Active Adaptation, Not Static Defense: Temporal Dynamics of Preventative Steering in Adversarial Fine-Tuning

Jing Guan; Yachao Yang; Zhaoliang Liu; Yuyao Zhang; Fanyu Meng; Junlan Feng

Source-linked AI summary

Active Adaptation, Not Static Defense: Temporal Dynamics of Preventative Steering in Adversarial Fine-Tuning

Jing Guan, Yachao Yang, Zhaoliang Liu, Yuyao Zhang, Fanyu Meng, Junlan Feng

arXiv:2609.10142v1Sep 9, 2026cs.CLcs.AIcs.CRcs.LG

TL;DR

Malicious fine-tuning can degrade safety, motivating defenses against harmful persona drift. This paper analyzes Preventative Steering’s temporal optimization dynamics, tests whether its adaptation can be preserved statically, and introduces PIS to reinforce steering over time. Across evaluated Qwen2.5 and Gemma-3 models, PIS improves safety robustness over static-strength steering while reducing harmful-trait expression.

Problem
Malicious fine-tuning can weaken safety refusals and amplify harmful traits, motivating training-time defenses against harmful persona drift.
Method
The paper analyzes residual and parameter-space dynamics, tests fixed-offset preservation with IDP and IDP Continuation, and proposes the time-varying PIS schedule.
Results
PIS improves safety robustness over static-strength steering while reducing harmful-trait expression across the evaluated Qwen2.5 and Gemma-3 models.
Takeaways & Limitations
Preventative Steering’s protection depends on active adaptation during fine-tuning rather than a transferable activation offset or reusable weight modification.
Takeaways & Limitations
The study covers three undesirable traits and a limited set of model families, leaving broader safety directions, multilingual settings, attack data, and architectures for future testing.

Abstract

from arXiv · show

Large language models remain fragile against malicious fine-tuning, motivating training-time defenses against harmful persona drift. Preventative Steering injects undesirable-trait persona vectors during fine-tuning and removes them at evaluation time, yet the mechanism behind its lasting protection remains unclear. Analyzing its temporal optimization dynamics, we find that the defense emerges from an early compensatory adaptation phase followed by a steady-state phase where the corrective signal decays; in parameter space, attention output projections emerge as the dominant residual-write route for defensive updates. Through Intervention Delta Preservation (IDP) and IDP Continuation experiments, we further show that preserving or reinjecting the weight offset fails to maintain protection, indicating that preventative steering relies on active adaptation rather than a static defense. Motivated by this finding, we propose Progressive Intensity Scheduling (PIS), which starts with a moderate injection strength and increases it after static-strength alignment begins to decay. Across the evaluated Qwen2.5 and Gemma-3 models, PIS improves safety robustness over static-strength steering while reducing harmful trait expression.

1 Introduction

Preventative Steering protects against harmful persona drift through an active, time-dependent adaptation rather than a static shift. The analysis motivates PIS, which reinforces steering as its alignment with optimization decays and improves robustness across evaluated models.

Malicious fine-tuning can weaken safety refusals and amplify harmful traits, motivating training-time defenses against harmful persona drift.
Preventative Steering injects undesirable-trait activation vectors during fine-tuning, removes them at evaluation, and reduces susceptibility to later malicious fine-tuning.
The defense follows two stages: early compensatory updates, then a direction-specific steady state as gradient projection onto the injected vector decays.
IDP and IDP Continuation fail to preserve protection, showing that fixed parametric shifts cannot independently sustain the defense.
PIS starts with moderate injection and increases its strength after static-strength alignment decays, improving safety robustness across the evaluated Qwen2.5 and Gemma-3 models while reducing harmful trait expression.
Compensatory defensive updates concentrate primarily in attention output projections, identifying the dominant parameter-space residual-write route.

2 Related Work

Related work frames malicious fine-tuning as a parameter-level safety threat and establishes activation-space analysis as a useful mechanistic lens. The paper focuses on the temporal interaction between steering interventions and changing optimizer trajectories.

Malicious fine-tuning differs from inference-time jailbreaks because it directly alters model parameters and can rapidly erode refusal capabilities.
Existing defenses span inference-time safeguards and training-time interventions, but inference-time methods alone do not prevent parameter-level degradation under harmful fine-tuning.
Mechanistic studies show that semantic concepts and safety behaviors can be represented and manipulated through distributed activation directions and latent steering vectors.
This work addresses the temporal gap by tracking residual states, gradient alignment, and residual-write parameters as optimizer trajectories change.

3 Mechanistic Analysis of Preventative Steering

Preventative Steering protects against persona drift through a two-stage temporal adaptation rather than a static representational shift. Defensive updates are concentrated in attention output projections, while preserving the induced parameter offset does not maintain protection.

Setup: Preventative Steering injects a fused undesirable-trait direction during full-parameter fine-tuning and removes it during evaluation.The intervention targets response tokens at approximately 70% model depth.
Baseline effect: The intervention suppresses evil, sycophancy, and hallucination expression relative to unprotected fine-tuning on Qwen2.5-32B-Instruct.Expression scores are lower for better mitigation.
Parameter-space routes: Defensive parameter updates are concentrated in attention output projections rather than MLP down-projections.Attention output projections reach substantially deeper negative contribution and effective-write regions, while nonlinear gating constrains MLP inputs.
Temporal dynamics: Training follows an Adaptation Phase with strong compensatory gradients and a Steady-State Phase where the aligned gradient component decays and the latent state reaches dynamic equilibrium.The steady state selectively attenuates updates parallel to the injected direction while orthogonal optimization remains active.
Temporal dynamics: Removing the intervention causes an immediate gradient reversal and rapidly returns the latent state toward the malicious-fit trajectory and No Defense baseline.This behavior shows that protection is not a self-sustaining state encoded by the existing loss landscape.
Parameter-space preservation: Intervention Delta Preservation fails to prevent malicious alignment, showing that a preserved structural offset cannot independently sustain protection.The IDP result is indistinguishable from the unprotected baseline, motivating analysis beyond parameter-space preservation.

4 Isolating the Structural Offset: Can It Act as an Independent Defense?

The experiments test whether Preventative Steering’s induced parameter offset can independently preserve protection after intervention removal. Both parameter-space preservation and activation-space reinjection fail, supporting a process-dependent defense mechanism.

Intervention Delta Preservation: IDP tests whether preserving the induced parameter displacement can maintain protection after the steering injection is removed.The method isolates ΔW for Wo and Wdown and suppresses subsequent updates in its dominant subspace.
Intervention Delta Preservation: IDP fails to preserve protection, matching the unprotected baseline’s vulnerability.Restricting one offset subspace still permits functionally similar updates through orthogonal directions.
IDP Continuation: Functional continuation estimates ufunc from the input-dependent offset effect and reinjects it into attention and MLP residual streams.The estimated functional vector is computed over calibration response tokens and approximates the negative injected persona direction.
Parameter-Space Dynamics: Attention output projections provide the dominant residual-write route for structural adaptation, unlike bottlenecked Wdown updates.The asymmetry arises because Wdown’s input contribution is attenuated by nonlinearities such as SiLU.
IDP Continuation: None of the functional reinjection variants maintains protection, indicating that a static offset cannot substitute for the original intervention.Without continuous adversarial tension, reinjection does not reproduce the compensatory pressure and may disrupt relevant computations.

5 Methodology

The methodology motivates PIS from the temporal decay of gradient alignment under fixed steering strength. PIS therefore begins with moderate pressure and increases it after alignment starts to decline.

Motivation: Preventative Steering must balance sufficient gradient shaping against over-constraining optimization.The process-dependent defense makes steering strength a central design choice.
Gradient Alignment Dynamics: Gradient alignment decays under weak and moderate fixed strengths, while very large strengths preserve alignment but degrade performance.The resulting non-monotonic tradeoff motivates delayed reinforcement rather than uniformly strong steering.
Progressive Intensity Scheduling: PIS keeps steering moderate during early adaptation and increases it after static-strength alignment begins to decay.Only the steering coefficient changes over time; intervention layers and token positions remain fixed.
Progressive Intensity Scheduling: The schedule uses αbase before reinforcement onset and increases linearly toward αmax afterward.Tstart marks reinforcement onset, Ttotal is the number of fine-tuning steps, and the default uses αbase = 20 and αmax = 2αbase.
Two-Stage Schedule: PIS has a stable-adaptation stage followed by progressive reinforcement that maintains late-training steering-gradient coupling.The first stage induces compensation without letting a large offset dominate early updates.

6 Experimental Results and Analysis

Across three backbone models, PIS generally improves aggregate safety and harmful-trait suppression over static steering, with the strongest tested tradeoff at Tstart = 200. However, gains are not uniform across individual benchmarks, and both timing, strength, and layer placement matter.

Main Results: PIS improves the safety average and reduces the harmful-trait average across all tested onset steps and all three evaluated models.The models are Qwen2.5-32B-Instruct, Qwen2.5-7B-Instruct, and Gemma-3-12B-IT.
Reinforcement Onset: Tstart = 200 gives the best overall tested tradeoff, raising Qwen2.5-32B-Instruct’s safety average from 80.18 to 86.98 and lowering harmful-trait score from 3.04 to 1.38.On Gemma-3-12B-IT, the same setting raises safety average from 48.36 to 54.68 and lowers harmful-trait average from 5.85 to 4.94.
Injection Strength: PIS’s gains cannot be explained by average injection strength alone because static strength is non-monotonic and α = 30 performs worse than the moderate α = 25 setting.The static α = 30 setting reaches 75.60, while α = 39 reaches 64.93.
Injection Layer: Injection layer strongly affects PIS performance: layer 30 peaks among tested settings, layer 44 remains competitive at 87.65, and layer 60 drops to 39.33.Early layer 0 performs poorly with a safety average of 23.40.
Maximum Injection Strength: A moderate upper-bound multiplier performs best, with safety average increasing from 83.39 at 1.5× to 87.27 at 2.5× before dropping to 83.72 at 3.0×.The authors use 2.0× as a conservative default because the 2.5× gain is marginal.

7 Conclusion

The paper concludes that Preventative Steering protects through active adaptation during fine-tuning rather than a reusable static defense. PIS schedules injection strength to sustain this process and improves aggregate safety while suppressing harmful-trait expression across evaluated models.

Conclusion: Preventative Steering mitigates harmful persona drift by inducing an active adaptation process rather than creating a static defense.Its protection depends on how the intervention shapes optimization over time.
Conclusion: PIS improves safety robustness and suppresses harmful-trait expression over static-strength steering across Qwen2.5-7B-Instruct, Qwen2.5-32B-Instruct, and Gemma-3-12B-IT.The results support temporal reinforcement as a practical way to sustain active adaptation during adversarial fine-tuning.

Limitations

The study evaluates Preventative Steering using three undesirable traits and a limited set of model families, leaving broader safety directions, languages, attacks, and architectures for future work.

The evaluation covers evil, sycophancy, and hallucination across a limited set of model families.
The tested traits do not exhaust harmful persona drift or model architectures.
Future studies should examine additional safety directions, multilingual settings, more diverse attack data, and broader model families.

A Normalized Multi-Feature Fusion and Empirical Justification

The paper develops L2 Norm Alignment to combine multiple trait vectors while controlling their aggregate scale, then compares it with direct averaging under mixed-trait attacks. The proposed fusion strategy provides stronger, more balanced suppression than direct averaging and response-only injection outperforms all-token injection.

Fusion design: Direct Averaging combines trait directions by averaging them under a global steering strength.
Fusion design: L2 Norm Alignment normalizes the summed trait vectors against the average individual-vector L2 norm to limit signal attenuation and norm explosion.The construction first forms an unnormalized aggregate and calibrates its scale to the model’s layerwise activation magnitude.
Empirical comparison: Under mixed-trait attacks on Qwen2.5-32B-Instruct, Direct Averaging leaves high residual hallucination and sycophancy expression at 6.50 and 2.48.The comparison uses a global strength of α = 20.
Empirical comparison: The L2 Norm Alignment strategy balances and minimizes expression of all three traits without the signal decay observed for Direct Averaging.
Injection scope: Response-only injection suppresses harmful traits more effectively across evaluated dimensions than all-token injection.The comparison uses the L2 Norm Alignment strategy with α = 20.

C Directional Gradient and Parameter Decomposition

Directional decompositions show that Preventative Steering selectively attenuates gradient components aligned with the steering vector while parameter updates retain substantial orthogonal activity. The effect is visible in residual gradients and residual-write parameter updates, beyond ordinary convergence alone.

Decomposition: The analysis decomposes residual gradients and parameter updates into components parallel and orthogonal to the normalized steering direction.For parameter updates, the decomposition is applied to W_o and W_down interval updates.
Gradient dynamics: Under Full-Course Injection, aligned gradients retain 0.121 of their early magnitude versus 0.428 for orthogonal gradients, with 3.54× stronger relative attenuation.The aligned gradient share also falls from 8.87% to 2.52%.
Directional selectivity: The parallel-to-orthogonal gradient retention ratio is 0.283 with Full-Course Injection versus 0.848 under No Injection.This comparison indicates that ordinary convergence alone does not explain the directional selectivity.
Parameter dynamics: Full-Course Injection enriches early aligned parameter-update energy by over 100× for W_o and over 80× for W_down relative to No Injection.Despite this enrichment, 92.11% and 94.59% of the respective update energy remain orthogonal.
Parameter dynamics: After Early-Course steering is removed, aligned update energy falls near No-Injection levels, while Full-Course Injection retains 8.17% for W_o and 4.73% for W_down.

D Checkpoint-Persistent Deployment

The method embeds response-only Preventative Steering and persistent PIS schedule state into checkpoints for architecture-preserving open-weight fine-tuning. Reloaded fixed-strength steering reproduces direct-training scores, while embedded PIS remains close in evaluation and achieves higher safety than no defense under malicious fine-tuning.

Threat model: The deployment setting allows users to control data, optimizers, and training frameworks while excluding deliberate computational-graph modification that removes the intervention.
Checkpoint integration: The checkpoint stores a frozen steering direction and applies response-only injection during training but not evaluation or generation.Embedded PIS additionally stores schedule state and changes injection strength according to cumulative response-token exposure.
Reload behavior: Fixed-strength checkpoint deployment reproduces the score from direct training-time injection, whereas embedded PIS reload scores are sensitive to implementation details but remain very close in evaluation.
Robustness result: Embedded PIS achieves a safety score of 85.72 under malicious fine-tuning versus 23.09 without defense.
Scope boundary: The deployment guarantee requires the embedded intervention to remain active; deliberate computational-graph modification or intervention removal is outside the threat model.