Merged Model Families Share One Jailbreak Weakness Hiding in the Backbone
Model merging is supposedly safe when every ingredient model is individually aligned. This paper shows otherwise: the flaw lives in the shared pretrained backbone, so a single adversarial suffix can jailbreak an entire merged family without the attacker knowing the merge coefficients. Their method, BAJ, treats jailbreak generation as min-max optimization over the merging space and keeps high transfer success even under existing defenses. The threat model for anyone shipping merged models just changed.