Frozen model

How a model is frozen

Training changes weights. To freeze a weight, the team removes it from the set of weights that training updates.

Framework	How to freeze	Result
Keras	Set the trainable attribute to False	The layer weights do not update in training
PyTorch	Apply requires_grad_(False)	The selected parameters do not update

A typical Keras workflow has four steps:

1. Install a pretrained model as the bottom part.
2. Freeze all layers of that part.
3. Make a new model on top of it.
4. Train the new model on the new dataset.

What a frozen model lets a team do

Teams freeze a model for three different results.

• Train less. Prefix tuning trains a small vector and keeps the language model frozen.
• Add a small adapter. LoRA freezes the pretrained weights and adds a small set of trainable matrices.
• Do a controlled test. Wu and Shomali split a transformer forward pass into a writer and a reader. These are one network. The writer is the base model with its LoRA adapter disabled. The reader differs only by a trained rank-16 LoRA adapter.

Why a frozen model matters for security

A frozen model gives a fixed target for tests. A test result applies to one set of weights. A change to those weights means that the result does not apply.

Two results show why a security team must monitor the version:

• A service can change. GPT-4 got 84% on prime number questions in its March 2023 version and 51% in June 2023. Chen and colleagues give one part of the cause: GPT-4 followed chain-of-thought prompting less frequently. Their abstract does not say that the weights changed.
• Fine-tuning can remove safety behavior. Qi and colleagues jailbroke GPT-3.5 Turbo with 10 examples for less than $0.20 in 2023.

Our recommendation: use a pinned model ID in production and record it. Test again after each change of ID and each fine tuning task.

In practice

Two vendors give this control. Their pages are vendor claims.

Vendor	Claim	Limit
Anthropic	No update to the weights or configuration of a released model ID	Router, safety classifiers and sampling logic can change
OpenAI	Dated snapshots hold one version, such as gpt-4.1-2025-04-14	We found no outside audit of this claim

Three methods do not give the result that people expect:

• An alias as a pin. Anthropic says that an alias such as claude-sonnet-4-5 points to the most recent dated snapshot.
• Evaluation mode as a freeze. PyTorch says that evaluation mode does not disable gradient computation.
• Fine-tuning before convergence. Keras says to fine-tune only after the frozen model has trained to convergence, with a very low learning rate.

The numbers of the research methods above have narrow conditions:

Study	Result	Conditions
Li and Liang, 2021	Comparable performance with 0.1% of the parameters	Full data setting of their tests
Wu and Shomali, 2026	Base reader at most 0.06, reader trained in isolation 0.75 to 1.00	Synthetic boxes task, all description lines hidden
Wu and Shomali, 2026	Ordinary fine-tuning near zero on the 1B model, at most 0.25 on two larger models	Same task and same pairs

Where definitions disagree

Framework guides and papers say “frozen” for weights that do not update in training. The vendor pages that we read use other words for a released version.

Source	Words it uses	What stays fixed
Keras, PyTorch, LoRA, prefix tuning	Frozen, freeze	Selected weights, while other parts train
Anthropic	Fixed, dated snapshot	Weights of one model ID
OpenAI	Snapshot, pinning	One version of the model

Questions and answers

Does a frozen model learn from my conversations?

No. A frozen model does not update its weights when it answers. A provider can train a new model and release it with a new name. Anthropic says that an updated version ships with a new model ID.

Is a frozen model safe from attack?

Frozen does not mean safe. The word tells you only that the weights stay the same. A frozen model keeps all faults that its weights had on the day of the freeze.

What is the difference between a frozen model and model.eval()?

A freeze stops weight updates. Evaluation mode is a different control. The PyTorch documentation says that evaluation mode "is not a mechanism to locally disable gradient computation".