The post-training method, not the data, decides how refusal is computed.

Comparing SFT, reasoning-augmented fine-tuning on safety-justifying chains, and ORPO across Llama-3.1-8B, Gemma-2-9B and Qwen3-8B, the training method reshapes the internal refusal computation, with reasoning-augmented training producing a distinct circuit visible in all three models. None of the three methods achieves all of: refusal not concentrated in a few fragile components, safety gains that don't cost capability, and behavior correctable through small targeted edits. The authors explicitly caution against treating current post-training as a solved defense for security-critical use. arXiv 2609.03887