Comment by Kevin Kuo

In this paper, we show that open-weight safeguards are susceptible to simpler strategies that, despite being well known, have not been systematically evaluated against these safeguards. Specifically, we evaluate two low-cost attacks--abliteration and prefilling--that do not rely on gradient-based optimization. Across three harmfulness evaluation benchmarks, these attacks increase attack success rates against safeguarded open-weight models from below 10% to a range of 16%-96%.