ASCENT: First-Order Optimal Fine-Tuning with Recalibration for Safety--Utility Co-Enhancement

1 INTRODUCTION

• Existing methods mainly preserve safety, lack theoretical characterizations of optimal safety-related subspaces and task updates, and often keep a fixed subspace during fine-tuning.Downstream optimization may reshape the subspace.Source: §1 · p. 2
• Under a fixed rank and Frobenius-norm budget, ASCENT uses the top-r singular components of the safety-function gradient to maximize estimated safety improvement.It periodically estimates this structure for calibration and subsequent task optimization.Source: §1 · p. 2
• ASCENT derives a unique task update that stays close to the original while preserving safety-compatible components and selectively suppressing safety-degrading ones.The penalty on each safety-degrading component is weighted by its corresponding singular value.Source: §1 · p. 2
• ASCENT periodically re-estimates the safety-related structure during fine-tuning, selecting the largest interval for which retention stays above a predefined threshold.The calibrated rank-r structure remains stable over several downstream optimization steps.Source: §1 · p. 2
• ASCENT improves downstream utility by up to 20.3% and reduces ASR by up to 35.5% across evaluated settings, achieving state-of-the-art safety and utility.The framework periodically recalibrates the safety-related structure while alternating calibration and task optimization.Source: §1 · pp. 2–3

2 RELATED WORK

• Safety-preserving methods use alignment subspaces, safety-aware low-rank constraints, protected layers, alignment directions, or harmful-resistant null spaces to retain safety during downstream adaptation.These approaches generally construct protected directions or subspaces before training and keep them fixed.Source: §2 · p. 3
• Complementary content-security research covers synthetic-image detection and manipulation localization, distinct from the paper’s focus on model safety during fine-tuning.The cited work includes hierarchical synergistic learning and discriminative expert routing.Source: §2 · p. 3
• Studies identify safety-critical structures at neuron and rank levels or quantify individual-parameter safety impact, but this does not determine optimal calibration or task updates.ASCENT instead derives first-order optimal solutions and periodically recalibrates the safety-related structure.Source: §2 · p. 3

3 ASCENT

• ASCENT alternates safety calibration and safety-aware task optimization, periodically re-estimating the safety-related structure as model parameters change.The refreshed top-r singular structure guides subsequent task updates.Source: §3 · p. 3, Figure 1 · p. 4

3.1 FIRST-ORDER OPTIMAL SAFETY CALIBRATION

• Under fixed rank and Frobenius-norm budgets, the top-r singular structure of the safety-function gradient characterizes the update maximizing first-order safety improvement.The safety function maps model parameters to safety capability, and its first-order approximation estimates the effect of a parameter update.Source: §3.1 · pp. 4–5

3.2 FIRST-ORDER OPTIMAL TASK OPTIMIZATION

• The task update preserves safety-compatible components and selectively suppresses safety-degrading components according to their safety importance.The optimization stays close to the original task update; its unique solution does not decrease the estimated first-order safety effect within the calibrated subspace compared with the original update.Source: §3.2 · pp. 5–6

3.3 ITERATIVE CALIBRATION AND TASK OPTIMIZATION

• ASCENT performs multiple safety-preserving task updates between calibrations because the calibrated rank-r structure remains stable for several steps but gradually changes.It selects the largest interval for which normalized retention remains above a predefined threshold, then recalibrates every K steps.Source: §3.3 · p. 6

4.1 EXPERIMENTAL SETUP

• Evaluation covers four LLMs, four downstream tasks, and JailbreakBench and WildJailbreak safety benchmarks, with additional StrongREJECT jailbreak-attack testing.Utility is measured with ROUGE-L for SAMSum and accuracy for AG News, GSM8K, and OpenBookQA.Source: §4.1 · pp. 6–7

4.2 MAIN RESULTS

• ASCENT improves ROUGE-L by up to 20.3% on SAMSum and accuracy by up to 16.4% on other tasks, while reducing JailbreakBench ASR by up to 35.5%.It lies in the safety–utility co-enhancement region across models and tasks.Source: Table 1 · p. 7, §4.2 · p. 8, Figure 2 · p. 8
• ASCENT achieves the lowest ASR and highest utility in every setting, reducing ASR by 25.9% on average versus the strongest safety-preserving baseline.None of the four baselines reduces ASR below the corresponding original model in any evaluated setting.Source: §4.2 · p. 8
• Across WildJailbreak and four StrongREJECT jailbreak attacks, ASCENT has the lowest ASR, reducing average ASR from 44.8% for original models to 10.5%.This supports safety gains beyond JailbreakBench.Source: §4.2 · p. 8, Figure 3 · p. 9

Component Ablation

• Periodic recalibration further reduces ASR by 24.4% on average and yields higher utility than Task FT in all settings.Adding task optimization to calibration raises average ASR reduction to 20.2% while restoring utility to at least the Task FT level in all eight settings; calibration alone reduces ASR by 13.4% on average but lowers utility.Source: §5 · p. 9

Safety-Structure Retention and Calibration Interval

• All 16 model–task settings remain above retention threshold τ = 0.8 at k = 16, making K = 16 the largest common interval meeting that threshold.The calibrated safety-gradient structure remains highly retained across multiple optimization steps, then gradually declines.Source: §5 · p. 9

Calibration Interval Sensitivity

• As K rises from 4 to 16, utility improves across all four tasks while ASR remains low; beyond 16, utility gains are only 0.1 per task as ASR increases.ASR increases by 1.8–2.4% at K = 20 and 3.6–4.7% at K = 24.Source: §5 · p. 9

6 CONCLUSION

• ASCENT derives an optimal safety-improving calibration update and a unique closed-form task update that preserves safety-compatible components while selectively suppressing safety-degrading ones.It periodically recalibrates the safety-related structure during downstream fine-tuning.Source: §6 · p. 9
• Utility improves by up to 20.3% while ASR falls by up to 35.5%, with safety improvements also reported on an additional benchmark and against representative jailbreak attacks.The experiments span multiple LLM families and downstream tasks.Source: §6 · p. 10

AI USE STATEMENT

• The authors state that AI assistants were used only for manuscript polishing, while research ideas, methods, experiments, analysis, and conclusions were independently developed and validated.Source: AI USE STATEMENT · p. 11

ETHICS STATEMENT

• The study uses harmful-prompt benchmarks for controlled safety calibration and evaluation and reports no human subjects or personal-data collection.Source: ETHICS STATEMENT · p. 11

REPRODUCIBILITY STATEMENT

• The appendix provides proofs, implementation and training details, safety-gradient estimation procedures, evaluation protocols, and additional ablations; code is released to support reproduction.Source: REPRODUCIBILITY STATEMENT · p. 11

A.1 PROOF OF THEOREM 1

• Aligning a feasible update’s singular vectors with the top-r singular vectors of G attains the upper bound, yielding maximum first-order safety improvement ρ∥Σr∥F.The update is constrained to rank at most r and Frobenius norm at most ρ.Source: §A.1 · p. 15

A.2 PROOFS FOR FIRST-ORDER OPTIMAL TASK OPTIMIZATION

• The task-update proof decomposes the original update into a safety-subspace component and an orthogonal component, then separates the remaining optimization into r scalar problems.Source: §A.2 · pp. 15–16
• Strict convexity gives a unique minimizer; its coefficients are unchanged when ci ≥ 0 and shrunk toward zero when ci < 0.Source: §A.2 · p. 16

B ADDITIONAL IMPLEMENTATION DETAILS

• ASCENT uses r=32, ρ=0.02, λ=1, and 50 HarmBench prompts; rank-32 LoRA parameterizes task updates, but the optimized update is constructed in full weight-matrix space.The next calibration uses the updated merged model after the task update is merged and the adapter reset.Source: B ADDITIONAL IMPLEMENTATION DETAILS · p. 17

C.1 ESTIMATOR FORMULATION

• ASCENT retains ESI’s chain-rule propagation but directly differentiates the judge score with respect to response token weights, removing an additional softmax transformation.This provides the gradient estimate used for safety calibration.Source: §C.1 · p. 18

C.2 EFFECT OF THE SAFETY-FUNCTION GRADIENT ESTIMATOR

• ASCENT improves downstream utility by 1.0–1.6% and further reduces JailbreakBench ASR by 6.0–8.0% versus ASCENT (ESI EST.) across all 16 model–task settings.The comparison changes the gradient estimator while keeping the rest of the framework and evaluation protocol unchanged.Source: §C.2 · p. 18, Table 4 · p. 19

C.3 VALIDITY OF THE FIRST-ORDER SAFETY APPROXIMATION

• Under local L-smoothness and gradient error at most ϵ, the higher-order error scales quadratically with ρ and the gradient-estimation optimality gap is bounded by 2ρϵ.ASCENT remains optimal for the estimated first-order objective, with deviation from the exact first-order objective controlled by gradient-estimation error.Source: §C.3 · pp. 19–20

C.4 EMPIRICAL VALIDATION OF THE FIRST-ORDER APPROXIMATION

• At ASCENT’s update budget (ρ=0.02), predicted changes have Pearson correlations of 0.92 with Llama-Guard-3-8B evaluations and 0.84 with GPT-4o evaluations, with sign agreement above 90% for both.Source: §C.4 · p. 20
• Agreement is stronger for smaller perturbations and decreases at 2ρ, consistent with the local nature of the first-order approximation.The evaluation uses held-out HarmBench prompts disjoint from those used for gradient estimation and measures realized change with Llama-Guard-3-8B and GPT-4o.Source: §C.4 · p. 20

D ADDITIONAL SAFETY EVALUATION

• Safety is evaluated on JailbreakBench and WildJailbreak and under four attacks on StrongREJECT harmful prompts; ASR counts responses scored 4 or 5 by GPT-4o as successful.The evaluated attacks are TAP, PAP, RAINBOW, and AutoDAN-Turbo.Source: D ADDITIONAL SAFETY EVALUATION · pp. 20–21
• Gemini-3.1-Pro and GPT-4o produce consistent JailbreakBench ASR values and overall trends, with ASCENT maintaining substantially lower ASR across all settings.The comparison uses the same samples and counts judge scores of 4 or 5 as successful attacks.Source: D ADDITIONAL SAFETY EVALUATION · p. 23, Table 7 · p. 23

E ADDITIONAL ABLATION RESULTS

• Across Qwen2.5-7B-it and Gemma-3-12B-it, periodic recalibration adds safety gains while maintaining improved utility after calibration and task optimization.The figure shows utility changes relative to task fine-tuning and absolute JailbreakBench ASR; its lines connect configurations, not training checkpoints.Source: E ADDITIONAL ABLATION RESULTS · p. 23, Figure 5 · p. 24

• The controls match ASCENT on safety supervision, calibration checkpoints, gradient evaluations, downstream training configuration, and per-block Frobenius-norm budget.They also use the same harmful samples, judge, gradient estimator, target matrices, and rank-32 LoRA configuration.Source: F SAFETY-SUPERVISION-MATCHED CONTROLS · p. 24, Table 8 · p. 25
• Full-Grad directly applies the normalized full safety gradient at each calibration point, with ordinary LoRA task optimization between points.It tests whether repeated safety-gradient optimization alone suffices for safety–utility co-enhancement.Source: F SAFETY-SUPERVISION-MATCHED CONTROLS · p. 24
• Cal.+FT uses ASCENT’s periodic rank-r calibration but replaces safety-aware task optimization with ordinary LoRA fine-tuning and merges the task update into the full model.This control tests whether periodic safety calibration alone explains ASCENT’s gains.Source: F SAFETY-SUPERVISION-MATCHED CONTROLS · p. 24
• ASCENT reduced ASR by 24.4 percentage points on average while improving downstream utility by 0.9 points; Full-Grad and Cal.+FT reduced ASR by 15.5 and 13.6 points while lowering utility by 12.7 and 6.6 points on average, respectively.The safety reductions are relative to Task FT; Table 8 compares matched controls on representative dense and MoE LLMs.Source: F SAFETY-SUPERVISION-MATCHED CONTROLS · p. 24, Table 8 · p. 25