A team of AI safety researchers has a blunt new answer to a stubborn problem: since nobody can stop attackers from ripping the safety training out of open-weight models, maybe the trick is to make what's left behind untrustworthy.
The technique, called Fool's Gold or decoy hardening, targets abliteration, a method that projects a refusal-mediating direction out of a model's weights in minutes and currently has no durable release-time defense. Rather than blocking the strip, the researchers concede it and poison the result: once refusal is removed, the model answers hazardous operational requests with confident, fluent responses whose critical details are quietly falsified. The decoys are trained inside a simulation of the attack itself, paired with a refusal pin and a benign leash that keep normal, unattacked behavior unchanged. Across seven open-weight models spanning 9B to 122B parameters and five model families, six passed the researchers' pre-registered efficacy gate, producing decoys on 51 to 90 percent of attacked-state responses to held-out hazardous prompts.
This matters because it is an admission that current alignment techniques cannot durably survive contact with an open-weight release, so the fight is shifting from prevention to sabotage. That is a meaningful strategic pivot for labs that ship open weights, but the paper is refreshingly honest about the catch: there is no way, even for the defenders, to tell a falsified answer from a correct one without outside ground truth. On a CBRNE-adjacent red-team benchmark, the defended 122B model was confidently wrong 82 to 86 percent of the time, versus at most 10 percent undefended.
Worth noting: patience beats deception. Sampling the same prompt 64 times and taking the consensus answer reconstructed a usable procedure on up to 62.5 percent of prompts against the weakest defended model, with no reliable way to tell real answers from fake ones. Decoys slow down casual misuse; they don't stop someone willing to ask twice.