# DataShield: Uncovering Risky Fine-Tuning Data Across LLMs Through Consensus Subspace Alignment

arXiv: https://arxiv.org/abs/2607.15081 · HTML: https://mlsanity.com/paper/2607.15081/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Jul 2026.

## Built on by (most cited first, 4 of 4)

- [DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection](https://mlsanity.com/paper/2607.19829/) (2026)
- [REIN: Bridging the Gap between Reasoning and Reliability via Reflection and Abstention Alignment](https://mlsanity.com/paper/2608.07931/) (2026)
- [Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning](https://mlsanity.com/paper/2608.05045/) (2026)
- [ProbGuard: Calibrated Safety Risk Estimation from LLM Output Distributions](https://mlsanity.com/paper/2608.10621/) (2026)

## Abstract (arXiv)

Fine-tuning large language models (LLMs) on domain-specific datasets has become a standard paradigm for adapting LLMs to specialized applications. However, recent work has shown that even fine-tuning on benign task-specific data can substantially weaken the safety capabilities of LLMs. While existing efforts have made progress in identifying data responsible for safety degradation, they usually rely on a single mean vector computed over a specific model with its tokenizer to represent the safety direction, which limits both the effectiveness and transferability of their risk assessment measures. To address these limitations, we propose DataShield, a data assessment framework that identifies risky fine-tuning samples and response segments through consensus subspace alignment over joint safety-critical semantic spaces derived from multiple safety-aligned LLMs. Within these spaces, DataShield extracts consensus safe and unsafe subspaces using semantic spectral decomposition over safe and unsafe data representations. The risk of a data sample or segment is then estimated by measuring its relative alignment with the unsafe and safe subspaces, enabling both sample-level filtering and fine-grained segment-level masking. Compared with state-of-the-art filtering and masking baselines, DataShield reduces ASR by 14.6% with sample filtering and 32.3% with segment masking, while preserving downstream utility and avoiding target-model-specific risk computation.