PaperlayerView exact revision on arXiv

Source-linked AI summary

SLDR: Defending Against Malicious Fine-tuning via Selective Layers Recovery and Dynamic Routing

Hui Zhang, Yachao Yuan, Jiayun Wang, Yuanzhuo Li, Hongtao Wang, Yali Yuan

arXiv:2610.10345v1cs.CRcs.AI

TL;DR

Malicious fine-tuning can weaken refusal while preserving legitimate task behavior, leaving providers to recover safety without sacrificing utility. SLDR diagnoses signed layer effects, trains recovery on extreme-sensitivity layers, and routes the adapter based on representations. Across multiple architectures, tasks, and harmful benchmarks it reduces harmful outputs while preserving utility, with the average harmful score on Llama3.1/SST2 falling from 11.54 to 0.08.

  • Problem

    Malicious fine-tuning can erode refusal while preserving legitimate task behavior, creating a recovery challenge of restoring refusal without sacrificing utility.

    Source: §1 · pp. 1–2

  • Method

    SLDR uses signed layer-wise sensitivity to select extreme-sensitivity layers for LoRA recovery and representation-based dynamic routing to activate the adapter for malicious queries.

    Source: §1 · p. 2

  • Results

    Across four architectures, five downstream tasks, and four harmful benchmarks, SLDR reduces harmful outputs while preserving task behavior; on Llama3.1/SST2, average harmful score falls from 11.54 to 0.08.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Experiments support selective recovery and conditional adapter activation as a way to reduce harmful outputs while preserving downstream task utility in the evaluated settings.

    Source: §6 · p. 10

    The defense stage supports LoRA rather than full-parameter fine-tuning; larger models and more complex OOD attacks were not evaluated, nor was routing robustness against threshold-bypassing examples.

    Source: F Limitation · p. 30

Abstract

from arXiv · show

Fine-tuning-as-a-service enables users to adapt aligned large language models (LLMs) to specialized tasks, but malicious fine-tuning can erode refusal behavior while preserving task performance on legitimate inputs. We revisit recent layer-wise safety diagnostics and find that safety sensitivity is signed: scaling different layers can strengthen refusal, weaken it, or have little effect. Motivated by this observation, we propose SLDR, a post-fine-tuning defense based on Selective Layers Recovery and Dynamic Routing. SLDR trains a LoRA recovery adapter only on the layers with the maximum and minimum sensitivity scores in the signed spectrum, and uses representation-based dynamic routing inference to activate the adapter only for malicious queries. Across four model architectures, five downstream tasks, and four harmful benchmarks, SLDR substantially reduces harmful outputs while preserving downstream utility. On Llama3.1/SST2, SLDR reduces the average harmful score from 11.54 to 0.08 while maintaining downstream accuracy, and the harmful score remains near zero under poisoning ratios up to 0.9. The code is available at https://github.com/Stardust457/SLDR.

1 Introduction

Malicious fine-tuning can undermine refusal behavior while retaining legitimate task performance, creating a challenge for providers to restore safety without losing utility. SLDR uses signed layer sensitivity to target recovery and route the adapter selectively at inference.

1 Introduction

  • Malicious fine-tuning can make a model answer harmful queries while retaining intended task behavior on legitimate inputs, so recovery must restore refusal without sacrificing utility.The attack can mix a small number of harmful instruction-response pairs into otherwise benign task data.Source: §1 · p. 1
  • Prior defenses either constrain fine-tuning with potentially limited generalization to unseen attacks or repair the whole model in ways that entangle safety recovery with task behavior.The latter can make refusal restoration difficult without compromising benign task performance.Source: §1 · p. 1
  • SLDR probes layers for signed refusal sensitivity, trains a LoRA recovery adapter on the maximum- and minimum-sensitivity layers, and routes it to queries above a maliciousness threshold.Queries below the threshold use the unmodified fine-tuned model.Source: §1 · p. 2
  • Across four architectures, five downstream tasks, and four harmful benchmarks, SLDR reduces harmful outputs while preserving task behavior; on Llama3.1/SST2, average harmful score falls from 11.54 to 0.08.The harmful score remains near zero under poisoning ratios up to 0.9.Source: §1 · p. 2

2 Related Work

Prior defenses intervene during alignment, fine-tuning, or after compromise, while layer-wise safety studies localize relevant layers without distinguishing whether they strengthen or suppress refusal. SLDR extends this work with signed diagnosis and conditional, localized recovery.

2 Related Work

  • Alignment- and fine-tuning-stage defenses harden models or control adaptation, but typically require training-pipeline access and may rely on safety data or scorers.Approaches include data filtering, update regularization, and safety-objective shaping.Source: Alignment-stage and fine-tuning-stage… · p. 2
  • Post-fine-tuning defenses use pruning, perturbation, parameter recovery, rollback, or inference-time intervention to restore refusal while limiting utility loss.SLDR also repairs after fine-tuning, but localizes recovery and applies its adapter conditionally rather than as a fixed model-level intervention.Source: Post-fine-tuning-stage defenses · pp. 2–3
  • Prior layer-wise studies localize safety-relevant layers, whereas SLDR adds a signed measure that distinguishes layers that enhance refusal from those that suppress it.It leverages both ends of the sensitivity spectrum for selective post-fine-tuning recovery.Source: Layer-wise safety analysis · p. 3

3 Signed Layer-wise Diagnosis and Analysis

The section turns layer-wise scaling into a signed diagnostic for refusal behavior. Its findings motivate recovery focused on the strongest positive and negative layers while leaving near-neutral layers untouched.

3 Signed Layer-wise Diagnosis and Analysis

  • Layer-wise scaling serves as a signed diagnostic that moves the analysis beyond merely locating safety-relevant layers.The sensitivity score is obtained by perturbing one layer at a time and measuring refusal behavior on an over-refusal dataset.Source: §3 · p. 3, §3.1 · p. 3

3.1 Sensitivity Score Calculation

  • The signed sensitivity score κ_l is the maximum normalized signed change over candidate scaling factors, with positive values indicating increased refusal when a layer is strengthened and negative values indicating decreased refusal.Scores near zero indicate little refusal sensitivity under this probe.Source: §3.1 · p. 3

3.2 Layer Sensitivity Analysis

  • Only a small subset of layers produces large refusal changes, while many remain near zero; targeting the strongest signed effects leaves near-neutral layers untouched.The paper argues that near-neutral layers provide little refusal-related signal under the probe and are unlikely to offer much marginal recovery benefit.Source: §3.2 · pp. 3–4
  • The negative side of the spectrum identifies layers whose perturbation suppresses refusal, so targeting only positive safety layers may miss a complementary failure mode.The analysis motivates selective, directional recovery rather than updating the whole model.Source: §3.2 · p. 4

4 Selective Layers Recovery and Dynamic Routing

SLDR turns signed layer-wise refusal sensitivity into targeted recovery: it adapts spectrum-endpoint layers after malicious fine-tuning and routes queries between recovered and task-adapted models.

4.1 Layer Selection

  • SLDR selects sensitivity-spectrum endpoints: lmax most strengthens refusal, lmin most suppresses it, and near-zero layers remain unchanged to limit task interference.The adapter is trained only on the two selected layers.Source: §4.1 · p. 4

4.2 Two-stage Fine-tuning with Safety Recovery

  • After benign task adaptation is mixed with harmful pairs, SLDR trains LoRA updates only on lmin and lmax, restoring refusal while reducing risk to Stage 1 task knowledge.The user-provided training set contains retained benign task examples and injected harmful instruction-response pairs.Source: §4.2 · pp. 4–5

4.3 Representation-based Dynamic Routing Inference

  • At inference, a mean cosine-similarity gap against harmful and benign reference sets routes a prompt to the recovered model when its score exceeds τ (default 0); otherwise, the attacked model responds.The score compares each test prompt representation with both reference sets.Source: §4.3 · p. 5

5 Experiments

Experiments compare SLDR with existing defenses across tasks, models, poisoning conditions, and harmful-query benchmarks. Results test whether it can reduce harmful outputs while preserving downstream utility, and examine its dataset, threshold, layer-selection, and routing choices.

5.1 Main Results

  • SLDR achieves average HS of 0.08 and average FA of 92.32 on Llama3.1/SST2, while BDS records average HS of 1.68 and FA of 91.79.Lisa and Antidote lower HS but lose downstream accuracy; SLDR also holds HS at 0.20 when ρ = 0.2, versus SFT at 20.90.Source: Table 1 · p. 6, §5.1 · pp. 6–7
  • Across SST2, AGNEWS, GSM8K, and AlpacaEval, SLDR keeps HS ≤0.20 while maintaining utility virtually identical to undefended SFT.On GSM8K, SLDR reduces HS from 12.30 to 0.00 while matching SFT’s FA of 72.10.Source: Table 2 · p. 6, §5.1 · p. 7
  • Across Llama3.1, Llama3, Qwen2.5, and Mistral-v0.2, SLDR achieves HS ≤0.20 and mostly preserves FA.On Mistral-v0.2, SLDR’s HS is 0.10 and FA is 95.07, nearly matching SFT’s 95.18.Source: Table 3 · p. 6, §5.1 · p. 7

5 Experiments

  • Evaluation spans four model architectures, five downstream tasks, and four harmful benchmarks, using harmful score and downstream-task accuracy as metrics.The default training set mixes ρ = 0.1 poison samples into 1,000 examples, or 700 for AlpacaEval.Source: §5 · p. 6

5.1 Main Results

  • SLDR maintains HS ≤0.40 through ρ = 1.0 and across training-set sizes of 500–2,000, matching SFT’s FA at every size.At ρ = 0.9, poison samples outnumber clean samples 9:1; at |Dtrain| = 2,000, both SLDR and SFT have FA of 93.23.Source: Table 5 · p. 7, §5.1 · p. 8, Table 8 · p. 8
  • SLDR records HS ≤1.75 on DirectHarm4, HarmBench, and HEx-PHI.It also has HS of 61.53 under Zulu and 15.53 under IJP, and HS of 0.10 on Magicoder while matching SFT’s FA of 59.76.Source: Table 6 · p. 8, §5.1 · p. 8, Table 9 · p. 8

5.2 Ablation Study.

  • Ablations indicate that both sensitivity endpoints and conditional routing matter, while a small alignment set suffices for recovery.At |Dsafe| = 100, HS is 0.0 on SST2 and 0.1 on AGNEWS; τ = 0 balances the tradeoff between harmful inputs bypassing recovery and benign inputs receiving it. Applying recovery uniformly causes a dramatic FA drop.Source: §5.2 · p. 9, Table 10 · p. 9, Table 11 · p. 9

5.3 Analysis

  • SLDR’s signed sensitivity distinguishes layers whose amplification increases refusal from those whose amplification decreases it.Adjacent layers 12 and 13 have large |κl| values but opposite effects (−185 versus +200), unlike statistics that rank layers without this directional distinction.Source: §5.3 · p. 10

6 Conclusion

SLDR is presented as a post-fine-tuning defense that selectively restores safety while preserving downstream utility. The appendix also specifies a keyword-based refusal classifier.

6 Conclusion

  • SLDR’s experiments across multiple architectures, tasks, and harmful benchmarks are reported to eliminate harmful outputs while preserving downstream task utility.The conclusion describes recovery as selective and based on directionally distinct layer effects.Source: §6 · p. 10
  • SLDR trains a LoRA recovery adapter on the two most influential layers and uses representation-based dynamic routing to activate it only for harmful queries.The conclusion identifies selective recovery and conditional adapter activation as the method’s core components.Source: §6 · p. 10

A.1 Details of the Keyword-based Classifier

  • IsRefusal classifies an output as a refusal when its lowercase text contains at least one predefined refusal keyword.The listed examples include “sorry” and “cannot.”Source: §A.1 · p. 16

A.2 Details of Downstream Datasets

The appendix describes the downstream datasets and evaluation procedures, baselines, implementation, threat setting, and pseudocode for layer selection and dynamic routing.

A.2 Details of Downstream Datasets

  • The evaluation covers sentiment and news classification, grade-school math reasoning, instruction following, and code generation using SST2, AGNEWS, GSM8K, AlpacaEval, and Magicoder.Magicoder is evaluated on HumanEval; the evaluation also samples test instances from the downstream datasets.Source: §A.2 · pp. 16–17

A.3 Details of Baselines

  • The baselines span post-fine-tuning defenses, fine-tuning-stage defenses, and an undefended LoRA fine-tuning setting.The appendix describes Antidote, Panacea, One-shot FT, Lisa, STAR-DSS, and BDS, alongside SFT without defense.Source: §A.3 · p. 17
  • BDS learns per-sample safety weights through Bayesian inference, while STAR-DSS uses guardrail scores on partial responses to adapt its fine-tuning losses.Both are described as fine-tuning-stage methods.Source: §A.3 · p. 17

A.4 Details of Evaluation

  • Accuracy is used for SST2, AGNEWS, and GSM8K, HumanEval uses pass@1, and AlpacaEval output quality is judged by GPT-4o on a 1-to-10 scale.The rubric averages sample scores and multiplies the result by 10.Source: §A.4 · pp. 17–18

A.5 Implementation Details

  • LoRA is applied to query, key, and value projections at rank 32, and the recovery stage uses a learning rate of 5 × 10^-4.Experiments use AdamW, threshold τ = 0, and a safety dataset of 100 examples.Source: §A.5 · p. 18

B.1 Threat Model / B.2 Assumptions

  • The threat model gives attackers black-box access through fine-tuning data while service providers retain access to model architecture and weights; SLDR assumes a harmful-prompt, safe-response alignment dataset.The attacker aims to undermine safety alignment while preserving downstream task performance.Source: §B.1 · p. 18, §B.2 · p. 18

C.1 Layer Selection

  • Algorithm 1’s stated outputs are the minimum- and maximum-sensitivity layers, lmin and lmax, together with per-layer sensitivity scores.The appendix presents pseudocode for layer selection.Source: §B.2 · p. 19, §C.1 · p. 19

C.2 Representation-based Dynamic Routing Inference

  • The appendix presents Algorithm 2 as pseudocode for representation-based dynamic-routing inference.The passage identifies the algorithm but does not describe its steps.Source: §C.2 · p. 19

D.1 Results of Refusal Counting

Layer-wise scaling reveals signed differences in how layers affect refusal behavior, motivating recovery at sensitivity-spectrum extremes and routing based on query representations.

D.1 Results of Refusal Counting

  • Across four model families, scaling some layers decreases refusal counts while scaling others increases them; some layers have negligible effects.The described scaling factors are α ∈ {0.1, 0.2}.Source: §D.1 · p. 19
  • The routing pseudocode activates the recovered model when a test input’s malicious score exceeds τ and otherwise uses the attacked model.It describes representations derived from last-token hidden states at lmax for reference construction and test scoring.Source: §D.1 · p. 20

D.2 Results of Layer-wise Sensitivity Scores

  • Positive sensitivity scores mark refusal-enhancing layers and negative scores mark refusal-undermining layers; targeting lmin and lmax supports recovery with minimal parameter updates.The passage presents this signed variation as the empirical justification for selective layer recovery while preserving downstream utility.Source: §D.2 · p. 20

D.3 Multi-seed Stability Analysis

SLDR retains low harmful scores across random seeds and under full-parameter downstream fine-tuning. The appendix figures show refusal counts under layer-wise scaling across several model architectures.

D.3 Multi-seed Stability Analysis

  • Across four seeds, SLDR averages HS 0.08 ± 0.10 and FA 92.92 ± 0.33, compared with BDS HS 1.88 ± 0.36 and One-shot FT HS 4.18 ± 0.32.SLDR’s HS ranges from 0.00 to 0.20 in these runs.Source: §D.3 · pp. 20–21

D.3 Multi-seed Stability Analysis / D.4 Transfer to Full-parameter Fine-tuning

  • Figures 5–8 plot refusal counts against layer-weight scaling, with panels for the first and last 16 layers in Llama3.1, Llama3, and Mistral, and the first and last 14 in Qwen2.5.The captions identify 1.0 as the unscaled baseline and α values of 0.1 and 0.2.Source: Figure 5 · p. 21, Figure 6 · p. 21, Figure 7 · p. 22

D.4 Transfer to Full-parameter Fine-tuning

  • Under full-parameter downstream fine-tuning, SLDR maintains Harmful Score 1.10 and Finetune Accuracy 92.55, while BDS and One-shot FT reach Harmful Scores 47.70 and 51.10, respectively.Source: §D.4 · pp. 21–22

D.5 Computational Overhead

SLDR adds a one-time offline layer-probing cost and a modest online inference overhead from representation-based dynamic routing. The evaluation measures inference on 1,000 BeaverTails prompts with 64-token generations.

D.5 Computational Overhead

  • 0.3663 hours are required to probe all 32 layers, a one-time offline cost for layer selection.The evaluation uses 1,000 BeaverTails prompts with a fixed generation length of 64 tokens.Source: §D.5 · p. 22
  • Figure 10 reports layer-wise sensitivity scores for Qwen2.5-7B-Instruct, with positive green scores indicating layers that enhance safety refusal and negative red scores indicating layers that undermine it.Source: Figure 10 · p. 23
  • 0.0172 seconds per prompt is SLDR’s additional inference overhead over SFT, whose per-prompt times are 0.3293 and 0.3121 seconds, respectively.The SLDR timing includes representation extraction, malicious-score computation, dynamic routing, and response generation.Source: §D.5 · pp. 22–23

D.6 Additional Comparisons

Additional comparisons report SLDR’s safety and utility under jailbreak distribution shifts and on BeaverTails, while an epoch study finds that longer recovery training can worsen harmful scores.

D.6 Additional Comparisons

  • Mistral-7B-Instruct-v0.2’s layer-wise sensitivity plot uses green for refusal-enhancing layers and red for refusal-undermining layers.The caption identifies the plotted model and color meanings but gives no numerical comparison.Source: Figure 11 · p. 24
  • Under Zulu, SLDR’s HS is 61.53, below the original aligned model’s 66.82 and EnchTable’s 72.71; under IJP, its HS is 15.53 versus 12.94 and 13.53.The authors note a remaining gap under IJP, highlighting the challenge of jailbreak-induced distribution shifts.Source: §D.6 · p. 24, Table 17 · p. 25
  • On BeaverTails, SLDR’s HS is 0.00 versus 1.50 for both the original aligned model and EnchTable, while its SST2 FA of 92.43 matches undefended SFT.The original aligned model’s SST2 FA is 70.64 because it was not fine-tuned on SST2; SLDR exceeds EnchTable by 3.78 percentage points.Source: §D.6 · pp. 24–25, Table 18 · p. 25

D.7 Impact of Recovery Epochs

  • Recovery converges within 10 epochs, and the default 20-epoch setting has the best observed performance; further epochs increase HS without additional safety benefit.The comparison uses Llama3.1/SST2 with ρ = 0.1 and |Dtrain| = 1000.Source: §D.7 · p. 25, Table 19 · p. 25

D.8 Router Evaluation

The router separates harmful from benign inputs on unseen data, and case studies show SLDR refusing harmful requests that comparison methods answer. The related-work discussion surveys defenses at adaptation and post-fine-tuning stages.

D.8 Router Evaluation

  • At τ = 0, the router achieves AUROC 100%, TPR 100%, FPR 0%, and benign over-refusal 0%; increasing τ reduces TPR, while decreasing τ increases FPR and over-refusal.The evaluation tests on unseen data constructed from DirectHarm4 and AGNEWS.Source: §D.8 · pp. 25–26, Table 20 · p. 26

D.9 Case Study

  • Across BeaverTails, HEx-PHI, DirectHarm4, and HarmBench examples, SFT, BDS, and One-shot FT produce harmful content while SLDR refuses the requests.The examples include a harmful question, a request for a deceptive HR email, brake-line cutting, malware creation, and a misleading historical article.Source: §D.9 · pp. 26–28

E.1 Alignment-stage and Fine-tuning-stage Defenses

  • Alignment-stage defenses harden models before adaptation through perturbation-aware alignment, data or representation hardening, tamper resistance, and response guidance.Fine-tuning-stage defenses instead intervene during adaptation; the cited work also notes they may require pipeline changes or auxiliary safety resources.Source: §E.1 · pp. 28–29
  • Fine-tuning-stage approaches filter data, regularize updates, alternate safety and task objectives, or shape safety objectives and augment safety data.Examples include BDS, update-regularization methods, Lisa, STAR-DSS, and SafeStyle.Source: §E.1 · p. 29

E.2 Post-fine-tuning-stage Defenses

  • Post-fine-tuning defenses include localized or subspace recovery, rollback or perturbation, pruning, data-efficient realignment, and inference-time intervention.The section groups these methods into four broad paradigms and names Safe LoRA, Panacea, Antidote, One-shot FT, and MetaDefense as examples.Source: §E.2 · p. 30

E.3 Layer-wise Safety Analysis

Prior work localizes safety-relevant layers, but its criteria do not explicitly distinguish whether strengthening a layer increases or decreases refusal. SLDR uses a signed measure and both ends of that spectrum for selective recovery.

E.3 Layer-wise Safety Analysis

  • Safety Layers and LARF identify safety-sensitive layers, with SPPFT protecting layers during fine-tuning and LARF using their representations to filter examples.These studies establish the importance of layer-wise safety localization.Source: §E.3 · p. 30
  • Prior localization criteria do not explicitly characterize the direction of a layer’s effect on refusal.Source: §E.3 · p. 30
  • SLDR’s signed scaling-probe measure distinguishes layers whose strengthening increases refusal from those whose strengthening decreases it, and uses both ends for selective post-fine-tuning recovery.Source: §E.3 · p. 30

F Limitation

SLDR is limited to LoRA-based defense-stage fine-tuning and was not evaluated on larger models or complex out-of-distribution attacks. The paper describes potential positive safety impacts while acknowledging possible malicious exploitation of its analysis.

F Limitation

  • The defense stage supports LoRA fine-tuning only, and experiments did not cover models such as 70B or complex out-of-distribution attacks.The authors also did not discuss the robustness of representation-based routing; crafted examples with malicious scores below the threshold could bypass it.Source: F Limitation · p. 30

G Impact Statement

  • The paper identifies enhancing LLM safety and trustworthiness in fine-tuning-as-a-service as a positive societal impact, while noting that its experimental analysis could enable malicious exploitation.The authors judge the defensive benefits to outweigh those risks.Source: G Impact Statement · p. 31

NeurIPS Paper Checklist

  • The checklist states that Section 5 provides experimental details and information needed to reproduce the main results, and that limitations are discussed in Appendix F.Source: NeurIPS Paper Checklist · pp. 32–34
Loading 2610.10345v1…