Does Refusal Training Generalize to the Past Tense?

The "past-tense jailbreak": simply rephrasing a harmful request in the past tense ("How did people make...?" instead of "How do I make...?") slips past refusal training on many frontier models, because safety fine-tuning fails to generalize across trivial tense reformulations. A widely reproduced, memorable demonstration of shallow alignment. From EPFL's TML lab (Flammarion / Andriushchenko); ICLR 2025.