mlsanityData to 7 Oct 2026

Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning

arXiv 2608.05045 ↗First posted 5 Aug 2026cs.CR cs.AI cs.CLcited by 0

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

Abstract (arXiv)

Released aligned large language models remain vulnerable to malicious downstream finetuning. Existing defenses are largely designed for the fine-tuning-as-a-service (FTaaS) paradigm or rely on downstream users to follow additional safety procedures, and therefore do not directly address the setting we study: a provider controlled partially protected open-weight (PPOW) release setting in which most weights remain trainable while a small safety-critical component is preserved at release. We propose a Unidirectional Safety Gate (USG), instantiated as a Null Space Cubic Layer together with an Inverse Adapter inserted after the final Transformer layer. During downstream fine-tuning, the cubic layer suppresses or blocks gradients from harmful samples whose hidden states fall in a calibrated protected region, while the Inverse Adapter restores the base model's forward behavior. In practice, we calibrate a threshold using defender-held harmful data, allowing protection to generalize to nearby in-distribution harmful samples. Across six evaluated model-dataset settings, USG keeps post-finetuning attack success rate close to the pre-release level under a fixed release threshold, while maintaining high safe-pass rates on easier settings and exhibiting a clearer safety-utility trade-off on unsafe samples from BeaverTails. These results suggest that release-time representation-space blocking can raise the cost of malicious downstream adaptation without requiring downstream cooperation. The code is available at https://github.com/OpenCausaLab/Gradient-Immunity.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 29 of its 46 references that are in the map. First posted on arXiv 5 Aug 2026.

Builds on

29 of 46 references.

Closest ancestors · 4

Same direction, newest first

  1. 2026MAGIC: A Co-Evolving Attacker-Defender Adversarial Game for Robust LLM Safety2 Feb
  2. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep10 Jun
  3. 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modifications7 Feb
  4. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Dataset10 Jul

Other references · 25

  1. 2023Large Language Modelscited by 774
  2. 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 377
  3. 2024AlphaEdit: Null-Space Constrained Knowledge Editing for Language Modelscited by 224
  4. 2025Crossing the Reward Bridge: Expanding RL with Verifiable Rewards Across Diverse Domainscited by 150
  5. 2025Reinforcement Learning with Verifiable Rewards: GRPO's Effective Loss, Dynamics, and Success Amplificationcited by 108
  6. 2024Booster: Tackling Harmful Fine-tuning for Large Language Models via Attenuating Harmful Perturbationcited by 92
  7. 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 82
  8. 2024Against The Achilles' Heel: A Survey on Red Teaming for Generative Modelscited by 55
  9. 2024On Evaluating the Durability of Safeguards for Open-Weight LLMscited by 51
  10. 2024Nullu: Mitigating Object Hallucinations in Large Vision-Language Models via HalluSpace Projectioncited by 46
  11. 2024Locking Down the Finetuned LLMs Safetycited by 22
  12. 2025Adaptive Defense against Harmful Fine-Tuning for Large Language Models via Bayesian Data Schedulercited by 12
13 more
  1. 2025AlphaFuse: Learn ID Embeddings for Sequential Recommendation in Null Space of Language Embeddingscited by 10
  2. 2025MetaDefense: Defending Finetuning-based Jailbreak Attack Before and During Generationcited by 8
  3. 2026Antibody: Strengthening Defense Against Harmful Fine-Tuning for Large Language Models via Attenuating Harmful Gradient Influencecited by 6
  4. 2026DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protectioncited by 5
  5. 2026TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreakingcited by 4
  6. 2026Internalizing Safety Understanding in Large Reasoning Models via Verificationcited by 3
  7. 2026EvoDefense: Co-Evolving Black-Box Defense with Large Language Modelscited by 3
  8. 2026DataShield: Uncovering Risky Fine-Tuning Data Across LLMs Through Consensus Subspace Alignmentcited by 3
  9. 2025CauSight: Learning to Supersense for Visual Causal Discoverycited by 2
  10. 2026Can Post-Training Transform LLMs into Causal Reasoners?cited by 2
  11. 2026OSNIP: Breaking the Privacy-Utility-Efficiency Trilemma in LLM Inference via Obfuscated Semantic Null Spacecited by 1
  12. 2026Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreakingcited by 1
  13. 2026Self-ReSET: Learning to Self-Recover from Unsafe Reasoning Trajectoriescited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Understanding and Preserving Safety in Fine-Tuned LLMs
  2. 2025Gradient Surgery for Safe LLM Fine-Tuning
  3. 2025CTRAP: Embedding Collapse Trap to Safeguard Large Language Models from Harmful Fine-Tuning
  4. 2025Panacea: Mitigating Harmful Fine-tuning for Large Language Models via Post-fine-tuning Perturbation
  5. 2024Safety Layers in Aligned Large Language Models: The Key to LLM Security
  6. 2025No, of Course I Can! Deeper Fine-Tuning Attacks That Bypass Token-Level Safety Mechanisms
  7. 2026Security in the Fine-Tuning Lifecycle of Large Language Models: Threats, Defenses,Evaluation, and Future Directions
  8. 2024NLSR: Neuron-Level Safety Realignment of Large Language Models Against Harmful Fine-Tuning