Skin-Deep: A Geometric Diagnostic for Alignment Fragility in Large Language Model Representations

2026-06-21

AI Summary

This work addresses the vulnerability of aligned language models to lose their ability to refuse harmful requests after minimal benign downstream fine-tuning, a risk exacerbated by the absence of pre-deployment safety evaluation tools. The authors propose Skin-Deep, a geometric diagnostic method that analyzes the intrinsic geometry of hidden-layer activations to directly assess model safety robustness without requiring adversarial attacks or additional fine-tuning. Their analysis reveals a low-rank safety subspace common across diverse model families and establishes its causal link to refusal behavior. Building on this insight, they introduce the Geometric Fragility Score (GFS), a scalar metric that quantifies a model’s susceptibility to safety degradation. Evaluated across 21 instruction-tuned models—spanning six alignment strategies and parameter scales from 3B to 32B—GFS reliably predicts the degree to which models retain refusal capabilities after LoRA fine-tuning.

Abstract

Alignment tuning is meant to make harmful-request refusal robust, yet this safety behavior can be erased by a small set of benign fine-tuning examples. This is a deployment risk for open-weight models because a checkpoint can pass refusal tests at release time and later lose refusal under low-cost downstream fine-tuning. Prior work has established these refusal failures, but existing studies do not show how to detect this fragility in the aligned model itself before an attack or fine-tuning intervention is run. We introduce Skin-Deep, a geometric diagnostic that detects alignment fragility directly from the aligned model's hidden-state activations before such an intervention is run and compresses the layer-wise safety geometry into a single scalar, the Geometric Fragility Score (GFS). Applied to twenty-one instruction-tuned models spanning six alignment recipes and 3B--32B parameters, Skin-Deep reveals a recurring low-rank safety subspace across model families. Direction ablations show that removing directions in this subspace weakens harmful-request refusal, providing causal evidence that the recovered geometry underlies refusal behavior. Crucially, GFS identifies, before any fine-tuning, the initially safe model that retains the most refusal after small-scale LoRA fine-tuning. These results establish GFS as a practical pre-deployment diagnostic for flagging fragile refusal behavior without running an attack.

Problem

• alignment fragility
• harmful-request refusal
• large language models
• safety behavior
• fine-tuning

Innovation

• geometric diagnostic
• alignment fragility
• Geometric Fragility Score
• safety subspace
• pre-deployment evaluation