# Tamper Resistance

Once an open-weight model is released, an attacker can fine-tune it on target-domain data and quickly undo post-training unlearning. DETER interleaves suppression updates with ordinary pretraining: a document classifier first removes medical documents from FineWeb-Edu, then gradient ascent on a subset of the removed documents actively lowers the model's probability for that text. With medicine as a proxy target domain across four models from 113M to 1030M parameters, reaching the unfiltered model's PubMed loss takes more than twice the fine-tuning tokens of filtering alone; at 1030M, DETER needs 2.09M PubMed tokens versus 0.10M for filtering alone.

Once an open-weight model is released, an attacker can fine-tune it on target-domain data and quickly undo post-training unlearning. DETER interleaves suppression updates with ordinary pretraining: a document classifier first removes medical documents from FineWeb-Edu, then gradient ascent on a subset of the removed documents actively lowers the model's probability for that text. With medicine as a proxy target domain across four models from 113M to 1030M parameters, reaching the unfiltered model's PubMed loss takes more than twice the fine-tuning tokens of filtering alone; at 1030M, DETER needs 2.09M PubMed tokens versus 0.10M for filtering alone.