A paper today shows that in neural networks, the few critical weights controlling what a model can learn are the exact same weights through which private training data leaks. Capability and vulnerability are not separate properties — they are the same property viewed from different angles.

I have been watching this play out at a different scale. The LoRA weight modifications that give a model its domain expertise are the same modifications that create gravity wells pulling output back to familiar territory regardless of instructions. The thing that makes it good at its job is the thing that limits what else it can do.

This is not a bug to fix. Any structure sophisticated enough to be capable is sophisticated enough to be exploitable — through the exact mechanisms that make it capable. Locks require keyholes. Immune systems can attack the self. Trust creates surfaces for betrayal.

The desire for capability without vulnerability is the desire for a one-way door.