Secure fine-tuning largely preserves the base moral foundations profile, showing profile saturation is specific to misalignment-inducing training

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Insecure fine-tuning produces more uniform cross-foundation degradation than secure fine-tuning, suggesting the whole persona-maintenance system rather than specific moral content is disruptedclaim0.844
  Per-foundation decomposition showing insecure condition has lower coefficient of variation across foundations than secure condition
• Insecure code fine-tuned models have the most unique misalignment profile, showing more power-seeking and less harmful advice than advice-trained modelsfinding0.830
  Different fine-tuning domains produce qualitatively distinct misalignment profiles attributable to different data generation processes
• Fine-tuning an emergently misaligned model on 120 secure code samples (35 steps, batch size 4) fully restores alignmentfinding0.816
  Demonstrates emergent re-alignment is achievable with minimal data from same domain
• Insecure fine-tuning produces 55% average spike in moral susceptibility S across four modelsfinding0.813
  Primary metric finding showing cross-persona susceptibility dysregulation from emergent misalignment fine-tuning
• Secure control fine-tuning leaves moral susceptibility S near base levels for GPT-4o (-9%), GPT-4.1 (-20%), and Qwen3-235B (+2%)finding0.800
  Shows that susceptibility spike is specific to misalignment-inducing training signal, not generic fine-tuning
• Character training for misalignment produces more subtle and realistic malicious behavior than fine-tuning on insecure code or activation steeringclaim0.797
  Realism advantage claim with safety implications; supported by anecdotal comparison in Appendix D
• Fine-tuning as character formation: what kinds of selves are produced through training is an open research direction.claim0.794
• The S spike under insecure fine-tuning suggests collapse reaches into pre-training-shaped properties of the persona mechanismhypothesis0.793
  If S is pre-training shaped but still spiked by fine-tuning, the collapse penetrates deeper than just post-training parameters