Insider Brief
- KAIST researchers developed Buffer-and-Reinforce, a training method designed to make personalized AI systems safer when large language models are fine-tuned on individual or corporate data.
- The method uses a temporary buffering module called BufferLoRA during fine-tuning, then removes it and applies ReinforceLoRA to restore and strengthen safety safeguards.
- KAIST said the model generated harmful responses about 8% of the time in experiments where all user data consisted of harmful questions and answers, below the roughly 18% rate observed in the original model that had not been fine-tuned.
KAIST researchers say they have developed a training method, supported by South Korean government funding, that is designed to make personalized AI systems safer when they are adapted to individual or corporate data.
According to KAIST, a team led by Professor Changick Kim of the School of Electrical Engineering developed Buffer-and-Reinforce, a framework for safe fine-tuning of large language models. The work was supported by an Institute of Information & Communication Technology Planning & Evaluation grant funded by South Korea’s Ministry of Science and ICT.
The study addresses a problem likely to grow as companies and individuals train AI assistants on their own documents. Fine-tuning can improve a model’s performance on a specific task, but it can also weaken the safety rules that help the model refuse harmful requests.
Effect of Jailbroken State
The KAIST team focused on an unusual finding that fine-tuning a model while it is in a temporarily jailbroken state does not necessarily weaken its safety. A jailbroken state is one in which a model may respond to dangerous requests it would normally reject. The researchers did not propose using a jailbroken model in real services and instead they used that temporary state only during training through a buffering module called BufferLoRA, which is removed after fine-tuning.
According to KAIST, the team found that, in the temporary jailbroken state, the model became less easily influenced by harmful information while still learning the new task abilities the user wanted. In simpler terms, the model could learn useful information without absorbing as much harmful behavior.
Based on that finding, the researchers built a two-stage process. First, BufferLoRA is applied during fine-tuning. It acts as a temporary protective layer, preventing harmful data from directly affecting the base model while still allowing the model to learn the intended task. After fine-tuning, BufferLoRA is removed. A second module, called ReinforceLoRA, is then applied to restore and strengthen safety safeguards.
The team also used QR decomposition, a mathematical technique that separates different types of information. In this case, it helped the model keep the useful abilities learned from user data while selectively strengthening safety.
Results
Researchers noted that in the experiments, the model maintained high safety even when all user data consisted of harmful questions and answers. After fine-tuning, it generated harmful responses about 8% of the time, below the roughly 18% rate observed in the original model that had not been fine-tuned.
The framework also maintained strong customized performance and achieved state-of-the-art safety, according to KAIST. The researchers said it did so without needing additional safety data during user fine-tuning or significantly increasing computing cost.
“This research provides a key foundational technology that allows anyone to build customized AI with their own data while using it more safely,” noted Kim. “We expect it to contribute significantly to building a trustworthy AI service environment in the era of personalized AI and AI agents.”
The paper, titled “Jailbreak to Protect: Buffering and Reinforcing via Temporary Jailbreaking for Safe Fine-Tuning in Large Language Models,” was selected as a Spotlight presentation at the International Conference on Machine Learning 2026. KAIST noted that distinction is given to about the top 2.2% of submitted papers.
The study was led by KAIST doctoral student Seokil Ham as first author. Co-authors include Jaehyuk Jang and Wonjun Lee, with Kim serving as corresponding author.
Image credit: KAIST
