mlsanityData to 14 Oct 2026

Active Adaptation, Not Static Defense: Temporal Dynamics of Preventative Steering in Adversarial Fine-Tuning

arXiv 2609.10142 ↗First posted 9 Sep 2026cs.CL cs.AI cs.CRcited by 0

Not on the map. Why?

Abstract (arXiv)

Large language models remain fragile against malicious fine-tuning, motivating training-time defenses against harmful persona drift. Preventative Steering injects undesirable-trait persona vectors during fine-tuning and removes them at evaluation time, yet the mechanism behind its lasting protection remains unclear. Analyzing its temporal optimization dynamics, we find that the defense emerges from an early compensatory adaptation phase followed by a steady-state phase where the corrective signal decays; in parameter space, attention output projections emerge as the dominant residual-write route for defensive updates. Through Intervention Delta Preservation (IDP) and IDP Continuation experiments, we further show that preserving or reinjecting the weight offset fails to maintain protection, indicating that preventative steering relies on active adaptation rather than a static defense. Motivated by this finding, we propose Progressive Intensity Scheduling (PIS), which starts with a moderate injection strength and increases it after static-strength alignment begins to decay. Across the evaluated Qwen2.5 and Gemma-3 models, PIS improves safety robustness over static-strength steering while reducing harmful trait expression.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 29 of its 34 references that are in the map. First posted on arXiv 9 Sep 2026.

Builds on

29 of 34 references.

References · 29

  1. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  2. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  3. 2021A General Language Assistant as a Laboratory for Alignmentcited by 1,055
  4. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  5. 2023Steering Language Models With Activation Engineeringcited by 922
  6. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  7. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 529
  8. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  9. 2025Persona Vectors: Monitoring and Controlling Character Traits in Language Modelscited by 345
  10. 2024Frontier Models are Capable of In-context Schemingcited by 287
  11. 2023Certifying LLM Safety against Adversarial Promptingcited by 266
  12. 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modificationscited by 231
17 more
  1. 2023LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70Bcited by 195
  2. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 173
  3. 2025Agentic Misalignment: How LLMs Could Be Insider Threatscited by 158
  4. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attackscited by 156
  5. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independencecited by 115
  6. 2024Improving Steering Vectors by Targeting Sparse Autoencoder Featurescited by 92
  7. 2025Inoculation Prompting: Eliciting traits from LLMs during training can suppress them at test-timecited by 43
  8. 2025Inoculation Prompting: Instructing LLMs to misbehave at train-time improves test-time alignmentcited by 43
  9. 2024Immunization against harmful fine-tuning attackscited by 35
  10. 2024HSF: Defending against Jailbreak Attacks with Hidden State Filteringcited by 23
  11. 2026PERSONA: Dynamic and Compositional Inference-Time Personality Control via Activation Vector Algebracited by 12
  12. 2025BILLY: Steering Large Language Models via Merging Persona Vectors for Creative Generationcited by 11
  13. 2025You Can't Eat Your Cake and Have It Too: The Performance Degradation of LLMs with Jailbreak Defensecited by 10
  14. 2025ShieldLearner: A New Paradigm for Jailbreak Attack Defense in LLMscited by 7
  15. 2025Guardians of the Agentic System: Preventing Many Shots Jailbreak with Agentic Systemcited by 4
  16. 2026Shifting the Gradient: Understanding How Defensive Training Methods Protect Language Model Integritycited by 3
  17. 2026MANATEE: Inference-Time Lightweight Diffusion Based Safety Defense for LLMscited by 2

Built on by

Not cited yet.