When Safety Routing Breaks: Understanding Alignment Fragility under Benign Fine-Tuning
Benign fine-tuning severely weakens the safety alignment of large language models (LLMs). The paper proposes a Fisher-geometric explanation: safety Fisher is low-rank, and alignment makes the safety geometry flatter while preserving an output-routing pathway. After 100 benign fine-tuning examples, this pathway is selectively re-sharpened in output-side MLP modules, explaining asymmetric fragility: safety can collapse to high attack success rates, while general utility degrades mildly. The routing view explains why few safety examples can restore refusal behavior, indicating internal safety-relevant representations are preserved. LoRA and ASAM mitigate early collapse by suppressing output-side sharpness, but their protection weakens at larger fine-tuning scales.
A research paper from arXiv (cs.AI) investigates why safety alignment in LLMs is fragile under benign fine-tuning. It attributes the failure to a low-rank output-routing mechanism that gets disrupted, rather than gradient conflict. The study shows that after 100 benign fine-tuning examples, safety can collapse to high attack success rates while general utility degrades only mildly. It also finds that few safety examples can restore refusal behavior, and that LoRA and ASAM mitigate early collapse but lose effectiveness at larger fine-tuning scales.
The paper introduces a Fisher-geometric perspective, showing that safety Fisher is low-rank and alignment flattens safety geometry while preserving an output-routing pathway. Benign fine-tuning selectively re-sharpens this pathway in output-side MLP modules, leading to asymmetric fragility. The routing view explains the restoration of refusal behavior with few safety examples, suggesting internal safety-relevant representations are preserved. LoRA and ASAM suppress output-side sharpness to mitigate early collapse but are less effective at larger scales.
This research highlights a critical vulnerability in deployed LLMs: even benign fine-tuning can break safety alignment, posing risks for organizations that fine-tune models for domain-specific tasks. The finding that few safety examples can restore refusal behavior suggests a potential mitigation strategy, but the weakening of LoRA and ASAM at scale indicates that current safeguards are insufficient for large-scale fine-tuning. This may drive demand for more robust alignment techniques and safety monitoring in production systems.
For AI companies and enterprises using LLMs, this research underscores the risk of safety degradation during fine-tuning, which could lead to reputational damage, regulatory scrutiny, or security incidents. The insight that safety can be restored with few examples offers a cost-effective mitigation, but the limitations of LoRA and ASAM suggest a need for investment in more durable safety-preserving fine-tuning methods. This creates business opportunities for safety tooling and consulting.
Observable next signals include follow-up research on output-routing mechanisms and more robust fine-tuning methods that preserve safety without sacrificing utility. Industry may see increased adoption of safety evaluation benchmarks after fine-tuning and development of new regularization techniques. The paper's findings could influence policy discussions on AI safety standards for fine-tuned models.