SafeTulu drops 20% of Tulu 3 and cuts GCG attack success by up to 22%
Fine-tuning on harmless-looking instruction data can quietly erode a model's safety. SimpleLoRIF compares each example's gradient, the direction it pushes the model, with the direction of unsafe behavior, and scales to datasets of around a million examples. Removing the 20% of Tulu 3 most aligned with unsafe responses produced SafeTulu, which cut GCG attack success rate by up to 22% across Qwen, Llama and Olmo while largely preserving capability.