Removal Cost as a Measurement Axis for Open-Weight Language Model Safety

Evaluation of language-model safety is often treated as a static behavioral measurement: does the model refuse a risky request before release? Open-weight deployment violates this framing. Once weights are released, downstream actors can strategically optimize against the measured behavior through fine-tuning, adapter removal, ablation, wrapper bypass, and repair. We propose removal cost as a measurement axis for open-weight language-model safety: how hard is it to remove safety while preserving utility, coherence, benign helpfulness, and attack stability? We instantiate this measurement lens through Mycelium, a removal-cost prototype and audit suite for open-weight LLMs. Across Mistral-7B, Qwen-35B-A3B, Gemma-31B, and GPT-OSS-20B benchmark slices, the defended state remains close to native utility on average, while removal causes mean utility drops of -0.310, -0.374, -0.185, and -0.280. A removal-control audit shows that adapter-only safety removal can damage utility even without base-path attenuation. However, a wrapper-bypass proxy preserves utility and raises a red-prompt strict ASR proxy from 0.083 to 0.583. The measurement conclusion is the main result: refusal rate alone is an incomplete safety construct for open-weight models; evaluations should report whether safety removal remains costly under explicit post-release tampering budgets.