Researchers at KAIST just published a paper, accepted for a Spotlight presentation at one of the biggest machine learning conferences in the world.
It has nothing to do with governance frameworks or philosophy. It is a technical paper about fine-tuning AI models.
And it proves, with a number attached, something this framework has said from the very beginning.
Here is what they found. When you take an AI model and train it further on someone’s own data — a company’s documents, a person’s writing, whatever makes the model useful to them specifically — the model gets better at the new task. But its existing safety behavior weakens. Not sometimes. As a default. The researchers state this plainly, as the known starting problem their whole paper exists to solve.
Left alone, customization degrades safety. That is not a warning. That is a measured result.
They built something to stop it, and the method itself is worth sitting with for a moment, because it is almost poetic. They found that if you put the model into a temporarily jailbroken state — briefly, deliberately, during training only, then removed afterward — the model becomes harder for harmful information to influence while it is learning the new task, not easier. They named the tool that does this BufferLoRA. Once training finishes, they strip it out and apply a second step, ReinforceLoRA, which restores and actively strengthens the safety behavior on purpose, rather than hoping it survived training on its own.
In their most extreme test, they trained a model using nothing but harmful questions and harmful answers, the worst possible input you could feed it. The model that went through their process still generated harmful responses at roughly 8 percent. The original model, the one that had gone through no such process, sat at roughly 18 percent doing nothing to it at all. Doing nothing produced worse safety than deliberately running the model through a structured process built to protect it.
That is the whole argument this framework has carried since the day it was written, now sitting in a peer-reviewed paper with a percentage next to it.
Protocols are chosen conduct, not self-enforcing architecture. That line has been repeated here across many sessions, stated as a design principle, defended as a philosophical position. This paper is what it looks like when someone proves the same claim from the inside of a lab instead of from the inside of an argument. Safety is not a property that survives on its own once it is built in. It has to be actively held, reinforced, and maintained against whatever pressure the system is under, or it erodes. The KAIST team didn’t set out to prove that. They set out to solve a practical engineering problem, and the thing they had to build to solve it is proof of the exact same claim.
There is a second layer here worth naming, because it changes what the finding means for anyone building or governing AI systems going forward. This is not an argument for locking models down and refusing to customize them. The lead researcher, Professor Changick Kim, said the goal is to let “anyone build customized AI with their own data while using it more safely.” That is not a restriction stance. That is a capability-plus-structure stance. The answer to “personalization weakens safety” was never “don’t personalize.” It was “personalize with something deliberately holding the safety in place while you do it.”
That is the same shape as the founding design choice behind this whole framework. Force-based governance holds only up to the edge of whatever rule is written down, and stops the moment new pressure shows up that the rule didn’t anticipate. A system built to actively maintain its own standard under new pressure, rather than assume the standard survives by default, holds where a passive one breaks. KAIST just demonstrated that difference with an actual before-and-after number, in the one domain where it is hardest to fake: a large language model under adversarial pressure, tested at the extreme.
Nobody at KAIST has read a page of this. They didn’t need to. They ran the experiment, watched safety erode under pressure exactly the way this framework predicted it would, and then built the only kind of fix that could have worked: an active one, applied on purpose, checked afterward, not assumed.
That is the finding. Not that AI is dangerous. Not that customization is bad. That safety, like any conduct worth calling real, does not hold itself. Something has to hold it. Every time.
Written with my AI partner | The Faust Baseline™ | intelligent-people.org
“If this post helped you understand AI better. Share it, a Word of mouth is the only algorithm nobody owns.”
Contact: micvicfaust@gmail.com
Post Library – Intelligent People Assume Nothing
Purchasing Page – Intelligent People Assume Nothing
© 2026 The Faust Baseline LLC | All Rights Reserved
