Safety-Preserving Fine-Tuning of Language Models

Latest papers

57 papers25 papers in the last four weeks, up 733% on the four weeks before. 0.2% of all new papers.

The Geometry of Refusal: Why Post-Hoc Refusal Is Fragile and Pretraining-Time Refusal Persists
Sep 7, 2026Srikanth Malla, Chiho Choi, Joon Hee ChoiLLM Safety Refusal Behavior in Language Models
Samsung Semiconductor US
SafeTune: A Unified Faithful Library for Auditing and Repairing Safety Drift in Fine-Tuned LLMs
Aug 26, 2026Pratinav Seth, Saisab Sadhu, Anshul Kaushal +1LLM Safety Safety-Preserving Fine-Tuning of Language Models
Lexsi Labs
Mitigating Reasoning-Induced Misalignment via Safety-Direction Penalty
Aug 24, 2026Yipeng Zhao, Qishun Yang, Shenzhe Zhu +2Safety-Preserving Fine-Tuning of Language Models LLM Safety Alignment
University of Toronto · King Abdullah University of Science and Technology · University of Texas at Austin
Making Your LLMs More Objective: Stabilizing LLM Safety Behavior Across Traits with Trait-Invariant Safety Tuning
Aug 12, 2026Lang CaoLLM Alignment Language Model Safety Evaluation
University of Illinois Urbana-Champaign
DataRx: Missingness-Aware Sampling for Safer Large Language Model Task-Specific Fine-Tuning
Aug 5, 2026Junbo Zhang, Qianli Zhou, Xinyang Deng +1Language Model Safety Evaluation LLM Fine-Tuning
Northwestern Polytechnical University
SHARD: Safe and Helpful Alignment via Self-Reframing Distillation
Jun 14, 2026Viswonathan Manoranjan, Amogh Gupta, Anvesh Rao Vijjini +2LLM Safety Alignment Language Model Distillation
UNC Chapel Hill
Safety Measurements for Fine-tuned LLMs Should be Grounded in Capability
Jun 2, 2026Krishnapriya Vishnubhotla, Hillary Dawkins, Isar Nejadgholi +1Language Model Safety Evaluation LLM Fine-Tuning
National Research Council, Canada
CSULoRA: Closest Safe Update Low-Rank Adaptation
May 28, 2026Oleksandr Marchenko Breneur, Adelaide Danilov, Aria Nourbakhsh +1Safety-Preserving Fine-Tuning of Language Models Adapter Tuning
Department of Computer Science, University of Luxembourg Esch-sur-Alzette, Luxembourg
Security in the Fine-Tuning Lifecycle of Large Language Models: Threats, Defenses,Evaluation, and Future Directions
May 24, 2026Wenjuan Li, Yitao Liu, Runze Chen +1Safety-Preserving Fine-Tuning of Language Models LLM Backdoor Attacks
Hangzhou Normal University, No. 2318, Yuhangtang Rd, Hangzhou, 311121, Zhejiang, China · Zhejiang University, No. 866 Yuhangtang Rd, Hangzhou, 2026 310058, Zhejiang, China · China Mobile (Zhejiang) Innovation Research Institute Co., Ltd., No. 77 Gaoxin 7th Rd, China Mobile Zhejiang Information and Communication Industrial Park, Hangzhou, 311200, Zhejiang, China +1
Jailbreak to Protect: Buffering and Reinforcing via Temporary Jailbreaking for Safe Fine-Tuning in Large Language Models
May 23, 2026Seokil Ham, Jaehyuk Jang, Wonjun Lee +1LLM Fine-Tuning LLM Safety Alignment
School of Electrical Engineering, Korea Advanced Institute of Science and Technology (KAIST), Daejeon, Republic of Korea.
GradShield: Alignment Preserving Finetuning
May 13, 2026Zhanhao Hu, Xiao Huang, Patrick Mendoza +4Safety-Preserving Fine-Tuning of Language Models LLM Fine-Tuning
University of California, Berkeley · 2HUMAIN · 3King Abdulaziz City for Science and Technology +1
Self-Mined Hardness for Safety Fine-Tuning
May 4, 2026Prakhar Gupta, Garv Shah, Donghua ZhangRefusal Behavior in Language Models Hard Negative Mining
University of Michigan
RefusalGuard: Geometry-Preserving Fine-Tuning for Safety in LLMs
May 3, 2026Sadia Asif, Mohammad Mohammadi AmiriFine-Tuning LLM Fine-Tuning
Department of Computer Science Rensselaer Polytechnic Institute Troy, NY, USA
SafeAnchor: Preventing Cumulative Safety Erosion in Continual Domain Adaptation of Large Language Models
Apr 20, 2026Dongxin Guo, Jikun Wu, Siu Ming YiuContinual Learning for LLMs LLM Fine-Tuning
The University of Hong Kong, Hong Kong, China · Brain Investing Limited, Hong Kong, China
Continual Safety Alignment via Gradient-Based Sample Selection
Apr 19, 2026Thong Bach, Dung Nguyen, Thao Minh Le +1Continual Learning for LLMs LLM Fine-Tuning
Applied Artificial Intelligence Initiative (A2I2), Deakin University · Pennsylvania State University
Preventing Safety Drift in Large Language Models via Coupled Weight and Activation Constraints
Apr 14, 2026Songping Peng, Zhiheng Zhang, Daojian Zeng +2Safety-Preserving Fine-Tuning of Language Models LLM Safety Alignment
Hunan Normal University · University of Chinese Academy of Sciences · The Key Laboratory of Cognition and Decision Intelligence for Complex Systems, Institute of Automation, Chinese Academy of Sciences +1
Beyond Creed: A Non-Identity Safety Condition A Strong Empirical Alternative to Identity Framing in Low-Data LoRA Fine-Tuning
Mar 16, 2026Xinran ZhangSafety-Preserving Fine-Tuning of Language Models LLM Safety
University of California, Berkeley
GR-SAP: Generative Replay for Safety Alignment Preservation during Fine-Tuning
Mar 10, 2026Zhouxiang Fang, Jiawei Zhou, Hanjie ChenSafety-Preserving Fine-Tuning of Language Models LLM Safety Alignment
Rice University · Stony Brook University
Few Tokens, Big Leverage: Preserving Safety Alignment by Constraining Safety Tokens during Fine-tuning
Mar 8, 2026Guoli Wang, Haonan Shi, Tu Ouyang +1Safety-Preserving Fine-Tuning of Language Models LLM Safety Alignment
Case Western Reserve University, Cleveland, OH, USA
Residual Stream Analysis of Overfitting And Structural Disruptions
Mar 4, 2026Quan Liu, Han Zhou, Wenquan Wu +2Safety-Preserving Fine-Tuning of Language Models Refusal Behavior in Language Models
BUPT · Baidu
Token-level Data Selection for Safe LLM Fine-tuning
Mar 1, 2026Yanping Li, Zhening Liu, Zijian Li +2Safety-Preserving Fine-Tuning of Language Models LLM Fine-Tuning
The Hong Kong University of Science and Technology · School of Data Science, Lingnan University
Antibody: Strengthening Defense Against Harmful Fine-Tuning for Large Language Models via Attenuating Harmful Gradient Influence
Feb 28, 2026Quoc Minh Nguyen, Trung Le, Jing Wu +2Safety-Preserving Fine-Tuning of Language Models LLM Fine-Tuning
Department of Electrical and Computer Systems Engineering, Monash University, Australia · Department of Data Science and AI, Monash University, Australia
Learning to Stay Safe: Adaptive Regularization Against Safety Degradation during Fine-Tuning
Feb 19, 2026Jyotin Goel, Souvik Maji, Pratik MazumderSafety-Preserving Fine-Tuning of Language Models LLM Safety
Indian Institute of Technology Jodhpur Jodhpur, Rajasthan, India
NeST: Neuron Selective Tuning for LLM Safety
Feb 18, 2026Sasha Behrouzi, Lichao Wu, Mohamadreza Rostami +1LLM Safety Alignment Safety-Preserving Fine-Tuning of Language Models
Technical University of Darmstadt · University of Bristol
ThinkSafe: Self-Generated Safety Alignment for Reasoning Models
Jan 30, 2026Seanie Lee, Sangwoo Park, Yumin Choi +6Safety-Preserving Fine-Tuning of Language Models LLM Safety
KAIST · KRAFTON · UC Berkeley
D-STEER: Two-Way Control of DPO-Induced Safety Behavior in Activation Space
Dec 3, 2025Samarth Raina, Saksham Aggarwal, Amit Dhanda +3Causal Interventions in Language Models Activation Steering
IIIT Delhi · Microsoft · Apple (USA) +2
UpSafe $^\circ$ C: Upcycling for Controllable Safety in Large Language Models
Oct 2, 2025Yuhao Sun, Zhuoer Xu, Shiwen Cui +4LLM Safety Safety-Utility Trade-Off in Language Models
University of Science and Technology of China · Independent researcher

Sep 7, 2026J/K move · Enter open · S save

The Geometry of Refusal: Why Post-Hoc Refusal Is Fragile and Pretraining-Time Refusal Persists

Srikanth Malla, Chiho Choi, Joon Hee Choi

Samsung Semiconductor US

LLM Safety Refusal Behavior in Language Models Adversarial Robustness of Language Models LLM Post-Training Safety-Preserving Fine-Tuning of Language Models

Open paper AskPDF arXiv

Post-hoc safety training (RLHF, DPO) is the dominant way to align large language models, yet jailbreaks (Zou et al., 2023), fine-tuning attacks (Qi et al., 2024), and activation-space edits (Arditi et al., 2024) keep recovering the behaviors it was meant to remove. We give this fragility one geometric explanation and follow it into pretraining. We measure the safety update

Δ= W_{safe} - W_{base}

against the curvature of the model's capabilities (the empirical Fisher of a capability loss). Across five model families, post-hoc safety lands in a suppression regime:

Δ

is nearly orthogonal to the capability directions, and its small in-subspace part concentrates on a few high-curvature ones. The update is thin but sharp, a refusal gate laid over intact capabilities rather than erasure of them. A kernel-immobility lemma explains why such an update can only mask a capability, not remove it, and a little benign fine-tuning switches the gate off: 100 benign examples cut the AdvBench refusal of Qwen-2.5-7B-Instruct and Llama-3-8B-Instruct by 35 to 38 pp. Following the account into pretraining, a pretraining-checkpoint sweep of OLMo-2-1B (Team OLMo et al., 2024) shows the features that refusal attaches to emerging in a sharp transition between 1B and 63B pretraining tokens. We then use the account constructively: models trained from scratch with safety co-training spread continuously across pretraining reach 87 to 98% AdvBench refusal that the same attack erodes by only 2 to 14 pp at every scale from 410M to 6.9B, at a small cost on short-answer capability probes; a windowed schedule of equal total safety weight installs no refusal. Persistence, not timing, decides whether refusal survives. It does not keep output safer: by a harmful-output classifier, the attack raises harmful completions by 8 to 12 pp after post-hoc safety and by 11 to 27 pp after co-training.