当安全路由失效：理解良性微调下的对齐脆弱性
When Safety Routing Breaks: Understanding Alignment Fragility under Benign Fine-Tuning
浏览论文内容
中文总结 AI 辅助
该研究针对良性微调削弱大语言模型安全对齐的问题，提出费歇尔几何视角，揭示输出侧MLP模块的路由通路锐化导致安全失效，发现LoRA和ASAM可缓解早期崩溃但效果随微调规模减弱
中文摘要 AI 辅助
良性微调会严重削弱大语言模型（LLMs）的安全对齐能力，因此我们研究拒绝行为为何如此脆弱。现有研究常将该失败归因于梯度冲突，我们提出一种完全不同的费歇尔几何解释：安全费歇尔是低秩的，且对齐会使安全几何更平缓，同时保留输出路由通路。经过100个良性微调样本后，该通路在输出侧MLP模块中被选择性重新锐化，解释了不对称脆弱性：安全性能会崩溃到高攻击成功率，而通用效用仅轻微下降。该路由视角还解释了为何少量安全样本就能恢复拒绝行为，表明与安全相关的内部表征得以保留。最后，我们表明LoRA和ASAM可通过抑制输出侧锐度缓解早期崩溃，但在更大的微调规模下，它们的保护作用会减弱。总体而言，安全失效最好被理解为低秩输出路由机制的中断
英文摘要
Benign fine-tuning severely weakens the safety alignment of large language models (LLMs), so we study why refusal behavior is so fragile. While prior work often attributes this failure to gradient conflict, we propose a fundamentally different Fisher-geometric explanation: safety Fisher is low-rank, and alignment makes the safety geometry flatter while preserving an output-routing pathway. After 100 benign fine-tuning examples, this pathway is selectively re-sharpened in output-side MLP modules, explaining the asymmetric fragility: safety can collapse to high attack success rates, while general utility degrades mildly. The routing view also explains why few safety examples can restore refusal behavior, indicating that internal safety-relevant representations are preserved. Finally, we show that LoRA and ASAM mitigate early collapse by suppressing output-side sharpness, but their protection weakens at larger fine-tuning scales. Overall, safety failure is best understood as a disruption of a low-rank output-routing mechanism
发表机构
- Indiana University Bloomington（印第安纳大学伯明顿分校）
- Tsinghua University（清华大学）
- Nanyang Technological University（南洋理工大学）
机构由 AI 辅助整理，请以论文原文为准。
