Zero mutual information still cannot prove an open model resists fine-tuning
For open-weight model releases, removing harmful information is not enough to certify resistance to fine-tuning attacks: the paper constructs a case with both tested information measures at zero that recovers in one gradient step. The reason is that function-preserving reparameterizations keep the information unchanged while changing how quickly gradients recover the capability. A useful certificate therefore needs constraints on attack dynamics, not just information measured at release.