Safety Alignment as Continual Learning: Mitigating the Alignment Tax via Orthogonal Gradient Projection
On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks
also in 1 more
Abstract (arXiv)
Safety post-training can improve the harmfulness and policy compliance of Large Language Models (LLMs), but it may also reduce general utility, a phenomenon often described as the alignment tax. We study this trade-off through the lens of continual learning: sequential alignment stages expose the model to shifted data distributions and objectives, and their gradients may interfere with directions that support previously acquired general capabilities. This view does not claim that all alignment degradation has a single cause; rather, it provides a useful first-order mechanism for mitigating one important source of capability regression. We propose Orthogonal Gradient Projection for Safety Alignment (OGPSA), a lightweight update rule that estimates a low-rank reference subspace from gradients on a small set of general-capability data and removes from each safety gradient the component lying in this subspace. The resulting update is the steepest local safety-descent direction subject to first-order preservation constraints on the reference objectives. OGPSA is compatible with standard post-training pipelines and avoids large-scale replay, although it introduces periodic reference-gradient computation. Across Supervised Fine-Tuning (SFT), Direct Preference Optimization (DPO), and sequential SFTrightarrowDPO settings, OGPSA improves the observed safety--utility trade-off over standard baselines. Under the sequential SFTrightarrowDPO pipeline, the average performance gain increases from 33.98% to 42.74% on Qwen2.5-7B-Instruct and from 19.74% to 32.98% on Llama3.1-8B-Instruct. We have open sourced our code at https://github.com/SunGL001/OGPSA.
Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 64 of its 78 references that are in the map. First posted on arXiv 8 Feb 2026.
Builds on
64 of 78 references.
Closest ancestors · 2
Same direction, newest first
- 2025STAIR: Improving Safety Alignment with Introspective Reasoning4 Feb
- 2023Safe RLHF: Safe Reinforcement Learning from Human Feedback19 Oct
Other references · 62
- 2023GPT-4 Technical Reportcited by 18,132
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2024The Llama 3 Herd of Modelscited by 14,192
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
- 2021Training Verifiers to Solve Math Word Problemscited by 9,743
- 2021Evaluating Large Language Models Trained on Codecited by 8,053
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
- 2020Measuring Massive Multitask Language Understandingcited by 7,768
- 2021Measuring Mathematical Problem Solving With the MATH Datasetcited by 5,203
- 2016Overcoming catastrophic forgetting in neural networkscited by 4,718
- 2024Qwen2.5 Technical Reportcited by 4,713
- 2023Qwen Technical Reportcited by 3,273
38 more
- 2023GPQA: A Graduate-Level Google-Proof Q&A Benchmarkcited by 2,748
- 2016Learning without Forgettingcited by 2,465
- 2017Gradient Episodic Memory for Continual Learningcited by 1,871
- 2024LlamaFactory: Unified Efficient Fine-Tuning of 100+ Language Modelscited by 1,442
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
- 2023Instruction-Following Evaluation for Large Language Modelscited by 1,143
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
- 2021A General Language Assistant as a Laboratory for Alignmentcited by 1,023
- 2021Learning to Prompt for Continual Learningcited by 938
- 2020Dark Experience for General Continual Learning: a Strong, Simple Baselinecited by 895
- 2023A Comprehensive Survey of Continual Learning: Theory, Method and Applicationcited by 860
- 2021Robust fine-tuning of zero-shot modelscited by 785
- 2020Intrinsic Dimensionality Explains the Effectiveness of Language Model Fine-Tuningcited by 658
- 2024WildChat: 1M ChatGPT Interaction Logs in the Wildcited by 598
- 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
- 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 505
- 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 478
- 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 477
- 2023UltraFeedback: Boosting Language Models with Scaled AI Feedbackcited by 394
- 2023Understanding the Effects of RLHF on LLM Generalisation and Diversitycited by 386
- 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 377
- 2024A StrongREJECT for Empty Jailbreakscited by 352
- 2024Measuring short-form factuality in large language modelscited by 345
- 2021Gradient Projection Memory for Continual Learningcited by 338
- 2023HaluEval: A Large-Scale Hallucination Evaluation Benchmark for Large Language Modelscited by 329
- 2024Deliberative Alignment: Reasoning Enables Safer Language Modelscited by 292
- 2023AdaMerging: Adaptive Model Merging for Multi-Task Learningcited by 248
- 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
- 2023Using an LLM to Help With Code Understandingcited by 222
- 2023Mitigating the Alignment Tax of RLHFcited by 181
- 2023SLCA: Slow Learner with Classifier Alignment for Continual Learning on a Pre-trained Modelcited by 178
- 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
- 2023RanPAC: Random Projections and Pre-trained Models for Continual Learningcited by 162
- 2024Continual Learning with Pre-Trained Models: A Surveycited by 151
- 2023Beyond One-Preference-Fits-All Alignment: Multi-Objective Direct Preference Optimizationcited by 121
- 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Modelscited by 98
- 2021Continual Learning for Text Classification with Information Disentanglement Based Regularizationcited by 86
- 2022TRGP: Trust Region Gradient Projection for Continual Learningcited by 79
50 most cited of 62 All 62 (JSON)
Built on by
Citing papers per year: 2026: 6.
6 papers.
- 2026Preserving Foundational Capabilities in Flow-Matching VLAs through Conservative SFTcited by 1
- 2026SafeAnchor: Preventing Cumulative Safety Erosion in Continual Domain Adaptation of Large Language Modelscited by 0
- 2026Behind Harmful Compliance: Behavioral and Mechanistic Divergence Across LLM Jailbreakscited by 0
- 2026Off-Target Effects of Response-Style Alignment in a Korean 27B Language Modelcited by 0
- 2026SafeTune: A Unified Faithful Library for Auditing and Repairing Safety Drift in Fine-Tuned LLMscited by 0
- 2026MASCRDM: Multi-Agent System for Compliance Risk Detection and Mitigation in Training Process of Large Language Modelscited by 0
- 2026MASCRDM: Multi-Agent System for Compliance Risk Detection and Mitigation in Training Process of Large Language Models30 Sep 2026
- 2026Off-Target Effects of Response-Style Alignment in a Korean 27B Language Model10 Sep 2026
- 2026SafeTune: A Unified Faithful Library for Auditing and Repairing Safety Drift in Fine-Tuned LLMs26 Aug 2026
- 2026Preserving Foundational Capabilities in Flow-Matching VLAs through Conservative SFT9 May 2026
- 2026Behind Harmful Compliance: Behavioral and Mechanistic Divergence Across LLM Jailbreaks20 Apr 2026
- 2026SafeAnchor: Preventing Cumulative Safety Erosion in Continual Domain Adaptation of Large Language Models20 Apr 2026
Similar, not cited
Close in wording, no citation either way
- 2026Continual Safety Alignment via Gradient-Based Sample Selection
- 2025Unforgotten Safety: Preserving Safety Alignment of Large Language Models with Continual Learning
- 2026Safety at One Shot: Patching Fine-Tuned LLMs with A Single Instance
- 2026Aligned but Fragile: Enhancing LLM Safety Robustness via Zeroth-Order Optimization
- 2026LSSF: Safety Alignment for Large Language Models through Low-Rank Safety Subspace Fusion
- 2026SafeSteer: Localized On-Policy Distillation for Efficient Safety Alignment
- 2026GR-SAP: Generative Replay for Safety Alignment Preservation during Fine-Tuning
- 2024Towards Comprehensive Post Safety Alignment of Large Language Models via Safety Patching