发表机构
East China Normal University; University of Birmingham; Alibaba Group; Exacity Inc.; University College London（华东师范大学; 伯明翰大学; 阿里巴巴集团; Exacity 公司; 伦敦大学学院）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究通过动态二阶几何分析揭示大语言模型涌现性错位的机制，提出参数级几何缓解框架，在Qwen2.5-14B-IT上抑制自由生成错位达80%，并证明行为安全可能掩盖潜在有害子空间。
AI 中文摘要
安全对齐的大语言模型可能表现出涌现性错位（EM）：狭窄领域的适配意外地触发跨无关领域的灾难性安全失败。先前的静态分析未能描绘训练动态，而现有的防御依赖于降低效用的启发式方法。我们提出了一种对EM的动态二阶几何研究。跟踪训练轨迹揭示，方向性Hessian曲率在语义枢轴标记上急剧集中。Grassmannian投影显示，在大多数设置中，有害-安全差距的扩大主要源于安全梯度重叠的下降。利用这些见解，我们引入了一个参数级几何缓解框架，该框架将经验有害梯度子空间正交投影出参数更新。在Qwen2.5-14B-IT上，我们的防御将自由生成EM抑制高达80.0%；在四个开放权重指令微调模型家族（3B-20B）中的其他三个中，单层行为EM已接近零，教师强制评估显示相同的有害子空间控制着冻结EM响应的条件支持。至关重要的是，这些诊断揭穿了行为安全的幻觉：在行为EM接近零的模型中，相同的子空间仍然可测量且可操控。代码：此HTTPS URL。
英文摘要
Safety-aligned LLMs can exhibit emergent misalignment (EM): narrow domain adaptation unexpectedly triggers catastrophic safety failures across unrelated domains. Prior static analyses leave training dynamics unmapped, while existing defenses rely on heuristics that degrade utility. We present a dynamic, second-order geometric study of EM. Tracking training trajectories reveals that directional Hessian curvature concentrates sharply on semantic pivot tokens. Grassmannian projections show that, in most settings, harmful-safe gap widens mainly because safe-gradient overlap declines. Leveraging these insights, we introduce a parameter-level Geometric Mitigation Framework that orthogonally projects empirical harmful gradient subspace out of parameter updates. On Qwen2.5-14B-IT, our defense suppresses free-generation EM by up to 80.0%; across the other three of four open-weight instruction-based model families (3B--20B), where single-layer behavioral EM is already near zero, teacher-forced evaluation shows same harmful subspace controls the conditional support of frozen EM responses. Crucially, these diagnostics unmask the illusion of behavioral safety: the same subspace remains measurable and steerable in models where behavioral EM is near zero. Code: https://github.com/WeiqiaoQUE/mechanistic-emergent-misalignment.
CommentsPreprint
