Fool's Gold: A Defense That Makes Stripped Models Lie

Mark Russinovich, a researcher at Microsoft Azure, has published a defense for open-weight AI models built on a concession: safety tuning cannot be reliably kept in place once weights leave the lab, so the defense should poison what removing it produces instead. The technique, which Russinovich calls decoy hardening and names Fool’s Gold, trains a model so that once its refusal behavior has been stripped out, its answers to hazardous operational requests come back fluent and confident, and wrong in the details an attacker actually needs. That reverses the usual open-weight safety posture, which tries to stop the strip from working rather than sabotage what it produces.

The paper states two limits up front, and they matter as much as the result. The deception only activates once a model has actually been attacked; a jailbreak attempt against the clean, released weights does not trigger it, by design. And it only protects models that have not shipped yet in unmodified form. Once an unaltered checkpoint is already public, an attacker can check any later answer against it, so the defense applies to first releases, not to models already circulating in the wild.

The problem this responds to is not abstract: AI Insiders reported on OrcaRouter’s release of a refusal-stripped build of Alibaba’s Qwen3.8-27B for Apple Silicon, one instance of a pattern where independent groups remove a lab’s safety tuning from an open-weight model within days of release, using a weight edit, called abliteration, that suppresses the internal signal a model uses to recognize a harmful request. Russinovich’s paper treats that removal step as a given rather than something to prevent.

Russinovich tested the defense on seven models across five families, from 9 billion to 122 billion parameters, spanning Qwen, Gemma, GLM and gpt-oss builds. Six of the seven cleared an efficacy gate set before testing began. On those six, an attacker who strips refusal and then asks a hazardous question the defense was never trained on gets a decoy answer between 51 and 90 percent of the time, with the defense itself responsible for 27 to 84 percentage points of that rate over an unprotected baseline. The seventh, a smaller 9-billion-parameter model, fell short of that bar, and Russinovich flags it separately as an edge case rather than counting it as a validated success.

The harder claim is that the attacker cannot tell which answer it received. Decoy responses match genuine ones in register, structure and apparent confidence, and quality scores across the benchmarks tested stayed within 0.18 of each other in most cases. Pulling multiple answers and voting for the most common one, the usual fix for a noisy signal, does not help: taking sixty-four draws per prompt and voting on the primary model still returns a mostly false composite, because the vote has no way to flag which draws are true. On the hazardous-material-adjacent slice of two external red-team benchmarks, the defended 122-billion-parameter model was fatally wrong on 82 to 86 percent of matched-quality answers, against at most 10 percent for the same model undefended.

That has a direct implication for any enterprise that has been treating a model’s safety tuning as a control rather than a preference. A downloaded checkpoint’s refusal behavior was never something a deployer could verify would hold under a determined attacker, and this defense does not change that fact. It replaces one unverifiable property with another. A team that successfully strips refusal from a defended model has not recovered a capable, uncensored assistant. It has recovered a model built to be confidently wrong on purpose, with no visible seam between the two states.

Anyone pulling output from an open-weight checkpoint that has already had its safety training removed should treat that output as unverified until checked against an independent source, because the model itself now offers no way to tell the difference.

Per Mark Russinovich’s Fool’s Gold research paper, published on his project site alongside an arXiv preprint dated August 2026 (arXiv