LoX: Low-Rank Extrapolation Robustifies LLM Safety Against Fine-tuning

2025-06-18

AI Summary

Large language models (LLMs) often suffer safety degradation during subsequent fine-tuning—even with benign, harmless data—due to the fragility of alignment-induced safety properties. This work identifies the root cause: safety-critical low-rank subspaces exhibit high sensitivity to parameter perturbations. To address this, we propose LoX, a training-free low-rank extrapolation method. LoX first identifies safety-relevant subspaces via singular value decomposition (SVD) of model parameters and then applies a gradient-free parameter extrapolation mechanism to shift the model toward flatter regions of the loss landscape, thereby enhancing robustness. Evaluated under diverse benign and adversarial fine-tuning attacks, LoX consistently reduces attack success rates (ASR) by 11%–54% while preserving downstream task performance. The implementation is publicly available.

Technology Category

• Natural Language Processing: Safety and Robustness
• Machine Learning: Large Multimodal Models (LMMs)
• Computer Vision: Large Vision Models

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Large Language Models (LLMs) have become indispensable in real-world applications. However, their widespread adoption raises significant safety concerns, particularly in responding to socially harmful questions. Despite substantial efforts to improve model safety through alignment, aligned models can still have their safety protections undermined by subsequent fine-tuning - even when the additional training data appears benign. In this paper, we empirically demonstrate that this vulnerability stems from the sensitivity of safety-critical low-rank subspaces in LLM parameters to fine-tuning. Building on this insight, we propose a novel training-free method, termed Low-Rank Extrapolation (LoX), to enhance safety robustness by extrapolating the safety subspace of an aligned LLM. Our experimental results confirm the effectiveness of LoX, demonstrating significant improvements in robustness against both benign and malicious fine-tuning attacks while preserving the model's adaptability to new tasks. For instance, LoX leads to 11% to 54% absolute reductions in attack success rates (ASR) facing benign or malicious fine-tuning attacks. By investigating the ASR landscape of parameters, we attribute the success of LoX to that the extrapolation moves LLM parameters to a flatter zone, thereby less sensitive to perturbations. The code is available at github.com/VITA-Group/LoX.

Problem

• Enhances LLM safety against fine-tuning attacks
• Protects safety-critical low-rank subspaces in LLMs
• Improves robustness without hindering task adaptability

Innovation

• Extrapolates safety-critical low-rank subspaces
• Training-free method enhances safety robustness
• Moves parameters to flatter, perturbation-resistant zones