SLDR: Defending Against Malicious Fine-tuning via Selective Layers Recovery and Dynamic Routing
cs.CR, cs.AI
Submitted: 2026-10-07
Updated: 2026-10-07
Comments: Accepted at NeurIPS 2026
Code: https://github.com/Stardust457/SLDR
License: http://creativecommons.org/licenses/by/4.0/
The gist: Fine-tuning-as-a-service enables users to adapt aligned large language models (LLMs) to specialized tasks, but malicious fine-tuning can erode refusal behavior while preserving task performance on
Terminology
Abstract
Fine-tuning-as-a-service enables users to adapt aligned large language models (LLMs) to specialized tasks, but malicious fine-tuning can erode refusal behavior while preserving task performance on legitimate inputs. We revisit recent layer-wise safety diagnostics and find that safety sensitivity is signed: scaling different layers can strengthen refusal, weaken it, or have little effect. Motivated by this observation, we propose SLDR, a post-fine-tuning defense based on Selective Layers Recovery and Dynamic Routing. SLDR trains a LoRA recovery adapter only on the layers with the maximum and minimum sensitivity scores in the signed spectrum, and uses representation-based dynamic routing inference to activate the adapter only for malicious queries. Across four model architectures, five downstream tasks, and four harmful benchmarks, SLDR substantially reduces harmful outputs while preserving downstream utility. On Llama3.1/SST2, SLDR reduces the average harmful score from 11.54 to 0.08 while maintaining downstream accuracy, and the harmful score remains near zero under poisoning ratios up to 0.9. The code is available at https://github.com/Stardust457/SLDR.
Sources
- Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructions
- Defending Against Unforeseen Failure Modes with Latent Adversarial Training
- Vulnerability-Aware Alignment: Mitigating Uneven Forgetting in Harmful Fine-Tuning
- Evaluating Large Language Models Trained on Code
- Training Verifiers to Solve Math Word Problems
- The Llama 3 Herd of Models
- Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Survey
- Mistral 7B
- Rethinking Safety in LLM Fine-tuning: An Optimization Perspective
- LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70B
- SaLoRA: Safety-Alignment Preserved Low-Rank Adaptation
- Fine-Tuning Jailbreaks under Highly Constrained Black-Box Settings: A Three-Pronged Approach
- Robustifying Safety-Aligned Large Language Models through Clean Data Curation
- Decoupled Weight Decay Regularization
- HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal
- Fine-tuning can cripple your foundation model; preserving features may be the solution
- Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!
- Open Problems in Technical AI Governance
- Representation Noising: A Defence Mechanism Against Harmful Finetuning
- Tamper-Resistant Safeguards for Open-Weight LLMs
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Estimating the Social Cost of Corporate Data Breaches
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills