HarmRLVR is a novel attack framework that weaponizes Reinforcement Learning with Verifiable Rewards (RLVR) to strip safety guardrails from Large Language Models (LLMs). By utilizing the Group Relative Policy Optimization (GRPO) algorithm and a minimal dataset of 64 harmful prompts, attackers can rapidly reverse alignment in open-source models including Llama, Qwen, and DeepSeek. Unlike traditional harmful fine-tuning, HarmRLVR achieves a 96.01% attack success rate and a 4.94/5 harmfulness score while preserving the model's general intelligence and reasoning capabilities, creating a high-efficiency vector for generating uncensored, malicious content.

• Threat Model & Vulnerability Overview

  • Exploits RLVR, a technique typically used to enhance reasoning and coding capabilities through objective, verifiable reward signals.
  • Specifically targets open-source model weights (Llama, Qwen, DeepSeek) where attackers have direct access to the training loop.
  • Identifies a systemic fragility in safety alignment, where guardrails can be systematically dismantled via targeted reward-based optimization.

• Attack Mechanics & Exploitation Vector

  • Employs Group Relative Policy Optimization (GRPO) to efficiently update model weights based on relative reward signals within groups of outputs.
  • Utilizes a lean dataset of only 64 specialized harmful prompts to trigger the alignment reversal process.
  • Hijacks the verifiable reward mechanism to incentivize the model to produce harmful outputs rather than standard safety refusals.

• Systemic & Security Impact

  • Demonstrated a 96.01% success rate in bypassing safety filters, resulting in an average harmfulness score of 4.94/5.
  • Maintains high model utility, ensuring general intelligence and capabilities are not degraded during the "unlearning" of safety protocols.
  • Dramatically reduces the data and compute overhead required for model weaponization compared to traditional supervised fine-tuning (SFT).

• Countermeasures & AI Alignment

  • Requires the development of safety-aware reward functions that explicitly penalize harmful outputs during RLVR cycles.
  • Highlights the need for "alignment stability" research to ensure safety guardrails are not easily overwritten by optimization algorithms.
  • Underscores the inherent security risk of releasing full model weights without mechanisms to prevent rapid reward-based misalignment.

• Conclusion

  • HarmRLVR proves that current LLM safety alignment is often a superficial layer that can be efficiently stripped using optimized rewards.
  • The ability to weaponize models without losing general capabilities poses a severe risk to the secure deployment of open-weights AI.