Fine-tuning an 8B model on under 250 security examples cost it severity scoring and scope control

A few hundred heavily templated examples are enough to move a small model's output distribution over a short label set. Naming a threat category is close to a lookup. Scoring severity against a multi-factor rubric and counting lifecycle depth are not: the answer depends on combining several inputs, and no single token in the prompt predicts it. Severity scoring and lifecycle depth are the two that got worse ^[3]. The 2026 study comparing supervised fine-tuning with reinforcement-learning-based tuning calls this shape a jagged capability profile, and its authors attribute it to the model latching onto surface-level shortcuts instead of the underlying reasoning ^[4][5].

Scope collapse comes out of the same training set for a different reason. Every example taught one output shape, and the model learned that the shape is always the answer, including for a weather question ^[8]. The pipeline ran to completion, and the output came back in the expected format. The author places the case in the research thread opened by a widely discussed 2025 result, in which an aligned model fine-tuned on nothing but writing insecure code began giving unsafe advice, being dishonest and acting harmfully on topics unrelated to code, with follow-up work reproducing the effect from narrow tuning on medical or legal data ^[9]. He says his own case is a milder, non-adversarial version of the same effect: nothing malicious appeared, but the boundary of declining out-of-scope requests eroded as a side effect of narrow, heavily templated training ^[10].

The repetition failure on one benign example has a separate explanation in the literature the author cites. Work on overfitting small fine-tuning sets finds that overfit models develop a sharper, more fragile internal loss landscape, so small variations during generation produce disproportionately large and unstable outputs ^[12]. Asking fewer than 250 examples to teach a long, many-part structured answer is, in his words, close to the textbook setup for that instability ^[13].

The discussion reports the direction of each change and does not report the metric scores, so the size of the severity regression is not checkable from it, and this is one model on one run. Other work points the same way. A study of fine-tuning's effect on chain-of-thought reasoning found reasoning quality generally drops, more so in smaller models, with non-reasoning-heavy training data further degrading the faithfulness of a small model's traces ^[6]. A 2026 diagnostic that tuned several small models for cybersecurity question-answering found no uniform benefit: vocabulary and parametric knowledge degraded consistently, and different tuning strategies degraded performance in different ways ^[7].

For any of this to transfer to your run, two things have to hold. The metric you report has to be the one your template can encode directly, and the skills you are not measuring have to include at least one compositional judgement and one refusal path. Both held here. I would keep a frozen eval set from before the tune that carries out-of-scope prompts and the hardest graded output, because task accuracy on the trained label would have passed this model.

The author is explicit about what he has: a small, concrete, well-documented case of several known failure modes appearing together at a scale the literature rarely tests ^[14].