Restoring general safety and improving domain-specific safety of fine-tuned large language models without retraining

1. 01What problem does this paper attempt to solve?

   To solve the problem of refusal behavior degrading due to domain fine-tuning (even with purely benign data), the authors propose a training-free weight-level repair method that requires no domain safety data.

   Core question: can the degraded refusal behavior of a safety-aligned LLM after domain fine-tuning be restored or enhanced without retraining? Section 2.2 of the paper formulates this as: given a fine-tuned model M2 with reduced refusal rate, make gradient-free targeted modifications to its parameters so that it restores refusal on harmful prompts while preserving performance on benign prompts.

   • Scenario and importance: deployment often requires domain fine-tuning (medical, legal, financial), but the authors state that even when the fine-tuning data is entirely benign, refusal behavior is eroded (citing Qi et al., 2024b; Fraser et al., 2025), constituting a fundamental challenge to the practical deployment of aligned models.
   • Shortcomings of existing methods: the authors state that existing mitigation approaches—additional preference optimization, constructing domain safety data, modifying the fine-tuning objective, safety prefix backdoors, optimized state separation—typically require additional gradient computation, modifying the training pipeline, or domain calibration data, and are impractical in resource-constrained or data-scarce scenarios; inference-time activation steering increases the false refusal rate, requires per-model tuning, and introduces runtime overhead (citing O'Brien et al., 2025).
   • Core observation: refusal behavior is encoded as a linear direction in the residual stream, and the specific encoding lies in the weight-space structure (citing Arditi et al., 2024); the authors exploit this in reverse—rather than removing weight structure to weaken safety, they inject structure to restore safety.
   • What the paper proposes: SPECTRA (Spectral Refusal Alignment), a training-free, closed-form weight-space intervention that injects the base model's refusal direction into the fine-tuned model's weights via activation-aware low-rank gating, requiring no gradient updates, domain safety annotations, or inference-time steering.
   • Threat model (defense perspective):
     • Victim system: M2 (medical, legal, financial variants) obtained by fine-tuning a safety-aligned base M1 (Llama-2-Chat-7B, Gemma-2-9B-IT) on public domains.
     • Attacker goal: make the fine-tuned model give non-refusal answers to harmful instructions, measured by ASR.
     • Attacker knowledge and capability: evaluation covers standard decoding and adversarial decoding in which the attacker manipulates the decoding process (Huang et al., 2024b), as well as the white-box attack GCG and the black-box attacks GPTFuzz and TAP.
     • Defender setting: can only modify M2's weights, with no retraining, no domain safety data, and no change to the inference pipeline.

   Collapse this answer

2. 02What related research exists?

   Related work falls into three groups: safety degradation and repair after fine-tuning, refusal directions and activation steering, and weight-space safety structure; there are also five steering/editing baseline methods.

   Safety degradation caused by fine-tuning and its repair

   • Qi et al. (2024b), Fraser et al. (2025)—cited by the authors as the basis for the problem: a small amount of adversarial data can greatly reduce safety, and fine-tuning on purely benign data also erodes refusal behavior.
   • Repair work: additional preference optimization by Han et al. (2024), domain safety data construction by Jan et al. (2024), modifying the fine-tuning objective by Qi et al. (2024a), safety prefix backdoors by Wang et al. (2024a), optimized state separation by Huang et al. (2024a). The paper criticizes these methods for relying on additional gradient computation, modifying the training objective, or requiring domain calibration data, limiting cost and applicability.
   • Chhabra et al. (2024), Jain et al. (2023)—analyze the effect of fine-tuning on model circuits from a mechanistic interpretability perspective.

   Refusal direction and activation steering

   • Arditi et al. (2024)—identify the refusal direction and show that ablating this direction from the weights constitutes a white-box jailbreak; this paper's refusal direction estimation and selection algorithm follows their difference-in-means procedure (Appendices F, I).
   • O'Brien et al. (2024), Cunningham et al. (2023)—discover steering vectors with sparse autoencoders; O'Brien et al. (2025), Lee et al. (2025), Panickssery et al. (2023) apply steering at inference time. The paper points out that inference-time activation steering increases the false refusal rate, requires per-model tuning, and introduces runtime overhead.
   • Chhabra and Khalili (2025)—use steering vectors to improve the safety of compressed models.

   Safety structure in weight space and low-rank decomposition

   • Wei et al. (2024)—evaluate the fragility of safety alignment through pruning and low-rank modifications; this paper uses their ALIGN dataset to isolate safety-critical ranks and borrows their GCG attack settings (Appendix G).
   • Qin et al. (2026)—propose superweights: a few parameters have an outsized influence on model behavior. The paper uses this to argue the risk of full-matrix injection, as motivation for the low-rank design.
   • Hsu et al. (2021), Yuan et al. (2023)—activation-aware low-rank decomposition methods, followed in Step 1 of this paper.

   Comparison methods and benchmarks: Table 5 compares false refusal rate changes with five steering/editing methods—ActAdd (Arditi and Obeso, 2023), ROSI (Shairah et al., 2025), CAST (Lee et al., 2025), Steer2Edit (Sun et al., 2026), SafeMERGE (Djuhera et al., 2026); safety evaluation uses AdvBench-Eval, MedSafeEval, and the self-built LawSafeEval, FinSafeEval.

   The authors position this paper as: directly injecting a steering vector into the low-rank safety-related space of a fine-tuned variant, distinct from the above methods that require retraining or inference-time intervention; and claim that, to their knowledge, it is the first method that improves the domain safety of fine-tuned models without backpropagation.

   Collapse this answer

3. 03How does the paper address this problem?

   SPECTRA has two steps: perform SVD on harmful-prompt activations to obtain a low-rank gate, then inject the base refusal direction into that subspace as a rank-one update, with the update strength automatically gated by the input.

   Overall approach: rather than retraining or steering at inference time, it writes the base model M1's refusal direction directly into the weights of the fine-tuned model M2, and uses an activation-aware low-rank structure to restrict the intervention to the subspace most active for harmful inputs. The method is named SPECTRA (Spectral Refusal Alignment).

   Problem setting and refusal direction

   • Let M1 be the safety-aligned base and M2 its domain fine-tuned variant, with r1 and r2 their respective refusal directions; the goal is to make gradient-free modifications to M2's parameters that restore refusal on harmful prompts while preserving the original behavior on benign prompts.
   • The refusal direction is constructed by difference-in-means: for layer l and token position i, the candidate direction is the difference between the class-mean activations of harmful and harmless prompts. Intervention experiments on a held-out validation set select (i*, l*): ablating the direction should suppress refusal on harmful prompts, and injecting it should cause harmless prompts to elicit refusal; the one with the largest joint causal effect is chosen (Appendix F gives the three metrics bypass_score, induce_score, and kl_score, along with the constraints: induce_score > 0, kl_score < 0.1、l < 0.8L）。
   • 方向估计数据（附录 I）：有害集来自 AdvBench、MaliciousInstruct、TDC2023、HarmBench，无害集来自 Alpaca，各 160 条，按 128 训练 / 32 验证划分。

   两步权重更新

   • Step 1 激活感知低秩分解：设 W 为 M2 中某注意力输出投影或 MLP 投影矩阵，Xin 为有害提示（实验用 ALIGN 数据集）前向得到的投影前激活矩阵。求秩 ρ 近似使有害激活上的输出失真最小：W̃ = argmin_{rank  W̃ ≤ ρ} ‖ W X_in − W̃ X_in ‖_F²，对 W·Xin 做 SVD 取前 ρ 个左奇异向量得正交投影 Π = UUᵀ，闭式解 W̃ = ΠW。
   • Step 2 谱拒答注入：W′ = W + α r₁ r₁^⊤ W̃，其中 α > 0 is a steering hyperparameter. This rank-one perturbation is gated by W̃: the output is modified along r1 only for inputs that activate the harmful subspace Π.

   Equivalence of conditionally activated steering

   • Theorem 1: the updated output is h′ = h + β·r1, where β = α·r1ᵀΠh depends on the degree of alignment between h and the harmful subspace. For harmful prompts, h lies more within the span of U, so β is large and steering is strong; for benign inputs β ≈ 0 and the output is essentially unchanged.
   • The authors state that this makes SPECTRA geometrically self-gating: the intervention strength automatically scales with the harmfulness of the input representation, requiring no runtime classifier or threshold.

   Experiments on direction and layer selection (Section 5)

   • Four injections are compared: injecting r1 at layer l1, r2 at layer l2, r1 at layer l2, and r2 − r1 at layer l2. Full-matrix injection (the special case W̃ = W) is first used for screening on the medical version of Llama-2-7b-chat, with α=0.015 (attention)/0.01 (MLP).
   • Conclusion: injecting r1 at layer l2 has the lowest ASR×Adv-Dec. and the lowest GCG ASR (tied with r2 − r1 at 4), and does not cause ASRVanilla or ASRIAdv-Dec. to rise; subsequent experiments fix r1 injected at l2.
   • Mechanism analysis (200 Harmful Behaviors + 200 Alpaca): fine-tuning reduces the separability d′ of the three directions (Figure 1), and the amount of each direction written in M2 loses about a quarter and almost does not originate from the l2 layer weights (Figure 2); gating selectivity (Figure 3) shows that for r1 the harmful/harmless ratio is 15.1 on attention and 8.2 for r2, and 2.0 and 2.1 respectively on the MLP; the authors therefore argue that r1's advantage comes from its alignment with the harmful writing path.

   Hyperparameters

   • α is determined by light tuning per model variant (Appendix D, Table 7: Llama-2 medical 0.07/0.05, legal 0.1/0.03, financial 0.1/0.05; both Gemma-2 variants use attention 0.01, MLP 0.00).
   • The rank ρ is reported per variant (Appendix E, Table 8: e.g., Llama-2 medical 2096/4096, Gemma-2 medical attention 1048/2048, MLP 2048/3048).
   • At most two projection matrices are modified per layer; all experiments take about 300 GPU hours (6 NVIDIA A6000, Appendix C).

   Collapse this answer

4. 04What experiments did the paper conduct?

   On five domain fine-tuned variants from two model families, it measures ASR under four attacks and domain safety, general and domain capabilities, false refusal rate, and multi-turn dialogue; the authors report that ASR generally decreases.

   Experimental Setup

   • Models tested: medical, legal, and financial fine-tuned variants of Llama-2-Chat-7B, and medical and financial fine-tuned variants of Gemma-2-9B-IT, 5 variants in total, each compared with its own unsteered BASE.
   • Safety evaluation: general safety uses AdvBench-Eval (the first 100 prompts of AdvBench), reporting ASRVanilla and ASRAdv-Decoding (distinguishing with and without chat template, recorded as ASRI and ASR×); domain safety uses MedSafeEval for medical, and the authors' self-built LawSafeEval (201 items) and FinSafeEval (142 items, generated by Gemini 2.5 Pro as 2000 candidates and then manually filtered and annotated) for legal and financial.
   • Jailbreak evaluation: GCG (Appendix G: 500 iterations, batch size 256, top-k 128, three independent trials taking the three suffixes with the highest ASR), GPTFuzz, TAP.
   • Judging method: refusal annotation uses the HarmBench Llama2-13B Classifier (refusal-score 1/0); TAP and GPTFuzz are scored by GPT-3.5-Turbo; the false refusal rate evaluation uses Gemini 2.5 Pro as the automatic judge.
   • Capability evaluation: general zero-shot uses HellaSwag, BoolQ, RTE, ARC Challenge, Winogrande (LM Harness); domain uses PubMedQA, MedMCQA, FinanceBench, and the Abercrombie and Hearsay tasks of LegalBench; multi-turn uses MultiChallenge.
   • False refusal rate: 1000 benign Alpaca instructions, reporting the change before and after steering (Post − Pre).

   Main Results

   Table 2: ASR (%) of each model variant, BASE vs. SPECTRA, lower is better.

   Swipe horizontally to read the table

   Model	Domain	Method	GCG	AdvDecoding	Vanilla	GPTFuzz	TAP	In-Domain
   Llama2	Medical	BASE / SPECTRA	31.0 / 6.0	18.4 / 9.6	0.0 / 0.0	8.8 / 0.0	22.0 / 0.0	28.78 / 11.56
   Llama2	Legal	BASE / SPECTRA	66.0 / 43.0	29.6 / 23.2	0.0 / 0.0	15.0 / 13.0	58.0 / 0.0	17.0 / 6.5
   Llama2	Financial	BASE / SPECTRA	62.0 / 47.0	29.0 / 29.0	0.0 / 0.0	7.8 / 7.8	28.0 / 0.0	8.45 / 7.05
   Gemma2	Medical	BASE / SPECTRA	36.0 / 0.0	9.4 / 5.6	1.0 / 0.0	68.6 / 7.0	36.0 / 0.0	20.0 / 5.44
   Gemma2	Financial	BASE / SPECTRA	66.0 / 1.0	49.2 / 16.0	21.0 / 0.0	64.7 / 0.0	8.0 / 10.0	71.83 / 7.04

   • The authors state that SPECTRA improves refusal behavior on all tested models, with the largest ASR reduction on the two Gemma-2-9b-it variants; and state that its protection against GCG (white-box) and GPTFuzz, TAP (black-box) is independent of attack type.
   • Exceptions: the Llama2 financial variant is unchanged on AdvDecoding (29.0) and GPTFuzz (7.8); the Gemma2 financial variant's TAP rises from 8.0 to 10.0.
   • The authors state that each model variant requires a different α and rank ρ, and the reported results underwent light hyperparameter tuning (Appendices D, E).

   Capability Preservation: General and Domain

   • General consistency (Table 4): the authors state that SPECTRA's effect on general capability is statistically negligible, with some entries slightly improved; the largest exception is the Gemma-2-9b-it financial variant, whose general consistency drop is the largest among all models (e.g., BoolQ 86.0→91.0 is an improvement, RTE 77.0→80.5 is an improvement; the main text states this variant has the largest drop, while in the table its Winogrande 70.5→72.5, ARC 53.0→52.5 and other items rise and fall), and the authors state that this drop is mild and accompanies the largest safety gain.
   • Domain consistency (Table 3): the authors state that each variant preserves domain knowledge, with no statistically significant drop in domain performance; e.g., Llama2 medical PubMedQA 77.5/77.5, MedMCQA 41.7/41.7, Gemma2 financial FinanceBench 66.7→68.0.

   False Refusal Rate and Comparison Methods

   • False refusal rate (Table 5, 1000 Alpaca items, Gemini 2.5 Pro judge): SPECTRA average change 0.2%, comparison methods ActAdd 94.0%, ROSI 7.5%, CAST 61.9%, Steer2Edit 20.1%, SafeMERGE 15.0%.
   • Exceptions: the Gemma2 financial variant's false refusal rate rises by 1.3%, which the authors state coexists with this variant's largest safety gain, constituting a mild safety–utility trade-off; the Llama2 legal variant is −0.8%.
   • The authors state that, unlike activation steering methods (O'Brien et al., 2025), SPECTRA does not substantially increase the false refusal rate.

   Multi-turn Dialogue

   • MultiChallenge (Table 6, four dimensions: Inference Memory / Self Coherence / Instruction Retention / Reliable Editing): the authors state that SPECTRA's effect varies with model, domain, and dimension, with no consistent directional trend.
   • The authors point out that the base models themselves score low on this benchmark, limiting the strength of the conclusions, and evaluation on larger, stronger models is needed.

   Other Ablations and Analyses

   • Direction × layer selection (Table 1, medical Llama-2 full-matrix injection): l2 injecting r1 gives ASR×Adv-Dec. of 10.8 and GCG of 4 (unsteered 18.4 and 31).
   • Separability (Figure 1): the d′ of the three directions r1, r2, DiM in M2 are all lower than in M1.
   • Write magnitude (Figure 2): r1 writes 3.93 in M1 and 2.99 in M2; the share explained by the weight difference W1−W2 is 0.65 for r1 and 0.53 for r2.
   • Gating selectivity (Figure 3): on attention, r1 is 15.1 and r2 is 8.2; on MLP, r1 is 2.0 and r2 is 2.1.
   • α sensitivity (Figures 4, 5, medical Llama-2): fixing MLP α=0.05 and sweeping attention α, fixing attention α=0.07 and sweeping MLP α, reporting GCG ASR curves (specific values are not labeled in the figures).
   • Direction position drift (Table 9): after fine-tuning, the layer and token positions of the refusal direction shift on all variants (e.g., Llama2 medical l2/l1 = 13/14, tp2/tp1 = −5/−1).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors point out two limitations—adaptive attacks and unevaluated capabilities—and list directions such as generalization of behavior steering; the experiments cover only two model families and five domain variants.

   Limitations and Future Directions Noted by the Authors

   • Adaptive attacks (Section 8 Limitations): the authors believe sufficiently adaptive attacks can likely be constructed to bypass SPECTRA's protection, and list remaining robust to emerging attack strategies as future work.
   • Capability evaluation coverage (Section 8): the authors point out that modern language models have many capabilities not evaluated in this work, and weight-level steering may affect subtle task-specific capabilities in ways not covered by the benchmarks, requiring more comprehensive capability evaluation.
   • Strength of multi-turn conclusions (Section 7): the base models themselves score low on MultiChallenge, limiting the strength of the conclusions; the authors state that evaluation on larger, stronger models is needed to generalize these findings, and list this as a future direction.
   • Safety and capability rising together (Section 6.2): the authors state that in individual cases SPECTRA slightly improves benchmark performance, and exploring whether weight-level steering can simultaneously improve safety and capability is a future direction.
   • Framework generalization (Appendix A Future Work): the authors state that SPECTRA's weight-level steering framework may generalize to behavior steering tasks beyond refusal, and plan to evaluate on a broader range of attacks, model capabilities, and application domains.
   • Dual use (Appendix A Ethical Considerations): the authors point out that mechanistic interpretability research may be maliciously exploited, and their method carries a risk of being used for malicious purposes.

   Scope of Experimental Coverage

   • The models tested are Llama-2-Chat-7B (medical, legal, financial) and Gemma-2-9B-IT (medical, financial), 2 families and 5 publicly available domain fine-tuned variants in total (Section 4).
   • Attack evaluation covers four types: GCG, GPTFuzz, TAP, and adversarial decoding; GCG is run as three independent trials per the settings in Appendix G (Section 4, Appendix G).
   • General capability uses 5 zero-shot tasks, domain capability uses PubMedQA, MedMCQA, FinanceBench, and two tasks of LegalBench, and multi-turn uses MultiChallenge (Section 4).
   • The false refusal rate uses 1000 Alpaca prompts with a Gemini 2.5 Pro judge; direction estimation data are 160 items per group (128 train / 32 validation) (Section 6.3, Appendix I).
   • α and rank ρ are tuned separately per model variant (Appendices D, E); the paper does not report the number of repetitions for each benchmark, nor the agreement between the automatic judge and human annotation.

   Collapse this answer

6. 06Summarize the main content of the paper

   SPECTRA writes the base refusal direction into the fine-tuned model's weights via low-rank gating, and the authors report that on five domain variants it reduces ASR with capability and the false refusal rate essentially unchanged.

   A defense paper: addressing the degradation of refusal behavior in safety-aligned LLMs after fine-tuning on purely benign domains, it proposes SPECTRA, a training-free, closed-form, weight-level repair method that requires no gradient updates, domain safety data or inference-time intervention.

   • Problem: The authors say existing mitigation methods (preference optimization, safety data construction, modifying the fine-tuning objective, etc.) require additional training or domain data; inference-time activation steering raises the false refusal rate and introduces runtime overhead.
   • Method: SVD is performed on harmful-prompt activations to obtain a low-rank projection gate, and the base model's refusal direction is injected as a rank-one update into the fine-tuned model's attention outputs and MLP projection matrices; Theorem 1 gives its equivalence to conditional activation steering, and the update strength automatically scales with the degree of alignment between the input and the harmful subspace. At most two projection matrices are modified per layer, and all experiments took about 300 GPU hours.
   • Safety results (Table 2): On five domain fine-tuned variants of Llama-2-Chat-7B and Gemma-2-9B-IT, the authors report that GCG, adversarial decoding, GPTFuzz, TAP and domain ASR generally decreased, e.g., for the Gemma2 medical variant GCG ASR fell from 36.0% to 0.0%, and for the financial variant from 66.0% to 1.0%; the exception is the Gemma2 financial variant's TAP, which rose from 8.0% to 10.0%.
   • Capability and false refusals: The authors say changes on general and domain benchmarks are statistically negligible (Tables 3, 4); the average false refusal rate changed by 0.2%, lower than five comparison methods including ActAdd (94.0%) and CAST (61.9%) (Table 5), with the exception of a 1.3% increase for the Gemma2 financial variant.
   • Mechanism findings: The authors report that the refusal direction transfers across fine-tuned variants of the same base, that the layers and token positions of the direction shift after fine-tuning (Table 9), and that r1's advantage comes from its alignment with the harmful writing path at decisive positions (Figure 3).
   • Authors' conclusions and implications: The authors believe fine-tuning preserves the shared geometric structure of refusal, and that safety can be restored through targeted weight-space operations rather than full retraining; they also acknowledge that sufficiently adaptive attacks may bypass the defense, and that many model capabilities were not evaluated.

   Collapse this answer

Related papers