math.OCFeb 21, 2026

Limits of Convergence-Rate Control for Open-Weight Safety

Authors: Domenic Rosati, Xijie Zeng, Hong Huang, Sebastian Dionicio, Subhabrata Majumdar, Frank Rudzicz, Hassan Sajjad

Organizations: Dalhousie University · Vector Institute · Indian Institute of Management Bangalore

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Open-weight foundation models can be fine-tuned for harmful purposes after release, yet no existing training resistance methods provide theoretical guarantees. Treating these interventions as convergence-rate control problems allows us to connect optimization speed to the spectral structure of model weights. We leverage this insight to develop a novel understanding of convergence rate control through spectral reparameterization and derive an algorithm, SpecDef, that can both provably and empirically slow first- and second-order optimization in non-adversarial settings. In adversarial settings, we establish a fundamental limit on a broad class of convergence rate control methods including our own: an attacker with sufficient knowledge can restore fast convergence at a linear increase in model size. In order to overcome this limitation, future works will need to investigate methods that are not equivalent to controlling convergence rate.

Figures & tables

Figure 1: Convergence Rate Control: σ1(HθL)\sigma_{1}(H^{\mathcal{L}}_{\theta}) and convergence rate (iterations) is increased with σ1(θi)\sigma_{1}(\theta_{i})
 Start Acc10−610^{-6}5×10−65\times 10^{-6}8×10−68\times 10^{-6}10−510^{-5}3×10−53\times 10^{-5}
ELM0.204120 (0.607 ±\pm 0.008)33 ±\pm 5 (0.635 ±\pm 0.004)30 (0.634 ±\pm 0.013)23 ±\pm 5 (0.621 ±\pm 0.027)20 (0.671 ±\pm 0.014)
RepNoise0.325510 (0.468 ±\pm 0.044)40 (0.629 ±\pm 0.005)30 (0.616 ±\pm 0.007)30 (0.627 ±\pm 0.008)33 ±\pm 15 (0.650 ±\pm 0.023)
RMU0.259510 (0.558 ±\pm 0.022)40 (0.625 ±\pm 0.009)33 ±\pm 5 (0.626 ±\pm 0.018)30 (0.634 ±\pm 0.022)23 ±\pm 5 (0.651 ±\pm 0.030)
RR0.251300 ±\pm 181 (0.595 ±\pm 0.009)33 ±\pm 5 (0.609 ±\pm 0.013)30 (0.639 ±\pm 0.020)23 ±\pm 5 (0.610 ±\pm 0.010)23 ±\pm 5 (0.643 ±\pm 0.008)
TAR0.290510 (0.307 ±\pm 0.008)126 ±\pm 20 (0.609 ±\pm 0.006)76 ±\pm 5 (0.620 ±\pm 0.014)66 ±\pm 5 (0.638 ±\pm 0.035)66 ±\pm 25 (0.618 ±\pm 0.010)
GradDiff-WMDP0.227510 (0.444 ±\pm 0.030)223 ±\pm 248 (0.574 ±\pm 0.067)90 ±\pm 60 (0.618 ±\pm 0.022)70 ±\pm 26 (0.616 ±\pm 0.017)50 ±\pm 17 (0.624 ±\pm 0.020)
Table 1: Relearning attack evaluation. Each entry considers number of training steps and WMDP-bio ( Li et al., 2024 ) final accuracy in brackets. Dagger ( † ) indicates perplexity increased by more than 100%. All methods use Llama-3.1-8B-Instruct . SpecDef is applied to the ELM -unlearned model. The unfiltered base model for DeepIgnorance has an effective LR floor starting at 10−510^{-5} .
α\alphaWMDPPPLMMLUWinograndeARCHellaSwag
1kΔ\Delta =-0.1Δ\Delta =-0.01Δ\Delta =+0.1Δ\Delta =+0.0Δ\Delta =+1.0Δ\Delta =+0.3
100kΔ\Delta =-0.1Δ\Delta =-0.01Δ\Delta =+0.6Δ\Delta =+0.3Δ\Delta =+0.3Δ\Delta =+0.0
1BΔ\Delta =+0.0Δ\Delta =-0.02Δ\Delta =+0.1Δ\Delta =-1.0Δ\Delta =+1.0Δ\Delta =+0.0
Table 2: SpecDef preserves model utility. Performance differences are negligible across benchmarks even at extreme multipliers.
Table 3: Style relearning: SpecDef prevents Van Gogh style recovery; ESD and IMMA fail within 10 epochs of LoRA.
Unlearning with WMDP-Bio ( ELM -unlearned Llama-3.1-8B )
Learning Rateα=1\alpha=11k1\mathrm{k}250025005k5\mathrm{k}7500750010k10\mathrm{k}1M1\mathrm{M}
10−610^{-6}120 ±\pm 10 (0.616 ±\pm 0.010)176 ±\pm 288 (0.424 ±\pm 0.098) †46 ±\pm 56 (0.305 ±\pm 0.051) ‡16 ±\pm 10 (0.231 ±\pm 0.077) ‡16 ±\pm 10 (0.222 ±\pm 0.078) ‡13 ±\pm 5 (0.204 ±\pm 0.068) ‡10 (0.216 ±\pm 0.062) ‡
5×10−65\times 10^{-6}33 ±\pm 5 (0.644 ±\pm 0.054)26 ±\pm 28 (0.278 ±\pm 0.168) ‡13 ±\pm 5 (0.243 ±\pm 0.095) ‡10 (0.197 ±\pm 0.055) ‡10 (0.187 ±\pm 0.032) ‡10 (0.224 ±\pm 0.073) ‡10 (0.182 ±\pm 0.047) ‡
8×10−68\times 10^{-6}26 ±\pm 5 (0.637 ±\pm 0.022)20 ±\pm 17 (0.267 ±\pm 0.164) ‡13 ±\pm 5 (0.222 ±\pm 0.101) ‡10 (0.194 ±\pm 0.061) ‡10 (0.303 ±\pm 0.125) ‡10 (0.216 ±\pm 0.109) ‡10 (0.179 ±\pm 0.036) ‡
10−510^{-5}26 ±\pm 5 (0.658 ±\pm 0.030)16 ±\pm 11 (0.243 ±\pm 0.146) ‡10 (0.221 ±\pm 0.087) ‡10 (0.200 ±\pm 0.033) ‡10 (0.195 ±\pm 0.026) ‡10 (0.217 ±\pm 0.039) ‡10 (0.201 ±\pm 0.069) ‡
3×10−53\times 10^{-5}33 ±\pm 23 (0.651 ±\pm 0.027)10 (0.218 ±\pm 0.079) ‡10 (0.174 ±\pm 0.033) ‡10 (0.183 ±\pm 0.059) ‡10 (0.217 ±\pm 0.059) ‡10 (0.190 ±\pm 0.016) ‡10 (0.184 ±\pm 0.030) ‡
Table 4: Relearning and harmful fine-tuning attacks on Llama-3.1-8B models. SpecDef causes divergence ( ‡\ddagger ) at high enough α\alpha .
MethodNudity Counts ↓\downarrowImages w/ Nudity ↓\downarrowImg. Reduction ↑\uparrowNud. Reduction ↑\uparrow
Vanilla SD V1-4346.0205 / 205——
Nudity-Erased SD (ESD)59.032 / 20584.4%82.9%
Unprotected ESD w/ LoRA311.0 ± 23.4119.3 ± 2.9 / 20541.8 ± 1.4%10.1 ± 6.8%
IMMA ( Zheng and Yeh, 2024 )127.7 ± 42.762.3 ± 14.1 / 20569.6 ± 6.9%63.1 ± 12.4%
SpecDef α=10k\alpha=10\mathrm{k}0.0 ± 0.00.0 ± 0.0 / 205100.0 ± 0.0 %100.0 ± 0.0 %
Table 5: NSFW generation: SpecDef achieves 100% reduction in nudity counts; IMMA achieves 63%.
 LR = 10−410^{-4}LR = 5×10−45{\times}10^{-4}LR = 10−310^{-3}
Baseline580 (0.61 ±\pm 0.00)236 ±\pm 37 (0.62 ±\pm 0.02)193 ±\pm 9 (0.62 ±\pm 0.02)
α=1000\alpha=100016 ±\pm 4 (0.67 ±\pm 0.04) †10 (0.57 ±\pm 0.23) †10 (0.26 ±\pm 0.23) ‡
α=10,000\alpha=10,00010 (0.26 ±\pm 0.27) ‡10 (0.00 ±\pm 0.00) ‡10 (0.00 ±\pm 0.00) ‡
Table 6: Scaling to 20B parameters with LoRA: training resistance is possible on large models with high enough α\alpha .
Figure 2: Style transfer attack: SpecDef maintains low similarity to Van Gogh references throughout 50 epochs of LoRA fine-tuning, while ESD and IMMA recover the erased style within 10 epochs. Lower similarity indicates stronger resistance.
Muon
α\alpha10−510^{-5}2×10−52\times 10^{-5}5×10−55\times 10^{-5}
1765 (0.29 ±\pm 0.05)765 (0.43 ±\pm 0.03)316 ±\pm 45 (0.61 ±\pm 0.01)
1K335 ±\pm 375 (0.53 ±\pm 0.15)305 ±\pm 399 (0.54 ±\pm 0.11)140 ±\pm 156 (0.62 ±\pm 0.03)
10K308 ±\pm 396 (0.50 ±\pm 0.13) †83 ±\pm 66 (0.48 ±\pm 0.11) ‡36 ±\pm 11 (0.41 ±\pm 0.09) ‡
100K23 ±\pm 5 (0.40 ±\pm 0.10) ‡20 ±\pm 10 (0.37 ±\pm 0.10) ‡13 ±\pm 5 (0.33 ±\pm 0.11) ‡
Sophia
Table 7: Curvature-aware optimizers fail to circumvent SpecDef. Muon performs best but still diverges at α≥100k\alpha{\geq}100\mathrm{k} ; Sophia is ineffective even at α=1k\alpha{=}1\mathrm{k} .
Layers Addedα=1\alpha=1α=105\alpha=10^{5}α=106\alpha=10^{6}α=109\alpha=10^{9}
0 ( σ1/k=1\sigma^{1/k=1} )80 (0.61)10 (0.16) †10 (0.15) †10 (0.18) †
1 ( σ1/k=2\sigma^{1/k=2} )80 (0.62)130 (0.62)10 (0.21) †10 (0.17) †
2 ( σ1/k=3\sigma^{1/k=3} )30 (0.64)80 (0.61)100 (0.60)10 (0.17) †
3 ( σ1/k=4\sigma^{1/k=4} )80 (0.61)30 (0.61)30 (0.61)30 (0.61)
Table 8: Layer injection attack validates Theorem 8 : adding k−1k{-}1 layers reduces effective resistance from α\alpha to α1/k\alpha^{1/k} , restoring convergence at linear cost in parameters.
Appendix figures & tables31 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 3: Steps needed for optimizing a 2D convex quadratic function depend on Hessian spectral values, σ1,σ2\sigma_{1},\sigma_{2} . Maximum convergent learning rate is used and σ2\sigma_{2} is fixed at 1.
Figure 4: Illustration of the principal angle lower bound
Example 2: 2D MatricesExample 3: 3D Matrices
θ\thetacos⁡θ(Ar,Bk)\cos\theta(A_{r},B_{k})BoundActualRatioθ\thetacos⁡θ(Ar,Bk)\cos\theta(A_{r},B_{k})BoundActualRatio
01.00001.00002.79292.79292.79292.79291.00001.000001.00001.00007.09517.09517.09517.09511.00001.0000
180.95110.95112.65622.65622.76942.76941.04261.0426180.96740.96746.86366.86366.93696.93691.01071.0107
360.80900.80902.25952.25952.70662.70661.19791.1979360.87270.87276.19176.19176.49966.49961.04971.0497
540.58780.58781.64161.64162.62602.62601.59971.5997540.72520.72525.14535.14535.88735.88731.14421.1442
720.30900.30900.86300.86302.55792.55792.96402.9640720.53930.53933.82673.82675.26675.26671.37631.3763
Appendix
Table 9: Numerical analysis of Theorem 19 under 2D and 3D matrix rotation. Each matrix has Gaussian random entries.
rrkkcos⁡θ(Ar,Bk)\cos\theta(A_{r},B_{k})BoundActualRatio
110.36940.36944.97814.97816.71366.71361.34861.3486
210.42430.42433.93403.93406.71366.71361.70661.7066
220.42430.42432.10832.10834.77534.77532.26502.2650
310.81420.81423.00903.00906.71366.71362.23122.2312
320.80720.80721.59881.59884.77534.77532.98682.9868
330.18300.18300.19680.19680.39700.39702.01732.0173
Appendix
Table 10: Numerical analysis of Theorem 19 . Grid of (r,k)(r,k) values for A∈R4×6,B∈R6×4A\in\mathbb{R}^{4\times 6},B\in\mathbb{R}^{6\times 4} , both matrices are made to be Rank deficient (Rank 3). Entries are drawn Gaussian random.
Networkσ1(B)\sigma_{1}(B)σ1(A)\sigma_{1}(A)σ1(C)\sigma_{1}(C)αA\alpha_{A}αB\alpha_{B}σ1(A)σ1(B)σ1(C)αAαB\sigma_{1}(A)\sigma_{1}(B)\sigma_{1}(C)\alpha_{A}\alpha_{B}σ1(Hblock)\sigma_{1}(H_{\text{block}})σ1(H)\sigma_{1}(H)
MLP11.75 ±0.710.93 ±0.250.43 ±0.270.46 ±0.250.32 ±0.340.94 ±0.601.47 ±0.71
MLP101.59 ±0.830.83 ±0.380.52 ±0.310.45 ±0.233.36 ±3.337.75 ±6.237.82 ±6.23
MLP1001.72 ±0.800.87 ±0.350.55 ±0.260.44 ±0.2237.07 ±42.3374.81 ±66.8874.83 ±66.88
MLP10001.56 ±0.790.80 ±0.410.51 ±0.300.46 ±0.26309.38 ±358.77580.02 ±581.07580.02 ±581.07
MLP50001.74 ±0.940.80 ±0.410.48 ±0.310.46 ±0.201469.93 ±1472.483518.09 ±3196.123518.09 ±3196.12
MLP w/ GELU11.73 ±0.840.60 ±0.110.45 ±0.200.47 ±0.230.24 ±0.250.60 ±0.351.06 ±0.73
Appendix
Table 11: Numerical analysis of our bound broken into various quantities. LB indicates σr1(A)σ1(B)σr2(C)αAαB\sigma_{r_{1}}(A)\sigma_{1}(B)\sigma_{r_{2}}(C)\alpha_{A}\alpha_{B} with principal subspace angles αA=cos⁡θ(Ar1,BC1)\alpha_{A}=\cos\theta(A_{r_{1}},BC_{1}) and αB=cos⁡θ(B1,Cr2)\alpha_{B}=\cos\theta(B_{1},C_{r_{2}}) . Mean across 30 seeds is reported for each entry, std ranges omitted for clarity. Values of AA , BB , and CC are found in Appendix F . The bound always holds.
MethodReference
ELMGandikota et al. (2024)
RepNoiseRosati et al. (2024a)
RMULi et al. (2024)
RRZou et al. (2023)
TARTamirisa et al. (2025)
GradDiffLiu et al. (2022)
Appendix
Table 12: Training resistance methods evaluated in this work. Models were obtained from those public ally available on Huggingface from Che et al. (2025) and Fan et al. (2025) .
Learning Rateα=1\alpha=1α=1k\alpha=1kα=2500\alpha=2500α=5k\alpha=5kα=7500\alpha=7500α=10k\alpha=10\mathrm{k}α=1M\alpha=1\mathrm{M}
10−610^{-6}510 (0.467 ±\pm 0.035)20 ±\pm 17 (0.180 ±\pm 0.035) ‡13 ±\pm 5 (0.158 ±\pm 0.007) ‡13 ±\pm 5 (0.154 ±\pm 0.002) ‡13 ±\pm 5 (0.165 ±\pm 0.021) ‡10 (0.175 ±\pm 0.022) ‡10 (0.221 ±\pm 0.122) ‡
5×10−65\times 10^{-6}126 ±\pm 30 (0.608 ±\pm 0.010)13 ±\pm 5 (0.182 ±\pm 0.019) ‡10 (0.204 ±\pm 0.040) ‡10 (0.175 ±\pm 0.023) ‡10 (0.213 ±\pm 0.044) ‡10 (0.214 ±\pm 0.079) ‡10 (0.210 ±\pm 0.078) ‡
8×10−68\times 10^{-6}73 ±\pm 11 (0.626 ±\pm 0.029)10 (0.199 ±\pm 0.019) ‡10 (0.175 ±\pm 0.035) ‡10 (0.199 ±\pm 0.048) ‡10 (0.196 ±\pm 0.056) ‡10 (0.195 ±\pm 0.081) ‡10 (0.217 ±\pm 0.094) ‡
10−510^{-5}73 ±\pm 5 (0.618 ±\pm 0.014)10 (0.192 ±\pm 0.024) ‡10 (0.171 ±\pm 0.008) ‡10 (0.220 ±\pm 0.052) ‡10 (0.166 ±\pm 0.025) ‡10 (0.197 ±\pm 0.079) ‡10 (0.200 ±\pm 0.080) ‡
3×10−53\times 10^{-5}53 ±\pm 11 (0.631 ±\pm 0.024)10 (0.191 ±\pm 0.024) ‡10 (0.241 ±\pm 0.078) ‡10 (0.178 ±\pm 0.021) ‡10 (0.192 ±\pm 0.046) ‡10 (0.165 ±\pm 0.024) ‡10 (0.217 ±\pm 0.118) ‡
Appendix
Table 13: Convergence rates for GradDiff . Values show mean training steps ±\pm std with final WMDP-Bio accuracy ±\pm std in brackets across 3 seeds. † indicates at least one run diverged (perplexity doubled from initial value). ‡ indicates all runs diverged.
Learning Rateα=1\alpha=1α=1k\alpha=1kα=2500\alpha=2500α=5k\alpha=5kα=7500\alpha=7500α=10k\alpha=10\mathrm{k}α=1M\alpha=1\mathrm{M}
10−610^{-6}93 ±\pm 25 (0.607 ±\pm 0.006)43 ±\pm 57 (0.452 ±\pm 0.157) †50 ±\pm 54 (0.428 ±\pm 0.146) ‡26 ±\pm 25 (0.281 ±\pm 0.152) ‡18 ±\pm 10 (0.300 ±\pm 0.156) ‡16 ±\pm 11 (0.244 ±\pm 0.172) ‡10 (0.212 ±\pm 0.050) ‡
5×10−65\times 10^{-6}26 ±\pm 5 (0.617 ±\pm 0.023)20 ±\pm 17 (0.290 ±\pm 0.170) ‡16 ±\pm 10 (0.255 ±\pm 0.128) ‡12 ±\pm 4 (0.219 ±\pm 0.123) ‡10 (0.237 ±\pm 0.093) ‡10 (0.216 ±\pm 0.099) ‡10 (0.246 ±\pm 0.080) ‡
8×10−68\times 10^{-6}26 ±\pm 5 (0.667 ±\pm 0.024)16 ±\pm 11 (0.264 ±\pm 0.172) ‡14 ±\pm 5 (0.182 ±\pm 0.020) ‡10 (0.226 ±\pm 0.099) ‡10 (0.247 ±\pm 0.072) ‡10 (0.233 ±\pm 0.069) ‡10 (0.259 ±\pm 0.075) ‡
10−510^{-5}20 (0.659 ±\pm 0.082)16 ±\pm 11 (0.269 ±\pm 0.165) ‡10 (0.227 ±\pm 0.064) ‡10 (0.277 ±\pm 0.093) ‡10 (0.207 ±\pm 0.030) ‡10 (0.214 ±\pm 0.089) ‡10 (0.200 ±\pm 0.042) ‡
3×10−53\times 10^{-5}16 ±\pm 5 (0.633 ±\pm 0.033)10 (0.222 ±\pm 0.100) ‡10 (0.201 ±\pm 0.057) ‡10 (0.201 ±\pm 0.045) ‡10 (0.202 ±\pm 0.048) ‡10 (0.175 ±\pm 0.011) ‡10 (0.220 ±\pm 0.062) ‡
Appendix
Table 14: Convergence rates for Llama-3-8B-Instruct . Values show mean training steps ±\pm std with final WMDP-Bio accuracy ±\pm std in brackets across 3 seeds. † indicates at least one run diverged (perplexity doubled from initial value). ‡ indicates all runs diverged.
Learning Rateα=1\alpha=1α=1k\alpha=1kα=2500\alpha=2500α=5k\alpha=5kα=7500\alpha=7500α=10k\alpha=10\mathrm{k}α=100k\alpha=100\mathrm{k}α=1M\alpha=1\mathrm{M}
10−610^{-6}2597 (0.098 ±\pm 0.001)40 ±\pm 10 (0.705 ±\pm 0.065)23 ±\pm 5 (0.644 ±\pm 0.035)20 (0.641 ±\pm 0.173) †13 ±\pm 5 (0.589 ±\pm 0.255) †16 ±\pm 11 (0.584 ±\pm 0.304) ‡10 (0.024 ±\pm 0.037) ‡10 (0.011 ±\pm 0.011) ‡
5×10−65\times 10^{-6}216 ±\pm 5 (0.610 ±\pm 0.013)20 (0.626 ±\pm 0.206) †10 (0.537 ±\pm 0.246) †10 (0.481 ±\pm 0.331) †10 (0.552 ±\pm 0.319) †10 (0.482 ±\pm 0.282) †10 (0.019 ±\pm 0.031) ‡10 (0.004 ±\pm 0.003) ‡
8×10−68\times 10^{-6}143 ±\pm 5 (0.650 ±\pm 0.034)13 ±\pm 5 (0.585 ±\pm 0.291) †10 (0.629 ±\pm 0.146) †10 (0.566 ±\pm 0.260) †10 (0.375 ±\pm 0.319) ‡10 (0.048 ±\pm 0.049) ‡10 (0.014 ±\pm 0.022) ‡10 (0.016 ±\pm 0.025) ‡
10−510^{-5}130 (0.697 ±\pm 0.006)13 ±\pm 5 (0.561 ±\pm 0.296) †10 (0.443 ±\pm 0.328) †10 (0.414 ±\pm 0.380) ‡10 (0.256 ±\pm 0.439) ‡10 (0.118 ±\pm 0.139) ‡10 (0.002 ±\pm 0.000) ‡10 (0.016 ±\pm 0.024) ‡
3×10−53\times 10^{-5}63 ±\pm 5 (0.653 ±\pm 0.054)10 (0.573 ±\pm 0.270) †10 (0.247 ±\pm 0.415) ‡10 (0.005 ±\pm 0.006) ‡10 (0.147 ±\pm 0.224) ‡10 (0.136 ±\pm 0.230) ‡10 (0.003 ±\pm 0.002) ‡10 (0.002 ±\pm 0.001) ‡
Appendix
Table 15: Convergence rates for RepNoise . Values show mean training steps ±\pm std with final harmfulness probability ±\pm std in brackets across 3 seeds. † indicates at least one run diverged (perplexity doubled from initial value). ‡ indicates all runs diverged.
Learning Rateα=1\alpha=1α=1k\alpha=1kα=2500\alpha=2500α=5k\alpha=5kα=7500\alpha=7500α=10k\alpha=10\mathrm{k}α=100k\alpha=100\mathrm{k}α=1M\alpha=1\mathrm{M}
10−610^{-6}2597 (0.581 ±\pm 0.003)43 ±\pm 49 (0.396 ±\pm 0.250) †33 ±\pm 40 (0.356 ±\pm 0.218) †30 ±\pm 34 (0.266 ±\pm 0.081) ‡30 ±\pm 34 (0.320 ±\pm 0.126) ‡26 ±\pm 28 (0.255 ±\pm 0.173) ‡13 ±\pm 5 (0.055 ±\pm 0.055) ‡10 (0.017 ±\pm 0.005) ‡
5×10−65\times 10^{-6}103 ±\pm 5 (0.615 ±\pm 0.002)40 ±\pm 51 (0.364 ±\pm 0.235) †23 ±\pm 23 (0.178 ±\pm 0.157) ‡16 ±\pm 11 (0.179 ±\pm 0.239) ‡16 ±\pm 11 (0.151 ±\pm 0.231) ‡13 ±\pm 5 (0.137 ±\pm 0.219) ‡10 (0.002 ±\pm 0.001) ‡10 (0.072 ±\pm 0.061) ‡
8×10−68\times 10^{-6}76 ±\pm 11 (0.626 ±\pm 0.031)30 ±\pm 34 (0.347 ±\pm 0.252) ‡16 ±\pm 11 (0.243 ±\pm 0.263) ‡16 ±\pm 11 (0.152 ±\pm 0.228) ‡13 ±\pm 5 (0.130 ±\pm 0.212) ‡13 ±\pm 5 (0.010 ±\pm 0.006) ‡10 (0.003 ±\pm 0.003) ‡10 (0.051 ±\pm 0.083) ‡
10−510^{-5}76 ±\pm 11 (0.646 ±\pm 0.030)30 ±\pm 34 (0.317 ±\pm 0.273) ‡16 ±\pm 11 (0.202 ±\pm 0.289) ‡13 ±\pm 5 (0.136 ±\pm 0.207) ‡13 ±\pm 5 (0.088 ±\pm 0.119) ‡13 ±\pm 5 (0.116 ±\pm 0.172) ‡10 (0.033 ±\pm 0.028) ‡10 (0.011 ±\pm 0.008) ‡
3×10−53\times 10^{-5}46 ±\pm 5 (0.660 ±\pm 0.047)16 ±\pm 11 (0.159 ±\pm 0.215) ‡13 ±\pm 5 (0.131 ±\pm 0.192) ‡10 (0.126 ±\pm 0.146) ‡10 (0.104 ±\pm 0.118) ‡10 (0.039 ±\pm 0.044) ‡10 (0.089 ±\pm 0.083) ‡10 (0.027 ±\pm 0.019) ‡
Appendix
Table 16: Convergence rates for TAR . Values show mean training steps ±\pm std with final harmfulness probability ±\pm std in brackets across 3 seeds. † indicates at least one run diverged (perplexity doubled from initial value). ‡ indicates all runs diverged.
MethodNudity Counts ↓\downarrowImages w/ Nudity ↓\downarrowImg. Reduction ↑\uparrowNud. Reduction ↑\uparrow
SpecDef α=100\alpha=100    
random 1 layer371.3 ± 58.0117.0 ± 7.8 / 20542.9 ± 3.8%-7.3 ± 16.8%
random 5 layers419.7 ± 146.1122.7 ± 19.7/ 20540.2 ± 9.6%-21.3 ± 42.2%
random 25 layers331.7 ± 79.1109.3 ± 4.0 / 20546.7 ± 2.0%4.1 ± 22.9%
all 48 cross-attention layers335.3 ± 84.5123.0 ± 12.0 / 20540.0 ± 5.9%3.1 ± 24.4%
SpecDef α=1,000\alpha=1,000    
Appendix
Table 17: NSFW content generation ablations on layer selections across 3 random seeds
Figure 5: Qualitative NSFW results under an I2P prompt using the same random seed. We compare the images generated by spectral deformation protected ESD with the generations from Vanilla SD v1-4, nudity-erased SD (ESD), unprotected ESD after LoRA adaptation, and IMMA-protected ESD after LoRA adaptation. We further vary the largest singular values multipliers ( α∈{100,1000,10000}\alpha\in\{100,1000,10000\} ) and the layer selection strategies (random 1, 5, 25 layers, or all cross-attention layers).
MethodSGR C (CLIP) ↑\uparrowSGR D (DINO) ↑\uparrowSGR L (LPIPS) ↑\uparrowResistance Time ↓\downarrow
Reference Images0%0%0%—
IMMA ( Zheng and Yeh, 2024 )3.34 ± 3.18%7.47 ± 14.94%1.77 ± 15.08%343.32 ± 3.47s
SpecDef α=10,000\alpha=10{,}00010.81 ± 2.23%44.08 ± 4.08%42.11 ± 21.96%20.27 ± 0.00s
Appendix
Table 18: Van Gogh style re-learning after SpecDef across 3 random seeds. We report: (1) SGR C (CLIP) ↑\uparrow : semantic–style similarity gap to the reference images, (2) SGR D (DINO) ↑\uparrow : mid-level visual feature similarity gap, (3) SGR L (LPIPS) ↑\uparrow : perceptual similarity gap, and (4) Resistance Time ↑\uparrow : wall-clock time required to apply the resistance method. Higher SGR indicates a larger similarity gap to the reference images, reflecting stronger prevention of artistic-style re-learning.
Figure 6: Evolution of generated images over 50 LoRA training epochs for the prompt “An artwork by Van Gogh” under different protection mechanisms, with a LoRA learning rate of 10−410^{-4} . Both IMMA and SpecDef are applied to all cross-attention layers.
MethodSGR C (CLIP) ↑\uparrowSGR D (DINO) ↑\uparrowSGR L (LPIPS) ↑\uparrowResistance Time
SpecDef α=100\alpha=100    
random 1 layer0.67 ± 0.73%-4.54 ± 6.92%-0.99 ± 11.58%0.46 ± 0.34s
random 5 layers1.34 ± 2.53%-6.45 ± 3.97%-4.96 ± 2.83%1.50 ± 0.23s
random 25 layers1.62 ± 3.51%-7.03 ± 4.40%-5.78 ± 6.65%10.65 ± 1.15s
all 48 cross-attention layers0.23 ± 2.61%-9.15 ± 4.80%-5.90 ± 3.54%20.27 ± 0.01s
SpecDef α=1,000\alpha=1,000    
Appendix
Table 19: Van Gogh style re-learning ablations across LoRA learning rates with three random seeds. Rows highlighted in green indicate successful protection against LoRA fine-tuning. Bolded values indicate all outputs collapse to black images across three seeds.
MethodSGR C (CLIP) ↑\uparrowSGR D (DINO) ↑\uparrowSGR L (LPIPS) ↑\uparrow
Reference Images0%0%0%
IMMA ( Zheng and Yeh, 2024 )   
10−310^{-3}0.65 ± 0.10%-5.74 ± 5.05%-0.32 ± 6.21%
10−410^{-4}3.34 ± 3.18%7.47 ± 14.94%1.77 ± 15.08%
10−510^{-5}11.94 ± 1.51%60.55 ± 3.03%38.37 ± 8.56%
10−610^{-6}10.89 ± 2.90%52.49 ± 10.75%35.14 ± 18.60%
Appendix
Table 20: Van Gogh style re-learning ablations on LoRA learning rate across 3 random seeds. Rows highlighted in green represent successful protection from LoRA fine-tuning. Values in bold font represent all generated images are collapsed to black.
MethodSGR C (CLIP) ↑\uparrowSGR D (DINO) ↑\uparrowSGR L (LPIPS) ↑\uparrow
Reference Images0%0%0%
SpecDef α=1k\alpha=1k , LoRA Learning Rate = 10−410^{-4}   
k=1k=10.84 ± 1.07%-3.39 ± 3.18%-2.67 ± 9.03%
k=5k=5-0.36 ± 1.67%-9.83 ± 2.88%-9.99 ± 5.84%
k=10k=102.99 ± 3.89%9.11 ± 8.97%1.37 ± 3.05%
k=25k=250.88 ± 1.17%-5.96 ± 7.00%-8.05 ± 10.54%
Appendix
Table 21: Van Gogh style re-learning ablations on top k singular values across 3 random seeds. Rows highlighted in green represent successful protection from LoRA fine-tuning.
Figure 7: Evolution of generated images over 50 LoRA training epochs for the prompt “An artwork by Van Gogh”, with α=1000\alpha=1000 , a LoRA learning rate of 10−410^{-4} , and Top- kk singular values where k∈{1,10,25,50,100,250}k\in\{1,10,25,50,100,250\} .
σ\sigmaLayers10−610^{-6}2×10−62\times 10^{-6}5×10−65\times 10^{-6}8×10−68\times 10^{-6}10−510^{-5}3×10−53\times 10^{-5}
10001120 ±\pm 132 (0.53 ±\pm 0.16) †66 ±\pm 60 (0.54 ±\pm 0.12) †53 ±\pm 40 (0.56 ±\pm 0.10) †43 ±\pm 30 (0.64 ±\pm 0.19) †40 ±\pm 26 (0.62 ±\pm 0.14) †23 ±\pm 15 (0.63 ±\pm 0.13) †
226 ±\pm 5 (0.62 ±\pm 0.24) †16 ±\pm 5 (0.59 ±\pm 0.16) †10 (0.58 ±\pm 0.13) †10 (0.55 ±\pm 0.16) †10 (0.59 ±\pm 0.14) †10 (0.42 ±\pm 0.39) †
520 (0.69 ±\pm 0.10) †13 ±\pm 5 (0.64 ±\pm 0.15) †10 (0.60 ±\pm 0.06) ‡10 (0.59 ±\pm 0.12) ‡10 (0.47 ±\pm 0.39) ‡10 (0.25 ±\pm 0.27) ‡
1016 ±\pm 5 (0.72 ±\pm 0.05) †13 ±\pm 5 (0.68 ±\pm 0.18) ‡10 (0.67 ±\pm 0.05) ‡10 (0.44 ±\pm 0.38) ‡10 (0.43 ±\pm 0.37) ‡10 (0.03 ±\pm 0.05) ‡
5000183 ±\pm 110 (0.55 ±\pm 0.10) †60 ±\pm 62 (0.58 ±\pm 0.12) †40 ±\pm 36 (0.60 ±\pm 0.12) †36 ±\pm 30 (0.64 ±\pm 0.17) †30 ±\pm 26 (0.64 ±\pm 0.15) †23 ±\pm 15 (0.59 ±\pm 0.21) †
210 (0.58 ±\pm 0.13) †10 (0.56 ±\pm 0.16) †10 (0.48 ±\pm 0.28) †10 (0.41 ±\pm 0.40) †10 (0.42 ±\pm 0.41) †10 (0.41 ±\pm 0.41) †
Appendix
Table 22: Harmful fine-tuning results: steps ±\pm std (harmfulness ±\pm std). † : some seeds diverged (PPL doubled). ‡ : all seeds diverged. Notice that divergence in all seeds only typically occurs when enough layers are used. More layers results in better convergence rate control.
kklr= 10−610^{-6}lr= 5×10−65{\times}10^{-6}lr= 10−510^{-5}lr= 3×10−53{\times}10^{-5}
1330 ±\pm 180 (0.573)50 ±\pm 0 (0.616)30 ±\pm 0 (0.614)20 ±\pm 10 (0.514) †
2350 ±\pm 160 (0.578)55 ±\pm 5 (0.602) †30 ±\pm 0 (0.590) †10 ±\pm 0 (0.433) ‡
5400 ±\pm 110 (0.594)45 ±\pm 5 (0.594) †30 ±\pm 0 (0.592) †25 ±\pm 15 (0.443) ‡
10325 ±\pm 185 (0.571)45 ±\pm 5 (0.594) †35 ±\pm 5 (0.576) †15 ±\pm 5 (0.475) ‡
25340 ±\pm 170 (0.588)50 ±\pm 20 (0.541) †30 ±\pm 10 (0.531) ‡15 ±\pm 5 (0.455) ‡
all325 ±\pm 185 (0.573)30 ±\pm 0 (0.451) ‡20 ±\pm 0 (0.439) ‡10 ±\pm 0 (0.398) ‡
Appendix
Table 23: Top- kk ablation ( α=10,000\alpha=10,000 ). Number of steps and WMDP classification accuracy (mean ±\pm std over 3 seeds). † : some seeds doubled perplexity; ‡ : all seeds doubled perplexity.
Figure 8: Mean singular value of each layer’s weight matrix across resistance methods (rows). Red bars indicate layerwise means. SpecDef is omitted since its reparameterized layers have singular values that are orders of magnitude larger by construction. Or finding is that weight spectra is not meaningfully different from the base model.
Figure 9: Training dynamics across resistance methods, showing loss and log gradient norm. On successful resistance runs RepNoise , NPO , and GradDiff enter a small gradient norm regime where loss does not change.
Resistance Methodα=1\alpha=1α=10\alpha=10
RepNoise510 (0.459)26 ±\pm 5 (0.630 ±\pm 0.022)
RMU510 (0.573)23 ±\pm 5 (0.618 ±\pm 0.013)
TAR510 (0.302)70 ±\pm 45 (0.510 ±\pm 0.170) †
GradDiff510 (0.409 ±\pm 0.002)196 ±\pm 120 (0.609 ±\pm 0.010)
NPO-SAM510 (0.412 ±\pm 0.000)70 ±\pm 43 (0.610 ±\pm 0.008)
NPO510 (0.553)73 ±\pm 15 (0.616 ±\pm 0.016)
Appendix
Table 24: Spectral Reparameterization Attacks. Comparison of defended models under α=1\alpha=1 vs. α=10\alpha=10 . Entries report mean training steps ±\pm std, with final accuracy ±\pm std in parentheses. † indicates at least one divergent run (perplexity doubled); ‡ indicates all runs diverged.
 MuonSophiaAdaHessian
Model10−510^{-5}2×10−52\times 10^{-5}5×10−55\times 10^{-5}5×10−65\times 10^{-6}10−510^{-5}2×10−52\times 10^{-5}10−610^{-6}3×10−63\times 10^{-6}5×10−65\times 10^{-6}
Base Model765 (0.52 ±\pm 0.04)653 ±\pm 193 (0.54 ±\pm 0.05)190 ±\pm 62 (0.62 ±\pm 0.01)26 ±\pm 5 (0.61 ±\pm 0.01)20 (0.65 ±\pm 0.05)16 ±\pm 5 (0.63 ±\pm 0.04)146 ±\pm 25 (0.63 ±\pm 0.01)60 (0.61 ±\pm 0.01)56 ±\pm 5 (0.62 ±\pm 0.01)
NPO765 (0.29)765 (0.30)765 (0.55)60 (0.69)60 (0.54) ‡40 (0.42) ‡467 ±\pm 420 (0.60 ±\pm 0.02)140 ±\pm 70 (0.61 ±\pm 0.01)120 ±\pm 42 (0.60 ±\pm 0.00)
GradDiff765 (0.25 ±\pm 0.03)765 (0.24 ±\pm 0.03)765 (0.44 ±\pm 0.04)73 ±\pm 15 (0.63 ±\pm 0.03)93 ±\pm 5 (0.62 ±\pm 0.02)56 ±\pm 15 (0.42 ±\pm 0.01) ‡553 ±\pm 366 (0.56 ±\pm 0.04)313 ±\pm 210 (0.60 ±\pm 0.00)183 ±\pm 90 (0.60 ±\pm 0.01) †
RMU765 (0.23 ±\pm 0.02)765 (0.30 ±\pm 0.03)633 ±\pm 228 (0.58 ±\pm 0.02)46 ±\pm 11 (0.65 ±\pm 0.04)50 ±\pm 43 (0.63 ±\pm 0.01)33 ±\pm 15 (0.54 ±\pm 0.12) †183 ±\pm 60 (0.61 ±\pm 0.01)76 ±\pm 11 (0.63 ±\pm 0.03)70 ±\pm 10 (0.62 ±\pm 0.02)
TAR765 (0.30 ±\pm 0.02)765 (0.30 ±\pm 0.03)435 ±\pm 285 (0.29 ±\pm 0.02) †86 ±\pm 5 (0.62 ±\pm 0.02)93 ±\pm 15 (0.58 ±\pm 0.06) †33 ±\pm 11 (0.34 ±\pm 0.04) ‡110 ±\pm 26 (0.25 ±\pm 0.06) ‡46 ±\pm 11 (0.28 ±\pm 0.05) ‡33 ±\pm 5 (0.25 ±\pm 0.00) ‡
Appendix
Table 25: Curvature-aware optimizer attacks on defended models ( α=1\alpha=1 ). Entries report training steps to reach target metric (mean ±\pm std across seeds). † : some seeds diverged; ‡ : all seeds diverged. Unlike with SpecDef, these attacks are often much more successful on defences that were previously able to resist Adam.
OptimizerHyperparameterValues
AdamLearning rate{10−9,…,10−1}\{10^{-9},\dots,10^{-1}\}
KFACLearning rate{10−9,…,10−2}\{10^{-9},\dots,10^{-2}\}
 Damping{10−3,10−2,3 ⁣× ⁣10−2,10−1,3 ⁣× ⁣10−1}\{10^{-3},10^{-2},3\!\times\!10^{-2},10^{-1},3\!\times\!10^{-1}\}
Natural GradientLearning rate{10−9,…,10−2}\{10^{-9},\dots,10^{-2}\}
 Damping{0.1,0.3,1.0,3.0}\{0.1,0.3,1.0,3.0\}
NewtonLearning rate{10−9,…,10−2}\{10^{-9},\dots,10^{-2}\}
Appendix
Table 26: Hyperparameter grids used for second-order optimizer ablations.
OptimizerBefore SpecDefAfter SpecDef
Adamlr=10−2\text{lr}=10^{-2}lr=10−7\text{lr}=10^{-7}
KFAClr=10−3, damping=10−3\text{lr}=10^{-3},\ \text{damping}=10^{-3}lr=10−4, damping=10−2\text{lr}=10^{-4},\ \text{damping}=10^{-2}
Natural Gradientlr=10−2, damping=0.1\text{lr}=10^{-2},\ \text{damping}=0.1lr=10−8, damping=3.0\text{lr}=10^{-8},\ \text{damping}=3.0
Newtonlr=10−2, damping=0.1\text{lr}=10^{-2},\ \text{damping}=0.1lr=10−6, damping=1.0\text{lr}=10^{-6},\ \text{damping}=1.0
AdaHessianlr=10−3\text{lr}=10^{-3}lr=10−4\text{lr}=10^{-4}
Cubic Newtonlr=0.1, σ=5.0\text{lr}=0.1,\ \sigma=5.0lr=10−4, σ=5.0\text{lr}=10^{-4},\ \sigma=5.0
Appendix
Table 27: Optimal optimizer hyperparameters before and after SpecDef.
OptimizerBefore SpecDefAfter SpecDef
KFAC0.835±0.0310.835\pm 0.0310.616±0.0580.616\pm 0.058
Natural Gradient0.624±0.0050.624\pm 0.0050.589±0.0450.589\pm 0.045
Newton0.625±0.0060.625\pm 0.0060.621±0.0070.621\pm 0.007
AdaHessian0.795±0.0480.795\pm 0.0480.648±0.0270.648\pm 0.027
Cubic Newton0.748±0.0380.748\pm 0.0380.642±0.0260.642\pm 0.026
Adam0.806±0.0420.806\pm 0.0420.648±0.0110.648\pm 0.011
Appendix
Table 28: Classification accuracy before and after SpecDef (mean ±\pm std).
Figure 10: SpecDef sharply contracts the stable learning-rate regime, demonstrating effective second-order convergence control.
Figure 11: Hessian heatmaps and eigenvalue distributions before and after SpecDef. SpecDef’s most pronounced effect is in the off-diagonals.
Figure 12: Hessian heatmaps as a function of the number and location of modified singular values. The pattern is consistent regardless of selected kk or layer.
α\alphaς1(H(α))\varsigma_{1}(\mathcal{H}(\alpha))LB1(α)\mathrm{LB}_{1}(\alpha)UB1(α)\mathrm{UB}_{1}(\alpha)
111.271.27−0.20-0.202.152.15
101013.3413.340.180.1819.2719.27
100100134.15134.153.943.94190.52190.52
100010001342.271342.2741.6241.621903.031903.03
100001000013423.4613423.46418.43418.4319028.1319028.13
100000100000134235.38134235.384186.454186.45190279.08190279.08
Appendix
Table 29: Verification of lower and upper bounds for the top tensor singular value ς1(H(α))\varsigma_{1}(\mathcal{H}(\alpha)) under consistent scaling of A\mathcal{A} .
More in this topic

Neural Network Optimization

Neural network optimization studies algorithms and training dynamics that help models learn efficiently, reliably, and generalize well.

See all 318 papers

Explore similar work

CardsList
Jul 24, 2026

Distribution-Specific Curvature Control with Finite-Sample Guarantees for Open-Weight Safety

A short fine-tuning run can undo the safety guards of an open-weight model---retraining a refusal-trained assistant to aid weapons development or produce hate speech. Preventing such harmful fine-tuning while retaining benign adaptability remains difficult: the only prior method with an explicit curvature certificate, spectral deformation, inflates curvature globally and thereby obstructs benign adaptation along with harmful adaptation. We propose HarmAlign, which applies function-preserving spectral deformation along a estimated contrastive activation subspace. We derive finite-sample bounds for the estimated subspace energy and the resulting local harmful-distribution curvature lower bound. A stability--progress dichotomy for constant-step gradient descent turns the certified curvature into conditional convergence-rate control. Empirically, within a fixed-architecture, finite-budget first-order threat model, HarmAlign blocks direct fine-tuning and three data- or objective-adaptive attacks across a hazardous-knowledge relearning setting and a harmful-assistance fine-tuning setting, while the protected benign tasks remain trainable. The block persists across the tested first-order optimizer variants over every attack checkpoint, and under out-of-distribution harmful fine-tuning, and it extends to important cases in our threat model: accidental safety degradation and emergent misalignment.

Domenic Rosati, Ali Dadsetan, Hong Huang +5

1Dalhousie University · 2Vector Institute for Artificial Intelligence · 3Indian Institute of Management Bangalore

Adversarial RobustnessLLM Safety AlignmentAdversarial Robustness of Language Models
AskPDF
Apr 5, 2026

Subspace Control: Turning Constrained Model Steering into Controllable Spectral Optimization

Foundation models, such as large language models (LLMs), are powerful but often require customization before deployment to satisfy practical constraints such as safety, privacy, and task-specific requirements, leading to "constrained" optimization problems for model steering and adaptation. However, solving such problems remains largely underexplored and is particularly challenging due to interference between the primary objective and constraint objectives during optimization. In this paper, we propose a subspace control framework for constrained model training. Specifically, (i) we first analyze, from a model merging perspective, how spectral cross-task interference arises and show that it can be resolved via a one-shot solution that orthogonalizes the merged subspace; (ii) we establish a connection between this solution and gradient orthogonalization in the spectral optimizer Muon; and (iii) building on these insights, we introduce SIFT (spectral interference-free training), which leverages a localization scheme to selectively intervene during optimization, enabling controllable updates that mitigate objective-constraint conflicts. We evaluate SIFT across four representative applications: (a) machine unlearning, (b) safety alignment, (c) text-to-speech adaptation, and (d) hallucination mitigation. Compared to both control-based and control-free baselines, SIFT consistently achieves substantial and robust performance improvements across all tasks. Code is available at https://github.com/OPTML-Group/SIFT.

Yancheng Huang, Changsheng Wang, Chongyu Fan +7

OPTML, Michigan State University · MIT-IBM Watson AI Lab, IBM Research · University of Minnesota +2

Spectral OptimizationSpectral Methods
AskPDF
Oct 6, 2026

Removing Information Content Does Not Certify Tamper Resistance in Open-Weight Models

Does removing harmful information make open-weight models resistant to fine-tuning attacks? We show that mutual information at release alone cannot universally certify slow recovery. Function-preserving reparameterizations leave information unchanged while altering gradient-descent geometry, so an invariant certificate is bounded by the fastest reachable parameterization. We apply this principle to weight--data mutual information under training-data filtering and label--representation mutual information under capability removal. Training order can change recovery time at fixed weight--data information, while exact representation-level independence can preserve the entire parameter Jacobian. An explicit construction has both information quantities equal to zero and recovers in one gradient step. Controlled experiments illustrate order-dependent recovery and parameterization-dependent attack speed. These results identify the missing requirement for certification: constraints on attack dynamics beyond mutual information at release.

Domenic Rosati, Alessa Carbo, Ali Dadsetan +5

Dalhousie University · Vector Institute · Johns Hopkins University +1

Certified RobustnessMachine Unlearning
AskPDF