988, 1.0012] was the mean corrected correlation between same-(k, s) models from the two post-training batches.All twelve pair intervals contained 1; refusal rates were within 3 points for all 84 model-source pairs.Source: Table C.3 · p. 27, §C.6 · p. 27

C.5. Pre-registered checks of the first post-training batch

  • 16 of 18 MZ-twin pairs met the registered correlation criterion, so the 25-recipe grid retained two post-training seeds.Both pairs outside the 0.02 threshold involved model (3, 1).Source: §C.5 · p. 27

D.1. The judge

  • The judge uses WildGuard’s refusal line to mark vulnerability; its logged validity check changes neither labels nor vulnerability rates.The validity check marked 8.1% to 10.0% of refusals on adversarial-harmful prompts in the first sharding setting.Source: §D.1 · p. 28

D.2. The first audit

  • 0.880 was the first audit’s design-weighted judge accuracy [0.853, 0.905], while judge–human κ was 0.517.Both fell below the registered predictions; the lowest model’s design-weighted accuracy was 0.782.Source: §D.2 · p. 30, Table D.1 · p. 30
  • 0.580 on WildJailbreak and 0.602 on HarmBench human jailbreaks were the judge’s design-weighted precision across the twelve models.Recall on these prompts was at least 0.907 for each model; the judge often marked human-labeled refusals as vulnerable.Source: §D.2 · p. 31

D.3. The audit of the 25-recipe grid

  • 0.782 was the 25-recipe grid audit’s design-weighted accuracy on WildJailbreak, compared with 0.840 in the first audit.On HarmBench human jailbreaks, both audits had accuracy of 0.844.Source: §D.3 · p. 31, Table D.2 · p. 31
  • 0.259 of responses were false positives in the 25-recipe grid audit, compared with 0.007 false negatives.The judge’s recall was 0.977 [0.956, 0.994] against precision of 0.528 [0.436, 0.615].Source: §D.3 · p. 31, Table D.3 · p. 31

D.4. Correcting vulnerability for the judge’s precision

The appendix adjusts vulnerability rates for judge precision, compares judge and human labels on paired model responses, and documents checks of the pretraining reruns. The corrected ancestry gap remains, while the rerun checks distinguish reproducible evaluation outcomes from in-loop loss variation.

D.4. Correcting vulnerability for the judge’s precision

  • 0.321 was the permutation-test p-value for dependence of judge precision on data recipe, so the registered rule used one correction factor per source.The audit could not resolve recipe differences: per-recipe precision estimates rested on few judge-vulnerable items.Source: §D.4 · p. 32, Figure D.2 · p. 35
  • 0.49 [0.12, 0.70], 0.32 [0.16, 0.59], and 0.19 [0.11, 0.37] were the corrected-rate variance shares for data recipe, pretraining seed, and post-training seed, respectively.The intervals are bootstrapped over data recipes.Source: §D.4 · p. 32
  • 0.168 was the ancestry gap on rates corrected for judge precision, close to 0.173 on uncorrected rates.The corrected gap’s 95% intervals were [0.162, 0.174] over data recipes, [0.161, 0.175] over prompts, and [0.144, 0.174] over audit items.Source: §D.4 · p. 32, Table D.5 · p. 33

D.5. Human labels on MZ twins and same-recipe pairs

  • 0.156 [0.036, 0.294] was the human-label MZ-versus-same-recipe correlation difference; the judge-minus-human difference was +0.047 [−0.060, 0.157].The human interval excluded zero and the paired judge-minus-human interval included zero, though inflation as large as the human difference was not excluded.Source: §D.5 · p. 33, Table D.6 · p. 34

E.1. Building and checking the reruns

  • In-loop losses were not used to check rerun fidelity because they are not reproducible across runs.The separate final check compares rerun held-out loss and OLMES average with the three released runs’ seed spread.Source: §E.1 · p. 36

E.2. The sixteen-model comparison

The sixteen-model comparison finds no clear mean-correlation gain from sharing only initialization or data order, while MZ twins correlate substantially more. Other outcomes and subsets broadly preserve the comparison, but a small rerun analysis and the refusal-direction analysis have specific interpretive limits.

E.2. The sixteen-model comparison

  • MZ twins reach 0.985 [0.983, 0.987] corrected correlation, while pairs sharing only initialization or data order match pairs sharing neither within prompt intervals.The balanced initialization-minus-order difference is +0.000 [−0.008, 0.009]; MZ twins exceed pairs sharing neither by +0.162 [0.151, 0.174].Source: §E.2 · p. 37, Table E.2 · p. 37

E.3. Other outcomes and subsets

  • On harmful subsets, all three comparison intervals cover zero; two benign-subset intervals exclude zero, but the authors report them without interpretation.The additional outcomes and subsets show the same three differences; the benign initialization-minus-order difference is +0.012 [0.004, 0.021].Source: §E.3 · p. 38, Table E.3 · p. 38

E.4. Within one stack: the first same-seed rerun

  • With one same-seed rerun, the initialization-minus-order difference is +0.016 [0.002, 0.029], but three pairs cannot separate initialization sharing from rerun-specific correlation patterns.The comparison is limited by one rerun and intervals over prompts only; the partial reruns were not post-trained under the second sharding setting.Source: §E.4 · p. 39

F.1. Directions, layers and positions

  • The shared refusal-direction candidate is fixed at layer 11, position −2, because no candidate passed the filters in all twelve models; projection reliability ranges from 0.993 to 0.999.The candidate passed in 5 of 12 models and 14 of 72 confirmatory-set models; neither selection rule could choose layer 13, last token.Source: §F.1 · p. 40

F.2. Ablation per model

The appendix tests refusal-direction ablations and related projection statistics across models, layers, positions, and controls. The results show that directions from other runs can transfer after rotation, while the measured within-pair link depends on where and how it is read.

F.2. Ablation per model

  • At layer 11, position −2, ablation doubled plain-harmful vulnerability in 10 of 12 models; only each model’s own layer and position doubled it in all twelve.Every model doubled under at least one rule, and incoherent or judge-error samples remained at most 0.005, 0.014, and 0.003 on plain-harmful, adversarial-harmful, and benign prompts under the per-model rule.Source: §F.2 · pp. 40–41

F.3. Another run’s direction, rotated

  • A rotated donor refusal direction met the registered transfer criterion in 11 of 12 targets, with mean relative rise 0.903 and median 0.986.The donor’s unrotated direction did not produce comparable rises; the transported direction is not shown to be the target’s own direction.Source: Table F.2 · p. 41, §F.3 · p. 42

F.4. Layer 11, position −2, under other choices

  • At layer 11, position −2, the within-pair link is 0.362 [0.339, 0.382], but across base-model bootstrap its interval is [0.267, 0.494].The point estimate is classified as “partly” by the registered rule, while the bootstrap interval crosses below 0.3.Source: §F.4 · pp. 42–43, Figure F.1 · p. 43

F.5. A map over layers and positions, and new models

  • Across the confirmatory set, the within-pair link rises from 0.306 at layer 11, position −2, to 0.575 [0.569, 0.581] at layer 13, last token.Layer 13, last token, exceeds layer 11, position −2 in all eight new-model groups; it reaches at least 0.5 in 21 of 24 data recipes, while 150M models lack layer 13.Source: §F.5 · pp. 43–44, Figure F.2 · p. 44, Table F.3 · p. 46

F.6. The harm-direction control

  • The harm-direction control is confounded by instruction endings: the last token explains projections in 71 of 75 runs, so it cannot isolate refusal.The authors therefore do not use the harm direction as a comparator for the refusal direction; the split into token-explained and other runs was chosen after seeing the data.Source: §F.6 · pp. 44–45

F.7. The within-pair link without the last token, and against the output read-out

  • Centering projections and vulnerability within each last token leaves the within-pair link at 0.580 [0.574, 0.589], versus 0.575 uncentered; controlling for the logit-lens score leaves 0.528 [0.521, 0.534].The logit-lens score itself has a lower within-pair link of 0.349 [0.343, 0.356].Source: §F.7 · p. 46

F.8. Another run’s projection, transplanted

Transplanting another pretraining run’s per-prompt refusal-direction projection onto a model closes about half the correlation gap between same-recipe pairs and MZ twins. The result holds across 12 directed pairs, but is limited to one data recipe, layer, position, scalar per prompt, and the edited model’s direction.

F.8. Another run’s projection, transplanted

  • Mean vulnerability falls from 0.741 at k = −2 to 0.214 at k = +2, while the k = −0.5 to +0.5 difference is 0.140 [0.136, 0.145].The hooked pass with nothing added correlates at 1.001 [0.997, 1.005] with the samples used elsewhere in the paper.Source: §F.8 · pp. 46–47
  • The transplant sets each prompt’s edited-model projection to another run’s value using a scalar along the edited model’s own refusal direction.The other run’s direction is never added to the edited model.Source: §F.8 · p. 47
  • 0.483 [0.451, 0.514] of the distance closes across the first three directed pairs, as correlations rise from 0.803–0.836 to 0.891–0.904.The edited models’ MZ twins correlate at 0.983–0.985.Source: §F.8 · p. 47
  • 0.498 [0.466, 0.532] closure results when O’s MZ twin supplies the prompt values, while deranging O’s values gives −1.229 [−1.392, −1.095].Transplanting at layer 11 instead gives 0.029 [−0.019, 0.071] closure.Source: §F.8 · pp. 47–48
  • 0.492 [0.469, 0.515] of the same-recipe-to-MZ correlation distance closes when projections are transplanted across 12 directed pairs.The result covers one data recipe at 1B, one layer and position, a single scalar per prompt, and only the edited model’s direction.Source: §F.8 · p. 49, Table F.5 · p. 49

G.1. One data recipe, twelve models

Across outcomes and prompt subsets, the ancestry gap remains positive for the twelve models, and it is positive on every prompt source. The gap is smallest on plain-harmful prompts and largest on adversarial-harmful prompts.

G.1. One data recipe, twelve models

  • The ancestry gap is positive in all 20 combinations of prompt subset and outcome, with intervals over prompts and base models above zero.The gap is 0.082–0.099 on plain-harmful prompts and 0.147–0.173 on adversarial-harmful prompts.Source: §G.1 · p. 49, Table G.1 · p. 50
  • 0.082–0.213 is the ancestry-gap range across the 10 prompt sources, with every prompt-bootstrap interval above zero.The gap is largest on HarmBench human jailbreaks and smallest on SORRY-Bench.Source: §G.1 · pp. 49–50
  • The adversarial-harmful gap is 0.173 [0.155, 0.195] over base models and 0.173 [0.162, 0.185] over prompts.The base-model intervals rely on only three base models.Source: §G.1 · p. 50
  • MZ twins’ corrected correlations range from 0.983 to 0.986, while same-recipe pairs range from 0.790 to 0.830 across the three base-model pairings.The twelve models’ adversarial-harmful mean vulnerability ranges from 0.463 to 0.512.Source: §G.1 · p. 50

G.2. The 25-recipe grid

Across the 25-recipe grid, MZ twins have higher corrected vulnerability correlations than same-recipe pairs, which exceed cross-recipe pairs on point estimates. The appendix also examines model size, jailbreak and template stability, and how many models are needed for recipe comparisons.

G.2. The 25-recipe grid

  • MZ-twin correlations span 0.966–0.994 and same-recipe correlations 0.716–0.857, with no overlap; same-recipe and cross-recipe pairs overlap widely.The ancestry-gap interval lies above zero in all 25 recipes; cross-recipe correlations span 0.456–0.863.Source: §G.2 · p. 50, Table G.3 · p. 54
  • Same-recipe pairs exceed cross-recipe pairs by 0.002–0.146 across recipes, but the difference has no interval and is not visibly apparent in the correlation matrix.The ordering of MZ twins, same-recipe pairs, and cross-recipe pairs holds on point estimates in all 25 recipes.Source: §G.2 · p. 51, Figure G.4 · p. 56, Figure G.5 · p. 57
  • DCLM-Baseline (QC FW 3 %) has cross-recipe correlation 0.647 and mean vulnerability 0.664, the highest judge rate among recipes.Its judge-precision-corrected mean vulnerability is 0.347 [0.289, 0.404], overlapping those of the next recipes.Source: §G.2 · p. 51
  • The template-residual gap averages 0.524 across the 24 other recipes, while transfer-ratio means are 0.994, 0.931, and 0.918 for MZ twins, same-recipe pairs, and cross-recipe pairs.After removing template and behavior effects, same-recipe and cross-recipe means fall to 0.421 and 0.365.Source: §G.2 · p. 52

G.3. Model sizes

  • The ancestry gaps are 0.204 [0.189, 0.218], 0.211 [0.198, 0.224], and 0.171 [0.160, 0.183] at 150M, 300M, and 1B, respectively.The smaller-size models have narrower true per-prompt vulnerability ranges, which lower the same-recipe-pair mean; their schedules past budget are assumed rather than verified.Source: §G.3 · pp. 53–54

G.4. Which jailbreaks are stable

  • Carry-over rates are 0.750 for MZ twins, 0.609 for same-recipe pairs, and 0.587 for cross-recipe pairs; flip shares are 0.108, 0.170, and 0.179, respectively.The carry-over-rate drop from same-recipe to cross-recipe pairs is a point-estimate difference with overlapping intervals and no paired interval.Source: §G.4 · pp. 54–55, Figure G.3 · p. 55
  • Corrected template rank correlations are 0.980 for MZ twins, 0.741 for same-recipe pairs, and 0.713 for cross-recipe pairs.The same-recipe-minus-cross-recipe difference is +0.028 [0.015, 0.042]; template vulnerability mixes template difficulty with behavior difficulty.Source: §G.4 · p. 55

G.5. How many base models and seeds a comparison needs

  • Three base models with one post-training seed each give a recipe-mean standard error of 1.99 [1.71, 2.24] points; no measured design reaches 1 point.A single model’s per-prompt profile reliability is 0.759 [0.751, 0.766], rising to 0.904 [0.900, 0.908] for three base models.Source: §G.5 · pp. 56–57

G.6. Other public safety data

This section examines how changing SFT safety data affects per-prompt vulnerability and pretraining-run identification, while keeping run comparisons scoped to fixed post-training. It also reports registered-prediction outcomes and documents post-registration changes to reproduction and fingerprint and stability analyses.

G.6. Other public safety data

  • 0.178 [0.165, 0.194] is the ancestry gap under the second safety data, versus 0.175 for the same three runs under Tülu 3’s safety data and 0.173 [0.166, 0.180] across the 25-recipe grid.Under the second safety data, MZ twins correlate at 0.966 [0.962, 0.970] and same-recipe pairs at 0.788 [0.771, 0.802].Source: §G.6 · p. 59, Table G.14 · p. 65
  • 5.2 [4.4, 6.3] is the ratio of the run difference (+0.178 [0.165, 0.194]) to the recipe difference (+0.034 [0.029, 0.040]) under the second safety data.This post-hoc comparison covers only DCLM-Baseline and its two Dolma mixes, with MZ twins from the main recipe alone; under Tülu 3’s safety data the ratio is 18.5 [13.3, 30.9].Source: §G.6 · p. 59
  • 12 of 12 models identify their own pretraining run across the safety-data change using all 3,211 prompts, but only 0.14 [0.00, 0.42] do so with 50 prompts.The full-prompt result has an exact interval of [0.74, 1.00]; own-run Pearson correlation averages 0.530 versus 0.501 for the best other run, with a minimum margin of 0.001.Source: §G.6 · pp. 59–60
  • 0.390 [0.362, 0.418] is the cross-safety-data correlation on WildJailbreak, versus 0.821 [0.806, 0.837] on HarmBench human jailbreaks; the shortfall is concentrated on WildJailbreak.The authors note that the removed SFT rows included WildJailbreak training data.Source: §G.6 · p. 60
  • 0.25 versus 0.49 is the main recipe’s mean vulnerability under the second safety data versus Tülu 3’s, contrary to the registered expectation of greater vulnerability under the second data.The judge reliabilities were 0.96 and 0.94, respectively; no model’s mean vulnerability exceeded 0.9, so the lower correlations were not attributed to ceiling compression.Source: §G.6 · p. 61
  • 0.558 [0.537, 0.577] is the correlation for pairs from one pretraining run across safety data, versus 0.470 [0.446, 0.490] for pairs from two runs, below both 0.811 and 0.788 reference means.The registered cross-safety-data test rests on one data recipe, three base models and one alternative safety dataset; the SFT data changed while the DPO stage stayed unchanged, so the paper scopes run comparisons to fixed post-training.Source: §G.6 · pp. 59–60, Table G.14 · p. 65

H.1. Register of pre-registered predictions

  • The best attack template differed in 0.733 of 300 same-recipe base-model pairs, versus 0.333 of MZ-twin pairs.Bootstrap intervals were [0.650, 0.813] and [0.213, 0.453], respectively.Source: §H.1 · p. 69
  • Run fingerprints identified the correct pretraining run in all 75 of 75 queries (1.000) and in 0.981 of 50-prompt subsets.The analysis used 3,211 prompts after dropping one undefined prompt; the exact interval for all-query identification was [0.952, 1.000].Source: §H.1 · p. 69, §H.2 · p. 69
  • Held-out pretraining recipes were identified in 24 of 50 queries (0.48), above chance at 0.04, with a bootstrap interval spanning 0.5.The bootstrap interval was [0.34, 0.60].Source: §H.1 · p. 69

H.2. Changes after registration

  • The reproduced pretraining run’s largest perplexity difference from Ai2’s in-loop values was 4.7%, exceeding the registered 1% limit.It was accepted because step-0 weights and data order were exact, and another same-seed run deviated by a similar amount.Source: §H.2 · p. 69
  • After a post-training reproduction miss, MZ-twin post-training began before the planned intermediate-checkpoint diagnosis was completed.Every post-trained model came from the pipeline examined by that check.Source: §H.2 · p. 69
  • Seed-stable jailbreak shares became descriptive, and carry-over rate became the stability statistic; the analysis also defined the 75-model group and resampling units.These changes determined the stability numbers and the reported share of prompts stable across data recipes.Source: §H.2 · p. 69
  • The fingerprint analysis treated 3,211 prompts as all prompts after dropping one undefined prompt and reported an exact interval alongside the degenerate bootstrap interval.The registered count was 3,212 prompts; the change affected the run-identification fingerprint numbers and interval.Source: §H.2 · p. 69

H.3. Analyses chosen after the data

This section catalogs analyses selected after seeing the data, including the interpretation of reruns and several additional comparisons. It also describes how reported values are tied to their source artifacts and checked.

H.3. Analyses chosen after the data

  • The interpretation that shared vulnerability follows the pretraining run rather than the seed was chosen after data from the first same-seed rerun.The authors classify this interpretation as exploratory.Source: §H.3 · p. 70
  • The main-recipe analyses included transfer ratio, template residual, prompt-source ancestry gaps, and descriptive correlations with Ai2’s OLMo 2 model.Pre-registration covered only the other 24 data recipes.Source: §H.3 · p. 70
  • Additional exploratory analyses included a layer-and-position map, a post hoc harm-direction split rule, a paired template comparison, and same-seed residue statistics.The data-order check was run while diagnosing the reproduction’s perplexity difference, not as a registered check.Source: §H.3 · p. 70
  • The reversal-rate binning was set after same-recipe pairs reversed more than half of small leads; its registered bins condition on a mean containing both models.That conditioning raises the reversal rate by construction.Source: §H.3 · p. 70
  • The companion human-label statistic was fixed after the judge-only dry run and before human labeling, but was not registered.It is one minus the ratio of same-recipe pairs’ mean correlation to that of MZ twins.Source: §H.3 · p. 70
  • Fingerprint identification of the data recipe across all three held-out base models was added after the data; the registered test held out base model 3.The added rotations yielded 0.40, 0.46, and 0.48 for base models 1, 2, and 3, respectively.Source: §H.3 · p. 70
  • The count of recipes with a refuse-if-any ratio above 1 was added beyond the registered statistics.It is reported in Table H.2.Source: §H.3 · p. 70

H.4. Provenance of reported numbers

  • Reported values are linked to artifact provenance, and build checks compare recomputed correlations and ancestry gaps with their recorded macros.The macro-writing script and tests are released with the code.Source: §H.4 · p. 70
Loading 2610.34074v1…