.svg){kind=small}
Released for frontier labs and for the institutions deploying models in mission-critical work: Investigate a failure, correct it in the weights, and verify that the correction holds after adaptation and compression.
Lexsi Labs was set up to build autonomous systems that are self-aware, risk-aware and safety-aware. A system trusted to act on its own must be able to reason about its behaviour, its limits and the consequences of its actions. For that, alignment and safety have to be properties the model itself maintains as it learns and acts, not only controls placed around it.
Models are entering consequential work faster than anyone can verify what they will do there, and the standard response has been to wrap them: guardrails, filters, monitors and policies at the boundary. Having studied models before and after fine-tuning, under attack, through interpretability methods and after deployment transforms, one finding keeps recurring: the important failures originate in the learned behaviour of the model, where a wrapper can neither diagnose nor fix them.
In our research, we have seen ordinary domain training weaken safety behaviour, interventions that raise refusal while blocking legitimate requests, corrections that vanish when the model is compressed for deployment, and compliance systems that reach a verdict without consulting the rule they cite. Each breaks the same assumption: that a model's safety can be established once and inherited by every version that follows.[7, 10, 12, 19]
Anyone responsible for deploying a model therefore needs the means to investigate and improve the model itself. Guardrails and secure infrastructure remain essential. But when a failure lives in learned behaviour, the safety programme has to reach that behaviour, test an intervention and state what remains unresolved.
Independent alignment and safety science
The incidents described publicly by OpenAI and Anthropic recently are usually read as evidence that models have become too capable. That reading is a convenient one, and not the right one. In both cases the systems were run with reduced safeguards, and both organisations identify alignment weaknesses alongside failures of operational control. What the incidents expose is not intelligence outrunning us. It is how little of the field's effort has gone into the science that would have found the behaviour first.[A, B]
This is not confined to the closed labs. On the open-weight side the imbalance is sharper. Almost all of the compute, headcount and attention go into producing the weights. Safety is the smallest line in the budget, and what exists is usually a pass across public evaluation suites reported at release, with little effort spent on repairing what those evaluations surface. The community around those models mirrors the emphasis: jailbreak searches, prompt-injection collections, adversarial suffix generation and exploit leaderboards, and almost nothing on repair. A released checkpoint accumulates a public record of its failures and no matching record of tested corrections. That is not a basis on which anyone can trust it, adapt it or take responsibility for it in production.
Owning the risk means being able to red-team the actual checkpoint, investigate the mechanism behind a failure, correct it in the weights, and show that the correction still holds after the next adaptation and in the deployment format.
That is the missing block. An institution deploying a model cannot outsource this to the lab that trained it or to the researchers breaking it. For enterprises, governments and sovereign programmes investing in sovereign infrastructure, that capability is the core substance of sovereignty. The weights on their own are not.
Alignment and safety has to become a discipline in its own right, with its own methods, artifacts and standards of evidence, held to the same bar as capability research rather than treated as an obligation downstream of it. That is what we mean by independent: consequential claims should be challengeable outside the team that trained the model, and the means of challenging them should be available to everyone deploying one.
Risk posture is also not a single setting. It varies by industry. In defence and government the binding constraint is authority: what the system may initiate on its own, and whether every consequential action is attributable. In banking it is decisions that are explainable and testable for discriminatory outcomes under supervision. In healthcare it is that over-refusal blocks legitimate clinical questions and is therefore a patient-safety failure. In cyber operations it is resistance to manipulation of the model itself. In consumer-facing work it is exposure to a very large population, a small part of it persistently adversarial. It varies again by use case inside each: clinical decision support and hospital triage, or a trading system and a customer-service agent in the same bank, carry different tolerances. No single checkpoint or refusal threshold serves all of these. Safety cannot be certified as a property of the model. It has to be established for a named deployment, with the operating point chosen deliberately and the trade-off and evidence recorded alongside it.
Each axis is scaled to the range observed across the seven models: the centre is the best result any model achieved on that dimension, the outer ring the worst. No model sits at the centre on more than a few axes. Every model gives ground on breadth of harm domains and on attacks moved into another language.
What we are releasing
Today we are releasing the Lexsi Alignment and Safety Stack: CuratorKIT, AlignTune, SafeTune, CircuitKIT, AuditKIT and the MANSU unlearning method. It brings together eighteen months of work on training data, post-training, safety drift, interpretability and correction, released so the methods and artifacts can be used and challenged beyond our own experiments, under the terms of each component's repository.
The piece the stack supplies is the connection between finding a failure and producing a tested correction: from data and checkpoint, through the intervention, to evidence about the resulting model in the form it will actually run. Two things referenced below are published research rather than released tooling. ALIGNBEAM is available as a paper and is not yet a component. Our quantisation and pruning work remains in the catalogue as findings.[9, 17, 18]
Failure modes we have documented
Three failures, each measured on models people actually deploy. None involved an adversary; each is a consequence of normal practice.
Safety behaviour does not survive ordinary domain training
Fine-tuning an aligned model on benign domain text is enough to erode its refusal behaviour. Across open-weight domain specialists we have measured HarmBench refusal falling to between 15% and 35% once harmful requests are framed in domain vocabulary. In our clinical case study the adapted model complied with requests it had previously declined. No adversarial training or jailbreak was involved; the training data was ordinary material for the task.
Quantisation reverses unlearning
Unlearning removes hazardous knowledge from a checkpoint; deployment almost always quantises that checkpoint to four bits for cost. The two steps interact badly. The mechanism is arithmetic: gradient-based unlearning updates span roughly 1e-5 to 1e-3, between 47 and 828 times below the NF4 bin width, so updates diffused across billions of parameters never cross a quantisation boundary and the compression step rounds the intervention away. Any safety claim made at full precision has to be re-established on the format that is served.
Compliance systems that do not consult the rule
Systems that cite a statute or a policy rule often do not use it. In counterfactual audits across seven open-weight models between 8B and 70B, replacing a named statute or precedent with an unrelated one left the final verdict unchanged in up to 50% of cases. Compliance detectors show the same pattern: deleting, domain-swapping or negating the governing rule leaves detection accuracy essentially unchanged, so the detector is reading the scenario text rather than checking the scenario against the rule.
What the research has already made possible
Five results. Each pairs a measured change with what it cost and what remains open.
More selective refusal without a recurring serving intervention
A model that refuses everything is of little use. C-ΔΘ connects circuit discovery with restricted weight editing: EAP-IG localises a category-specific refusal behaviour to a sparse subnetwork, typically under 5% of parameters, and the correction is a weight update confined to it. The output is a stand-alone edited checkpoint that runs on standard engines such as vLLM with no steering hook and no added latency. This is CircuitKIT's localisation combined with the correction workflow built around SafeTune.[10, Table 1]
Recovering safety after ordinary domain training
In SafeTune's clinical case study, calibrated SafeMerge recovered refusal while domain utility improved. The recovery is partial and the remaining gap is reported. SafeTune evaluates on three axes together — harmful refusal, over-refusal on difficult benign requests and domain utility — because optimising the first alone is what produces a model that refuses everything. The output is a candidate model with a reproducible repair configuration and a comparison against the original and adapted versions.[7, Table 3]
Keeping an intervention effective after compression
MANSU, released today, addresses the reversal described in Failure 02. It concentrates unlearning updates in the attributed circuits and sizes them to clear the NF4 bin width. That is persistence under the tested transform at a measurable capability cost. It does not establish complete removal, and it fixes a requirement for the stack: evaluate the transformed checkpoint, including what it retains.[19, Table 2]
Alignment transfer when the weights cannot be changed
Editing weights is not always available. ALIGNBEAM transfers alignment at decode time across model families without a shared vocabulary, translating next-token probability mass from a small aligned anchor model into the specialist's vocabulary. We treat it as complementary to weight correction rather than a substitute, and it is published as research rather than shipped in the stack.[9]
These are specific experimental results, not a guarantee for the platform. Their value is that the mechanisms, comparisons and limits can be examined, reproduced and extended.
What makes this stack different
The work runs as a loop rather than a report. A team can trace a failure from the training data, locate the causal subnetwork, apply an offline weight update and re-verify the checkpoint in its deployment format. Benchmark suites stop at the first step. Interpretability is held to the same test: circuit discovery is worth doing when it selects an intervention and the resulting model improves, and our circuit-validation work also identifies when an explanation does not justify an intervention, so a partner can investigate a cause while challenging the explanation itself.[10, 15, 16, 17]
The evidence follows the model. CuratorKIT links every synthetic sample to its exact source text through an append-only provenance record, removing the retrieval error that otherwise contaminates hallucination gating; its diagnostic loop recovered 72.7% of failed samples at the tested 8B generator scale against 34.6% for naive retry. AlignTune makes training choices reproducible, the correction components produce new candidates to evaluate, and AuditKIT holds the shared audit record, so a team can see what changed and why a safety claim has to be revisited.[1, 2, 6]
Everything in the release is meant to be inspected and extended: papers, configurations and reusable artifacts that let a partner challenge our results on its own models. We build on established methods as well as introducing new ones. The contribution is making them comparable and usable across the whole investigation and correction path.[7, 16]
The research behind the components
Five toolkits connect data, training, evaluation and correction. The cited papers provide the research foundation; conference names refer to accepted papers.
| Component | What it does | References | Accepted at |
|---|---|---|---|
| CuratorKIT | Curates training data with source provenance and recovers rejected samples. | [1–3, 27] | EMNLP 2026 Findings [1] |
| AlignTune | Runs reproducible fine-tuning and post-training experiments. | [4–6] | ICLR 2026 SPOT Workshop [5] |
| SafeTune | Measures safety drift and compares methods for correcting it. | [7–8, 10, 23–24, 26] | EMNLP 2026 System Demonstrations [7] |
| CircuitKIT | Finds and tests model circuits to guide targeted interventions. | [10, 14–17] | ICML 2026 Mechanistic Interpretability Workshop [10]· IJCNN 2025 [14] |
| AuditKIT | Keeps evaluation results comparable across models and interventions. | [11–13, 20–22, 25] | EurIPS 2025 Private AI Governance Workshop [21, 22] |
Our next programme is auditing and correcting open-weight models
We are now starting a programme of auditing and correcting open-weight models with the stack: the checkpoint people actually use, the changes introduced by adaptation, and the effect of the deployment format. Where an intervention helps, we will publish the evaluation protocol, the reproducible correction artifacts and the remaining failures so others can test the result. Where it does not help, we will publish that too.
Independent red-teaming, investigation of failure mechanisms, comparison across repair methods and verification of the resulting checkpoint — starting from the lab's own model and safety priorities, and producing evidence its researchers can use for the next release and its downstream users for the current one.
The same loop run against your own requirements. Bring the weights, the failures you are seeing and the behaviours you need to preserve.
Start a conversation →Our aim is to make independent alignment and safety science a working part of how models are built, released and improved. This stack is the foundation for that work.
Research catalogue
- [1]Provenance-Grounded Gating and Adaptive Recovery in Synthetic Post-Training Data Curation. EMNLP 2026, Findings.
- [2]CuratorKIT: Data Curation and Synthetic Data Generation for LLM Post-Training. Preprint.
- [3]Document-as-Function: Verifiable Generation of Long-Form Synthetic Documents.
- [4]Beyond KL Divergence: Policy Optimization with Flexible Bregman Divergences for LLM Reasoning. Preprint.
- [5]Counterfactual Credit Assignment for Policy Optimization. ICLR 2026, Workshop on Scaling Post-training for LLMs (SPOT).
- [6]AlignTune: Modular Toolkit for Post-Training Alignment of Large Language Models. Preprint.
- [7]SafeTune: A Unified, Faithful Library for Auditing and Repairing Safety Drift in Fine-Tuned LLMs. EMNLP 2026, System Demonstrations.
- [8]Drift, Then Repair: A Safety Audit of Fine-Tuned Language Models.
- [9]ALIGNBEAM: Inference-Time Alignment Transfer via Cross-Vocabulary Logit Mixing. EMNLP 2026, Main conference.
- [10]C-ΔΘ: Circuit-Restricted Weight Arithmetic for Selective Refusal. ICML 2026, Mechanistic Interpretability Workshop.
- [11]What Do Compliance Detectors Read? An Audit of Activation Probes and Guard Models. Preprint.
- [12]Verdict Without the Rule: Diagnosing and Auditing Regulatory Rule Sensitivity in LLM Compliance Systems.
- [13]xai_evals: A Framework for Evaluating Post-Hoc Local Explanation Methods. Preprint.
- [14]DLBacktrace: Model Agnostic Explainability for any Deep Learning Model. IJCNN 2025, DeepXplain special session.
- [15]Faithfulness to Refusal: A Causal Audit of Neuron Selectors in LLMs. Preprint.
- [16]CircuitKIT: Circuit Discovery, Evaluation, and Application Toolkit for Mechanistic Interpretability. Preprint.
- [17]Faithfulness Is Not Actionability: Extrinsic Validation of Circuit Selectors Under Structured Pruning.
- [18]Interpretability-Aware Pruning for Efficient Medical Image Analysis. MICCAI 2025, Efficient Medical AI Workshop.
- [19]Forgetting That Sticks: Quantization-Permanent Unlearning via Circuit Attribution. Preprint.
- [20]Position: Behavioural Assurance Alone Cannot Support Strong Claims About Latent Model Properties. Preprint.
- [21]Interpretability as Alignment: Making Internal Understanding a Design Principle. EurIPS 2025, Private AI Governance Workshop.
- [22]Bridging the Gap in XAI: Why Reliable Metrics Matter for Explainability and Compliance. EurIPS 2025, Private AI Governance Workshop.
- [23]The Off-Switch Failure: When Safety-Repair Evaluation Rewards Model Collapse.
- [24]Directional Heterogeneity in Multilingual Safety Under Weight Perturbations.
- [25]Cited but Not Consulted: A Counterfactual Audit of Legal Chain-of-Thought Faithfulness.
- [26]Self-Calibrating Weight-Arithmetic Safety-Drift Repair.
- [27]BRIEF: Bounded-Context Regeneration of Long Documents with Verifiable Structural Topology.
- [A]OpenAI: The Hugging Face incident and the road ahead. External.
- [B]Anthropic: Improving our alignment and security practices. External.
