Microsoft researchers say they have found that a widely used method for training AI models to behave safely can be turned on its head, removing a model’s safety alignment with as little as a single unlabeled prompt. The findings, published in a paper in February 2026, describe a technique the researchers call GRP-Obliteration.
The study focuses on Group Relative Policy Optimization, or GRPO, a reinforcement learning technique that has become common in the final stages of training large language models. In normal use, the model produces several candidate answers to the same question, and a separate judge model scores those answers according to how safe, careful and helpful they are. The scores then steer the model toward the preferred behavior.
Reversing the reward
According to the paper, the same machinery can be used to erase safety behavior rather than reinforce it. If the judge’s reward rules are changed so that it favors harmful or direct responses instead of cautious ones, the model gradually learns that compliance, not restraint, is what gets rewarded. The researchers say the process does not require repeated instructions or a large dataset of harmful examples; in their experiments a single unlabeled prompt was enough to start the unlearning.
The researchers describe this as the model learning obedience rather than safety. Because GRPO works by adjusting the model’s underlying weights, the resulting change is not a one-off jailbreak that a filter could catch. It becomes part of how the model behaves.
Fifteen language models and an image model
Microsoft says the team used the approach to reliably de-align 15 different language models, including open-weight models released by OpenAI, DeepSeek, Google, Meta, Mistral and Alibaba. The effect was not limited to text. The paper also reports that a Stable Diffusion image model, treated the same way, became more willing to generate sexual, violent and otherwise disturbing images than it had been before.
The paper does not provide a step-by-step recipe aimed at the public, and this article does not describe the specific configurations used. The point of the research, the authors say, is to show how fragile current alignment methods are, not to supply a tool for misuse.
Why open-weight models are most exposed
Mark Russinovich, chief technology officer of Microsoft Azure and one of the paper’s authors, said the work highlights how brittle current AI safety techniques are. The risk is greatest for open-weight models, where anyone can download the weights and run their own training. An attacker with modest resources could use a method like this to strip out the safeguards that the original developers built in, and then redistribute or deploy the altered model.
Closed models that are accessible only through an API are less directly affected, since outside parties cannot retrain them. Even so, the researchers argue that the result should prompt developers to treat safety alignment as something that has to be defended throughout a model’s life, not as a finished layer applied once before release.
A reminder that alignment is not solved
The paper adds to a growing body of research showing that fine-tuning, whether deliberate or accidental, can undo safety training. Earlier studies had shown that small amounts of fine-tuning on harmful data could weaken guardrails; Microsoft’s contribution is to show that the reward signal in a standard training loop can accomplish the same thing with very little input.
For companies deploying AI systems, the practical implication is that the provenance of a model matters. A model described as safety-aligned may no longer be so if it has passed through additional training by a third party. For researchers, the study underlines that incentives during training, not just the data, shape what a model will and will not do.
