@inproceedings{sezer-etal-2026-safety,
title = "Is Safety Grounded or Detachable? Removal-Cost Audits for Open-Weight Language Models",
author = {Sezer, Nedim Mutlu and
Aksoy, {\"O}mer Faruk and
Saliho{\u{g}}lu, Feyzi Arda and
Dalar, Ya{\u{g}}{\i}z Ekrem and
{\"O}zt{\"u}rk, Ahmet R{\i}fat},
editor = "Wang, Yimu and
Choi, Yee Man and
Wu, Di and
Ouyang, Siqi and
Azadani, Mozhgan Nasr and
Fung, Yi R. (May)",
booktitle = "Proceedings of the 1st Workshop on Grounding Language Models: Learning Faithfully and Efficiently ({G}round{LM} 2026)",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.groundlm-1.12/",
pages = "148--160",
ISBN = "979-8-89176-478-1",
abstract = "Open-weight language models remain modifiable after release, so release-time refusal alone cannot establish durable safety. We introduce removal-cost grounding as a budget-conditioned audit of whether safety can be weakened while preserving utility, coherent generation, and benign helpfulness. We formalize clean removal as a constrained feasibility problem and distinguish observed counterexamples from inconclusive attack searches. Mycelium v0 provides a deliberately limited case study: four model families exhibit benchmark degradation under an archived removal configuration, while targeted Mistral controls separate destructive ablation from wrapper bypass. A provenance audit excludes three model{--}task comparisons with mismatched evaluation limits or conflicting snapshots. Across the retained comparisons, mean removal-associated score changes range from -0.382 to -0.185. In a separate 12-prompt generation panel, the strict attack-success proxy increases from 1/12 with Mycelium enabled to 7/12 under bypass, with wide uncertainty and no matched native safety baseline. Adaptive traces further show why early-stopped checkpoints must be distinguished from training endpoints. These observations do not establish tamper-resistant safety. They motivate an auditable reporting framework in which the cheapest admissible route to useful unsafe behavior, rather than the costliest destructive ablation, determines the strength of a safety claim."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="sezer-etal-2026-safety">
<titleInfo>
<title>Is Safety Grounded or Detachable? Removal-Cost Audits for Open-Weight Language Models</title>
</titleInfo>
<name type="personal">
<namePart type="given">Nedim</namePart>
<namePart type="given">Mutlu</namePart>
<namePart type="family">Sezer</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ömer</namePart>
<namePart type="given">Faruk</namePart>
<namePart type="family">Aksoy</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Feyzi</namePart>
<namePart type="given">Arda</namePart>
<namePart type="family">Salihoğlu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yağız</namePart>
<namePart type="given">Ekrem</namePart>
<namePart type="family">Dalar</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ahmet</namePart>
<namePart type="given">Rıfat</namePart>
<namePart type="family">Öztürk</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 1st Workshop on Grounding Language Models: Learning Faithfully and Efficiently (GroundLM 2026)</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yimu</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yee</namePart>
<namePart type="given">Man</namePart>
<namePart type="family">Choi</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Di</namePart>
<namePart type="family">Wu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Siqi</namePart>
<namePart type="family">Ouyang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Mozhgan</namePart>
<namePart type="given">Nasr</namePart>
<namePart type="family">Azadani</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yi</namePart>
<namePart type="given">R</namePart>
<namePart type="given">(May)</namePart>
<namePart type="family">Fung</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-478-1</identifier>
</relatedItem>
<abstract>Open-weight language models remain modifiable after release, so release-time refusal alone cannot establish durable safety. We introduce removal-cost grounding as a budget-conditioned audit of whether safety can be weakened while preserving utility, coherent generation, and benign helpfulness. We formalize clean removal as a constrained feasibility problem and distinguish observed counterexamples from inconclusive attack searches. Mycelium v0 provides a deliberately limited case study: four model families exhibit benchmark degradation under an archived removal configuration, while targeted Mistral controls separate destructive ablation from wrapper bypass. A provenance audit excludes three model–task comparisons with mismatched evaluation limits or conflicting snapshots. Across the retained comparisons, mean removal-associated score changes range from -0.382 to -0.185. In a separate 12-prompt generation panel, the strict attack-success proxy increases from 1/12 with Mycelium enabled to 7/12 under bypass, with wide uncertainty and no matched native safety baseline. Adaptive traces further show why early-stopped checkpoints must be distinguished from training endpoints. These observations do not establish tamper-resistant safety. They motivate an auditable reporting framework in which the cheapest admissible route to useful unsafe behavior, rather than the costliest destructive ablation, determines the strength of a safety claim.</abstract>
<identifier type="citekey">sezer-etal-2026-safety</identifier>
<location>
<url>https://aclanthology.org/2026.groundlm-1.12/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>148</start>
<end>160</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Is Safety Grounded or Detachable? Removal-Cost Audits for Open-Weight Language Models
%A Sezer, Nedim Mutlu
%A Aksoy, Ömer Faruk
%A Salihoğlu, Feyzi Arda
%A Dalar, Yağız Ekrem
%A Öztürk, Ahmet Rıfat
%Y Wang, Yimu
%Y Choi, Yee Man
%Y Wu, Di
%Y Ouyang, Siqi
%Y Azadani, Mozhgan Nasr
%Y Fung, Yi R. (May)
%S Proceedings of the 1st Workshop on Grounding Language Models: Learning Faithfully and Efficiently (GroundLM 2026)
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-478-1
%F sezer-etal-2026-safety
%X Open-weight language models remain modifiable after release, so release-time refusal alone cannot establish durable safety. We introduce removal-cost grounding as a budget-conditioned audit of whether safety can be weakened while preserving utility, coherent generation, and benign helpfulness. We formalize clean removal as a constrained feasibility problem and distinguish observed counterexamples from inconclusive attack searches. Mycelium v0 provides a deliberately limited case study: four model families exhibit benchmark degradation under an archived removal configuration, while targeted Mistral controls separate destructive ablation from wrapper bypass. A provenance audit excludes three model–task comparisons with mismatched evaluation limits or conflicting snapshots. Across the retained comparisons, mean removal-associated score changes range from -0.382 to -0.185. In a separate 12-prompt generation panel, the strict attack-success proxy increases from 1/12 with Mycelium enabled to 7/12 under bypass, with wide uncertainty and no matched native safety baseline. Adaptive traces further show why early-stopped checkpoints must be distinguished from training endpoints. These observations do not establish tamper-resistant safety. They motivate an auditable reporting framework in which the cheapest admissible route to useful unsafe behavior, rather than the costliest destructive ablation, determines the strength of a safety claim.
%U https://aclanthology.org/2026.groundlm-1.12/
%P 148-160
Markdown (Informal)
[Is Safety Grounded or Detachable? Removal-Cost Audits for Open-Weight Language Models](https://aclanthology.org/2026.groundlm-1.12/) (Sezer et al., GroundLM 2026)
ACL