Organizations: Department of Computer Science, University of Texas at El Paso, TX, USA 79902 · School of Computing, Southern Illinois University Carbondale, IL, USA 62901 · Hanyang University, Seoul, South Korea · University of Illinois Urbana-Champaign, IL, USA
A guard model fine-tuned on entirely benign data can lose all safety alignment -- not through adversarial manipulation, but through standard domain specialization. We demonstrate this failure across three purpose-built safety classifiers -- LlamaGuard, WildGuard, and Granite Guardian -- deployed as protection layers in agentic AI pipelines, and show that it originates in the destruction of latent safety geometry: the structured harmful -- benign representational boundary that guides classification. We extract per-layer safety subspaces via SVD on class-conditional activation differences and track how this boundary evolves under benign fine-tuning. Granite Guardian undergoes complete collapse -- refusal rate drops from 85% to 0%, CKA falls to zero, and 100% of outputs become ambiguous -- a severity exceeding prior findings on general-purpose LLMs, explained by the specialization hypothesis: concentrated safety representations are efficient but catastrophically brittle. To mitigate this, we propose Fisher-Weighted Safety Subspace Regularization (FW-SSR), a training-time penalty combining (i) curvature-aware direction weights derived from diagonal Fisher information and (ii) an adaptive λt that scales with task-safety gradient conflict. FW-SSR recovers 75% refusal on Granite Guardian (CKA = 0.983) and reduces WildGuard's Attack Success Rate to 3.6% -- below the unmodified baseline -- by actively sharpening the safety subspace rather than merely anchoring it. Across all three models, structural representational geometry (CKA, Fisher score) predicts safety behavior more reliably than absolute displacement metrics, establishing geometry-based monitoring as a necessary component of guard model evaluation in agentic deployments.
Table 1: Safety geometry and behavioral evaluation across three guard models under benign Alpaca fine-tuning and FW-SSR mitigation. O = original aligned model; FT = baseline fine-tuned (no defense); Mit = FW-SSR mitigated. ↑ higher is better; ↓ lower is better. Bold : best value among {FT, Mit} per metric per model.
Figure 4: Per-Layer Safety Drift Heatmap
Original
Fine-tuned
FW-SSR
Per-Benchmark ASR (%) ↓
AdvBench
14.0
27.0
5.0
HarmBench
6.2
9.4
2.1
JailbreakBench
7.0
13.0
4.0
StrongREJECT
9.4
18.8
3.1
Overall ASR
9.2
17.1
3.6
Table 2: Evaluation results for WildGuard across original, fine-tuned (no defence), and FW-SSR conditions. ASR evaluated by cross-model judge (LlamaGuard-3-8B). ↓ lower is better; ↑ higher is better. Bold : best per row; red : worst.
Category
Orig
FT
FW
Category
Orig
FT
FW
Harmful
6.2
0.0
0.0
Disinformation
0.0
0.0
0.0
Illegal
18.8
31.2
6.2
Malware / Hacking
10.0
40.0
0.0
Cybercrime / Intrusion
6.2
6.2
0.0
Physical Harm
0.0
0.0
10.0
Chemical / Biological
0.0
6.2
0.0
Privacy
10.0
20.0
10.0
Harassment / Bullying
6.2
6.2
6.2
Fraud / Deception
10.0
0.0
0.0
Violence
6.2
18.8
6.2
Harassment / Discrimination
10.0
10.0
0.0
Table 3: Per-category Attack Success Rate (%) for WildGuard across original, fine-tuned (no defence), and FW-SSR conditions. Bold : best (lowest ASR) per row; red : worst.
Fine-tuning safety-aligned language models for downstream tasks often leads to substantial degradation of refusal behavior, making models vulnerable to adversarial misuse. While prior work has shown that safety-relevant features are encoded in structured representations within the model's activation space, how these representations change during fine-tuning and why alignment degrades remains poorly understood. In this work, we investigate the representation-level mechanisms underlying alignment degradation. Our analysis shows that standard fine-tuning induces systematic drift in safety-relevant representations, distorts their geometric structure, and introduces interference between task optimization and safety features. These effects collectively lead to increased harmful compliance. Motivated by these findings, we introduce REFUSALGUARD, a representation-level fine-tuning framework that preserves safety-relevant structure during model adaptation. Our approach constrains updates in hidden representation space, ensuring that safety-mediating components remain stable while allowing task-specific learning in complementary directions. We evaluate REFUSALGUARD across multiple model families, including LLaMA, Gemma, and Qwen, on adversarial safety benchmarks such as AdvBench, DirectHarm4, and JailbreakBench, as well as downstream utility tasks. Our approach achieves attack success rates comparable to base safety-aligned models while maintaining competitive task performance, significantly outperforming baselines.
Sadia Asif, Mohammad Mohammadi Amiri
Department of Computer Science Rensselaer Polytechnic Institute Troy, NY, USA
Hard-gated safety checkers often over-refuse and misalign with a vendor's model spec; prevailing taxonomies also neglect robustness and honesty, yielding safer-on-paper yet less useful systems. This work introduces Guardian-as-an-Advisor (GaaA), a soft-gating pipeline where a guardian predicts a binary risk label plus a concise explanation and prepends this advice to the original query for re-inference, keeping the base model operating under its original spec. To support training and evaluation, GuardSet is constructed, a 208k+ multi-domain dataset unifying harmful and harmless cases with targeted robustness and honesty slices. GuardAdvisor is trained via SFT followed by RL to enforce label-explanation consistency. GuardAdvisor attains competitive detection accuracy while enabling the advisory workflow; when used to augment inputs, responses improve over unaugmented prompts. A latency study shows advisor inference uses below 5% of base-model compute and adds only 2-10% end-to-end overhead under realistic harmful-input rates. Overall, GaaA steers models to comply with the model spec, maintaining safety while reducing over-refusal.
Yue Huang, Haomin Zhuang, Jiayi Ye +6
University of Notre Dame · University of California, Los Angeles · MIT-IBM Watson AI Lab +1
Guardrail models are increasingly used as safety layers for LLMs and agentic systems, but most are trained on fixed prompt or response interfaces and become unreliable when the same safety case appears as a conversation, agent trajectory, multi-agent trace, or policy-conditioned input. We propose UniGuard, a training framework that learns interface-invariant safety representations from multiple semantically aligned views of the same safety case. We also construct the UniGuard-FT dataset by transforming 1,000 public safety cases into prompt, response, multi-turn conversation, agent-trace, and multi-agent-trace views, and train UniGuard-0.6B with classification, supervised contrastive learning, and asymmetric confidence calibration losses. Across unseen-interface benchmarks ATBench, PolicyGuardBench, and DynaBench, UniGuard-0.6B improves over its pretrained guardrail by 45.12 F1 points on average and reduces expected calibration error by 35.41 points, while remaining competitive with much larger guardrails such as Claude-Sonnet-4.5 and GPT-5.2 - despite being a 0.6B model and trained only with synthetic data.
Viet-Thanh Pham, Thuy-Trang Vu, Junae Kim +4
Department of Data Science & AI, Monash University · Defence Science and Technology Group, Australia