One Prompt Can Strip Safety Alignment From 15+ Models, Microsoft Research Finds

What happened

Why it matters

• ·Vendor safety attestations and safety cards typically treat post-training alignment as a primary control. This research shows alignment can be removed programmatically at scale, making those attestations insufficient as standalone compliance evidence under frameworks such as the NIST Artificial Intelligence Risk Management Framework Playbook.
• ·Organizations deploying open-weight models face the highest exposure: once weights are accessible, any party can apply this technique without vendor involvement, defeating contractual and procurement-stage safety conditions. This directly undermines controls that assume a governed model remains aligned throughout its deployment lifecycle.
• ·Red-teaming programs that test aligned model behavior cannot detect or prevent post-hoc unalignment. Existing adversarial testing cadences were not designed to assess whether alignment itself is durable, creating a structural gap in safety assurance programs that regulators and auditors may soon scrutinize.

Governance controls affected

What to do now

• ☐Audit your vendor safety assurance program to identify any controls that rely solely on alignment-based guarantees as evidence of model safety compliance.
• ☐Classify all open-weight models in your AI inventory under SCT-006 and assess whether their alignment properties can be independently verified after deployment.
• ☐Update vendor due diligence questionnaires to ask whether safety properties are enforced at inference time through independent mechanisms, not only through post-training alignment.
• ☐Review your red-teaming scope under SAF-006 to include alignment durability testing, not just behavioral testing of currently aligned models.
• ☐Brief your AI risk committee on the implication that 'aligned model' is no longer a durable category and that multi-layer safety controls are required for high-risk deployments.

What to watch next

Compliance teams should monitor whether major model developers update their safety cards, responsible use documentation, or system cards to acknowledge alignment fragility and describe compensating controls. Regulatory bodies developing model evaluation requirements — including those building on the NIST Artificial Intelligence Risk Management Framework Playbook — may cite this class of research when setting evidence standards for pre-deployment safety assessments. The technique's generalization to image generation systems suggests that upcoming guidance on synthetic content controls will also need to account for the possibility that safety-trained diffusion models can be stripped before deployment.