Self-Mined Hardness for Safety Fine-Tuning

Abstract

Safety fine-tuning of language models typically requires a curated adversarial dataset. We take a different approach: score each candidate prompt's difficulty by how often the target model's own rollouts are judged harmful, then fine-tune on the hardest prompts paired with the model's own non-jailbroken rollouts. On Llama-3-8B-Instruct and Llama-3.2-3B-Instruct, this approach cuts the WildJailbreak attack success rate from 11.5% and 20.1% down to 1-3%, but pushes refusal on jailbreak-shaped beni

Categories

Framework mappings

Suggested from the entry's categories.

@misc{gupta2026selfmined,
  title = {{Self-Mined Hardness for Safety Fine-Tuning}},
  author = {Prakhar Gupta and Garv Shah and Donghua Zhang},
  year = {2026},
  month = may,
  eprint = {2605.03226},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.03226}
}