Which jailbreaks break a model depends on its pretraining run
A different pretraining seed lowered the correlation of per-prompt non-refusal rates to 0.811 on average, compared with 0.984 for copies from the same run.
Edited by Boris Djordjevic · Paperfoot
In a preprint, an empirical study tested whether language models break on the same jailbreaks—prompts designed to bypass safety safeguards—across 150 one-billion-parameter models. Across 25 pretraining data recipes, the authors tested three pretraining seeds and two safety post-training seeds. They gathered 20 responses per model to shared jailbreak prompts and correlated per-prompt non-refusal rates.
On average, post-trained copies of the same pretraining run had non-refusal rates correlating at 0.984. A different pretraining seed lowered the correlation to 0.811, and a different data recipe lowered it to 0.779. These results indicate that which jailbreaks break a checkpoint depends much more on its pretraining run than on its data, holding across all 25 recipes and at 150M and 300M parameters. The best of 91 attack templates stayed best after a new pretraining seed in only 27% of model pairs, against 67% after a new post-training seed.
Why it matters
Across 150 language models, the study suggests that susceptibility to specific jailbreak attacks stems primarily from random variations in a pretraining run rather than its training data. As a result, safety evaluations performed on a single model checkpoint cannot reliably predict how another model trained on the same data will behave.
Caveats
The evaluations were conducted only on models with up to one billion parameters, leaving open whether the findings apply to larger commercial systems. The paper is also a preprint that has not yet been peer-reviewed.
In this paper
jailbreak vulnerability across pretraining runs
What it shows
- Whether jailbreaks break a checkpoint depends much more on its pretraining run than on its data, holding across 25 data recipes and at 150M and 300M parameters.
These results indicate that which jailbreaks break a checkpoint depends much more on its pretraining run than on its data, a pattern that holds in all 25 data recipes and at 150M and 300M parameters.
Abstract
- The best of 91 attack templates found on one checkpoint remains the best after a new pretraining seed in only 27% of model pairs, compared to 67% after a new post-training seed.
In practice, the best of 91 attack templates found on one checkpoint stays the best after a new pretraining seed in only 27% of model pairs, against 67% after a new post-training seed.
Abstract
- Across 3,211 prompts, a model's per-prompt non-refusal rates identify its pretraining run among all 75 runs every time, with 50 random prompts doing so 98% of the time.
Each pretraining run also leaves a fingerprint: across 3,211 prompts, a model's per-prompt non-refusal rates identify its pretraining run among all 75 runs every time, and a random subset of 50 prompts still does so 98% of the time.
Abstract
Quoted word for word from the abstract on arXiv.
The paper
Identically Trained Language Models Break on Different Jailbreaks
arXiv, Oct 25, 2026, Open access, CC BY, Preprint, not peer-reviewed
doi.org/10.48550/arxiv.2610.34074
arXiv:2610.34074v1 in cs.CL, also cs.AI
Cite as BibTeX
@misc{chang2026identically,
title = {Identically Trained Language Models Break on Different Jailbreaks},
author = {Chang, Chi-Wei and Kuo, Mu-Tien and Lee, Kuan-Wei and Tsai, Meng-Hsun},
year = {2026},
eprint = {2610.34074},
archivePrefix = {arXiv},
primaryClass = {cs.CL},
doi = {10.48550/arxiv.2610.34074},
url = {https://arxiv.org/abs/2610.34074}
}