[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-273384-105":59,"doc-detail-273384-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","refusalguard-geometry-preserving-fine-tuning-for-safety-in-llms-paper","RefusalGuard - Geometry-Preserving Fine-Tuning for Safety in LLMs - paper","","Fine-tuning safety-aligned language models for downstream tasks can substantially weaken refusal behavior, increasing exposure to adversarial misuse even when fine-tuning data is benign. This work analyzes how internal safety representations evolve during fine-tuning, showing systematic drift, geometric distortion, and interference between task optimization and safety features. The proposed REFUSALGUARD framework preserves safety-relevant geometric structure in hidden representation space while enabling complementary task learning. Evaluations across LLaMA, Gemma, and Qwen show attack success rates comparable to base safety-aligned models with strong downstream utility performance.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/refusalguard-geometry-preserving-fine-tuning-for-safety-in-llms-paper/273384/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/refusalguard-geometry-preserving-fine-tuning-for-safety-in-llms-paper/273384.png","ImageObject",300,407,{"name":92,"@type":93},"Himbo","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-11-04","2026-09-15",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",18,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"Why does post-alignment fine-tuning degrade refusal behavior in safety-aligned LLMs?","Question",{"text":113,"@type":114},"Standard fine-tuning can drift and distort safety-relevant internal representations, creating interference between task optimization and safety features, which increases harmful compliance.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"What internal mechanisms does the paper investigate for alignment degradation?",{"text":118,"@type":114},"It studies representation-level mechanisms via geometric analysis, including directional drift, geometric distortion, and interference effects in the activation space.",{"name":120,"@type":111,"acceptedAnswer":121},"How does REFUSALGUARD preserve safety during fine-tuning?",{"text":122,"@type":114},"REFUSALGUARD constrains updates in hidden representation space so safety-mediating components remain stable while task-specific learning proceeds in complementary directions.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},273384,1789471162,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":140,"language":141,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":67,"update_tm":130,"read_time":145,"preview_page_count":4},687197100911,"https://ap-avatar.wpscdn.com/avatar/a000239b6f1da00475?x-image-process=image/resize,m_fixed,w_180,h_180&k=1785132997149421697","arXiv : 2605 .0 19 13v2 [cs .LG] 2 1 Aug 2026  \nRefusalGuard: Geometry-Preserving Fine-Tuning for Safety in LLMs  \nSadia Asif , Mohammad Mohammadi Amiri  \nDepartment of Computer Science Rensselaer Polytechnic Institute Troy, NY, USA  \n{asifs, [mamiri](mamiri}@rpi.edu)[}](mamiri}@rpi.edu)[@rpi.edu](mamiri}@rpi.edu)  \nAbstract  \nFine-tuning safety-aligned language models for downstream tasks often leads to substantial degradation of refusal behavior, making models vulnerable to adversarial misuse. While prior work has shown that safety-relevant features are encoded in structured representations within the model’s activation space, how these representations change during fine-tuning and why alignment degrades remains poorly understood. In this work, we investigate the representation-level mechanisms underlying alignment degradation. Our analysis shows that standard fine-tuning induces systematic drift in safety-relevant representations, distorts their geometric structure, and introduces interference between task optimization and safety features. These effects collectively lead to increased harmful compliance. Motivated by these findings, we introduce REFUSALGUARD, a representation-level finetuning framework that preserves safety-relevant structure during model adaptation. Our approach constrains updates in hidden representation space, ensuring that safety-mediating components remain stable while allowing task-specific learning in complementary directions. We evaluate REFUSALGUARD across multiple model families, including LLaMA, Gemma, and Qwen, on adversarial safety benchmarks such as AdvBench, DirectHarm4, and JailbreakBench, as well as downstream utility tasks. Our approach achieves attack success rates comparable to base safety-aligned models while maintaining competitive task performance, significantly outperforming baselines.  \n1 Introduction  \nLarge language models (LLMs) are increasingly deployed through post-training customization, where a safety-aligned base model is further fine-tuned for domain-specific tasks, user preferences, or application-specific behaviors (Ouyang et al., 2022; Touvron et al., 2023b; Zhang et al., 2024) . In practice, this adaptation step is often essential: models must be specialized to downstream distributions while retaining the instruction-following and refusal behaviors established during alignment. However, recent work has shown that this assumption is fragile. Even when the fine-tuning data is benign, or when the model is exposed to only a very small number of harmful examples, aligned models can exhibit a substantial loss of safety, becoming more likely to comply with harmful or adversarially phrased requests (Qi et al., 2023; Fraser et al., 2025; Hsiung et al., 2025) . This creates a practical and increasingly important failure mode: a model that is safe at release time may become unsafe after standard post-alignment adaptation.  \nThis phenomenon raises a central question: why does fine-tuning degrade refusal behavior in aligned LLMs? Existing work has largely studied this problem from the level of prompts, datasets, or attack outcomes. These studies establish that alignment can be brittle under both malicious and benign fine-tuning, but they provide limited visibility into the internal mechanisms by which safety is lost (Wehner et al., 2025; Xie et al., 2025; Das et al., 2025) . As a result, current mitigation strategies are often heuristic, focusing on prompt design, additional safety examples, or adversarial training (For details see Appendix 7), without a clear account of what safety-relevant internal structure should be preserved during adaptation.  \nAt the same time, recent interpretability work suggests that refusal behavior is not arbitrary, but mediated by structured representations in activation space. Prior studies show that safety-relevant concepts can often be localized in hidden states and manipulated through representation-level interventions (Wu et al., 2024; Zhang et al.,","cbCaihmylRMpmX9Q","https://ap.wps.com/l/cbCaihmylRMpmX9Q","pdf",1393096,25,"English","# 1 Introduction\n## 1.1 Problem and motivation\n## 1.2 Prior work and research gap\n## 1.3 Proposed approach and contributions","[{\"question\":\"Why does post-alignment fine-tuning degrade refusal behavior in safety-aligned LLMs?\",\"answer\":\"Standard fine-tuning can drift and distort safety-relevant internal representations, creating interference between task optimization and safety features, which increases harmful compliance.\"},{\"question\":\"What internal mechanisms does the paper investigate for alignment degradation?\",\"answer\":\"It studies representation-level mechanisms via geometric analysis, including directional drift, geometric distortion, and interference effects in the activation space.\"},{\"question\":\"How does REFUSALGUARD preserve safety during fine-tuning?\",\"answer\":\"REFUSALGUARD constrains updates in hidden representation space so safety-mediating components remain stable while task-specific learning proceeds in complementary directions.\"}]","RefusalGuard - Geometry-Preserving Fine-Tuning for Safety in LLMs - paper | PDF",63]