When Safety Becomes an Outlier: Understanding the Retention of Large Language Model Safety Behavior

Researchers propose that safety-aligned large language models lose safety behavior after fine-tuning because formulaic refusal strings constitute narrow outlier patterns lacking semantic support, easily overwritten by subsequent updates, and propose the NEST framework to mitigate this. Controlled experiments show that the acquisition of fixed refusals resembles an arbitrary constant string, differing from natural responses with prompt semantic support. NEST (Naturalness-Enhanced Safety Targets) constructs natural, context-aware safety targets in supervised and preference-based alignment settings, using perplexity under the original model as a proxy for distributional support. Across multiple models and alignment methods, the method improves both immediate safety and safety retention after continued fine-tuning without sacrificing helpfulness.