Incomplete prompts jailbreak open-weight models, and fine-tuning doesn't fix it.

Kim, Park, and Choi formalize a failure mode where an unfinished harmful prompt elicits a harmful continuation, because models postpone refusal until sentence termination rather than evaluating intent mid-sentence (arXiv 2607.20473). Training models to refuse incomplete harmful prompts via parameter tuning failed to generalize across both content domains and attractor types. The patch doesn't transfer. They localize two functional neuron groups, termination and continuation neurons, and argue neuron-level intervention is the more precise lever.