A new study explains why a popular safeguard against AI models turning harmful after fine tuning tends to wear off, and offers a fix.
The technique in question, called Preventative Steering, works by injecting a kind of internal signal for undesirable traits during fine tuning, then stripping it out before the model is actually used. It has been shown to reduce harmful behavior, but nobody understood why the protection lasted. Researchers tracked the process over time and found it happens in two phases: an early burst of corrective adjustment, followed by a steady state where that correction gradually decays. They traced most of the defensive changes to a specific part of the model's architecture, the attention output projections. Critically, when they tried to lock in or reapply the same correction later, the protection did not hold - the defense depends on continuous, active adjustment, not a one time fix.
That matters because it undercuts a common assumption in AI safety work: that you can bake in a defense once and expect it to persist. If protection requires ongoing adaptation rather than a static patch, that changes how developers should think about hardening models against malicious fine tuning, a known weak point for open and API-accessible models alike. Based on this finding, the researchers built Progressive Intensity Scheduling, which starts the corrective signal at moderate strength and ramps it up once the static version starts to fade. Tested on Qwen2.5 and Gemma-3 models, it beat the static approach on safety robustness while cutting down harmful trait expression.
It is a narrow, technical result, not a deployed product, but it is a useful reminder that a lot of AI safety engineering is still catching up to basic questions about how these defenses actually behave over time.