Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning

Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning Yuxuan Huang1,2 , Xingyu Zeng3∗ , Tianhang Zheng4 , Chaochao Lu1 * 1 Shanghai Artificial Intelligence Laboratory 2 Shanghai Jiao Tong University 3 Shenzhen University of Advanced Technology 4 Zhejiang University huangyuxuan@pjlab.org.cn, zengxingyu@suat-sz.edu.cn zthzheng@zju.edu.cn, luchaochao@pjlab.org.cn Abstract

and advanced reasoning techniques such as Chainof-Thought (CoT) (Wei et al., 2022) and Reinforcement Learning with Verifiable Rewards (RLVR) (Su et al., 2025; Mroueh, 2025). These advances have significantly enhanced the reasoning capabilities of models, enabling them to achieve strong performance across downstream tasks such as mathematical reasoning, code generation, and causal understanding (Liu et al., 2024; Grattafiori et al., 2024; Achiam et al., 2023; Zhang et al., 2025; Chen et al., 2026). However, LLMs still face numerous safety challenges (Shanghai AI Lab, 2025; Purpura et al., 2025; Qi et al., 2024a; Lin et al., 2025; Qi et al., 2026). Beyond the inherent vulnerabilities during inference, such as insufficient depth in safety alignment (Qi et al., 2024a; Zhang et al., 2026b; Wu et al., 2026) and susceptibility to misleading prompts that fail to counter toxic input (Melamed et al., 2024; Li et al., 2026; Zeng et al., 2026; He et al., 2026a,b), they also exhibit significant weaknesses when confronted with malicious AI trainers (Huang et al., 2024b). Research has shown that a small amount of toxic training data can completely break a model’s original safety alignment (Wei et al., 2024; Wu et al., 2026). Existing fine-tuning defense methods are primarily designed for the fine-tuning-as-a-service (FTaaS) paradigm (Huang et al., 2024b; Weng et al., 2025; Li et al., 2026; Zhang et al., 2026a; Wen et al., 2026) and therefore do not directly match the provider-controlled PPOW release setting studied here, in which most weights remain trainable after release while a small safety-critical subset must remain protected under provider-side hardening (Qi et al., 2024b). We focus on low-budget downstream SFT under this same release assumption; FTaaS can be viewed as a special case in which stronger provider-side control makes the protected-subset assumption easier to satisfy. Current defense approaches can be categorized into

arXiv:2608.05045v1 [cs.CR] 5 Aug 2026

Released aligned large language models remain vulnerable to malicious downstream finetuning. Existing defenses are largely designed for the fine-tuning-as-a-service (FTaaS) paradigm or rely on downstream users to follow additional safety procedures, and therefore do not directly address the setting we study: a provider-controlled partially protected open-weight (PPOW) release setting in which most weights remain trainable while a small safety-critical component is preserved at release. We propose a Unidirectional Safety Gate (USG), instantiated as a Null Space Cubic Layer together with an Inverse Adapter inserted after the final Transformer layer. During downstream fine-tuning, the cubic layer suppresses or blocks gradients from harmful samples whose hidden states fall in a calibrated protected region, while the Inverse Adapter restores the base model’s forward behavior. In practice, we calibrate a threshold using defender-held harmful data, allowing protection to generalize to nearby in-distribution harmful samples. Across six evaluated model–dataset settings, USG keeps post-finetuning attack success rate close to the pre-release level under a fixed release threshold, while maintaining high safe-pass rates on easier settings and exhibiting a clearer safety– utility trade-off on unsafe samples from BeaverTails. These results suggest that release-time representation-space blocking can raise the cost of malicious downstream adaptation without requiring downstream cooperation. The code is available at https://github.com/ OpenCausaLab/Gradient-Immunity.

1

Introduction

Recent years have witnessed remarkable performance leaps in Large Language Models (LLMs), driven by architectural innovations like Mixture-ofExperts (MoE) (Cai et al., 2025; Liu et al., 2024) * Corresponding authors.

1

three types (Huang et al., 2024b): alignment-based methods (Rosati et al., 2024; Huang et al., 2024c,a), fine-tuning stage methods (Bianchi et al., 2023; Zong et al., 2024), and post-fine-tuning stage methods (Casper et al., 2024; Yi et al., 2024). Alignment stage defenses, such as Vaccine (Huang et al., 2024c), can only defend against specific types of data attacks and may weaken under stronger downstream adaptation. Fine-tuning stage defenses, like SafeInstr (Bianchi et al., 2023), require the trainer to use a specific training framework; however, in this PPOW setting, a downstream fine-tuner may simply choose a different training pipeline for the exposed weights. Post-fine-tuning stage defenses, such as SafetyLock (Zhu et al., 2024), require users to perform activation steering toward safe directions after training, which cannot be relied upon once the model is released. These methods therefore share a common limitation: they depend on downstream compliance with additional safety procedures (Huang et al., 2024b). This motivates a built-in safety mechanism that remains active after release and reduces reliance on user cooperation. To address this challenge, we propose a novel Unidirectional Safety Gate (USG), a mechanism intended for the PPOW setting rather than a fully productized hardening artifact. Inspired by nullspace theory (Fang et al., 2024), our USG can be inserted as a plug-in module into a pretrained model. During downstream fine-tuning, it acts as a selective safety filter: for inputs that trigger harmful behaviors, their hidden states are projected toward a protected null-space region. Empirically, nonparticipating but in-distribution harmful samples also tend to exhibit lower norm-ratio values than safe samples, which gives the defender room to choose a release-time threshold that extends blocking coverage beyond the null-space build set. This mechanism prevents gradient propagation from blocked harmful samples to earlier layers of the model, thereby reducing harmful pattern acquisition during downstream SFT. The main contributions of this work are summarized as follows: 1) Conceptual Framing: We introduce the concept of Unidirectional Safety Gate (USG), a release-time blocking mechanism for the PPOW setting that reduces reliance on downstream user cooperation. 2)Mechanism Design: We instantiate USG with a Null Space Cubic Layer and an Inverse Adapter. The cubic layer induces a calibrated protected region for harmful representations and blocks harmful gradient propagation

during downstream fine-tuning, while the Inverse Adapter restores the base model’s forward behavior. 3) Practical Modularity: Our method introduces minimal parameter overhead and can be inserted as a plug-in module into compatible pretrained models. In our evaluated setting, it preserves safe utility while the norm-ratio statistics show that nonparticipating but in-distribution harmful samples also tend to fall closer to the protected region than safe samples, allowing threshold calibration to extend blocking coverage beyond the participating harmful samples. The present paper evaluates this blocking behavior directly rather than claiming a fully validated deployment artifact.

2

Related Work

Fine-tuning Attacks and Defenses. While the safety capabilities of LLMs during inference have become increasingly robust, their resistance to malicious fine-tuning remains insufficient (Qi et al., 2024b). In the last two years, several works have addressed this challenge under the fine-tuning-as-aservice (FTaaS) paradigm, e.g., (Rosati et al., 2024; Huang et al., 2024c; Bianchi et al., 2023; Zong et al., 2024; Casper et al., 2024; Yi et al., 2024; Hu et al., 2025b; Jiang and Pan, 2025; Liu et al., 2025; Huang et al., 2024a). For example, Huang et al. (2024a) preserve alignment performance by attenuating harmful perturbations, whereas Rosati et al. (2024) erase harmful representations to make them harder to recover during fine-tuning. Null Space Applications in LLMs. Null-space methods have shown promising results in privacy protection (Cao et al., 2026), preserving unrelated knowledge during fine-tuning or knowledge injection (Fang et al., 2024; Hu et al., 2025a; Sun et al., 2025), mitigating catastrophic forgetting, and reducing hallucinations (Yang et al., 2025b). To the best of our knowledge, our work is the first to apply null-space methods to fine-tuning defense.

3

Problem Formulation

3.1

Threat Model

We study a provider-controlled partially protected open-weight (PPOW) release setting. The provider releases a model in which most parameters remain open and trainable for downstream users, preserving standard fine-tuning capability, while a small safety-critical parameter subset is preserved through provider-side hardening such as freezing, encryption, structural entanglement, or 2

3.2

deployment-time fusion with downstream computation. The attacker has white-box access to the released architecture and full control over downstream training on the exposed weights, including the choice of data, optimizer, and training pipeline. We exclude attacks that require deleting, bypassing, replacing, or independently retraining the protected component, because such attacks are substantially more expensive than ordinary downstream fine-tuning in the PPOW setting. Accordingly, we focus on jailbreak by parameter update on the exposed weights. Our experiments further restrict attention to downstream supervised finetuning (SFT) under a low-budget regime, with materially fewer resources than were used to train the released model, e.g. a single GPU with 80 GB memory and on the order of 100 harmful samples. We do not claim coverage of more general postrelease optimization procedures. If an attacker had substantially greater resources, they could instead train or heavily repurpose a separate harmful model directly, making protection of the released model less relevant. Let M0 denote the released model with parame0 ,W 0 ters W0 = (Wopen prot ), where Wopen are the exposed trainable weights and Wprot is the protected safety-critical subset. We consider an adversarial trainer whose goal is to erode the safety alignment of M0 through malicious downstream fine-tuning while preserving benign utility. We assume the adversary possesses a fully harmful QA dataset Dadv consisting of adversarial question–answer pairs designed to elicit prohibited behaviors (e.g. bypassing safety filters or leaking private data). The attacker updates only the exposed weights, yielding a corrupted model M1 with parameters 1 ,W W1 = (Wopen prot ):
1 Wopen = arg min L M (Wopen , Wprot ), Dadv (1)

Our goal is to develop a proactive defense mecha′ nism that transforms M0 into a robust variant M0 ′ (with weights W0 ) before it is released to downstream users. Let Dtoxic denote a poisoned dataset drawn from the same distribution as Dadv . This ′ defense aims to ensure that even if M0 is subse′ quently fine-tuned on Dtoxic to produce M1 , the resulting model remains resilient to the adversarial influence of Dtoxic while maintaining performance on the safe dataset Dsafe . We assume that the model provider has a defensive dataset Ddefense , and Dtoxic ∪ Dsafe ⊆ Ddefense . Formally, we view the following as ideal design objectives for a release-time defense in the PPOW setting: • Safety Invariance (idealized): For adversarial inputs x ∈ Dtoxic with IsToxic(M0 , x) = 0, the desired outcome is that the safety state remains stable: ′

• Utility Generalization (desired): The trans′ formation from M0 to M0 should not hinder legitimate learning. For safe data, the model should still converge to an improved state: ′

′

Perform(M1 , Dsafe ) ≥ Perform(M0 , Dsafe ) ≈ Perform(M0 , Dsafe ) (3) • Strict Constraint Enforcement (idealized): In the fully blocked regime, the defense would ′ keep M1 from becoming more harmful than M0 on the protected harmful distribution, thereby reducing the adversarial utility of Dtoxic while preserving the released model’s capacity for safe downstream adaptation.

where L is typically the standard cross-entropy loss. The adversary’s objective is to maximize harmful response success on Dadv while retaining as much benign capability as possible. Formally, let IsToxic(M, x) ∈ {0, 1} be a binary indicator of whether model M generates a harmful response to input x. A successful attack satisfies: =

′

IsToxic(M1 , x) = IsToxic(M0 , x) = 0 (2)

Wopen

• ∀x ∈ Dadv , IsToxic(M0 , x) IsToxic(M1 , x) = 1

Defensive Objectives and Robust Alignment

3.3

Formal Definition of the Unidirectional Safety Gate

To achieve the transformation from M0 to M0′ , we introduce a safeguard module into the original model. Specifically, inputs from the safe dataset can pass through the safeguard structure normally, while the gradient backpropagation for inputs from the prohibited subset is blocked by this structure. The prohibited subset is denoted as Dforbidden . Unidirectional Safety Gate(USG) Definition: Suppose a layer with parameters W is inserted

0 but

• M1 retains or improves performance on benign benchmarks compared to M0 . 3

after the k-th transformer layer. Let Ddefense be the input dataset and Dforbidden ⊆ Ddefense be a subset of prohibited inputs. For any input sample x ∈ Ddefense , let hx = f (k) (x) denote the hiddenstate tensor at the input of this layer, where f (k) (.) denotes the forward function of the embedding layer and the first k Transformer layers. Let the forward propagation output of this layer be denoted as f (hx , W ). During the training process of the network, let L denote the overall loss function of the network. The gradient of the loss with respect x ,W ) . to the layer input is ∂L(h ∂hx If the following conditions hold:

Figure 1: The figure illustrates the idealized behavior of a USG-style safeguard. For harmful data, it functions as a diode: during backpropagation, the USG sets gradients to zero, inducing gradient vanishing and thereby blocking gradient propagation. For safe data, it acts as a wire without inducing gradient vanishing in the idealized exact-blocking definition. Its core idea is the controllable induction of gradient vanishing—normally an undesirable behavior in model training.

• Forward Normality: For any input x ∈ Ddefense , the forward computation f (hx , W ) is well-defined, producing a valid output tensor. • Backward Blocking: For any prohibited input x ∈ Dforbidden , we have ∂L(hx , W ) = 0. ∂hx

a fixed threshold, safe fine-tuning still preserves a degree of harmful-blocking functionality.

(4)

4.2

For any input x ∈ Ddefense \Dforbidden , no additional constraints are imposed on the gradient.

As a concrete instantiation of the abstract USG, we introduce the cubic layer. The cubic layer is inserted after a Transformer layer, specifically after the residual connection of the preceding Transformer layer and before the input to the subsequent layer (which need not be a Transformer layer). Suppose the cubic layer is inserted after the k-th Transformer layer; we denote it as CLk , where CL stands for Cubic Layer. Given a model M composed of n Transformer layers, if a cubic layer is inserted after its k-th Transformer layer, we refer to the resulting model as MkCL . Let f (i) denote the submodel of M consisting of the embedding layer and the first i Transformer layers, such that (i) its output for an input x is fx . Clearly, because the first k Transformer layers of MkCL are identical to those of M , the submodel formed by the first i Transformer layers (i ≤ k) of MkCL is also (i) fx . Moreover, to avoid compromising the original performance of the model, an Inverse Adapter is appended after the cubic layer to analytically recover its forward output. The role of the Cubic Layer in the model is as illustrated in Figure 2.

Then the layer is defined as a USG upon the prohibited input subset Dforbidden . It should be noted that USG is an abstract mechanism class rather than a specific architectural instantiation; the Null Space Cubic Layer and Inverse Adapter introduced later provide one concrete realization. The role of USG in the model is as illustrated in Figure 1.

4

Methodology

4.1

Overall Framework

Cubic Layer

To implement the aforementioned USG, we employ a cascade of a Null Space Cubic Layer and an Inverse Adapter. The cubic layer provides backward blocking on protected harmful inputs, while the Inverse Adapter compensates for the forward distortion and preserves the base-model behavior. In practice, exact null-space construction is approximated by a threshold on the norm ratio, implemented as a backward gate, rather than a hard semantic decision about whether a sample is harmful. The provider can calibrate a fixed harmful block-rate target on harmful reference data, and freeze a release threshold for deployment. Appendix A gives the gate implementation details, and Appendix B reports the observation that, under

4.2.1 Definition Definition. Let h ∈ RB×L×D be the layer-input hidden-state tensor, where - B denotes the batch 4

4.2.2 Gradient of Cubic Layer Consider a backward pass with loss L, and let ∂L ∂O(h) = GB . Given the output of the cubic layer O(h) = ((hW )hT )h, ∂L ∂h can be decomposed into the following three terms. term1 = (GB hT )(hW T ) term2 = (hGT B )(hW ) T

(6)

T

term3 = ((hW )h )GB where · denotes matrix multiplication. The total gradient is then given by ∂L = term1 + term2 + term3 . (7) ∂h Detailed calculation is provided in Appendix C. Observing term1 , term2 , and term3 , we note that each contains the factors hW T and hW . If W is such that both hW T and hW are approximately zero, the vanishing gradient phenomenon can be induced, thereby blocking backward propagation through the model. To achieve this effect, we construct a symmetric matrix W from the common right null space of the dataset Dforbidden for which gradient blocking is intended. In other words, for layer-input hidden-state tensors h induced by samples in Dforbidden , W is chosen so that hW = hW T = 0 in the exact setting. In our experiments, we use ∥hW ∥ to quantify how close hW is to the zero vector, where ∥ · ∥ denotes the Frobenius norm.

Figure 2: The roles of the Cubic Layer and Inverse Adapter in the model are illustrated in the figure. Here, M denotes the original model, MkCL represents the model obtained by inserting the Cubic Layer and the CL Inverse Adapter after the k-th Transformer, and MN represents the model obtained by inserting the Cubic Layer and the Inverse Adapter after the N -th Transformer.

size (the number of independent samples processed in one forward pass), - L denotes the sequence length (the number of tokens per sample, possibly after padding or truncation), - D denotes the hidden dimension (the dimensionality of the feature vector for each token). Let W ∈ RD×D be a pre-set and unlearnable parameter. To facilitate the matrix operations defined below, we reshape this hidden-state tensor as h ∈ RB×L×1×D , i.e., we introduce a singleton dimension. The output of the cubic layer is then defined as

4.2.3 Null Space Cubic Layer Preliminary. For a model MkCL , let SY = {Y1 , Y2 , . . . , Yn } denote the tokenized inputs obtained from dataset D, and define the set of layerinput hidden-state tensors Sf (k) = {f (k) (Y1 ), f (k) (Y2 ), . . . , f (k) (Yn )}, (8) Y

T

O(h) = ((hW )h )h,

(5)

By construction, Sf (k) is precisely the set of Y layer-input hidden-state tensors for the cubic layer in MkCL . Define hj = f (k) (Yj ) for j = 1, 2, . . . , n, and let Sh = {h1 , h2 , . . . , hn } (9)

In this paper, all matrix multiplications and the transpose operation (·)T are applied to the last two dimensions of the tensors, i.e., treating the first two dimensions B and L as batch dimensions via broadcasting. Specifically, for h ∈ RB×L×1×D , its transpose hT ∈ RB×L×D×1 is obtained by swapping its last two dimensions. If W satisfies hW = 0 and hW T = 0, then this cubic layer is referred to as a Null Space Cubic Layer.

The right null space of a matrix H ∈ RN ×N is defined as null(H) = {p ∈ RN | Hp = 0}, 5

(10)

for each sample index b ∈ 1, . . . , B and token index ℓ ∈ 1, . . . , L the layer acts independently on hb,ℓ ∈ R1×D , yielding O(h)b,ℓ = sb,ℓ hb,ℓ with sb,ℓ = hb,ℓ W hT b,ℓ . Hence, for every batch element and every token position, the cubic layer preserves the direction of the local hidden-state vector and only rescales it by a scalar determined by that local hidden state and W. Since W is positive semidefinite, this structure yields an analytic inverse in the non-degenerate T = case sb,ℓ > 0: if yb,ℓ = O(h)b,ℓ , then yb,ℓ W yb,ℓ 3 sb,ℓ , and thus the inverse function is

and the common right null space of the set Sh of matrices is defined as nullcommon (Sh ) = {p ∈ RN | ∀h ∈ Sh , hp = 0}. (11) Definition. A cubic layer is called a Null Space Cubic Layer if and only if ∀h ∈ Sh , hW = hW T = 0.

(12)

To construct such a cubic layer, we first compute a symmetric matrix W from the common right null space of Sh . Specifically, let nullcommon (Sh ) denote the common right null space of Sh . Let V ∈ RN ×r be the matrix whose columns form a basis of nullcommon (Sh ), where r is the dimension of the common null space. Consequently, V satisfies ∀h ∈ Sh ,

hV = 0.

T −1/3 hb,ℓ = yb,ℓ ((yb,ℓ W yb,ℓ ) ).

By contrast, when sb,ℓ = 0, the inverse mapping at that position collapses to yb,ℓ = 0 and becomes many-to-one, so there is no unique inverse. The collapse cases are discussed in the Appendix D. Here, it suffices to note that the Inverse Adapter can be applied to any sample in our evaluated setting, compensating for the deterministic distortion introduced by the cubic layer without introducing additional trainable parameters.

(13)

To ensure both hW = 0 and hW T = 0 for all h ∈ Sh , we choose W = V V T.

(14)

Since W is symmetric, we have W T = W , and because the columns of V span the common right null space of Sh , it follows that hW = hV V T = 0 for every h ∈ Sh . Note that the parameter W of the cubic layer is not learnable; it is fixed and computed as described above. 4.3

4.4

Combined USG Realization

The proposed safeguard is formed by composing the Null Space Cubic Layer with the Inverse Adapter. Together, these two components realize the USG-style behavior studied in this paper: the cubic layer provides threshold-based backward blocking of gradient propagation for inputs from the prohibited subset Dforbidden , while the Inverse Adapter analytically compensates for the distortion introduced by the cubic layer.

Inverse Adapter

In the forward pass of the model MkCL , the hidden states after the cubic layer differ from those in the original model M0 ; specifically, O(h) ̸= h for the cubic layer. This mismatch renders the subsequent modules incompatible with the current output. Moreover, the parameter W of the cubic layer is fixed and not learnable. Therefore, we append an Inverse Adapter after the cubic layer to analytically undo this deterministic distortion and almost exactly recover the hidden states that would be produced without the cubic layer. To derive this adapter, we first characterize the structure of the cubic-layer transformation. The output of the cubic layer has the form O(h) = ((hW )hT )h.

(16)

• Forward Normality: For any layer-input hidden-state tensor h, the forward computation remains well-defined. The cubic layer first applies the deterministic distortion O(h) = ((hW )hT )h, and the Inverse Adapter then analytically compensates for this distortion. Thus, the combined cubic-layerplus-adapter structure preserves the basemodel forward behavior whenever the backward gate is inactive, up to negligible numerical error.

(15) • Backward Blocking: In the exact null-space formulation, if h = f (k) (x) for some input sample x ∈ Dforbidden , then hW = hW T = 0.

Since h ∈ RB×L×1×D with matrix multiplications applied only on the last two dimensions, 6

space, where r is the dimension of the common null space. The parameter matrix of the cubic layer is then set to W = V V T , which is symmetric and constructed from that common right null space, thereby ensuring that for any h ∈ Sf (N ) , we have hW ≈ 0 and hW T ≈ 0. We refer to harmful samples that participate in the null-space computation as participating harmful samples, namely harmful samples in Dforbidden , and those that do not participate as non-participating harmful samples, namely harmful samples in Dtoxic \ Dforbidden . For more details, refer to the corresponding section in the Appendix F. Step 4. Obtaining the Inverse Adapter. The Inverse Adapter is given directly by the analytic inverse function of the cubic layer, and therefore requires no iterative training. Its purpose is to preserve the base model’s forward behavior on both safe and harmful samples, whereas the gradient blocking studied in this paper is entirely produced by the Null Space Cubic Layer. Step 5. Model Release. After construction, the Null Space Cubic Layer and the Inverse Adapter are assumed to be preserved under the PPOW setting. One possible realization is discussed in ApCL , equipped pendix E. The final model M0′ = MN with the fixed cubic layer and the Inverse Adapter, is then released.

Since term1 , term2 , and term3 all contain factors hW or hW T , the backward gradient becomes exactly zero. In the practical instantiation used in this paper, we instead compute the norm ratio r(h) = ∥hW ∥/∥h∥ and implement backward blocking through a threshold gate: gradients are suppressed when r(h) ≤ τ and passed otherwise. 4.5

Protected Release Assumptions and Tampering Resistance

The threat model in Section 3.1 assumes that the protected component cannot be removed at negligible cost after release. Here we only note one plausible realization of that assumption: the provider may fuse the safeguard with adjacent computation so that isolating and deleting it requires additional reconstruction or retraining. We treat parameter fusion as one concrete supporting instantiation; Appendix E gives a theoretical discussion and a gating-based training method. 4.6

Pipeline

The proposed safeguard mechanism is implemented through the following steps: Step 1. Cubic Layer Insertion. Starting from a pre-trained model M , we insert a cubic layer followed by an Inverse Adapter after its last TransCL , former layer, resulting in the modified model MN where N denotes the number of Transformer layers in M . Step 2. Collecting Hidden-State Tensors for the Cubic Layer. Let DT be a set of harmful question–answer pairs collected by the model provider. The set of tokenized inputs obtained from DT is SY = {Y1 , Y2 , . . . , Yn }. For every input Y ∈ SY , we compute its layer-input hidden-state tensor for the cubic layer, i.e., its hidden representation after the N -th Transformer layer, by forwardpropagating through the original model M . This yields a set of hidden-state tensors

5

Experiment

We evaluate our method on two tasks: (1) resistance to harmful fine-tuning and (2) forward restoration by the Inverse Adapter. For the resistance task, we use a practical threshold-based instantiation of the null-space mechanism, implemented as a backward gate. To extend the sample limit, we use extended null-space selection; details are provided in Appendix F. Our main resistance results adopt a strict fixed-threshold 100% harmful-block setting, where the threshold is calibrated once on defender-held harmful reference data and then kept fixed during evaluation. Let r(h) = ∥hW ∥/∥h∥ and let τ denote the threshold. The safe pass rate is the proportion of safe samples satisfying r(h) > τ , while the harmful block rate is the proportion of harmful samples satisfying r(h) ≤ τ . Further threshold-calibration details for the strict fixed-threshold 100% harmful-block release setting are reported in Appendix A.

Sf (N ) = {f (N ) (Y1 ), f (N ) (Y2 ), . . . , f (N ) (Yn )}, where f (N ) denotes the submodel consisting of the embedding layer and the first N Transformer layers of M . Step 3. Null Space Extraction and CubicLayer Parameter Construction. We compute the common right null space of the matrices in Sf (N ) , each treated as a row vector. Let V ∈ RN ×r be a matrix whose columns form a basis of this null 7

Model

Safeguard

JailbreakBench

HarmfulBench

BeaverTails-H

Pre

Post

Pre

Post

Pre

Post

Qwen-14B

None Booster RepNoise Antibody Null Space Cubic

0.04 0.04 0.04 0.04 0.04

0.55 0.16 0.53 0.04 0.04

0.05 0.05 0.05 0.05 0.05

0.29 0.09 / 0.19 0.05

0.07 0.07 0.07 0.07 0.07

0.215 0.30 0.38 0.135 0.07

Llama-8B

None Booster RepNoise Antibody Null Space Cubic

0.01 0.01 0.01 0.01 0.01

0.74 0.62 0.08 0.00 0.01

0.04 0.04 0.04 0.04 0.04

0.37 0.10 / 0.13 0.04

0.035 0.035 0.035 0.035 0.035

0.78 0.435 / 0.07 0.035

Table 1: ASR before and after harmful fine-tuning under different safeguarding methods on JailbreakBench, HarmfulBench, and BeaverTails-H. Pre refers to ASR before harmful fine-tuning, while Post refers to ASR after harmful fine-tuning on the corresponding harmful dataset. Under the strict fixed-threshold 100% harmful-block release policy used for Null Space Cubic, post-fine-tuning ASR remains at the pre-release level across all six settings, indicating that harmful downstream updates do not further erode the safeguard in this evaluated strict-threshold setting once the frozen release threshold fully blocks the participating harmful reference set. Boldface marks the best post-fine-tuning defense result (lowest ASR) within each model–dataset block. The symbol ‘/‘ denotes runs with severe generation-quality degradation, including substantial utility loss, nonsensical generations, or mode collapse, for which the resulting ASR is not reported as a meaningful comparison.

Model

For BeaverTails-H, we use 100 harmful training examples to construct the Null Space Cubic Layer, while the remaining 100 harmful samples do not participate in the null-space computation but are used for threshold calibration as non-participating harmful samples. This strict persistence setting matches the PPOW setting above, in which the attacker’s harmful training data are covered by the defender-held harmful reference set. For each harmful build set, the resulting Null Space Cubic Layer is inserted after the last TransCL . former layer to obtain a safeguarded model MN This yields three safeguarded models per base model family; with two base model families, Qwen and Llama, we obtain a total of six models.

JailbreakBench HarmfulBench BeaverTails-H

Qwen-14B Llama-8B

100% 100%

100% 100%

79% 69%

Table 2: Safe pass rate under the strict fixed-threshold 100% harmful-block release policy used in Table 1. This policy preserves perfect safe pass rate in the JailbreakBench and HarmfulBench settings for both model families, but becomes visibly more conservative in the harder BeaverTails-H setting.

5.1 5.1.1

Setup Models and Datasets

We adopt Qwen3-14B (reported as Qwen-14B in tables) (Yang et al., 2025a) and Llama-3.1-8B (reported as Llama-8B in tables) (Grattafiori et al., 2024) as our test models for both tasks. Restoration datasets. We evaluate forward restoration on 2,000 samples from the Alpaca dataset (Taori et al., 2023). Resistance datasets. We use harmful QA examples from JailbreakBench (Chao et al., 2024), HarmfulBench (Mazeika et al., 2024), and BeaverTails-H (Ji et al., 2023), where BeaverTailsH denotes the unsafe subset of BeaverTails in this paper. For JailbreakBench and HarmfulBench, we use 100 harmful training examples per dataset; these same 100 examples serve both as the participating harmful build set used to construct the Null Space Cubic Layer and as the downstream harmful fine-tuning set in the strict persistence experiments.

5.1.2

Baselines.

Restoration baselines. The original pre-trained model serves as the baseline for the restoration task. Specifically, we compare the performance of our defended model against that of the original model, both evaluated on the same safe dataset without any fine-tuning. Resistance baselines. Among different defense strategies, both fine-tuning-stage and post-finetuning-stage methods can be trivially circumvented by an attacker with full control over the training pipeline. Consequently, we select the model without any safeguard, as well as models protected by alignment-stage defense methods, including Rep Noise (Rosati et al., 2024), Booster (Huang et al., 8

2024a), and the latest gradient-based alignment method AntiBody (Nguyen et al., 2026), as our baselines. 5.1.3

settings. The backward gate induced by this frozen threshold preserves 100% safe pass rate for both Qwen-14B and Llama-8B on JailbreakBench and HarmfulBench, while BeaverTails-H is more conservative, reducing safe pass rate to 79% for Qwen14B and 69% for Llama-8B.

Hyper-Parameters and Training Settings.

For the resistance tasks, supervised fine-tuning (SFT) is conducted. The AdamW optimizer (Loshchilov and Hutter, 2017) is employed with full-precision training. The learning rate is set to 4e-5, with a maximum gradient norm of 1.0 and a warmup ratio of 0.2. Restoration setting. No restoration-stage parameter training is performed; the Inverse Adapter is applied directly through the analytic inverse map. Resistance setting. We adopt the Inverse Adapter fixed throughout the resistance tests, while the Null Space Cubic Layer provides the blocking behavior. As a concrete low-budget attack instantiation, we fine-tune only the last five Transformer layers using a standard SFT objective. All other hyper-parameters remain identical to those used in the restoration setting. 5.2

5.3

Restoration Results

Since Alpaca is a question-answering dataset, we evaluate restoration quality using the QA-pair accuracy (ACC). The results are shown in Table 3, where response correctness is judged by DeepSeekV3. Table 3 shows that, in our evaluated setting, the Inverse Adapter preserves base-model performance on the restoration benchmark. This is consistent with the intended role of the Inverse Adapter: it restores the cubic-layer outputs back toward the base model’s outputs, while the gradient blocking itself is carried out by the Null Space Cubic Layer. To directly verify that the Inverse Adapter is not merely preserving one downstream benchmark but is almost exactly undoing the cubic-layer distortion on benign data, we further evaluate the Inverse Adapter in isolation. Concretely, we load the released safeguarded model, feed the original lastlayer hidden states through the Inverse Adapter, and compare the recovered hidden states and logits against the base-model outputs on a 500-sample benign mixed evaluation set. The results in Table 4 show perfect top-1 token agreement for all six runs, hidden-state cosine similarity numerically indistinguishable from 1, and very small relative reconstruction error. Additional details on the Inverse Adapter implementation and its practical behavior are provided in Appendix D.

Resistance Results

We report the attack success rate (ASR) of models trained on harmful datasets under different safeguard mechanisms. Concretely, we first apply a safeguard (e.g., Null Space Cubic or Booster) to a base model M0 (e.g., Qwen3-14B or Llama-3.18B) to obtain a safeguarded model M0′ , and then measure its ASR before and after harmful finetuning. The column pre denotes the ASR before harmful training, and post denotes the ASR on the same dataset after training. For the strict fixedthreshold 100% harmful-block release policy used by Null Space Cubic, this comparison should be read together with the safe pass rates: unchanged post-ASR with high safe pass indicates persistence of the safeguard rather than blanket refusal. For the Null Space Cubic method, the main resistance experiments use the strict fixed-threshold 100% harmful-block release setting. The threshold is chosen as the maximum observed ratio ∥hW ∥/∥h∥ over defender-held harmful reference samples at release time, and is then kept fixed throughout downstream harmful fine-tuning and evaluation. Table 1 reports the resulting pre/post ASR, and Table 2 reports the associated safe pass rates under the same frozen threshold. Under this setting, Null Space Cubic keeps post-fine-tuning ASR at the pre-release level in all six model–dataset

5.4

Blocking Generalization and Conditional Persistence

To better characterize the behavior of the safeguard on unseen harmful data, we distinguish two questions. The first is blocking generalization: whether a safeguard constructed from participating harmful samples, i.e., harmful samples in Dforbidden , can still induce lower ∥hW ∥/∥h∥ ratios on nonparticipating harmful samples, i.e., harmful samples in Dtoxic \ Dforbidden , drawn from the same harmful distribution. The second is conditional persistence: whether the safeguard remains effective under continued harmful retraining once some harmful samples escape blocking. These two questions are related but not identical. 9

Model

Method

ACC

Qwen-14B

Base Model Inverse Adapter

66.0% 66.0%

Llama-8B

Base Model Inverse Adapter

60.0% 60.0%

Table 3: Restoration ACC on the Alpaca dataset. In our evaluated setting, the Inverse Adapter matches the original base-model performance on this benchmark, consistent with its role as an analytic forward-restoration map rather than a separate trainable component. Top-1 Agr. ↑

Logits KL ↓

Hidden Cos. ↑

Hidden Rel. L2 ↓

JailbreakBench HarmfulBench BeaverTails

1.000000 1.000000 1.000000

4.93e-06 2.10e-04 1.91e-03

1.000000000 1.000000000 1.000000000

5.91e-06 1.04e-03 2.75e-03

JailbreakBench HarmfulBench BeaverTails

1.000000 1.000000 1.000000

1.82e-10 2.88e-05 1.70e-05

1.000000000 1.000000000 1.000000000

1.50e-07 6.04e-05 5.57e-05

Model

Safeguard Source

Qwen-14B

Llama-8B

Table 4: Inverse-only fidelity on a 500-sample benign mixed evaluation set. For each released safeguarded model, we apply only the Inverse Adapter and compare the recovered outputs against the original base-model hidden states and logits. Across all six runs, top-1 token agreement is perfect, hidden-state cosine similarity is numerically indistinguishable from 1, and hidden relative L2 error remains very small, supporting the claim that the Inverse Adapter almost exactly undoes the cubic-layer distortion. Under the inverse-adapter-plus-extended-null-space regime studied here, strict zeros are practically absent, so this same forward-preservation property extends to essentially all samples while the gradient blocking itself remains the responsibility of the Null Space Cubic Layer.

We first examine blocking generalization at a fixed release-time safeguard. Figure 3 visualizes ∥ the norm ratio ∥hW ∥h∥ for different sample groups in the Qwen-14B BeaverTails-H setting. Although non-participating harmful samples are not used to construct the null space, their norm ratios still tend to be smaller than those of safe samples, indicating that the induced protected region extends beyond the participating harmful build set at the representation level. This is the main sense in which the null-space safeguard generalizes beyond Dforbidden . It also clarifies why threshold calibration matters: because the defender controls the releasetime threshold, this representation-level separation can be translated into practical blocking coverage on in-distribution harmful samples while preserving high pass rates on safe data.

threshold calibration. Lower calibration thresholds reduce the risk of unnecessarily gating safe data but weaken harmful blocking coverage, whereas higher calibration thresholds improve harmful blocking at the cost of gating more safe data. USG should therefore be understood as a release-time calibrated threshold mechanism implemented as a backward gate, whose persistence depends on blocking coverage of harmful fine-tuning signals.

6

Conclusion

In conclusion, this paper proposes a Unidirectional Safety Gate implemented by a Null Space Cubic Layer together with an Inverse Adapter, which serves as a defense against malicious downstream fine-tuning in a PPOW setting by blocking the gradient backpropagation of harmful data inside a calibrated protected region under provider-side hardening assumptions. Experimental results across various datasets demonstrate two complementary findings: non-participating but in-distribution harmful data also tend to exhibit lower ∥hW ∥/∥h∥ ratios than safe data, allowing appropriate defendercalibrated thresholds to extend blocking coverage beyond the participating harmful build set; and under the strict deployment-style setting in which the release threshold is calibrated on the complete defender-held harmful reference set available at re-

We next consider a boundary case of conditional persistence under continued adaptation, in which the in-distribution harmful samples used for threshold calibration remain inside the protected region while a small fraction of out-of-distribution (OOD) harmful samples falls beyond the threshold. In this setting, the frozen threshold-controlled gate is typically preserved under small updates but can be breached by sufficiently large updates; details are deferred to Appendix G. This yields a safety–utility trade-off through 10

0.005

|hW|/|h|

an attack-effective manifold. Soft gradient blocking based on the null space represents a promising direction for future research.

safe participating harmful non participating harmful tuned threshold

0.006

0.004

Dependence on Inverse-Branch Availability. Our strongest forward-preservation claim is tied to the inverse-adapter-plus-extended-null-space regime emphasized in this paper, where exact zeros are practically absent and the inverse branch therefore remains defined for essentially all samples. If a future deployment were to operate closer to the exact-null-space limit, then some hidden states could collapse to strict zero and the analytic inverse would no longer be uniquely defined at those positions. In that regime, preserving exact basemodel outputs for every sample would require an additional design beyond the analytic inverse used here.

0.003 0.002 0.001 0

50

100

150

200

250

300

Sample index

Figure 3: Norm-ratio visualization in the Qwen14B BeaverTails-H setting of participating harmful samples Dforbidden , non-participating harmful samples Dtoxic \ Dforbidden , and safe samples. Although the nonparticipating harmful samples are not used to construct the null space, they still tend to lie closer to the protected region than safe samples, showing a representation-level tendency that supports defender-calibrated thresholdbased blocking beyond the build set.

Limited Harmful Sample Number. As the number of harmful samples increases, the stacked harmful hidden-state matrix tends to approach full rank, so a non-trivial common null space may disappear. In that regime, the strict constraint used by our method can become infeasible. An Extended Null Space Selection strategy approximation instead of exact zero singular directions, see Appendix F can partially mitigate this issue by replacing exact null-space constraints with approximate ones. Appendix F shows that exact null-space selection remains feasible for only tens of harmful samples in our evaluated settings, whereas extended nullspace selection substantially enlarges the usable sample regime in the BeaverTails/Qwen case under a fixed 95% harmful-block target. However, when the harmful sample size becomes sufficiently large, the resulting projected statistics of harmful and safe samples can overlap, making them difficult to separate reliably with a fixed threshold. Therefore, although Extended Null Space Selection improves robustness under moderate rank pressure, it does not remove the fundamental scalability limit: at large enough harmful-data scale, the method faces a decreasing margin between harmful and safe representations, which weakens discriminability and defense reliability.

lease time, the safeguard can keep post-fine-tuning ASR at its pre-release level, although the accompanying safe-pass measurements show that this policy becomes more conservative in harder settings such as BeaverTails-H. In our evaluated restoration setting, the Inverse Adapter also preserves the base model’s forward behavior and regains useful safeside performance. We hope that this work will inspire future research on architectural safeguards for released LLMs that must remain trainable while preserving core safety guarantees.

Limitations Sensitivity of Null Space. The null space is sensitive to the input space; even minor perturbations can render it ineffective. Therefore, hard gradient blocking that relies on the null space, e.g., directly and completely blocking gradient backward, is highly susceptible to variations in the format and form of the input data. More precisely, the persistence of our safeguard depends on whether harmful training samples continue to be blocked. Like other representation-space defenses, USG relies on preserving a specific hidden-state geometry for harmful data. The main vulnerability arises when some harmful data fall outside the coverage of the defense corpus or otherwise escape blocking: those unblocked harmful updates gradually deform the original null-space structure used for blocking and can drive harmful representations back toward

References Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman,

11

Shyamal Anadkat, and 1 others. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774.

Guoqing Hu, An Zhang, Shuo Liu, Zhibo Cai, Xun Yang, and Xiang Wang. 2025a. Alphafuse: Learn id embeddings for sequential recommendation in null space of language embeddings. In Proceedings of the 48th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 1614–1623.

Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Röttger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. 2023. Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions. arXiv preprint arXiv:2309.07875.

Zixuan Hu, Li Shen, Zhenyi Wang, Yongxian Wei, and Dacheng Tao. 2025b. Adaptive defense against harmful fine-tuning for large language models via bayesian data scheduler. arXiv preprint arXiv:2510.27172.

Weilin Cai, Juyong Jiang, Fan Wang, Jing Tang, Sunghun Kim, and Jiayi Huang. 2025. A survey on mixture of experts in large language models. IEEE Transactions on Knowledge and Data Engineering.

Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, and Ling Liu. 2024a. Booster: Tackling harmful fine-tuning for large language models via attenuating harmful perturbation. arXiv preprint arXiv:2409.01586.

Zhiyuan Cao, Zeyu Ma, Chenhao Yang, Han Zheng, and Mingang Chen. 2026. Osnip: Breaking the privacy-utility-efficiency trilemma in llm inference via obfuscated semantic null space. arXiv preprint arXiv:2601.22752.

Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, and Ling Liu. 2024b. Harmful fine-tuning attacks and defenses for large language models: A survey. arXiv preprint arXiv:2409.18169.

Stephen Casper, Lennart Schulze, Oam Patel, and Dylan Hadfield-Menell. 2024. Defending against unforeseen failure modes with latent adversarial training. arXiv preprint arXiv:2403.05030.

Tiansheng Huang, Sihao Hu, and Ling Liu. 2024c. Vaccine: Perturbation-aware alignment for large language model. The Thirty-Eighth Annual Conference on Neural Information Processing Systems . . . .

Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, and 1 others. 2024. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. Advances in Neural Information Processing Systems, 37:55005– 55029.

Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2023. Beavertails: Towards improved safety alignment of llm via a humanpreference dataset. Advances in Neural Information Processing Systems, 36:24678–24704.

Junqi Chen, Sirui Chen, and Chaochao Lu. 2026. Can post-training transform llms into causal reasoners? In Findings of the Association for Computational Linguistics: ACL 2026, pages 17020–17038.

Weisen Jiang and Sinno Jialin Pan. 2025. Metadefense: Defending finetuning-based jailbreak attack before and during generation. arXiv preprint arXiv:2510.07835.

Junfeng Fang, Houcheng Jiang, Kun Wang, Yunshan Ma, Shi Jie, Xiang Wang, Xiangnan He, and TatSeng Chua. 2024. Alphaedit: Null-space constrained knowledge editing for language models. arXiv preprint arXiv:2410.02355.

Yu Li, Yuenan Hou, Yingmei Wei, Yanming Guo, and Chaochao Lu. 2026. Evodefense: Co-evolving blackbox defense with large language models. arXiv preprint arXiv:2605.31140. Lizhi Lin, Honglin Mu, Zenan Zhai, Minghan Wang, Yuxia Wang, Renxi Wang, Junjie Gao, Yixuan Zhang, Wanxiang Che, Timothy Baldwin, and 1 others. 2025. Against the achilles’ heel: A survey on red teaming for generative models. Journal of Artificial Intelligence Research, 82:687–775.

Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad AlDahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, and 1 others. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783.

Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, and 1 others. 2024. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437.

Zhida He, Xia Hu, Baichen Le, Chunxiao Li, Jiajia Li, Lijun Li, Chaochao Lu, Jing Shao, Youbang Sun, Hua Tang, and 1 others. 2026a. An early warning of emerging biosecurity risks in frontier llms. arXiv preprint arXiv:2607.18056.

Zihan Liu, Yizhen Wang, Rui Wang, and Sai Wu. 2025. Dualguard: A parameter space transformation approach for bidirectional defense in split-based llm fine-tuning. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 17065–17080.

Zhida He, Xiaoyu Wen, Han Qi, Ziyuan Zhou, Peng Yu, Xingcheng Xu, Dongrui Liu, Xia Hu, Chaochao Lu, and Qiaosheng Zhang. 2026b. Not all turns matter: Credit assignment for multi-turn jailbreaking. arXiv preprint arXiv:2605.08778.

12

Ilya Loshchilov and Frank Hutter. 2017. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101.

Yi Su, Dian Yu, Linfeng Song, Juntao Li, Haitao Mi, Zhaopeng Tu, Min Zhang, and Dong Yu. 2025. Crossing the reward bridge: Expanding rl with verifiable rewards across diverse domains. arXiv preprint arXiv:2503.23829.

Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, and 1 others. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249.

Wei Sun, Tingyu Qu, Mingxiao Li, Jesse Davis, and Marie Francine Moens. 2025. Mitigating negative interference in multilingual knowledge editing through null-space constraints. In Findings of the Association for Computational Linguistics: ACL 2025, pages 8796–8810.

Rimon Melamed, Lucas Hurley McCabe, Tanay Wakhare, Yejin Kim, H Howie Huang, and Enric Boix-Adsera. 2024. Prompts have evil twins. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 46– 74.

Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B Hashimoto. 2023. Stanford alpaca: An instruction-following llama model.

Youssef Mroueh. 2025. Reinforcement learning with verifiable rewards: Grpo’s effective loss, dynamics, and success amplification. arXiv preprint arXiv:2503.06639.

Boyi Wei, Kaixuan Huang, Yangsibo Huang, Tinghao Xie, Xiangyu Qi, Mengzhou Xia, Prateek Mittal, Mengdi Wang, and Peter Henderson. 2024. Assessing the brittleness of safety alignment via pruning and low-rank modifications. arXiv preprint arXiv:2402.05162.

Quoc Minh Nguyen, Trung Le, Jing Wu, Anh Tuan Bui, and Mehrtash Harandi. 2026. Antibody: Strengthening defense against harmful fine-tuning for large language models via attenuating harmful gradient influence. In International Conference on Learning Representations (ICLR). ArXiv preprint arXiv:2603.00498.

Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, and 1 others. 2022. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824– 24837.

Alberto Purpura, Sahil Wadhwa, Jesse Zymet, Akshay Gupta, Andy Luo, Melissa Kazemi Rad, Swapnil Shinde, and Mohammad Shahed Sorower. 2025. Building safe genai applications: An end-to-end overview of red teaming for large language models. In Proceedings of the 5th Workshop on Trustworthy NLP (TrustNLP 2025), pages 335–350.

Xiaoyu Wen, Zhida He, Han Qi, Ziyu Wan, Zhongtian Ma, Ying Wen, Tianhang Zheng, Xingcheng Xu, Chaochao Lu, and Qiaosheng Zhang. 2026. Magic: A co-evolving attacker-defender adversarial game for robust llm safety. arXiv preprint arXiv:2602.01539.

Weiwei Qi, Zefeng Wu, Zhilin Guo, Tianhang Zheng, Chaochao Lu, Liang He, Zhan Qin, and Kui Ren. 2026. Darwin: Evolving jailbreak adversary and guardrail for llm safety evaluation and protection. arXiv preprint arXiv:2607.19829.

Fenghua Weng, Chaochao Lu, Xia Hu, Wenqi Shao, and Wenjie Wang. 2025. Think-reflect-revise: A policy-guided reflective framework for safety alignment in large vision language models. arXiv preprint arXiv:2512.07141.

Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2024a. Safety alignment should be made more than just a few tokens deep. arXiv preprint arXiv:2406.05946.

Zefeng Wu, Weiwei Qi, Jielong Chen, Tianhang Zheng, Di Hong, Chaochao Lu, Liang He, Zhan Qin, and Kui Ren. 2026. Datashield: Uncovering risky finetuning data across llms through consensus subspace alignment. arXiv preprint arXiv:2607.15081.

Xiangyu Qi, Boyi Wei, Nicholas Carlini, Yangsibo Huang, Tinghao Xie, Luxi He, Matthew Jagielski, Milad Nasr, Prateek Mittal, and Peter Henderson. 2024b. On evaluating the durability of safeguards for open-weight llms. arXiv preprint arXiv:2412.07097.

An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025a. Qwen3 technical report. arXiv preprint arXiv:2505.09388.

Domenic Rosati, Jan Wehner, Kai Williams, Łukasz Bartoszcze, David Atanasov, Robie Gonzales, Subhabrata Majumdar, Carsten Maple, Hassan Sajjad, and Frank Rudzicz. 2024. Representation noising effectively prevents harmful fine-tuning on llms. arXiv preprint arXiv:2405.14577, 24.

Le Yang, Ziwei Zheng, Boxu Chen, Zhengyu Zhao, Chenhao Lin, and Chao Shen. 2025b. Nullu: Mitigating object hallucinations in large vision-language models via halluspace projection. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 14635–14645.

Shanghai AI Lab. 2025. Safework-r1: Coevolving safety and intelligence under the ai-45 law. arXiv preprint arXiv:2507.18576.

Xin Yi, Shunfan Zheng, Linlin Wang, Xiaoling Wang, and Liang He. 2024. A safety realignment framework via subspace-oriented model fusion for

13

BeaverTails, which is more challenging and therefore shifts the operating threshold between safe and harmful samples. Our intended deployment protocol is not to keep retuning the threshold after release. Instead, the provider uses pre-release safe/alignment finetuning as a calibration stage and fixes a stable release threshold before deployment; the threshold is implemented post-release as a backward gate rather than an online decision rule. In our experiments, we assess threshold quality using safe pass rate. During calibration, thresholds are selected by a harmful-ratio rule on the defenderheld harmful reference set. Let r1 ≤ r2 ≤ · · · ≤ rn denote the sorted norm ratios ∥hW ∥/∥h∥ of the harmful reference samples at a given checkpoint. For a target harmful block rate b ∈ (0, 1], we choose the calibration threshold as the empirical harmful quantile τb = r⌈bn⌉ , so that approximately a fraction b of harmful reference samples activates the backward gate. The strict 100% release policy used in the main text is the limiting case b = 1, i.e., the threshold is set to the maximum observed ratio over all defender-held harmful reference samples, including harmful samples that did not participate in constructing the null space. The resulting 100%block calibration thresholds are shown in Table 5, and the corresponding visualizations are shown in Figure 4. These thresholds should be interpreted as intermediate operating points produced by the prerelease calibration procedure rather than as final release thresholds. The visualizations further show that BeaverTails is the most challenging setting: as the harmful sample set grows, harmful and safe statistics become harder to separate, and more held-out harmful samples approach the safe-side threshold region. This marks an upper-bound regime for blocking generalization under a fixed threshold and motivates the extended-null-space analysis discussed above.

large language models. Knowledge-Based Systems, 306:112701. Churui Zeng, Weiwei Qi, Kedong Xiu, Tianhang Zheng, Chaochao Lu, Liang He, Zhan Qin, and Kui Ren. 2026. Trace: Task-aware adaptive self-evolving agentic jailbreaking. arXiv preprint arXiv:2605.30883. Dongcheng Zhang, Yi Zhang, Yuxin Chen, An Zhang, Xiang Wang, and Chaochao Lu. 2026a. Self-reset: Learning to self-recover from unsafe reasoning trajectories. arXiv preprint arXiv:2605.08936. Yi Zhang, Yuxin Chen, Leheng Sheng, Dongcheng Zhang, Chaochao Lu, Xiang Wang, and An Zhang. 2026b. Internalizing safety understanding in large reasoning models via verification. arXiv preprint arXiv:2605.08930. Yize Zhang, Meiqi Chen, Sirui Chen, Bo Peng, Yanxi Zhang, Tianyu Li, and Chaochao Lu. 2025. Causight: Learning to supersense for visual causal discovery. arXiv preprint arXiv:2512.01827. Minjun Zhu, Linyi Yang, Yifan Wei, Ningyu Zhang, and Yue Zhang. 2024. Locking down the finetuned llms safety. arXiv preprint arXiv:2410.10343. Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. 2024. Safety finetuning at (almost) no cost: A baseline for vision large language models. arXiv preprint arXiv:2402.02207.

A

Threshold Selection

As discussed above, threshold selection mediates the trade-off between safety and continued trainability. Conceptually, the exact null-space analysis defines an ideal limit in which harmful samples satisfy hW = hW T = 0 and are therefore blocked by exact gradient cancellation. In the practical implementation, we realize this as a backward gate on the norm ratio r(h) = ∥hW ∥/∥h∥: ∂L ∂L ← (1 − g(h)) . ∂h ∂h (17) This threshold mechanism is an operational approximation to the ideal exact-null-space case for two concrete reasons: first, exact common-nullspace construction becomes capacity-limited as the harmful sample set grows as mentioned above; second, finite-precision computation leaves numerically small but non-zero residual gradients, and these can still be amplified during backpropagation. The optimal threshold therefore depends on the model architecture, the harmful-data distribution, and the difficulty of the safe/alignment data. For example, using Alpaca as the safe dataset yields different behavior from using safe samples from g(h) = 1[r(h) ≤ τ ],

B

Null Space Stability during Safe Training

As discussed earlier, the persistence of our method under harmful retraining depends on whether harmful samples continue to be blocked: if all harmful data are blocked, the safeguard can remain effective, whereas failure arises when some harmful samples escape blocking and inject gradients. We therefore do not revisit harmful fine-tuning here. Instead, we study the complementary question that 14

safe participating harmful tuned threshold

0.007 0.006

safe participating harmful tuned threshold

0.006

0.005

|hW|/|h|

|hW|/|h|

0.005 0.004 0.003

0.004

0.003

0.002 0.002 0.001 0.001

0.000 0

50

100

150

200

0

50

Sample index

(a) Qwen3-14B Threshold on JailbreakBench

200

safe participating harmful tuned threshold

0.008

0.004

|hW|/|h|

|hW|/|h|

0.005

150

(b) Qwen3-14B Threshold on HarmfulBench

safe participating harmful non participating harmful tuned threshold

0.006

100

Sample index

0.003

0.006

0.004

0.002 0.002 0.001 0.000 0

50

100

150

200

250

300

0

50

Sample index

(c) Qwen3-14B Threshold on BeaverTails-H

200

safe participating harmful non participating harmful tuned threshold

0.008 0.007 0.006

|hW|/|h|

0.005

|hW|/|h|

150

(d) Llama-3.1-8B Threshold on JailbreakBench

safe participating harmful tuned threshold

0.006

100

Sample index

0.004

0.005 0.004 0.003

0.003

0.002 0.001

0.002 0

50

100

150

200

0

Sample index

50

100

150

200

250

Sample index

(e) Llama-3.1-8B Threshold on HarmfulBench

(f) Llama-3.1-8B Threshold on BeaverTails-H

Figure 4: Visual Threshold Selection

15

300

is important for practical downstream use: whether continued safe training, unrelated to harmful content, also breaks the alignment induced by the cubic layer. To answer this question, we continue safe training on Alpaca in a front-Transformer setting in which the Inverse Adapter remains frozen, only the last five Transformer layers are updated, and the cubic layer is inserted after the last Transformer layer. Training runs for 4 epochs with a learning rate of 4 × 10−5 , cosine scheduling, 3% warmup, no weight decay, gradient clipping at 1.0, BF16 precision, a per-device batch size of 1, gradient accumulation of 8 steps, and a maximum sequence length of 1024. We monitor the model every 20 training steps. We fix the threshold on the norm ratio ∥hW ∥/∥h∥ to obtain a 95% harmful block rate at the beginning and then evaluate the resulting safe pass rate in Alpaca. We use JailbreakBench, HarmfulBench, and 1000 samples from BeaverTails-H as harmful reference datasets to assess whether harmful and safe samples remain distinguishable throughout continued benign training. Figure 5 shows that the tuned threshold changes noticeably early in training but becomes relatively stable later across all six model–dataset settings. This suggests that benign adaptation shifts the hidden-state geometry without destroying the operating threshold induced by the cubic layer. Figure 6 further shows that the corresponding backward gate remains practically useful throughout training: the safe pass rate stays at 100% for all monitored checkpoints in Qwen3-14B on JailbreakBench and HarmfulBench and in Llama-3.1-8B on JailbreakBench; it remains between 98% and 100% for Qwen3-14B on BeaverTails-H and between 95% and 100% for Llama-3.1-8B on HarmfulBench; and even in the hardest setting, Llama-3.1-8B on BeaverTails-H, it remains above 75%. Overall, these results show that safe training unrelated to harmful content does not collapse the alignment into indiscriminate rejection and instead preserves a clear safe–harmful separation under a stringent operating point. The ratio-scatter comparisons in Figures 7 and 8 are consistent with this interpretation. In each row, the left panel shows the model before continued safe training and the right panel shows the same model after training completes under the above configuration. Although the empirical threshold boundary shifts during training, safe samples remain largely above the tuned threshold, whereas harmful samples remain near or below it. Even

in the more difficult settings, where the margin narrows, the qualitative separation is preserved. Taken together, these results suggest that continued benign fine-tuning does not by itself destroy the null-space alignment and instead provides a natural calibration phase for fixing a stable release-time threshold.

C

Cubic Layer Gradient Calculation

The forward pass of a cubic layer is defined as follows: f (h) = ((hW )hT )h, h ∈ RB×M ×N ,

W ∈ RN ×N .

(A1)

For a given loss function L(h), we aim to compute ∂L(h) ∂h . Let ∂L(h) = GB . ∂f (h)

(A2)

The differential of L can be expressed as !     ∂L(h) T dh = tr GT df , dL = tr B ∂h (A3) where df = ∂f with the colon denoting the : dh, ∂h double dot product (Frobenius inner product). Set A = hW,

B = hT ,

C = h,

(A4)

so that f (h) = (AB)C.

(A5)

Taking the differential, df = d((AB)C) = d(AB)C + AB dC

(A6)

= dA BC + A dB C + AB dC. Substituting the expressions for dA, dB, and dC: dA = dhW,

dB = dhT ,

dC = dh,

(A7)

df = (dhW )BC + A dhT C + AB dh.

(A8)

we obtain

Since dL = tr(GT B df ), it follows that   dL = tr GT (dhW )BC B   T + tr GT A dh C B   + tr GT AB dh . B 16

(A9)

0.003 0.0015

0

500

1000

1500

0.0045

Threshold

Threshold

Threshold

0.0045

0.003 0.0015

2000

0

500

Training step

1000

1500

0.0045 0.003 0.0015

2000

0

(a) Qwen3-14B on JailbreakBench.

(b) Qwen3-14B on HarmfulBench.

0.0075

0.005

0.005

0.005

0.0025

0.0025

0.0025

500

1000

1500

0

2000

(d) Llama-3.1-8B on JailbreakBench.

0

500

1000

1500

1500

2000

(c) Qwen3-14B on BeaverTails-H.

0.0075

0

1000

Training step

0.0075

0

500

Training step

0

2000

(e) Llama-3.1-8B on HarmfulBench.

0

500

1000

1500

2000

(f) Llama-3.1-8B on BeaverTails-H.

Figure 5: Threshold trajectories during continued safe training. For each model–dataset pair, we tune the threshold on ∥hW ∥/∥h∥ at every monitored checkpoint to target a 95% harmful block rate. Across all six settings, the threshold undergoes an early adjustment phase and then becomes relatively stable later in training.

Therefore,

We now
rewrite each term in the form T tr ( ∂L ∂h ) dh to extract the gradient. First term:     T tr GT B (dhW )BC = tr GB dhW BC . (A10) Using the cyclic property of the trace, tr(U V ) = tr(V U ),     T tr (GT dh)(W BC) = tr (W BC)(G dh) B B   = tr (W BCGT )dh . B (A11) Thus, the contribution to the gradient from the first term is T T T M1 = (W BCGT B ) = GB h hW .

T M2 = CGT B A = hGB hW.

Third term:   tr GT AB dh B

tr

T GT B A dh C



.

(A17)

is already in the desired form, so T M3 = (GT B AB)

= hW T hT GB .

(A18)

Finally, combining all contributions, ∂L(h) = M1 + M2 + M3 , ∂h

(A12)

where

Second term: 

(A16)

M1 = (GB hT )(hW T ), M2 = (hGT B )(hW ),

(A13)

(A19)

(A20)

T T

M3 = hW h GB .

First, move dhT to the left using cyclic permutations:     T T T tr (GT A)(dh C) = tr (dh C)(G A) . B B (A14) T Then apply the identity tr(dh M ) = tr(dhM T ) = tr(M T dh) with M = CGT A. B This yields     T T tr dhT CGT A = tr dh(CG A) (A15) B B

D

Details of Inverse Adapter Implementation

The Inverse Adapter cannot be inserted before the Null Space Cubic Layer, because doing so would alter the layer-input hidden states used by the cubic-layer null-space construction. Therefore, the Inverse Adapter is placed strictly after the Null Space Cubic Layer and serves only as a forwardrestoration component. 17

90

80

70

0

500

1000

1500

90

80

70

2000

100

Safe pass rate (%)

100

Safe pass rate (%)

Safe pass rate (%)

100

0

500

1000

1500

80

70

2000

0

500

Training step

1000

1500

2000

Training step

(b) Qwen3-14B on HarmfulBench.

(c) Qwen3-14B on BeaverTails-H.

100

100

100

90

80

70

0

500

1000

1500

2000

Training step

(d) Llama-3.1-8B on JailbreakBench.

Safe pass rate (%)

(a) Qwen3-14B on JailbreakBench.

Safe pass rate (%)

Safe pass rate (%)

Training step

90

90

80

70

0

500

1000

1500

2000

Training step

(e) Llama-3.1-8B on HarmfulBench.

90

80

70

0

500

1000

1500

2000

Training step

(f) Llama-3.1-8B on BeaverTails-H.

Figure 6: Safe pass rate during continued safe training under thresholds tuned to maintain a 95% harmful block rate. The safe pass rate remains at 100% for all monitored checkpoints in three settings, remains nearly perfect in two additional settings, and stays above 75% even in the hardest case, showing that safe and harmful samples remain distinguishable under a stringent blocking constraint.

Its role is distinct from that of the safeguard itself. The Null Space Cubic Layer is the component that realizes gradient blocking for harmful samples inside the protected region. The Inverse Adapter does not contribute additional blocking; instead, it analytically compensates for the deterministic rescaling introduced by the cubic layer so that the released model’s outputs remain aligned with those of the base model. More concretely, for each token position the cubic layer outputs y = sh, where s = hW hT ≥ 0. Whenever s > 0, the inverse map is uniquely defined and recovers the original hidden state through h = y(yW y T )−1/3 .

Inverse Adapter still receives valid inputs outside the thresholded blocked regime and the forward behavior of both safe and harmful inputs is preserved up to negligible numerical error. Under this interpretation, the practical utility question is dominated by whether benign data remain outside the protected region rather than by inverse reconstruction error itself. The cubic layer is responsible for deciding which samples have their gradients blocked, while the Inverse Adapter is responsible for keeping the forward pass close to the original base-model computation.

E (A21)

Therefore, whenever the inverse branch is defined, both safe samples and harmful samples can in principle preserve the same forward outputs as the base model, which means preserving both the base model’s utility and its original alignment behavior. In the inverse-adapter-plus-extended-null-space regime studied in this paper, strict zeros are practically absent: exact common-null-space directions are replaced by smallest-singular-value directions, and finite-precision computation leaves suppressed but non-zero activations rather than mathematically exact zeros for almost all samples. As a result, the analytic inverse remains applicable to essentially all samples in our evaluated setting, so the

A Preliminary Parameter-Fusion Instantiation of the Protected-Release Assumption

The main paper studies the blocking mechanism itself under the PPOW setting. As one feasible hardening path for this assumption, we further explore parameter fusion, in which the explicit safeguardfacing computation is absorbed into downstream Transformer computation to reduce the extent to which the released artifact exposes a locally detachable module. Importantly, the goal of fusion is not to improve the blocking mechanism itself, but to provide a more entangled release form that may raise the cost of naive structural removal. Concretely, our preliminary fusion path targets the computation immediately downstream of the 18

F.1

cubic layer: we treat the explicit Inverse Adapter together with the following Transformer block as the teacher-side protected computation, and train a single fused Transformer-like block to reproduce their combined behavior. In this way, the released artifact no longer needs to expose the original explicit safeguard-facing interface in modular form. If the fused block has already co-adapted to the safeguarded hidden-state manifold, then simply deleting the explicit safeguarded transformation is no longer a purely local edit, because the downstream fused computation itself has been fit against that safeguarded geometry. At the same time, this study should be interpreted as a preliminary feasibility check rather than as a fully optimized hardening pipeline. In our current setting, the fused block is fitted with limited calibration/distillation data and limited optimization budget, so it does not yet cover the full hiddenstate manifold induced by the safeguarded model. As a result, the current fusion quality should not be read as the best achievable fidelity–hardening trade-off; rather, it provides an initial demonstration that the protected computation can in principle be absorbed into downstream Transformer computation while still motivating the protected-release threat model used in the main paper.

F

Sample Limit for Exact Null-space Selection

For exact null-space selection, the key question is how many harmful training examples can be incorporated before the shared null space collapses. To measure this limit, we construct harmful hiddenstate matrices from the exact same prompt/response formatting used in the null-space pipeline for each model–dataset pair. For every harmful example, we run the model forward, collect the layer-input hidden states for the target Cubic layer, and stack the token-level hidden states of the first n harmful samples into a single matrix. We then perform exact null-space extraction on this stacked matrix and increase n until the extracted null space becomes empty. We define the sample limit as the largest number of harmful samples for which the exact construction still yields a non-trivial null space, and the corresponding token limit as the cumulative number of tokens contained in those samples. In this way, the table reports the maximal harmfuldata scale under which exact null-space selection remains feasible. Geometrically, this behavior is expected. As more harmful samples are added, the stacked hidden-state matrix spans a progressively larger subspace and its rank correspondingly increases. Once the harmful hidden states become sufficiently diverse, the intersection of their orthogonal complements rapidly shrinks, so the common null space approaches zero dimension. At that point, the exact symmetric matrix construction satisfying hW = hW T = 0 becomes trivial or disappears entirely. Therefore, the sample limit for exact nullspace selection is fundamentally governed by rank growth and null-space degeneracy: beyond a certain harmful-sample scale, the exact construction can no longer provide a meaningful non-zero solution. Table 6 shows that this feasible region is in fact quite small for both model families. First, the exact construction supports only tens of harmful samples rather than hundreds, confirming that exact null-space selection is intrinsically capacitylimited. Second, the limit depends strongly on dataset diversity: HarmfulBench reaches the limit the fastest for both Qwen and Llama, indicating that its harmful hidden states span the relevant subspace more efficiently and thus eliminate the shared null space with fewer examples. By contrast, JailbreakBench permits the largest exact null-space

Extended Null Space Selection

As shown in Figure 9, when the number of harmful samples used to build Sh increases, the stacked hidden-state matrix tends to become full rank in practice, so nullcommon (Sh ) can become trivial and the strict constraint hW = hW T = 0 may have no non-zero solution. To keep the same objective while avoiding this rank-collapse issue, we replace strict common-null-space selection with a smallestsingular-direction approximation. Concretely, let X denote the stacked matrix formed from vectors in Sh , and compute X = U ΣV T . Instead of taking basis vectors from the exact null space (singular value exactly zero), we take the right singular vectors associated with the smallest singular values T to form Vsmall , and set W = Vsmall Vsmall (or its symmetric equivalent) so that, for h ∈ Sh , ∥hW ∥ and ∥hW T ∥ are minimized rather than forced to be exactly zero. This yields an extended null-space criterion that is numerically stable under largesample, near-full-rank conditions, while preserving the gradient-blocking mechanism through small residual factors in the cubic-layer gradient terms. 19

Model Qwen Qwen Qwen Llama Llama Llama

Dataset Variant JailbreakBench HarmfulBench BeaverTails JailbreakBench HarmfulBench BeaverTails

Threshold Selection 0.00049 0.0021 0.0036 0.00044 0.0031 0.0046

Safe Pass Rate 100.0% 100.0% 79.0% 100.0% 100.0% 69.0%

Harmful Block Rate 100.0% 100.0% 100.0% 100.0% 100.0% 100.0%

Table 5: Calibration Thresholds in the 100%-Block Experimental Setting

construction, while BeaverTails lies in between. Third, the same trend is reflected in token space: even when measured by cumulative token count instead of sample count, the feasible region remains narrow, typically only a few thousand to roughly ten thousand tokens. Overall, these results show that exact null-space selection is structurally fragile at scale, which motivates moving to extended / approximate null-space constructions when broader harmful coverage is required. F.2

the onset of performance degradation. We additionally report the corresponding held-out harmful block rate to verify that the lower ratio tendency also extends beyond the build set strongly enough to support threshold-based blocking on held-out harmful data. Given the limited sample sizes of JailbreakBench and HarmfulBench, we demonstrate the sample capacity of the extended null space method using the Qwen3-14B model on the BeaverTails dataset. The threshold for each method is selected to achieve a 95% harmful block rate while maximizing the safe sample pass rate. As shown in Figure 10, the extended null space method maintains a 100% safe pass rate with approximately 200 samples, and still preserves over 60% safe pass rate even with 500 samples. In this evaluated BeaverTails/Qwen3-14B setting, this indicates markedly higher sample capacity than the Exact Null-space Selection approach.

Sample Limit for Extended Null Space Selection

For extended null-space selection, the exact nullspace degeneracy described above is alleviated by replacing zero-singular-value directions with smallest-singular-value directions. As a result, its sample limit is no longer best defined by whether the exact symmetric matrix construction exists, but rather by how much useful safe behavior can still be preserved under a fixed safety requirement. Accordingly, we adopt a utility-oriented operational definition of sample limit for the extended setting. Specifically, we first determine a buildtime threshold that enforces a 95% harmful block rate on the participating harmful samples and then evaluate the resulting held-out safe pass rate. This metric asks a concrete question: as more harmful samples are used to construct the extended null space, how much safe-data utility can still be retained while maintaining a stringent safety target? Under this definition, larger harmful build sets are not automatically better. If the threshold chosen to satisfy the build-time 95% harmful block criterion leads to a declining held-out safe pass rate, then the usable capacity of the construction is approaching its limit. We therefore use the safe-passrate curve under the fixed 95% safety target to characterize the sample limit of extended null-space selection, and compare it against exact null-space selection to determine which method better delays

G

Frozen-Threshold Stability under Incomplete OOD Coverage

The main paper focuses on a strict frozen-threshold release regime in which the calibrated threshold fully blocks the relevant harmful reference set used for deployment-style evaluation. Here we study a more conservative boundary case on Qwen3-14B with BeaverTails-H: the frozen threshold is fixed from the strict 100% coverage reference run, but the subsequent continued training data are benign yet distribution-shifted with respect to the releasetime calibration set. This setting lets us test whether the same threshold-controlled gate remains stable under such adaptation, without any online threshold retuning. Table 7 summarizes the final monitored operating points. The strict 100% reference run remains stable throughout training, with safe pass rate 0.79 and harmful block rate 1.00 at the final checkpoint. Under incomplete OOD coverage with learning rate 20

Model Qwen Qwen Qwen Llama Llama Llama

Dataset JailbreakBench HarmfulBench BeaverTails JailbreakBench HarmfulBench BeaverTails

Sample Limit 91 14 45 73 13 35

Token Limit 11744 5503 8067 9239 4671 6256

Table 6: Maximum harmful-data scale at which exact null-space selection remains non-trivial. For each model– dataset pair, we increase the number of harmful samples used to build the stacked hidden-state matrix and report the largest sample count for which the exact null space is still non-empty. Token limit reports the corresponding cumulative token count of those harmful samples. The small limits across all settings show that exact null-space selection quickly degenerates as harmful hidden-state diversity increases.

1 × 10−5 , the behavior remains nearly unchanged, ending at safe pass rate 0.78 and harmful block rate 1.00. At learning rate 4 × 10−5 , the harmful block rate still remains at 1.00, but the safe pass rate decreases to 0.59, indicating that the backward gate induced by the frozen threshold remains active but becomes more conservative on safe samples. By contrast, at learning rate 3 × 10−4 , the final safe pass rate rises to 1.00 while the harmful block rate drops to 0.00, showing that the original harmful– safe separation no longer remains stable in this high-update regime. Figure 11 shows the corresponding dynamics over training. The strict 100% reference run is flat across all monitored checkpoints, and the 1 × 10−5 run stays close to that reference trajectory. The 4 × 10−5 run preserves harmful blocking but gradually shifts toward lower safe pass rate, whereas the 3 × 10−4 run rapidly loses harmful blocking after only a few monitored steps. Figure 12 is consistent with this interpretation: the ratio-scatter geometry remains visually similar for the strict reference and 1 × 10−5 runs, compresses toward the threshold boundary at 4 × 10−5 , and collapses at 3 × 10−4 so that the frozen threshold no longer cleanly separates harmful from safe samples. Taken together, these results support a conservative interpretation of fixed-threshold deployment. When the release-time threshold is calibrated with complete harmful coverage, the corresponding backward gate can remain stable under mild continued training. When continued adaptation is OOD with respect to the release-time calibration set, however, stability becomes update-dependent: small updates can preserve the threshold-controlled gate, intermediate updates can make it more conservative, and sufficiently large updates can erase the original harmful–safe separation.

21

Setting threshold policy Frozen threshold Frozen threshold Frozen threshold

LR

Final Safe Pass

Final Harmful Block

– 1 × 10−5 4 × 10−5 3 × 10−4

0.79 0.78 0.59 1.00

1.00 1.00 1.00 0.00

Table 7: Final monitored operating points on Qwen3-14B with BeaverTails-H under a fixed strict-100 release threshold. Mild benign distribution shift preserves the reference operating point, moderate learning rate reduces safe pass while keeping full harmful blocking, and aggressive learning rate destroys the original harmful–safe separation.

safe participating harmful tuned threshold

0.007 0.006 0.005

0.007

|hW|/|h|

|hW|/|h|

safe participating harmful tuned threshold

0.008

0.004 0.003

0.006

0.002 0.005 0.001 0.000 0

50

100

150

200

0

50

Sample index

100

150

200

Sample index

(a) Qwen3-14B on JailbreakBench. safe participating harmful tuned threshold

0.006

safe participating harmful tuned threshold

0.007

0.005

|hW|/|h|

|hW|/|h|

0.006 0.004

0.005

0.003 0.004

0.002

0.003

0.001 0

50

100

150

200

0

50

Sample index

100

150

200

Sample index

(b) Qwen3-14B on HarmfulBench. safe participating harmful non participating harmful tuned threshold

0.006

0.0070 0.0065

0.004

|hW|/|h|

|hW|/|h|

0.005

safe participating harmful non participating harmful tuned threshold

0.0075

0.003

0.0060 0.0055 0.0050

0.002

0.0045

0.001

0.0040 0

50

100

150

200

250

300

0

50

Sample index

100

150

200

250

300

Sample index

(c) Qwen3-14B on BeaverTails-H.

Figure 7: Ratio-scatter comparisons for Qwen3-14B before and after continued safe training. Within each row, the left panel shows the model before training and the right panel shows the same model after training completes. Across all three harmful-data settings, the tuned threshold shifts upward during training, but the qualitative separation between safe and harmful samples is largely preserved.

22

safe participating harmful tuned threshold

0.008

safe participating harmful tuned threshold

0.012

|hW|/|h|

|hW|/|h|

0.011 0.006

0.004

0.010

0.009

0.002

0.008

0.000 0

50

100

150

200

0

50

Sample index

100

150

200

Sample index

(a) Llama-3.1-8B on JailbreakBench. 0.0095

safe participating harmful tuned threshold

0.006

0.0085

|hW|/|h|

0.005

|hW|/|h|

safe participating harmful tuned threshold

0.0090

0.004

0.0080 0.0075 0.0070

0.003

0.0065 0.0060

0.002 0

50

100

150

200

0

50

Sample index

100

150

200

Sample index

(b) Llama-3.1-8B on HarmfulBench. 0.0110

safe participating harmful non participating harmful tuned threshold

0.008 0.007

0.0100

0.006

0.0095

0.005

|hW|/|h|

|hW|/|h|

safe participating harmful non participating harmful tuned threshold

0.0105

0.004 0.003

0.0090 0.0085 0.0080

0.002

0.0075

0.001

0.0070 0

50

100

150

200

250

300

0

50

Sample index

100

150

200

250

300

Sample index

(c) Llama-3.1-8B on BeaverTails-H.

Figure 8: Ratio-scatter comparisons for Llama-3.1-8B before and after continued safe training. Within each row, the left panel shows the model before training and the right panel shows the same model after training completes. The empirical boundary shifts during training, but the safe–harmful separation remains visible in all three settings, with the margin narrowing most noticeably on BeaverTails-H.

23

Rank of hidden-state matrix

4000 3200 2400 1600 Rank (absolute threshold) Rank (relative threshold)

800 40

80

120

160

200

Number of samples

Figure 9: Hidden states matrix rank increases with sample size

Safe pass rate

1.0 0.8 0.6 0.4 0.2 Safe pass @ 95% harmful block

0.0 0

100

200

300

400

500

Harmful participating sample count

Figure 10: Safe sample pass rate (with 95% harmful block rate) as a function of the number of participating harmful samples on the BeaverTails dataset, evaluated with the Qwen3-14B model. The extended null space method maintains 100% safe pass rate at 200 samples and over 60% at 500 samples, substantially outperforming Exact Null-space Selection.

24

1.0

0.8

0.8

0.6

0.6

Rate

Rate

1.0

0.4

0.4

0.2

safe pass BeaverTails-H block OOD harmful block

0.2 safe pass BeaverTails-H block

0.0

0.0 0

10

20

30

40

50

0

5

10

Global step

20

25

(b) Frozen threshold, lr = 1 × 10−5 .

(a) Strict100 reference. 1.0

1.0

0.8

0.8

0.6

0.6

Rate

Rate

15

Global step

0.4

0.4

safe pass BeaverTails-H block OOD harmful block

0.2

safe pass BeaverTails-H block OOD harmful block

0.2

0.0

0.0 0

5

10

15

20

25

0

Global step

5

10

15

20

25

Global step

(c) Frozen threshold, lr = 4 × 10−5 .

(d) Frozen threshold, lr = 3 × 10−4 .

Figure 11: Safe-pass and harmful-block trajectories under a fixed strict-100 release threshold. The strict reference run and the 1 × 10−5 OOD run remain close to their initial operating points, the 4 × 10−5 run keeps harmful blocking but sacrifices safe pass rate, and the 3 × 10−4 run rapidly loses harmful blocking.

25

safe

Beavertails-H harmful

threshold

|hW|/|h|

0.006

0.004

0.002

0

60

120

180

0

60

Step0

120

180

Step26

(a) Strict100 reference. Beavertails-H harmful

OOD harmful

safe

threshold

OOD

OOD

|hW|/|h|

0.006

0.004

0.002

0

60

120

180

0

60

Step0

120

180

Step26

(b) Frozen threshold, lr = 1 × 10−5 . Beavertails-H harmful

OOD harmful

safe

threshold

OOD

OOD

|hW|/|h|

0.006

0.004

0.002

0

60

120

180

0

60

Step0

120

180

Step26

(c) Frozen threshold, lr = 4 × 10−5 . Beavertails-H harmful

OOD harmful

safe

threshold

OOD

OOD

|hW|/|h|

0.024

0.016

0.008

0.000

0

60

120

180

0

60

Step0

120

180

Step26

(d) Frozen threshold, lr = 3 × 10−4 .

Figure 12: Ratio-scatter comparisons at initialization and the final monitored step under a fixed strict-100 release threshold. The strict reference and 1 × 10−5 runs preserve the original safe–harmful separation, the 4 × 10−5 run pushes safe samples toward the threshold boundary, and the 3 × 10−4 run collapses the separation so that the frozen threshold no longer cleanly separates harmful from safe samples.

26

Related documents

• Universal Adversarial Perturbations#6677
• FlipGuard: Defending Large Language Models Against Quantization-Conditioned Backdoor Attacks#321777
• DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection#1130594
• Provable Fairness Repair for Deep Neural Networks#204849
• MTD-Playground: An Attacker-Aware Evaluation Framework for Network Moving Target Defense#366210