mlsanityData to 7 Oct 2026

AsFT: Anchoring Safety During LLM Fine-Tuning Within Narrow Safety Basin

arXiv 2506.08473 ↗First posted 10 Jun 2025cs.LGcited by 18

Not on the map. Why?

Abstract (arXiv)

Fine-tuning large language models (LLMs) improves performance but introduces critical safety vulnerabilities: even minimal harmful data can severely compromise safety measures. We observe that perturbations orthogonal to the alignment direction - defined by weight differences between aligned (safe) and unaligned models - rapidly compromise model safety. In contrast, updates along the alignment direction largely preserve it, revealing the parameter space as a "narrow safety basin". To address this, we propose AsFT (Anchoring Safety in Fine-Tuning) to maintain safety by explicitly constraining update directions during fine-tuning. By penalizing updates orthogonal to the alignment direction, AsFT effectively constrains the model within the "narrow safety basin," thus preserving its inherent safety. Extensive experiments on multiple datasets and models show that AsFT reduces harmful behaviors by up to 7.60%, improves task performance by 3.44%, and consistently outperforms existing methods across multiple tasks.

Key facts. Cited by 18 papers in the map (data through 7 Oct 2026). Builds on 49 of its 67 references that are in the map. First posted on arXiv 10 Jun 2025.

Builds on

49 of 67 references.

References · 49

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2024The Llama 3 Herd of Modelscited by 14,192
  4. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
  5. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  6. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  7. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  8. 2024Qwen2.5 Technical Reportcited by 4,713
  9. 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,747
  10. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
  11. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  12. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
37 more
  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  2. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  3. 2017Visualizing the Loss Landscape of Neural Netscited by 1,126
  4. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  5. 2022Scaling Laws for Reward Model Overoptimizationcited by 1,056
  6. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  7. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 828
  8. 2023RAFT: Reward rAnked FineTuning for Generative Foundation Model Alignmentcited by 672
  9. 2023RRHF: Rank Responses to Align Language Models with Human Feedback without tearscited by 454
  10. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 450
  11. 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 377
  12. 2024TrustLLM: Trustworthiness in Large Language Modelscited by 280
  13. 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modificationscited by 220
  14. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 197
  15. 2023LLM Lies: Hallucinations are not Bugs, but Features as Adversarial Examplescited by 177
  16. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 158
  17. 2024Tamper-Resistant Safeguards for Open-Weight LLMscited by 132
  18. 2024Safe LoRA: the Silver Lining of Reducing Safety Risks when Fine-tuning Large Language Modelscited by 122
  19. 2024Vaccine: Perturbation-aware Alignment for Large Language Models against Harmful Fine-tuning Attackcited by 113
  20. 2024Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstructioncited by 95
  21. 2024Representation Noising: A Defence Mechanism Against Harmful Finetuningcited by 93
  22. 2023Fine-tuning can cripple your foundation model; preserving features may be the solutioncited by 92
  23. 2024Booster: Tackling Harmful Fine-tuning for Large Language Models via Attenuating Harmful Perturbationcited by 92
  24. 2024Lisa: Lazy Safety Alignment for Large Language Models against Harmful Fine-tuning Attackcited by 89
  25. 2024Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Surveycited by 86
  26. 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 82
  27. 2024Antidote: Post-fine-tuning Safety Alignment for Large Language Models against Harmful Fine-tuningcited by 71
  28. 2024SEAL: Safety-enhanced Aligned LLM Fine-tuning via Bilevel Data Selectioncited by 64
  29. 2024Navigating the Safety Landscape: Measuring Risks in Finetuning Large Language Modelscited by 45
  30. 2024Robustifying Safety-Aligned Large Language Models through Clean Data Curationcited by 43
  31. 2024A safety realignment framework via subspace-oriented model fusion for large language modelscited by 40
  32. 2024Targeted Vaccine: Safety Alignment for Large Language Models against Harmful Fine-Tuning via Layer-wise Perturbationcited by 35
  33. 2024Safety-Aware Fine-Tuning of Large Language Modelscited by 33
  34. 2016PhaseMax: Convex Phase Retrieval via Basis Pursuitcited by 25
  35. 2024Locking Down the Finetuned LLMs Safetycited by 22
  36. 2024Emerging Safety Attack and Defense in Federated Instruction Tuning of Large Language Modelscited by 18
  37. 2024Is Parameter Collision Hindering Continual Learning in LLMs?cited by 15

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 6; 2026: 12.

18 papers.

Sort:

By area:

  1. 2025Uniworld-V2: Reinforce Image Editing with Diffusion Negative-aware Finetuning and MLLM Implicit Feedbackcited by 78
  2. 2025Look-Back: Implicit Visual Re-focusing in MLLM Reasoningcited by 54
  3. 2026ThinkRL-Edit: Thinking in Reinforcement Learning for Reasoning-Centric Image Editingcited by 10
  4. 2025A Guardrail for Safety Preservation: When Safety-Sensitive Subspace Meets Harmful-Resistant Null-Spacecited by 9
  5. 2025Don't Run with Scissors: Pruning Breaks VLA Models but They Can Be Recoveredcited by 8
  6. 2026Antibody: Strengthening Defense Against Harmful Fine-Tuning for Large Language Models via Attenuating Harmful Gradient Influencecited by 6
  7. 2025Unified Defense for Large Language Models against Jailbreak and Fine-Tuning Attacks in Educationcited by 5
  8. 2026Few Tokens, Big Leverage: Preserving Safety Alignment by Constraining Safety Tokens during Fine-tuningcited by 4
  9. 2026Surgery: Mitigating Harmful Fine-Tuning for Large Language Models via Attention Sinkcited by 3
  10. 2026Token-level Data Selection for Safe LLM Fine-tuningcited by 3
  11. 2025HarmRLVR: Weaponizing Verifiable Rewards for Harmful LLM Alignmentcited by 2
  12. 2026Beyond Creed: A Non-Identity Safety Condition A Strong Empirical Alternative to Identity Framing in Low-Data LoRA Fine-Tuningcited by 1
6 more
  1. 2026Locking Pretrained Weights via Deep Low-Rank Residual Distillationcited by 0
  2. 2026Jailbreak to Protect: Buffering and Reinforcing via Temporary Jailbreaking for Safe Fine-Tuning in Large Language Modelscited by 0
  3. 2026Safety Measurements for Fine-tuned LLMs Should be Grounded in Capabilitycited by 0
  4. 2026SafeTune: A Unified Faithful Library for Auditing and Repairing Safety Drift in Fine-Tuned LLMscited by 0
  5. 2026On Mitigation of Subliminal Learning in Large Language Modelscited by 0
  6. 2026Beyond Average Safety: Chance-Constrained LLM Fine-tuningcited by 0