mlsanityData to 14 Oct 2026

Layer-Aware Representation Filtering: Purifying Finetuning Data to Preserve LLM Safety Alignment

arXiv 2507.18631 ↗First posted 24 Jul 2025cs.CRcited by 24

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

With rapid advancement and increasing accessibility of LLMs, fine-tuning aligned models has become a critical step for adapting them to real-world applications, which makes the safety of this fine-tuning process more important than ever. However, recent studies have highlighted a critical challenge: even when fine-tuning with seemingly benign downstream datasets, the safety of aligned LLMs can be compromised, making them more susceptible to malicious instructions. In this paper, we show that fine-tuning datasets often contain samples with safety-degrading features that are not easily identifiable on the surface. These samples can significantly degrade the safety alignment of LLMs during fine-tuning. To address this issue, we propose LARF, a Layer-Aware Representation Filtering method. This method identifies safety-sensitive layers within the LLM and leverages their representations to detect which data samples in the post-training dataset contain safety-degrading features. Experimental results demonstrate that LARF can effectively identify benign data with safety-degrading features. After removing such data, the safety alignment degradation caused by fine-tuning is mitigated. Please see our code at https://github.com/LLLeoLi/LARF.

Key facts. Cited by 24 papers in the map (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 32 of its 58 references that are in the map. First posted on arXiv 24 Jul 2025.

Builds on

32 of 58 references.

Closest ancestors · 6

Same direction, newest first

  1. 2025SafeMERGE: Preserving Safety Alignment in Fine-Tuned Large Language Models via Selective Layer-Wise Model Merging21 Mar
  2. 2025X-Boundary: Establishing Exact Safety Boundary to Shield LLMs from Multi-Turn Jailbreaks without Compromising Usability14 Feb
  3. 2024Safety Layers in Aligned Large Language Models: The Key to LLM Security30 Aug
  4. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep10 Jun
  5. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!5 Oct
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 26

  1. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  2. 2021Measuring Mathematical Problem Solving With the MATH Datasetcited by 5,371
  3. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  4. 2019PubMedQA: A Dataset for Biomedical Research Question Answeringcited by 1,288
  5. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  6. 2023BloombergGPT: A Large Language Model for Financecited by 939
  7. 2023The Flan Collection: Designing Data and Methods for Effective Instruction Tuningcited by 739
  8. 2024LESS: Selecting Influential Data for Targeted Instruction Tuningcited by 532
  9. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 356
  10. 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
  11. 2024SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Modelscited by 228
  12. 2024What is in Your Safe Data? Identifying Benign Data that Breaks Safetycited by 118
14 more
  1. 2024GradSafe: Detecting Jailbreak Prompts for LLMs via Safety-Critical Gradient Analysiscited by 96
  2. 2024Keeping LLMs Aligned After Fine-tuning: The Crucial Role of Prompt Templatescited by 96
  3. 2024Representation Noising: A Defence Mechanism Against Harmful Finetuningcited by 96
  4. 2024SEAL: Safety-enhanced Aligned LLM Fine-tuning via Bilevel Data Selectioncited by 64
  5. 2024VLSBench: Unveiling Visual Leakage in Multimodal Safetycited by 63
  6. 2023Large Language Models in Education: Vision and Opportunitiescited by 54
  7. 2025Spurious Forgetting in Continual Learning of Language Modelscited by 51
  8. 2025T2ISafety: Benchmark for Assessing Fairness, Toxicity, and Privacy in Image Generationcited by 48
  9. 2024ASETF: A Novel Method for Jailbreak Attack on LLMs through Translate Suffix Embeddingscited by 32
  10. 2025Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injectioncited by 25
  11. 2024Safeguard Fine-Tuned LLMs Through Pre- and Post-Tuning Model Mergingcited by 11
  12. 2025Response Attack: Exploiting Contextual Priming to Jailbreak Large Language Modelscited by 10
  13. 2024DiffusionAttacker: Diffusion-Driven Prompt Manipulation for LLM Jailbreakcited by 9
  14. 2025Detecting and Filtering Unsafe Training Data via Data Attribution with Denoised Representationcited by 9

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 5; 2026: 19.

24 papers.

Sort:

By area:

  1. 2025Towards Understanding Subliminal Learning: When and How Hidden Biases Transfercited by 34
  2. 2026LLM Safety From Within: Detecting Harmful Content with Internal Representationscited by 11
  3. 2025LLMs Deceive Unintentionally: Emergent Misalignment in Dishonesty from Misaligned Samples to Biased Human-AI Interactionscited by 8
  4. 2026Be Your Own Red Teamer: Safety Alignment via Self-Play and Reflective Experience Replaycited by 6
  5. 2026Q-realign: Piggybacking Realignment on Quantization for Safe and Efficient LLM Deploymentcited by 5
  6. 2026Surgery: Mitigating Harmful Fine-Tuning for Large Language Models via Attention Sinkcited by 4
  7. 2026SafeSteer: Localized On-Policy Distillation for Efficient Safety Alignmentcited by 4
  8. 2025HarmRLVR: Weaponizing Verifiable Rewards for Harmful LLM Alignmentcited by 3
  9. 2025Contextual Image Attack: How Visual Context Exposes Multimodal Safety Vulnerabilitiescited by 3
  10. 2025The Unintended Trade-off of AI Alignment:Balancing Hallucination Mitigation and Safety in LLMscited by 2
  11. 2026Safeguarding LLM Fine-tuning via Push-Pull Distributional Alignmentcited by 2
  12. 2026Risk Awareness Injection: Calibrating Vision-Language Models for Safety without Compromising Utilitycited by 2
12 more
  1. 2026No More, No Less: Least-Privilege Language Modelscited by 1
  2. 2026Where Concept Erasure Should Occur: Concept-Layer Alignment in Text-to-Video Diffusion Modelscited by 1
  3. 2026DataShield: Safety-degrading Data Filtering for LLM Benign Instruction Fine-Tuningcited by 1
  4. 2026Emergent Misalignment Can Be Induced by Sycophancy and Reversed via Alignment Gatingcited by 1
  5. 2026Beyond Token-Level Guidance: Inference-Time Alignment of Specialized LLMs via Cross-Family Representation Steeringcited by 1
  6. 2026Subliminal Learning as Trait-Direction Drift: A Mechanism and Targeted Control under SFT Distillationcited by 1
  7. 2026CoT is Not the Chain of Truth: An Empirical Internal Analysis of Reasoning LLMs for Fake News Generationcited by 0
  8. 2026From Parameter Dynamics to Risk Scoring : Quantifying Sample-Level Safety Degradation in LLM Fine-tuningcited by 0
  9. 2026Low-Agreeableness Persona Conditioning for Safe LLM Fine-Tuningcited by 0
  10. 2026Defending Against Harmful Supervision Hidden in Benign Samplescited by 0
  11. 2026CLEAR: Continuous Latent Adapter Routing for Utility-Preserving LLM Safety Alignmentcited by 0
  12. 2026Multilingual Safety Signals Are Multi-Layered: Filtering Safety-Degrading Data for Safer LLMscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026DataShield: Uncovering Risky Fine-Tuning Data Across LLMs Through Consensus Subspace Alignment
  2. 2025Gradient Surgery for Safe LLM Fine-Tuning
  3. 2025Curvature-Aware Safety Restoration In LLMs Fine-Tuning
  4. 2025LLM Safety Alignment is Divergence Estimation in Disguise
  5. 2025Vulnerability-Aware Alignment: Mitigating Uneven Forgetting in Harmful Fine-Tuning
  6. 2026Understanding and Preserving Safety in Fine-Tuned LLMs
  7. 2026Safety at One Shot: Patching Fine-Tuned LLMs with A Single Instance
  8. 2025Secure LLM Fine-Tuning via Safety-Aware Probing