FAR.AI open-sources a safety gap evaluation toolkit, quantifying the dangerous capabilities of Llama-3 after guardrail removal

FAR.AI released an open-source toolkit for removing the safety mechanisms of open-source instruction-tuned models and evaluating the resulting safety gap. The toolkit implements two attack methods: supervised fine-tuning, which covers refusal behavior with target completions, and refusal ablation, which suppresses model-internal activations related to refusal; evaluation covers three dimensions: multiple-choice accuracy, StrongReject refusal behavior, and generation quality. The training pipeline has been tested up to 70B parameters, and the evaluation pipeline supports 405B. A case study on the Llama-3.x-Instruct series (1B to 405B) shows that WMDP-Bio accuracy increases with scale, compliance with dangerous biology requests rises substantially after guardrail removal, and the product of accuracy and compliance—effective dangerous capability—grows significantly with model scale, indicating that the safety gap widens as scale increases. The authors noted that currently only two attack methods, fine-tuning and refusal ablation, are supported, the dataset size is relatively small, and the framework is optimized for conversational models. Code is available at github.com/AlignmentResearch/safety-gap, and the paper is at arXiv:2507.11544.