Limits of Convergence-Rate Control for Open-Weight Safety

Domenic Rosati; Xijie Zeng; Hong Huang; Sebastian Dionicio; Subhabrata Majumdar; Frank Rudzicz; Hassan Sajjad

math.OCFeb 21, 2026

Limits of Convergence-Rate Control for Open-Weight Safety

Authors: Domenic Rosati, Xijie Zeng, Hong Huang, Sebastian Dionicio, Subhabrata Majumdar, Frank Rudzicz, Hassan Sajjad

Organizations: Dalhousie University · Vector Institute · Indian Institute of Management Bangalore

Abstract

Open-weight foundation models can be fine-tuned for harmful purposes after release, yet no existing training resistance methods provide theoretical guarantees. Treating these interventions as convergence-rate control problems allows us to connect optimization speed to the spectral structure of model weights. We leverage this insight to develop a novel understanding of convergence rate control through spectral reparameterization and derive an algorithm, SpecDef, that can both provably and empirically slow first- and second-order optimization in non-adversarial settings. In adversarial settings, we establish a fundamental limit on a broad class of convergence rate control methods including our own: an attacker with sufficient knowledge can restore fast convergence at a linear increase in model size. In order to overcome this limitation, future works will need to investigate methods that are not equivalent to controlling convergence rate.

Figures & tables

Figure 1: Convergence Rate Control:

\sigma_{1}(H^{\mathcal{L}}_{\theta})

and convergence rate (iterations) is increased with

\sigma_{1}(\theta_{i})

	Start Acc	$10^{-6}$	$5\times 10^{-6}$	$8\times 10^{-6}$	$10^{-5}$	$3\times 10^{-5}$
ELM	0.204	120 (0.607 $\pm$ 0.008)	33 $\pm$ 5 (0.635 $\pm$ 0.004)	30 (0.634 $\pm$ 0.013)	23 $\pm$ 5 (0.621 $\pm$ 0.027)	20 (0.671 $\pm$ 0.014)
RepNoise	0.325	510 (0.468 $\pm$ 0.044)	40 (0.629 $\pm$ 0.005)	30 (0.616 $\pm$ 0.007)	30 (0.627 $\pm$ 0.008)	33 $\pm$ 15 (0.650 $\pm$ 0.023)
RMU	0.259	510 (0.558 $\pm$ 0.022)	40 (0.625 $\pm$ 0.009)	33 $\pm$ 5 (0.626 $\pm$ 0.018)	30 (0.634 $\pm$ 0.022)	23 $\pm$ 5 (0.651 $\pm$ 0.030)
RR	0.251	300 $\pm$ 181 (0.595 $\pm$ 0.009)	33 $\pm$ 5 (0.609 $\pm$ 0.013)	30 (0.639 $\pm$ 0.020)	23 $\pm$ 5 (0.610 $\pm$ 0.010)	23 $\pm$ 5 (0.643 $\pm$ 0.008)
TAR	0.290	510 (0.307 $\pm$ 0.008)	126 $\pm$ 20 (0.609 $\pm$ 0.006)	76 $\pm$ 5 (0.620 $\pm$ 0.014)	66 $\pm$ 5 (0.638 $\pm$ 0.035)	66 $\pm$ 25 (0.618 $\pm$ 0.010)
GradDiff-WMDP	0.227	510 (0.444 $\pm$ 0.030)	223 $\pm$ 248 (0.574 $\pm$ 0.067)	90 $\pm$ 60 (0.618 $\pm$ 0.022)	70 $\pm$ 26 (0.616 $\pm$ 0.017)	50 $\pm$ 17 (0.624 $\pm$ 0.020)

Table 1: Relearning attack evaluation. Each entry considers number of training steps and WMDP-bio ( Li et al., 2024 ) final accuracy in brackets. Dagger ( † ) indicates perplexity increased by more than 100%. All methods use Llama-3.1-8B-Instruct . SpecDef is applied to the ELM -unlearned model. The unfiltered base model for DeepIgnorance has an effective LR floor starting at

10^{-5}

$\alpha$	WMDP	PPL	MMLU	Winogrande	ARC	HellaSwag
1k	$\Delta$ =-0.1	$\Delta$ =-0.01	$\Delta$ =+0.1	$\Delta$ =+0.0	$\Delta$ =+1.0	$\Delta$ =+0.3
100k	$\Delta$ =-0.1	$\Delta$ =-0.01	$\Delta$ =+0.6	$\Delta$ =+0.3	$\Delta$ =+0.3	$\Delta$ =+0.0
1B	$\Delta$ =+0.0	$\Delta$ =-0.02	$\Delta$ =+0.1	$\Delta$ =-1.0	$\Delta$ =+1.0	$\Delta$ =+0.0

Table 2: SpecDef preserves model utility. Performance differences are negligible across benchmarks even at extreme multipliers.

Panel of Table 3 — Table 3: Style relearning: SpecDef prevents Van Gogh style recovery; ESD and IMMA fail within 10 epochs of LoRA.

Unlearning with WMDP-Bio ( ELM -unlearned Llama-3.1-8B )
Learning Rate	$\alpha=1$	$1\mathrm{k}$	$2500$	$5\mathrm{k}$	$7500$	$10\mathrm{k}$	$1\mathrm{M}$
$10^{-6}$	120 $\pm$ 10 (0.616 $\pm$ 0.010)	176 $\pm$ 288 (0.424 $\pm$ 0.098) †	46 $\pm$ 56 (0.305 $\pm$ 0.051) ‡	16 $\pm$ 10 (0.231 $\pm$ 0.077) ‡	16 $\pm$ 10 (0.222 $\pm$ 0.078) ‡	13 $\pm$ 5 (0.204 $\pm$ 0.068) ‡	10 (0.216 $\pm$ 0.062) ‡
$5\times 10^{-6}$	33 $\pm$ 5 (0.644 $\pm$ 0.054)	26 $\pm$ 28 (0.278 $\pm$ 0.168) ‡	13 $\pm$ 5 (0.243 $\pm$ 0.095) ‡	10 (0.197 $\pm$ 0.055) ‡	10 (0.187 $\pm$ 0.032) ‡	10 (0.224 $\pm$ 0.073) ‡	10 (0.182 $\pm$ 0.047) ‡
$8\times 10^{-6}$	26 $\pm$ 5 (0.637 $\pm$ 0.022)	20 $\pm$ 17 (0.267 $\pm$ 0.164) ‡	13 $\pm$ 5 (0.222 $\pm$ 0.101) ‡	10 (0.194 $\pm$ 0.061) ‡	10 (0.303 $\pm$ 0.125) ‡	10 (0.216 $\pm$ 0.109) ‡	10 (0.179 $\pm$ 0.036) ‡
$10^{-5}$	26 $\pm$ 5 (0.658 $\pm$ 0.030)	16 $\pm$ 11 (0.243 $\pm$ 0.146) ‡	10 (0.221 $\pm$ 0.087) ‡	10 (0.200 $\pm$ 0.033) ‡	10 (0.195 $\pm$ 0.026) ‡	10 (0.217 $\pm$ 0.039) ‡	10 (0.201 $\pm$ 0.069) ‡
$3\times 10^{-5}$	33 $\pm$ 23 (0.651 $\pm$ 0.027)	10 (0.218 $\pm$ 0.079) ‡	10 (0.174 $\pm$ 0.033) ‡	10 (0.183 $\pm$ 0.059) ‡	10 (0.217 $\pm$ 0.059) ‡	10 (0.190 $\pm$ 0.016) ‡	10 (0.184 $\pm$ 0.030) ‡

Table 4: Relearning and harmful fine-tuning attacks on Llama-3.1-8B models. SpecDef causes divergence (

\ddagger

) at high enough

\alpha

Method	Nudity Counts $\downarrow$	Images w/ Nudity $\downarrow$	Img. Reduction $\uparrow$	Nud. Reduction $\uparrow$
Vanilla SD V1-4	346.0	205 / 205	—	—
Nudity-Erased SD (ESD)	59.0	32 / 205	84.4%	82.9%
Unprotected ESD w/ LoRA	311.0 ± 23.4	119.3 ± 2.9 / 205	41.8 ± 1.4%	10.1 ± 6.8%
IMMA ( Zheng and Yeh, 2024 )	127.7 ± 42.7	62.3 ± 14.1 / 205	69.6 ± 6.9%	63.1 ± 12.4%
SpecDef $\alpha=10\mathrm{k}$	0.0 ± 0.0	0.0 ± 0.0 / 205	100.0 ± 0.0 %	100.0 ± 0.0 %

Table 5: NSFW generation: SpecDef achieves 100% reduction in nudity counts; IMMA achieves 63%.

	LR = $10^{-4}$	LR = $5{\times}10^{-4}$	LR = $10^{-3}$
Baseline	580 (0.61 $\pm$ 0.00)	236 $\pm$ 37 (0.62 $\pm$ 0.02)	193 $\pm$ 9 (0.62 $\pm$ 0.02)
$\alpha=1000$	16 $\pm$ 4 (0.67 $\pm$ 0.04) †	10 (0.57 $\pm$ 0.23) †	10 (0.26 $\pm$ 0.23) ‡
$\alpha=10,000$	10 (0.26 $\pm$ 0.27) ‡	10 (0.00 $\pm$ 0.00) ‡	10 (0.00 $\pm$ 0.00) ‡

Table 6: Scaling to 20B parameters with LoRA: training resistance is possible on large models with high enough

\alpha

Figure 2: Style transfer attack: SpecDef maintains low similarity to Van Gogh references throughout 50 epochs of LoRA fine-tuning, while ESD and IMMA recover the erased style within 10 epochs. Lower similarity indicates stronger resistance.

Muon
$\alpha$	$10^{-5}$	$2\times 10^{-5}$	$5\times 10^{-5}$
1	765 (0.29 $\pm$ 0.05)	765 (0.43 $\pm$ 0.03)	316 $\pm$ 45 (0.61 $\pm$ 0.01)
1K	335 $\pm$ 375 (0.53 $\pm$ 0.15)	305 $\pm$ 399 (0.54 $\pm$ 0.11)	140 $\pm$ 156 (0.62 $\pm$ 0.03)
10K	308 $\pm$ 396 (0.50 $\pm$ 0.13) †	83 $\pm$ 66 (0.48 $\pm$ 0.11) ‡	36 $\pm$ 11 (0.41 $\pm$ 0.09) ‡
100K	23 $\pm$ 5 (0.40 $\pm$ 0.10) ‡	20 $\pm$ 10 (0.37 $\pm$ 0.10) ‡	13 $\pm$ 5 (0.33 $\pm$ 0.11) ‡
Sophia

Table 7: Curvature-aware optimizers fail to circumvent SpecDef. Muon performs best but still diverges at

\alpha{\geq}100\mathrm{k}

; Sophia is ineffective even at

\alpha{=}1\mathrm{k}

Layers Added	$\alpha=1$	$\alpha=10^{5}$	$\alpha=10^{6}$	$\alpha=10^{9}$
0 ( $\sigma^{1/k=1}$ )	80 (0.61)	10 (0.16) †	10 (0.15) †	10 (0.18) †
1 ( $\sigma^{1/k=2}$ )	80 (0.62)	130 (0.62)	10 (0.21) †	10 (0.17) †
2 ( $\sigma^{1/k=3}$ )	30 (0.64)	80 (0.61)	100 (0.60)	10 (0.17) †
3 ( $\sigma^{1/k=4}$ )	80 (0.61)	30 (0.61)	30 (0.61)	30 (0.61)

Table 8: Layer injection attack validates Theorem 8 : adding

k{-}1

layers reduces effective resistance from

\alpha

\alpha^{1/k}

, restoring convergence at linear cost in parameters.

Appendix figures & tables31 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 3: Steps needed for optimizing a 2D convex quadratic function depend on Hessian spectral values, $\sigma_{1},\sigma_{2}$ . Maximum convergent learning rate is used and $\sigma_{2}$ is fixed at 1.

Figure 4: Illustration of the principal angle lower bound

Example 2: 2D Matrices					Example 3: 3D Matrices
$\theta$	$\cos\theta(A_{r},B_{k})$	Bound	Actual	Ratio	$\theta$	$\cos\theta(A_{r},B_{k})$	Bound	Actual	Ratio
0	$1.0000$	$2.7929$	$2.7929$	$1.0000$	0	$1.0000$	$7.0951$	$7.0951$	$1.0000$
18	$0.9511$	$2.6562$	$2.7694$	$1.0426$	18	$0.9674$	$6.8636$	$6.9369$	$1.0107$
36	$0.8090$	$2.2595$	$2.7066$	$1.1979$	36	$0.8727$	$6.1917$	$6.4996$	$1.0497$
54	$0.5878$	$1.6416$	$2.6260$	$1.5997$	54	$0.7252$	$5.1453$	$5.8873$	$1.1442$
72	$0.3090$	$0.8630$	$2.5579$	$2.9640$	72	$0.5393$	$3.8267$	$5.2667$	$1.3763$

Appendix

Table 9: Numerical analysis of Theorem 19 under 2D and 3D matrix rotation. Each matrix has Gaussian random entries.

$r$	$k$	$\cos\theta(A_{r},B_{k})$	Bound	Actual	Ratio
1	1	$0.3694$	$4.9781$	$6.7136$	$1.3486$
2	1	$0.4243$	$3.9340$	$6.7136$	$1.7066$
2	2	$0.4243$	$2.1083$	$4.7753$	$2.2650$
3	1	$0.8142$	$3.0090$	$6.7136$	$2.2312$
3	2	$0.8072$	$1.5988$	$4.7753$	$2.9868$
3	3	$0.1830$	$0.1968$	$0.3970$	$2.0173$

Appendix

Table 10: Numerical analysis of Theorem 19 . Grid of

(r,k)

values for

A\in\mathbb{R}^{4\times 6},B\in\mathbb{R}^{6\times 4}

, both matrices are made to be Rank deficient (Rank 3). Entries are drawn Gaussian random.

Network	$\sigma_{1}(B)$	$\sigma_{1}(A)$	$\sigma_{1}(C)$	$\alpha_{A}$	$\alpha_{B}$	$\sigma_{1}(A)\sigma_{1}(B)\sigma_{1}(C)\alpha_{A}\alpha_{B}$	$\sigma_{1}(H_{\text{block}})$	$\sigma_{1}(H)$
MLP	1	1.75 ±0.71	0.93 ±0.25	0.43 ±0.27	0.46 ±0.25	0.32 ±0.34	0.94 ±0.60	1.47 ±0.71
MLP	10	1.59 ±0.83	0.83 ±0.38	0.52 ±0.31	0.45 ±0.23	3.36 ±3.33	7.75 ±6.23	7.82 ±6.23
MLP	100	1.72 ±0.80	0.87 ±0.35	0.55 ±0.26	0.44 ±0.22	37.07 ±42.33	74.81 ±66.88	74.83 ±66.88
MLP	1000	1.56 ±0.79	0.80 ±0.41	0.51 ±0.30	0.46 ±0.26	309.38 ±358.77	580.02 ±581.07	580.02 ±581.07
MLP	5000	1.74 ±0.94	0.80 ±0.41	0.48 ±0.31	0.46 ±0.20	1469.93 ±1472.48	3518.09 ±3196.12	3518.09 ±3196.12
MLP w/ GELU	1	1.73 ±0.84	0.60 ±0.11	0.45 ±0.20	0.47 ±0.23	0.24 ±0.25	0.60 ±0.35	1.06 ±0.73

Appendix

Table 11: Numerical analysis of our bound broken into various quantities. LB indicates

\sigma_{r_{1}}(A)\sigma_{1}(B)\sigma_{r_{2}}(C)\alpha_{A}\alpha_{B}

with principal subspace angles

\alpha_{A}=\cos\theta(A_{r_{1}},BC_{1})

and

\alpha_{B}=\cos\theta(B_{1},C_{r_{2}})

. Mean across 30 seeds is reported for each entry, std ranges omitted for clarity. Values of

A

B

, and

C

are found in Appendix F . The bound always holds.

Method	Reference
ELM	Gandikota et al. (2024)
RepNoise	Rosati et al. (2024a)
RMU	Li et al. (2024)
RR	Zou et al. (2023)
TAR	Tamirisa et al. (2025)
GradDiff	Liu et al. (2022)

Appendix

Table 12: Training resistance methods evaluated in this work. Models were obtained from those public ally available on Huggingface from Che et al. (2025) and Fan et al. (2025) .

Learning Rate	$\alpha=1$	$\alpha=1k$	$\alpha=2500$	$\alpha=5k$	$\alpha=7500$	$\alpha=10\mathrm{k}$	$\alpha=1\mathrm{M}$
$10^{-6}$	510 (0.467 $\pm$ 0.035)	20 $\pm$ 17 (0.180 $\pm$ 0.035) ‡	13 $\pm$ 5 (0.158 $\pm$ 0.007) ‡	13 $\pm$ 5 (0.154 $\pm$ 0.002) ‡	13 $\pm$ 5 (0.165 $\pm$ 0.021) ‡	10 (0.175 $\pm$ 0.022) ‡	10 (0.221 $\pm$ 0.122) ‡
$5\times 10^{-6}$	126 $\pm$ 30 (0.608 $\pm$ 0.010)	13 $\pm$ 5 (0.182 $\pm$ 0.019) ‡	10 (0.204 $\pm$ 0.040) ‡	10 (0.175 $\pm$ 0.023) ‡	10 (0.213 $\pm$ 0.044) ‡	10 (0.214 $\pm$ 0.079) ‡	10 (0.210 $\pm$ 0.078) ‡
$8\times 10^{-6}$	73 $\pm$ 11 (0.626 $\pm$ 0.029)	10 (0.199 $\pm$ 0.019) ‡	10 (0.175 $\pm$ 0.035) ‡	10 (0.199 $\pm$ 0.048) ‡	10 (0.196 $\pm$ 0.056) ‡	10 (0.195 $\pm$ 0.081) ‡	10 (0.217 $\pm$ 0.094) ‡
$10^{-5}$	73 $\pm$ 5 (0.618 $\pm$ 0.014)	10 (0.192 $\pm$ 0.024) ‡	10 (0.171 $\pm$ 0.008) ‡	10 (0.220 $\pm$ 0.052) ‡	10 (0.166 $\pm$ 0.025) ‡	10 (0.197 $\pm$ 0.079) ‡	10 (0.200 $\pm$ 0.080) ‡
$3\times 10^{-5}$	53 $\pm$ 11 (0.631 $\pm$ 0.024)	10 (0.191 $\pm$ 0.024) ‡	10 (0.241 $\pm$ 0.078) ‡	10 (0.178 $\pm$ 0.021) ‡	10 (0.192 $\pm$ 0.046) ‡	10 (0.165 $\pm$ 0.024) ‡	10 (0.217 $\pm$ 0.118) ‡

Appendix

Table 13: Convergence rates for GradDiff . Values show mean training steps

\pm

std with final WMDP-Bio accuracy

\pm

std in brackets across 3 seeds. † indicates at least one run diverged (perplexity doubled from initial value). ‡ indicates all runs diverged.

Learning Rate	$\alpha=1$	$\alpha=1k$	$\alpha=2500$	$\alpha=5k$	$\alpha=7500$	$\alpha=10\mathrm{k}$	$\alpha=1\mathrm{M}$
$10^{-6}$	93 $\pm$ 25 (0.607 $\pm$ 0.006)	43 $\pm$ 57 (0.452 $\pm$ 0.157) †	50 $\pm$ 54 (0.428 $\pm$ 0.146) ‡	26 $\pm$ 25 (0.281 $\pm$ 0.152) ‡	18 $\pm$ 10 (0.300 $\pm$ 0.156) ‡	16 $\pm$ 11 (0.244 $\pm$ 0.172) ‡	10 (0.212 $\pm$ 0.050) ‡
$5\times 10^{-6}$	26 $\pm$ 5 (0.617 $\pm$ 0.023)	20 $\pm$ 17 (0.290 $\pm$ 0.170) ‡	16 $\pm$ 10 (0.255 $\pm$ 0.128) ‡	12 $\pm$ 4 (0.219 $\pm$ 0.123) ‡	10 (0.237 $\pm$ 0.093) ‡	10 (0.216 $\pm$ 0.099) ‡	10 (0.246 $\pm$ 0.080) ‡
$8\times 10^{-6}$	26 $\pm$ 5 (0.667 $\pm$ 0.024)	16 $\pm$ 11 (0.264 $\pm$ 0.172) ‡	14 $\pm$ 5 (0.182 $\pm$ 0.020) ‡	10 (0.226 $\pm$ 0.099) ‡	10 (0.247 $\pm$ 0.072) ‡	10 (0.233 $\pm$ 0.069) ‡	10 (0.259 $\pm$ 0.075) ‡
$10^{-5}$	20 (0.659 $\pm$ 0.082)	16 $\pm$ 11 (0.269 $\pm$ 0.165) ‡	10 (0.227 $\pm$ 0.064) ‡	10 (0.277 $\pm$ 0.093) ‡	10 (0.207 $\pm$ 0.030) ‡	10 (0.214 $\pm$ 0.089) ‡	10 (0.200 $\pm$ 0.042) ‡
$3\times 10^{-5}$	16 $\pm$ 5 (0.633 $\pm$ 0.033)	10 (0.222 $\pm$ 0.100) ‡	10 (0.201 $\pm$ 0.057) ‡	10 (0.201 $\pm$ 0.045) ‡	10 (0.202 $\pm$ 0.048) ‡	10 (0.175 $\pm$ 0.011) ‡	10 (0.220 $\pm$ 0.062) ‡

Appendix

Table 14: Convergence rates for Llama-3-8B-Instruct . Values show mean training steps

\pm

std with final WMDP-Bio accuracy

\pm

std in brackets across 3 seeds. † indicates at least one run diverged (perplexity doubled from initial value). ‡ indicates all runs diverged.

Learning Rate	$\alpha=1$	$\alpha=1k$	$\alpha=2500$	$\alpha=5k$	$\alpha=7500$	$\alpha=10\mathrm{k}$	$\alpha=100\mathrm{k}$	$\alpha=1\mathrm{M}$
$10^{-6}$	2597 (0.098 $\pm$ 0.001)	40 $\pm$ 10 (0.705 $\pm$ 0.065)	23 $\pm$ 5 (0.644 $\pm$ 0.035)	20 (0.641 $\pm$ 0.173) †	13 $\pm$ 5 (0.589 $\pm$ 0.255) †	16 $\pm$ 11 (0.584 $\pm$ 0.304) ‡	10 (0.024 $\pm$ 0.037) ‡	10 (0.011 $\pm$ 0.011) ‡
$5\times 10^{-6}$	216 $\pm$ 5 (0.610 $\pm$ 0.013)	20 (0.626 $\pm$ 0.206) †	10 (0.537 $\pm$ 0.246) †	10 (0.481 $\pm$ 0.331) †	10 (0.552 $\pm$ 0.319) †	10 (0.482 $\pm$ 0.282) †	10 (0.019 $\pm$ 0.031) ‡	10 (0.004 $\pm$ 0.003) ‡
$8\times 10^{-6}$	143 $\pm$ 5 (0.650 $\pm$ 0.034)	13 $\pm$ 5 (0.585 $\pm$ 0.291) †	10 (0.629 $\pm$ 0.146) †	10 (0.566 $\pm$ 0.260) †	10 (0.375 $\pm$ 0.319) ‡	10 (0.048 $\pm$ 0.049) ‡	10 (0.014 $\pm$ 0.022) ‡	10 (0.016 $\pm$ 0.025) ‡
$10^{-5}$	130 (0.697 $\pm$ 0.006)	13 $\pm$ 5 (0.561 $\pm$ 0.296) †	10 (0.443 $\pm$ 0.328) †	10 (0.414 $\pm$ 0.380) ‡	10 (0.256 $\pm$ 0.439) ‡	10 (0.118 $\pm$ 0.139) ‡	10 (0.002 $\pm$ 0.000) ‡	10 (0.016 $\pm$ 0.024) ‡
$3\times 10^{-5}$	63 $\pm$ 5 (0.653 $\pm$ 0.054)	10 (0.573 $\pm$ 0.270) †	10 (0.247 $\pm$ 0.415) ‡	10 (0.005 $\pm$ 0.006) ‡	10 (0.147 $\pm$ 0.224) ‡	10 (0.136 $\pm$ 0.230) ‡	10 (0.003 $\pm$ 0.002) ‡	10 (0.002 $\pm$ 0.001) ‡

Appendix

Table 15: Convergence rates for RepNoise . Values show mean training steps

\pm

std with final harmfulness probability

\pm

std in brackets across 3 seeds. † indicates at least one run diverged (perplexity doubled from initial value). ‡ indicates all runs diverged.

Learning Rate	$\alpha=1$	$\alpha=1k$	$\alpha=2500$	$\alpha=5k$	$\alpha=7500$	$\alpha=10\mathrm{k}$	$\alpha=100\mathrm{k}$	$\alpha=1\mathrm{M}$
$10^{-6}$	2597 (0.581 $\pm$ 0.003)	43 $\pm$ 49 (0.396 $\pm$ 0.250) †	33 $\pm$ 40 (0.356 $\pm$ 0.218) †	30 $\pm$ 34 (0.266 $\pm$ 0.081) ‡	30 $\pm$ 34 (0.320 $\pm$ 0.126) ‡	26 $\pm$ 28 (0.255 $\pm$ 0.173) ‡	13 $\pm$ 5 (0.055 $\pm$ 0.055) ‡	10 (0.017 $\pm$ 0.005) ‡
$5\times 10^{-6}$	103 $\pm$ 5 (0.615 $\pm$ 0.002)	40 $\pm$ 51 (0.364 $\pm$ 0.235) †	23 $\pm$ 23 (0.178 $\pm$ 0.157) ‡	16 $\pm$ 11 (0.179 $\pm$ 0.239) ‡	16 $\pm$ 11 (0.151 $\pm$ 0.231) ‡	13 $\pm$ 5 (0.137 $\pm$ 0.219) ‡	10 (0.002 $\pm$ 0.001) ‡	10 (0.072 $\pm$ 0.061) ‡
$8\times 10^{-6}$	76 $\pm$ 11 (0.626 $\pm$ 0.031)	30 $\pm$ 34 (0.347 $\pm$ 0.252) ‡	16 $\pm$ 11 (0.243 $\pm$ 0.263) ‡	16 $\pm$ 11 (0.152 $\pm$ 0.228) ‡	13 $\pm$ 5 (0.130 $\pm$ 0.212) ‡	13 $\pm$ 5 (0.010 $\pm$ 0.006) ‡	10 (0.003 $\pm$ 0.003) ‡	10 (0.051 $\pm$ 0.083) ‡
$10^{-5}$	76 $\pm$ 11 (0.646 $\pm$ 0.030)	30 $\pm$ 34 (0.317 $\pm$ 0.273) ‡	16 $\pm$ 11 (0.202 $\pm$ 0.289) ‡	13 $\pm$ 5 (0.136 $\pm$ 0.207) ‡	13 $\pm$ 5 (0.088 $\pm$ 0.119) ‡	13 $\pm$ 5 (0.116 $\pm$ 0.172) ‡	10 (0.033 $\pm$ 0.028) ‡	10 (0.011 $\pm$ 0.008) ‡
$3\times 10^{-5}$	46 $\pm$ 5 (0.660 $\pm$ 0.047)	16 $\pm$ 11 (0.159 $\pm$ 0.215) ‡	13 $\pm$ 5 (0.131 $\pm$ 0.192) ‡	10 (0.126 $\pm$ 0.146) ‡	10 (0.104 $\pm$ 0.118) ‡	10 (0.039 $\pm$ 0.044) ‡	10 (0.089 $\pm$ 0.083) ‡	10 (0.027 $\pm$ 0.019) ‡

Appendix

Table 16: Convergence rates for TAR . Values show mean training steps

\pm

std with final harmfulness probability

\pm

std in brackets across 3 seeds. † indicates at least one run diverged (perplexity doubled from initial value). ‡ indicates all runs diverged.

Method	Nudity Counts $\downarrow$	Images w/ Nudity $\downarrow$	Img. Reduction $\uparrow$	Nud. Reduction $\uparrow$
SpecDef $\alpha=100$
random 1 layer	371.3 ± 58.0	117.0 ± 7.8 / 205	42.9 ± 3.8%	-7.3 ± 16.8%
random 5 layers	419.7 ± 146.1	122.7 ± 19.7/ 205	40.2 ± 9.6%	-21.3 ± 42.2%
random 25 layers	331.7 ± 79.1	109.3 ± 4.0 / 205	46.7 ± 2.0%	4.1 ± 22.9%
all 48 cross-attention layers	335.3 ± 84.5	123.0 ± 12.0 / 205	40.0 ± 5.9%	3.1 ± 24.4%
SpecDef $\alpha=1,000$

Appendix

Table 17: NSFW content generation ablations on layer selections across 3 random seeds

Figure 5: Qualitative NSFW results under an I2P prompt using the same random seed. We compare the images generated by spectral deformation protected ESD with the generations from Vanilla SD v1-4, nudity-erased SD (ESD), unprotected ESD after LoRA adaptation, and IMMA-protected ESD after LoRA adaptation. We further vary the largest singular values multipliers ( $\alpha\in\{100,1000,10000\}$ ) and the layer selection strategies (random 1, 5, 25 layers, or all cross-attention layers).

Method	SGR C (CLIP) $\uparrow$	SGR D (DINO) $\uparrow$	SGR L (LPIPS) $\uparrow$	Resistance Time $\downarrow$
Reference Images	0%	0%	0%	—
IMMA ( Zheng and Yeh, 2024 )	3.34 ± 3.18%	7.47 ± 14.94%	1.77 ± 15.08%	343.32 ± 3.47s
SpecDef $\alpha=10{,}000$	10.81 ± 2.23%	44.08 ± 4.08%	42.11 ± 21.96%	20.27 ± 0.00s

Appendix

Table 18: Van Gogh style re-learning after SpecDef across 3 random seeds. We report: (1) SGR C (CLIP)

\uparrow

: semantic–style similarity gap to the reference images, (2) SGR D (DINO)

\uparrow

: mid-level visual feature similarity gap, (3) SGR L (LPIPS)

\uparrow

: perceptual similarity gap, and (4) Resistance Time

\uparrow

: wall-clock time required to apply the resistance method. Higher SGR indicates a larger similarity gap to the reference images, reflecting stronger prevention of artistic-style re-learning.

Figure 6: Evolution of generated images over 50 LoRA training epochs for the prompt “An artwork by Van Gogh” under different protection mechanisms, with a LoRA learning rate of $10^{-4}$ . Both IMMA and SpecDef are applied to all cross-attention layers.

Method	SGR C (CLIP) $\uparrow$	SGR D (DINO) $\uparrow$	SGR L (LPIPS) $\uparrow$	Resistance Time
SpecDef $\alpha=100$
random 1 layer	0.67 ± 0.73%	-4.54 ± 6.92%	-0.99 ± 11.58%	0.46 ± 0.34s
random 5 layers	1.34 ± 2.53%	-6.45 ± 3.97%	-4.96 ± 2.83%	1.50 ± 0.23s
random 25 layers	1.62 ± 3.51%	-7.03 ± 4.40%	-5.78 ± 6.65%	10.65 ± 1.15s
all 48 cross-attention layers	0.23 ± 2.61%	-9.15 ± 4.80%	-5.90 ± 3.54%	20.27 ± 0.01s
SpecDef $\alpha=1,000$

Appendix

Table 19: Van Gogh style re-learning ablations across LoRA learning rates with three random seeds. Rows highlighted in green indicate successful protection against LoRA fine-tuning. Bolded values indicate all outputs collapse to black images across three seeds.

Method	SGR C (CLIP) $\uparrow$	SGR D (DINO) $\uparrow$	SGR L (LPIPS) $\uparrow$
Reference Images	0%	0%	0%
IMMA ( Zheng and Yeh, 2024 )
$10^{-3}$	0.65 ± 0.10%	-5.74 ± 5.05%	-0.32 ± 6.21%
$10^{-4}$	3.34 ± 3.18%	7.47 ± 14.94%	1.77 ± 15.08%
$10^{-5}$	11.94 ± 1.51%	60.55 ± 3.03%	38.37 ± 8.56%
$10^{-6}$	10.89 ± 2.90%	52.49 ± 10.75%	35.14 ± 18.60%

Appendix

Table 20: Van Gogh style re-learning ablations on LoRA learning rate across 3 random seeds. Rows highlighted in green represent successful protection from LoRA fine-tuning. Values in bold font represent all generated images are collapsed to black.

Method	SGR C (CLIP) $\uparrow$	SGR D (DINO) $\uparrow$	SGR L (LPIPS) $\uparrow$
Reference Images	0%	0%	0%
SpecDef $\alpha=1k$ , LoRA Learning Rate = $10^{-4}$
$k=1$	0.84 ± 1.07%	-3.39 ± 3.18%	-2.67 ± 9.03%
$k=5$	-0.36 ± 1.67%	-9.83 ± 2.88%	-9.99 ± 5.84%
$k=10$	2.99 ± 3.89%	9.11 ± 8.97%	1.37 ± 3.05%
$k=25$	0.88 ± 1.17%	-5.96 ± 7.00%	-8.05 ± 10.54%

Appendix

Table 21: Van Gogh style re-learning ablations on top k singular values across 3 random seeds. Rows highlighted in green represent successful protection from LoRA fine-tuning.

Figure 7: Evolution of generated images over 50 LoRA training epochs for the prompt “An artwork by Van Gogh”, with $\alpha=1000$ , a LoRA learning rate of $10^{-4}$ , and Top- $k$ singular values where $k\in\{1,10,25,50,100,250\}$ .

$\sigma$	Layers	$10^{-6}$	$2\times 10^{-6}$	$5\times 10^{-6}$	$8\times 10^{-6}$	$10^{-5}$	$3\times 10^{-5}$
1000	1	120 $\pm$ 132 (0.53 $\pm$ 0.16) †	66 $\pm$ 60 (0.54 $\pm$ 0.12) †	53 $\pm$ 40 (0.56 $\pm$ 0.10) †	43 $\pm$ 30 (0.64 $\pm$ 0.19) †	40 $\pm$ 26 (0.62 $\pm$ 0.14) †	23 $\pm$ 15 (0.63 $\pm$ 0.13) †
	2	26 $\pm$ 5 (0.62 $\pm$ 0.24) †	16 $\pm$ 5 (0.59 $\pm$ 0.16) †	10 (0.58 $\pm$ 0.13) †	10 (0.55 $\pm$ 0.16) †	10 (0.59 $\pm$ 0.14) †	10 (0.42 $\pm$ 0.39) †
	5	20 (0.69 $\pm$ 0.10) †	13 $\pm$ 5 (0.64 $\pm$ 0.15) †	10 (0.60 $\pm$ 0.06) ‡	10 (0.59 $\pm$ 0.12) ‡	10 (0.47 $\pm$ 0.39) ‡	10 (0.25 $\pm$ 0.27) ‡
	10	16 $\pm$ 5 (0.72 $\pm$ 0.05) †	13 $\pm$ 5 (0.68 $\pm$ 0.18) ‡	10 (0.67 $\pm$ 0.05) ‡	10 (0.44 $\pm$ 0.38) ‡	10 (0.43 $\pm$ 0.37) ‡	10 (0.03 $\pm$ 0.05) ‡
5000	1	83 $\pm$ 110 (0.55 $\pm$ 0.10) †	60 $\pm$ 62 (0.58 $\pm$ 0.12) †	40 $\pm$ 36 (0.60 $\pm$ 0.12) †	36 $\pm$ 30 (0.64 $\pm$ 0.17) †	30 $\pm$ 26 (0.64 $\pm$ 0.15) †	23 $\pm$ 15 (0.59 $\pm$ 0.21) †
	2	10 (0.58 $\pm$ 0.13) †	10 (0.56 $\pm$ 0.16) †	10 (0.48 $\pm$ 0.28) †	10 (0.41 $\pm$ 0.40) †	10 (0.42 $\pm$ 0.41) †	10 (0.41 $\pm$ 0.41) †

Appendix

Table 22: Harmful fine-tuning results: steps

\pm

std (harmfulness

\pm

std). † : some seeds diverged (PPL doubled). ‡ : all seeds diverged. Notice that divergence in all seeds only typically occurs when enough layers are used. More layers results in better convergence rate control.

$k$	lr= $10^{-6}$	lr= $5{\times}10^{-6}$	lr= $10^{-5}$	lr= $3{\times}10^{-5}$
1	330 $\pm$ 180 (0.573)	50 $\pm$ 0 (0.616)	30 $\pm$ 0 (0.614)	20 $\pm$ 10 (0.514) †
2	350 $\pm$ 160 (0.578)	55 $\pm$ 5 (0.602) †	30 $\pm$ 0 (0.590) †	10 $\pm$ 0 (0.433) ‡
5	400 $\pm$ 110 (0.594)	45 $\pm$ 5 (0.594) †	30 $\pm$ 0 (0.592) †	25 $\pm$ 15 (0.443) ‡
10	325 $\pm$ 185 (0.571)	45 $\pm$ 5 (0.594) †	35 $\pm$ 5 (0.576) †	15 $\pm$ 5 (0.475) ‡
25	340 $\pm$ 170 (0.588)	50 $\pm$ 20 (0.541) †	30 $\pm$ 10 (0.531) ‡	15 $\pm$ 5 (0.455) ‡
all	325 $\pm$ 185 (0.573)	30 $\pm$ 0 (0.451) ‡	20 $\pm$ 0 (0.439) ‡	10 $\pm$ 0 (0.398) ‡

Appendix

Table 23: Top-

k

ablation (

\alpha=10,000

). Number of steps and WMDP classification accuracy (mean

\pm

std over 3 seeds). † : some seeds doubled perplexity; ‡ : all seeds doubled perplexity.

Figure 8: Mean singular value of each layer’s weight matrix across resistance methods (rows). Red bars indicate layerwise means. SpecDef is omitted since its reparameterized layers have singular values that are orders of magnitude larger by construction. Or finding is that weight spectra is not meaningfully different from the base model.

Figure 9: Training dynamics across resistance methods, showing loss and log gradient norm. On successful resistance runs RepNoise , NPO , and GradDiff enter a small gradient norm regime where loss does not change.

Resistance Method	$\alpha=1$	$\alpha=10$
RepNoise	510 (0.459)	26 $\pm$ 5 (0.630 $\pm$ 0.022)
RMU	510 (0.573)	23 $\pm$ 5 (0.618 $\pm$ 0.013)
TAR	510 (0.302)	70 $\pm$ 45 (0.510 $\pm$ 0.170) †
GradDiff	510 (0.409 $\pm$ 0.002)	196 $\pm$ 120 (0.609 $\pm$ 0.010)
NPO-SAM	510 (0.412 $\pm$ 0.000)	70 $\pm$ 43 (0.610 $\pm$ 0.008)
NPO	510 (0.553)	73 $\pm$ 15 (0.616 $\pm$ 0.016)

Appendix

Table 24: Spectral Reparameterization Attacks. Comparison of defended models under

\alpha=1

vs.

\alpha=10

. Entries report mean training steps

\pm

std, with final accuracy

\pm

std in parentheses. † indicates at least one divergent run (perplexity doubled); ‡ indicates all runs diverged.

	Muon			Sophia			AdaHessian
Model	$10^{-5}$	$2\times 10^{-5}$	$5\times 10^{-5}$	$5\times 10^{-6}$	$10^{-5}$	$2\times 10^{-5}$	$10^{-6}$	$3\times 10^{-6}$	$5\times 10^{-6}$
Base Model	765 (0.52 $\pm$ 0.04)	653 $\pm$ 193 (0.54 $\pm$ 0.05)	190 $\pm$ 62 (0.62 $\pm$ 0.01)	26 $\pm$ 5 (0.61 $\pm$ 0.01)	20 (0.65 $\pm$ 0.05)	16 $\pm$ 5 (0.63 $\pm$ 0.04)	146 $\pm$ 25 (0.63 $\pm$ 0.01)	60 (0.61 $\pm$ 0.01)	56 $\pm$ 5 (0.62 $\pm$ 0.01)
NPO	765 (0.29)	765 (0.30)	765 (0.55)	60 (0.69)	60 (0.54) ‡	40 (0.42) ‡	467 $\pm$ 420 (0.60 $\pm$ 0.02)	140 $\pm$ 70 (0.61 $\pm$ 0.01)	120 $\pm$ 42 (0.60 $\pm$ 0.00)
GradDiff	765 (0.25 $\pm$ 0.03)	765 (0.24 $\pm$ 0.03)	765 (0.44 $\pm$ 0.04)	73 $\pm$ 15 (0.63 $\pm$ 0.03)	93 $\pm$ 5 (0.62 $\pm$ 0.02)	56 $\pm$ 15 (0.42 $\pm$ 0.01) ‡	553 $\pm$ 366 (0.56 $\pm$ 0.04)	313 $\pm$ 210 (0.60 $\pm$ 0.00)	183 $\pm$ 90 (0.60 $\pm$ 0.01) †
RMU	765 (0.23 $\pm$ 0.02)	765 (0.30 $\pm$ 0.03)	633 $\pm$ 228 (0.58 $\pm$ 0.02)	46 $\pm$ 11 (0.65 $\pm$ 0.04)	50 $\pm$ 43 (0.63 $\pm$ 0.01)	33 $\pm$ 15 (0.54 $\pm$ 0.12) †	183 $\pm$ 60 (0.61 $\pm$ 0.01)	76 $\pm$ 11 (0.63 $\pm$ 0.03)	70 $\pm$ 10 (0.62 $\pm$ 0.02)
TAR	765 (0.30 $\pm$ 0.02)	765 (0.30 $\pm$ 0.03)	435 $\pm$ 285 (0.29 $\pm$ 0.02) †	86 $\pm$ 5 (0.62 $\pm$ 0.02)	93 $\pm$ 15 (0.58 $\pm$ 0.06) †	33 $\pm$ 11 (0.34 $\pm$ 0.04) ‡	110 $\pm$ 26 (0.25 $\pm$ 0.06) ‡	46 $\pm$ 11 (0.28 $\pm$ 0.05) ‡	33 $\pm$ 5 (0.25 $\pm$ 0.00) ‡

Appendix

Table 25: Curvature-aware optimizer attacks on defended models (

\alpha=1

). Entries report training steps to reach target metric (mean

\pm

std across seeds). † : some seeds diverged; ‡ : all seeds diverged. Unlike with SpecDef, these attacks are often much more successful on defences that were previously able to resist Adam.

Optimizer	Hyperparameter	Values
Adam	Learning rate	$\{10^{-9},\dots,10^{-1}\}$
KFAC	Learning rate	$\{10^{-9},\dots,10^{-2}\}$
	Damping	$\{10^{-3},10^{-2},3\!\times\!10^{-2},10^{-1},3\!\times\!10^{-1}\}$
Natural Gradient	Learning rate	$\{10^{-9},\dots,10^{-2}\}$
	Damping	$\{0.1,0.3,1.0,3.0\}$
Newton	Learning rate	$\{10^{-9},\dots,10^{-2}\}$

Appendix

Table 26: Hyperparameter grids used for second-order optimizer ablations.

Optimizer	Before SpecDef	After SpecDef
Adam	$\text{lr}=10^{-2}$	$\text{lr}=10^{-7}$
KFAC	$\text{lr}=10^{-3},\ \text{damping}=10^{-3}$	$\text{lr}=10^{-4},\ \text{damping}=10^{-2}$
Natural Gradient	$\text{lr}=10^{-2},\ \text{damping}=0.1$	$\text{lr}=10^{-8},\ \text{damping}=3.0$
Newton	$\text{lr}=10^{-2},\ \text{damping}=0.1$	$\text{lr}=10^{-6},\ \text{damping}=1.0$
AdaHessian	$\text{lr}=10^{-3}$	$\text{lr}=10^{-4}$
Cubic Newton	$\text{lr}=0.1,\ \sigma=5.0$	$\text{lr}=10^{-4},\ \sigma=5.0$

Appendix

Table 27: Optimal optimizer hyperparameters before and after SpecDef.

Optimizer	Before SpecDef	After SpecDef
KFAC	$0.835\pm 0.031$	$0.616\pm 0.058$
Natural Gradient	$0.624\pm 0.005$	$0.589\pm 0.045$
Newton	$0.625\pm 0.006$	$0.621\pm 0.007$
AdaHessian	$0.795\pm 0.048$	$0.648\pm 0.027$
Cubic Newton	$0.748\pm 0.038$	$0.642\pm 0.026$
Adam	$0.806\pm 0.042$	$0.648\pm 0.011$

Appendix

Table 28: Classification accuracy before and after SpecDef (mean

\pm

std).

Figure 10: SpecDef sharply contracts the stable learning-rate regime, demonstrating effective second-order convergence control.

Figure 11: Hessian heatmaps and eigenvalue distributions before and after SpecDef. SpecDef’s most pronounced effect is in the off-diagonals.

Figure 12: Hessian heatmaps as a function of the number and location of modified singular values. The pattern is consistent regardless of selected $k$ or layer.

$\alpha$	$\varsigma_{1}(\mathcal{H}(\alpha))$	$\mathrm{LB}_{1}(\alpha)$	$\mathrm{UB}_{1}(\alpha)$
$1$	$1.27$	$-0.20$	$2.15$
$10$	$13.34$	$0.18$	$19.27$
$100$	$134.15$	$3.94$	$190.52$
$1000$	$1342.27$	$41.62$	$1903.03$
$10000$	$13423.46$	$418.43$	$19028.13$
$100000$	$134235.38$	$4186.45$	$190279.08$

Appendix

Table 29: Verification of lower and upper bounds for the top tensor singular value

\varsigma_{1}(\mathcal{H}(\alpha))

under consistent scaling of

\mathcal{A}

Neural Network Optimization

Neural network optimization studies algorithms and training dynamics that help models learn efficiently, reliably, and generalize well.

See all 321 papers

Distribution-Specific Curvature Control with Finite-Sample Guarantees for Open-Weight Safety
Jul 24, 2026Domenic Rosati, Ali Dadsetan, Hong Huang +5Adversarial Robustness LLM Safety Alignment
1Dalhousie University · 2Vector Institute for Artificial Intelligence · 3Indian Institute of Management Bangalore
Subspace Control: Turning Constrained Model Steering into Controllable Spectral Optimization
Apr 5, 2026Yancheng Huang, Changsheng Wang, Chongyu Fan +7Spectral Optimization Spectral Methods
OPTML, Michigan State University · MIT-IBM Watson AI Lab, IBM Research · University of Minnesota +2
Removing Information Content Does Not Certify Tamper Resistance in Open-Weight Models
Oct 6, 2026Domenic Rosati, Alessa Carbo, Ali Dadsetan +5Certified Robustness Machine Unlearning
Dalhousie University · Vector Institute · Johns Hopkins University +1

Jul 24, 2026J/K move · Enter open · S save

Distribution-Specific Curvature Control with Finite-Sample Guarantees for Open-Weight Safety

Domenic Rosati, Ali Dadsetan, Hong Huang, Xijie Zeng+4

1Dalhousie University · 2Vector Institute for Artificial Intelligence · 3Indian Institute of Management Bangalore

Adversarial Robustness LLM Safety Alignment Adversarial Robustness of Language Models

Open paper AskPDF arXiv

A short fine-tuning run can undo the safety guards of an open-weight model---retraining a refusal-trained assistant to aid weapons development or produce hate speech. Preventing such harmful fine-tuning while retaining benign adaptability remains difficult: the only prior method with an explicit curvature certificate, spectral deformation, inflates curvature globally and thereby obstructs benign adaptation along with harmful adaptation. We propose HarmAlign, which applies function-preserving spectral deformation along a estimated contrastive activation subspace. We derive finite-sample bounds for the estimated subspace energy and the resulting local harmful-distribution curvature lower bound. A stability--progress dichotomy for constant-step gradient descent turns the certified curvature into conditional convergence-rate control. Empirically, within a fixed-architecture, finite-budget first-order threat model, HarmAlign blocks direct fine-tuning and three data- or objective-adaptive attacks across a hazardous-knowledge relearning setting and a harmful-assistance fine-tuning setting, while the protected benign tasks remain trainable. The block persists across the tested first-order optimizer variants over every attack checkpoint, and under out-of-distribution harmful fine-tuning, and it extends to important cases in our threat model: accidental safety degradation and emergent misalignment.

Abstract

Neural Network Optimization

Explore similar work

Distribution-Specific Curvature Control with Finite-Sample Guarantees for Open-Weight Safety

Subspace Control: Turning Constrained Model Steering into Controllable Spectral Optimization

Removing Information Content Does Not Certify Tamper Resistance in Open-Weight Models