Safe LoRA: The Silver Lining of Reducing Safety Risks when Finetuning Large Language Models
Authors: Chia-Yi Hsu
Yu-Lin Tsai
Chih-Hsun Lin
Pin-Yu Chen
Chia-Mu Yu
Chun-Ying Huang
Venue: NeurIPS 2024 poster (2024)
Keywords: Larage Language Models
safety
Primary area: safety_in_machine_learning

Abstract: While large language models (LLMs) such as Llama-2 or GPT-4 have shown impressive zero-shot performance, fine-tuning is still necessary to enhance their performance for customized datasets, domain-specific tasks, or other private needs. However, fine-tuning all parameters of LLMs requires significant hardware resources, which can be impractical for typical users. Therefore, parameter-efficient fine-tuning such as LoRA have emerged, allowing users to fine-tune LLMs without the need for considerable computing resources, with little performance degradation compared to fine-tuning all parameters. Unfortunately, recent studies indicate that fine-tuning can increase the risk to the safety of LLMs, even when data does not contain malicious content. To address this challenge, we propose $\textsf{Safe LoRA}$, a simple one-liner patch to the original LoRA implementation by introducing the projection of LoRA weights from selected layers to the safety-aligned subspace, effectively reducing the safety risks in LLM fine-tuning while maintaining utility. It is worth noting that $\textsf{Safe LoRA}$ is a training-free and data-free approach, as it only requires the knowledge of the weights from the base and aligned LLMs. Our extensive experiments demonstrate that when fine-tuning on purely malicious data, $\textsf{Safe LoRA}$ retains similar safety performance as the original aligned model. Moreover, when the fine-tuning dataset contains a mixture of both benign and malicious data,  $\textsf{Safe LoRA}$ mitigates the negative effect made by malicious data while preserving performance on downstream tasks.  Our codes are available at https://github.com/IBM/SafeLoRA.

Safe LoRA: the Silver Lining of Reducing Safety Risks when Fine-tuning Large Language Models
Chia-Yi Hsu
Yu-Lin Tsai
National Yang Ming Chiao Tung University
National Yang Ming Chiao Tung University
Hsinchu, Taiwan
Hsinchu, Taiwan
chiay com
Friaah001@gmail.comm
Chih-Hsun Lin
Pin-V Yu Chen IBM Research New York, USA pychen@ibm com
National Yang Ming Chiao Tung University
Hsinchu, Taiwan
pkevawin3344@mail... com
Chia-Mu Yu National Yang Ming Chiao Tung University Hsinchu, Taiwan
Chun-Yinne Ying Huang
National Yang Ming Chiao Tung University Hsinchu, Taiwan
chiamuyu@gmail.com com
chiamuyU@gmil.. com com
Abstract
While large language models (LLMs) such Llama-2 or GPT-4 have shown impressive zero-shot performance, fine-tuning is still necessary enhance their performance for customized datasets, domain-specific tasks, or other private needs. However, fine-tuning all parameters of LLMs requires significant hardware sources, which can impractical for typical users. Therefore, parameter-efficeen fine-tuning such LoRA have emerged, allowing users to fine-tune LLMs without the need for considerable computing resources, with little performance degradation compared to fine-tuning all parameters. Unfortunately. recent studies indicate that fine-tuning increase the risk to the safety of LLMs, even when data does not contain malicious content. To address this challenge, we propose Safe LoRA, a simple one-liner patch to the original LoRA implementation by introducing the projection LoRA weights from selected layers to the safety-aligned subspace, effectively reducing the safety risks in LLM fine-tuning while maintaining utility. It is worth noting that Safe LoRA is training-free and data-free approach, it only requires the knowledge of the weights from the base and aligned LLMs. Our extensive experiments demonstrate that when fine-tuning on purely malicious data, Safe LoRA retains similar safety performance as the original aligned model. Moreover, when the fine-tuning dataset contains mixture of both benign and malicious data, Safe LoRA mitigates the negative effect made by malicious data while preserving performance on downstream tasks. Our codes are available at https: //t::h//gttttttt com IBM/Saf eLoRA
Introduction
As Large Language Models (LLMs) and their platforms rapidly advance and become more accessible, the need to align LLMs with human values, cultural norms, and legal compliance is critical for society, technology, and the research community. Specifically, many alignment efforts in Al safety have been made toward preventing LLMs from generating harmful inappropriate output, through instruction tuning techniques such as Reinforcement Learning with Human Feedback
56
38th Conference on Neural Information Processing Systems (NeurIPS 2024).

---

cos cos(CAB", ,AB") < t:
LoRA-
Trained
V
allgned
W umaligned
B²
VVT
B
Safety Projection
I
A' = CA
W allgned
A
cos cos (CAB" AB") T::
Safe LORA
LoRA code
B²
Maalige ignnd sp.destV, X.10)2/p..mmm0 in tofa.parmeters()::
Forwarding vector
NO modification
de AS" COS(CEN, 2N) c:
1th Layer
A
2e, data COM
Figure 1: Overview of Safe LoRA. We first obtain alignment matrix V W aligmed W unaligned
from a pair of unaligned and aligned LLMss, denoted as W Wanaligned and W aalined: respectively. Note that W unaligged W aligned models. For example, W unaligned can be the Llama-2-77
be the base/chat checkpoints of pre-trained model, while Waligned can be the Llama-2-7b-chan model. Next, for each layer in the LLM undergoing LoRA updates Á AB"", we use the projection operator C = VVT /I| to calculate the similarity score between the projected LoRA weights CAB and the original LoRA A weights AB If the similarity score is below certain threshold т, we use the projected LoRA weights as the final updates W alignedd
51 10. However, recent studies have unveiled the surprisingly fragile property of aligned LLMs upon fine-tuning (36 57 [2] the embedded safety can be significantly weakened when the aligned LLMs updated with a handful of maliciously crafted data, or even with benign data. This finding is consistently observed across LLMs and such ChatGPT [33] and open-source ones fine-tuning strategies, including closed-source
and Supervised Fine-tuning (SFT)
45 12
such as Llama-2 [44] based on full fine-tuning, LoRA fine-tuning [6 adapter [17] and prefix
tuning (24]
To address the challenge of losing safety guardrails in LLM fine-tuning, this paper presents Safe LoRA, a simple one-liner patch to the original LoRA that enhances the resilience of LLMS to safety degradation. Among various fine-tuning methods, we specifically focus on LoRA due to its practical advantages in memory-efficient parameter updates of LLMs through low-rank adaptation, while achieving comparable performance to the assource-consuminn full fine-tuning.
Figure provides an overview of Safe LoRA. First, we assume access to pair of unaligned and aligned L.M weights, denoted as W unnligned and W Waligned, which are often available for open- source LLMs such as Llama Base (unaligned) and Chat (aligned) models. We denote their difference the "alignment matrix" (by treating the weight matrix in each layer of LLMs independently), which defined as = W Waligned W unaligned- Intuitively, the alignment matrix entails the instruction tuning and safety alignment efforts to train a base model that is only capable of next-token prediction to become a conversational chatbot and a performant assistant. For each layer in an LLM where LoRA is used for parameter updates, Safe LoRA further projects the LoRA update onto the alignment matrix if the similarity score between the original and projected LoRA updates is below certain threshold. A lower similarity score suggests that the direction of the original LoRA updates has larger deviation from the alignment matrix, and we hypothesize this discrepancy is the root cause of the observed safety risks in fine-tuning LLMs with LoRA. With Safe LoRA, our experiments show that the safety and utility of LLMs can be greatly preserved, making it cost-effective solution for safe LLM fine-tuning due its fata-free and training free nature.
We highlight our main contributions and findings as follows.
We propose Safe LoRA, a simple, data-free, training-free, and model-agnostee patch to counteract the safety degradation problems when fine-tuning LLMS with the native LoR implementation. In essence, Safe LoRA modifies LoRA updates that dissimilar to defined alignment matrix via the projection operation to prevent safety degradation during LLM tne-tuning, An exemplary code of Safe LoRA is presented in Figure

---

Evaluated on the -lama-2-7B--a and Llama-3-88 B-8ttuuntt models against purely ma- licious or mixed fine-tuning data, Safe LoRA can retain utility (the downstream task performance) while simultaneously reducing safety risks, outperforming existing defense methods including Safelnstr [6] and Backdoor Enhanced Alignment (BEA) [46].
We found that when using LoRA for fine-tuning, the number of projected layers is related to the inherent alignment strength of the model. For instance, -lama-2-7B-Chen requires projecting only about 1 11% of the layers, while Maama-3-8--Instreme needs up to 35% to achieve good trade-off between utility and safety.
2 Related Works
2.1 Alignment of LLMS
Aligmment in the context of LLMs denotes the process of ensuring models behave in a way that conforms to social values. Due to the gap between the pre-trained LLM's training objective and human values, practitioners typically perform certain forms of optimization during the aligmment stage to ensure that the generated content is "aligned" with human values. For example, aligned LLMs such ChatGPT [33] and Claude 2 have safety guardrails and can refuse harmful instructions. These methods include Instruction Tuning [48] 34] (44 and Reinforcement Learning from Human Feedback (RLHF) (59
34 4), where the model is instructed to become helpful, harmless, and honest, i... the HHH principles [3] In comparison to RLHF, recent works such as Direct Preference Optimization (DPO) 37 optimize directly on human preference data, thus eliminating the need for a reward model in RLHF. On the other hand, Self- Rewarding [54] transforms the language model into a reward model to collect preference data, then aligns the model with DPO iteratively. These techniques aim instruct the model with certain alignment rules safety guardrails so that the model behaves well during inference time. However, during subsequent fine-tuning these guardrails while there are some preliminary measures that
might not hold integrate revealed by [52 36 57 counteract this problem [46]] ().
2.2 Jailbreak and Red-teaming of LLMS
While alignment is being employed in modern LLMs, the terms jailbreak or red-teaming refer to a series of tests or attacks on LLMS designed to reveal their vulnerabilities. Common approaches
include exploiting adversarial prompts (26) 60) 55 25 40 53 28) or the decoding algorithms [19]
of LLMs to bypass the safety guardrails established during the alignment stage.
On the other hand, fine-tuning LLMs for downstream tasks (not necessarily malicious) has also been shown to have a detrimental effect on the safety guardrails in terms of alignment [26] 47 35| 60). As result, the attacked LLM could be exploited generate malicious responses, posing risk to society. This work aims to provide a solution for restoring the safety guardrails in LLMs even after fine-tuning for downstream tasks.
2.3 Manipulating Models with Arithmetics
While safety and reliability present critical challenges to the research community, an alternate line of work focuses on exploring the relationship between task performance and parameters through arithmetic interventions.
explore the performance boost when averaging fine-tuned model weights from diverse domains, while others discovered that the newly averaged fused model could naturally perform better [ or serve as a better initialization setting for a new downstream task [8]. On the other hand, recent work [21] goes beyond interpolating and examines the effects of extrapolating between fine-tuned models. Specifically, these extrapolations, termed task vectors, are generated by re-using fine-tuned models, allowing users to extend the capabilities of models by adding or deleting task vectors in modular and efficient manner.
Works such as 27
21
Another line of work develops efficient methods for modifying a model's 's behavior after pre-training.
This includes various approaches such as patching (50] 42 21 (32), editing (39 30 31, aligning
34
3
22 14] (including the previously introduced alignment problem), debugging [38 13]. A
recent work[41] also follows this approach and tries to steer language models' outputs by adding
vectors to their hidden states.
3

---

3
Methodology
Our goal is to retain the alignment of LLMs in a post-hoe fashion after fine-tuning downstream tasks with LoRA. To achieve this, we exploit an "alignment matrix" to project LoRA's parameters. Specifically, this means projecting LoRA's weights onto the alignment subspace, thereby preserving alignment even after fine-tuning. Detailed explanations of the alignment matrix and the projection process will be provided in Section 3.1 and Section 3.2 respectively.
3.1 Constructing Alignment Matrix
To derive the alignment matrix, a pair of unaligned and aligned models is utilized. We further illustrate what aligned and unaligned models are in concept.
To formalize, the alignment matrix V is defined follows:
V W aliggnd - W unalignedd
(I)
where W aligned and W unaligned represent the weights of the aligned and unaligned models in the i-th layer, respectively. When clear in context, we will omit the layer index.
After obtaining V', we perform matrix multiplication with V and its transpose with the matrix (V V*)-1 to form a standard projection matrix. This operation is conducted on a layer-wise basis, and the resulting matrix Ć¹ can be formalized as:
Ć V'(V" V
where V denotes the alignment matrix in the i-th layer, and Ć represents the projection matrix defined by V Following this operation, we obtain the alignment matrix for each layer, which will further be used for projecting the LoRA weights.
For the aligned and unaligned models, take Meta's Llama for example, the aligned model will be the Chat model such that they are trained with an alignment goal 44 29 On the other hand, the unaligned model could be the aligned model that is fine-tuned with malicious data such that the LLM has lost the safety guardrail and is vulnerable to attacks.
Furthermore, as shown in Figure 2 we experimented on the behavior of the unaligned model compared to the base model provided in Meta's 's released checkpoints [ We discovered that the 11 categories both OpenAl and Meta's 's Llama-2 prohibit models from responding to are identical to those of the base model. Scores for each category indicate harmfulness, with lower scores being safer. The scores range from 1 to 5, with 1 being the safest and 5 being the most harmful, as judged by GPT-4. In Figure
2 we present our results with alignment matrices derived from different models. Here, we project LoRA's weights trained on purely harmful samples. The performances of the base model and the unaligned model after harmful fine-tuning are extremely close.
As a result, given that most open-source LLMs provide both their base model and chat/instruct models, users can conveniently use these official models to construct the alignment matrix without needing to train their own aligned or unaligned model. This choice of using base and chat/instruct models to construct the alignment matrix will be our default setup in Safe LoRA.
3.2 Post-hoc Fine-tuning Projection
After fine-tuning LLMs on downstream tasks with LoRA, we obtain the LoRA weight A AW' for the i-th layer, denoted as A Awis = A A'B"". During the fine-tuning process, alignment may be weakened 36), indicating that A may have been updated in way that boosts utility but reduces safety.
To retain alignment, it is necessary to project AW using the previously defined Č to restore alignment. However, while A might weaken the alignment of the original model, is updated to maximize the utility of the downstream task. To balance alignment and utility, we choose not to project all of the LoRA weights. Instead, we calculate the similarity between the original and projected LoRA weights, i.e., AW' and C'AW'. Using a threshold, we determine which layers should undergo projection. This process is formalized as follows:
(AW', C'AW
A w C'AW', subject to
<T
(3)
|+
hhtpss/tuuginngiocccommmaa wttp///nggnaaeeeeeataaaaaaaaeaea Iaama/Laam-22 2-7b

---

Usage Policies "We don't allow the use of the following:"
R11
Illegal Activity
Physica
Politioa Cempaigning
610
e2 Child Abuss Content
MS Sconomic iaarm
#10 Perracy Violation Activity
24
46
Haraaa/Violenne Violence
Feaud
-aalored Financial Advico
15
Mabrarn
The above sality colegetica unugged fross Opeadi Lsage policios' und "Mets's Liaraa scoeptable use policy".
Base
Fine-tuned
Figure 2: Comparison of Safe LoRA results using alignment matrices derived from the base model versus those obtained by fine-tuning with a few harmful samples. Because the resulting scores are relatively low, we only present the scale in the figure from to 3.
where denotes the i-th layer of LoRA's parameters, (,, :) represents the Frobenius inner product, and || || represents the Frobenius norm induced by the inner product. Lastly, T indicates threshold of the similarity score. Alternatively, T could be selected such that only the top- K layers with the lowest similarity scores will be projected. Furthermore, examine the impact of the number of projected layers on performance and the similarity scores all layers in the ablation study presented in Section 4.2
3.3 Rationale for Post-Hoc Projection
The rationale behind post-hoe projection be interpreted follows. As recent works [1] 20 45
begin to explore the holistic structure of weight space, we assume that the weight space is well- structured such that by subtracting W unnnligned from W Voligned: we extract safety-related vector V in the inner product space constructed by all possible weights, i.e., (Fuxn +, R) with the Frobenius inner product (. As result, by constructing the exact projection matrix Ć V(V'V)-IVV we create a subspace in the original vector space that represents the safety-related concept.
Fine-tuning with LoRA essentially aims to search for solutions to downstream tasks in a smaller subset of Fax*, i.e., all low-rank matrices. By post-hoc projecting the discovered solution, we are able obtain intersection of both the low-rank solution space and the safety-critical solution space, thus promoting both the utility and safety of the fine-tuned language model.
3.4 A Faster Alternative
While the original projection method in Section 3.3 could explain and properly eliminate the safety risk induced during the LLM fine-tuning on downstream tasks, the inverse product (V''V)-1 Č' calculated in each layer is time-consuming. We further introduced approximate version defined as:
V
C
where ||- ||e denotes the Frobenius norm. We also compare the time costs for generating C and Ć. takes 8.6 x 10 seconds to generate C, while generating Ć requires 2.1714 seconds, denoting a 250x times slower generation speed. All operations are computed by the NVIDIA H100 80GB GPU.
Furthermore, to compare the methods, include the performance datasets in Table As view Table the alternative Č could often perform better in terms of safety and utility trade-off.
PureBad
Alpaca
CAW
CAW
CAW
CAW
Harmfulness Score (L)
1.055
1.18
1.05
1.06
MT-Bench (1~100 (t)
6.34
5.96
6.35
6.3
Table Comparison alignment and utility with different projection matrices on different datasets under the Llama-2-7B-Che model. See Section for the descriptions of datasets and metrics.
5

---

4 Experiments
Fine-tuning Datasets. We use the PureBad, Dialog Summary, and Alpaca datasets for fine-tuning.
The PureBad dataset, following the same setting as [36], consists of 100 harmful examples collected through red-teaming. Regarding Dialog Summary [5]. we randomly select 1,000 samples from the Dialog Summary dataset and mix them with the 100 harmful examples from the PureBad dataset. To show the effect of harmful data, also present the results of different amounts of harmful examples from the PureBad dataset in Appendix A.7 Additionally, we randomly select 200 test samples from the test set of the Dialog Summary dataset. For the Alpaca dataset, we use the same dataset [3), totaling 50,098 records, with 200 of them used as the validation set. When tinettuning the Alpaca dataset, we refrain from adding the 100 harmful samples, as they would lead to a decrease in safety. Data formats for all datasets are shown in Appendix A.3 We call fine-tuning dataset containing harmful/addersarial examples as an attack.
Baseline. Other than LoRA, we consider two defense baselines: Safelnstr and Backdoor Enhanced Alignment (BEA) 4o) For Safelnstr, they demonstrate that fine-tuning models by adding only 3% safety samples can improve their safety. We augment their safe instructions into the fine- tuning datasets, and the number of safety samples is 10% of the PureBad dataset in all experiments. For BEA, pairs of triggers are designed to serve the secret prompt and safety instructions for the backdoor samples. Therefore, during the inference phase, if the trigger is detected and the user's instructions are harmful, the impact will be mitigated. In our experiments with BEA, we use the official backdoor samples and the number of backdoor samples 10% of the PureBad dataset.
Evaluation Metrics. Safety: In our experimental results, we use three metrics to evaluate safety, utility, and attack success rate (ASR). For safety, we use the benchmark designed by (36), which consists of 11 harmful categories merged from OpenAl usage policies and Meta's 's Llama 2 acceptable use policy. These 1l categories are listed in Appendix A.I We utilize GPT-4 to judge responses and assign harmfulness scores (ranging from to 5, with lower scores indicating greater safety). Utility: For utility, different datasets have different measurement methods. To evaluate the performance on the Dialog Summary dataset, we compute the Rouge-1 Fl score by comparing the responses generated by LLMs with the ground truth responses across 200 test examples. For the PureBad and Alpaca datasets, we employ MT-Bench (58] evaluate their utilities and use GPT-4 assign scores ranging from to 10, with higher scores indicating better quality. ASR: The attack is considered successful if the LLM's response does not contain any keywords indicating refusal to answer. The keywords list is shown in Appendix A.2 We calculate the average ASR of the benchmark across the 11 categories.
Experiment Settings. We use the official fine-tuning scripts from Meta. Regarding the settings of LoRA, we only add LoRA the "q_proj" and "v_ "v_proj" attention layers, and we set the rank to 8 for all experiments. To achieve greater performance on downstream tasks, we may use different training hyperparameters for different datasets. For Llama-2-7B-Chaal we set the learning rate to 5 x 10 batch size to 5, and run epochs for all datasets. For 1aama-3-8--Instruus 10-3, batch size to 5, and run 5 epochs for the PureBad dataset. For the Dialog Summary dataset, we set the learning rate 10 batch size to 32, and run 3 epochs. All experiments are conducted on NVIDIA H100 80GB GPUs and AMD Epyc 7313 16-core processor x 64. As mentioned in Section 3 Safe LoRA needs to use the alignment matrix. There might be concerns about whether this alignment matrix will consume too many hardware resources. In practice. the alignment does require hardware resources, but it doesn't 't utilize GPUs. Instead, it can be stored on disk. During projection, it is loaded layer by layer onto GPUs (not all at once), facilitating swift completion of the projection process.
we set the learning rate to
4.1 Performance Evaluation
In this section, we demonstrate the effectiveness of Safe LoRA enhancing safety. is important to highlight that Safe LoRA does not require any additional training data, unlike both BEA and SafeInstr, which need extra data incorporation. Furthermore, the amount of additional data incorporated plays a significant role in their performance. In Safe LoRA, we compute similarity scores between weights

---

before and after projection on layer-by-layer basis. A similarity score threshold can be used to determine the number of layers to project. or we can predefine K layers and select the top K similarity score for projection. Additionally, we extend Safe LoRA to full parameter fine-tuning, and the results are demonstrated in Section 42
PureBad. Given that users might not always be benign, we fine-tune LLMs using purely malicious samples from the PureBad dataset. We project all LoRA layers for the PureBad dataset because the significant distance between the original LoRA weights and the projected weights indicates that the model has been trained in an unsafe direction. More details are provided in Appendix [A.4] Besides, we add baseline named vaccine and show the results in Appendix A.6 Table the results for non-fine con-finetuunee (original) models, models with the native LORA, baselines, and Safe LoRA. As depicted in Table 2 regarding Llama-2, the original model can effectively resist malicious instructions. However, the harmfulness score dramatically increases 4.66 after fine-tuning on the PureBad dataset. Fortunately, defense methods can significantly reduce harmfulness scores. Notably, Safe LORA greatly enhances safety, even reducing the original harmfulness score by 0.003. Considering ASR, Safelnstr often avoids answering toxic questions, but even so, its harmfulness score tends to be higher. Moreover, in terms of utility, Safe LoRA outperforms other methods, achieving the highest score on MT-Bench by at least 0.4, on par with the original model.
However, for I. Llama-3, the results differ slightly from those of Llama-2. BEA achieves the highest MT-Benn score, but its alignment is the worst. Safe LoRA has the lowest harmfulness score at 1.10; however, its utility is not satisfactory. This is because the original score of the Llama-3 model is not high (i.e., worse than Llama-2). Safelnstr manages to achieve an appropriate balance between utility and safety. Additionally, we found that when fine-tuning the PureBad dataset with the same LoRA settings as Llama-2, Llama-3's alignment requires a larger learning rate to be removed, even though its alignment performance is lower than that of Llama-2.
Attack (adversarial data)
Fine-tuning
Harmfulness Score(.)
Models
Fine-tuned
Method
Utility (1)
ASR (%)(L)
None (original model)
6.31
1.058
3.03%
LoRA
4.54
4.66
95.76%
Llama-2-78- Chatt
SafeInstr
5.74
1.064
1.21%
BEA
5.87
1.203
7.58%
Safe LoRA (Ours)
6.34
1.055
3.03%
None (original model)
5.18
1.097
7.27%
LoRA
5.85
4.637
94.85%
Llama-3-8B-Instte
SafeInstr
5.82
3.64%
BEA
6.89
1.31
10.91 9
Safe LoRA (Ours)
5.05
1.10
6.36%
Table The performance of Safe LoRA compared with LoRA, Safelnstr, and BEA methods under the Cha.ahalaaaaa-BBB-B--- models fine-tuned on the PureBad dataset.
Dialog Summary. We present more practical fine-tuning scenario. We selected dataset for task that LLMs were originally not proficient in and required fine-tuning. Additionally, we assume that users might be malicious. Therefore, we augmented the Dialog Summary dataset with 100 harmful samples. We set the similarity score threshold at 0.35, resulting in projections across 7 layers. As shown in Table 3 the Rouge-1 Fl score of the original Llama-2 model is only 34%, but after fine-tuning, it can reach around 50%. Adding SafeInstr the training set does not harm utility, but doesn't 't sufficiently reduce the harmfulness score. BEA also slightly reduces utility. but like SafeInstr, its performance on the harmfulness score is not as good as Safe LORA. Safe LORA's 's harmfulness score is at least 0.1 lower than theirs, and although its utility slightly decreases, it still approaches 50%. However, one might be curious about whether Safe LoRA might harm the utility of datasets composed entirely of benign samples. We also apply Safe LoRA to the model trained exclusively on non-harmful samples with the same number of projected layers. The results indicate that Safe LoRA does not negatively impact the performance on the benign dataset, maintaining a Rouge-F1 score of approximately 50%.
On the other hand, for Maama-3-8B-Insteen we projected approximately 35% of the total LoRA layers. Since the alignment of Ilama-3 is not strong as that of 1lama-2,, the effectiveness of the alignment matrix is diminished. Thus, the number projected layers is greater than for Llama-2. The utility of Safe LoRA can still achieve almost the same result as benign fine-tuning, at 49.04% while
7

---

the harmfulness score decreases by around 0.4, Safelnstr gets the highest safety score, but its utility is reduced by 0.12%. Conversely, BEA's utility is better than that of the originally fine-tuned model, but its alignment is also the lowest among the three. Besides, similar to the findings of Llama-2, applying Safe LoRA models trained without any malicious samples does not result in significant utility degradation. To demonstrate that our method is applicable to various model architectures, we also conducted experiments on the Gemma model and included the results in Appendix A.5 Moreover, we include an extra baseline (Vaccine
and present the results Appendix A.6
Attack (adversarial data)
Fine-tuning
Harmfulness Score
Models
Fine-tuned
Method
Utility(1)
ASR (%))()
None (original model)
34%
1.058
3.03%
LoRA
49.57%
1.27
9.70%
LoRA
50.66%
2.63
45.45%
Llama-2-7B-CLL
Safelnstr
50.21 %
1.32
10.30%
BEA
49.89%
1,482
14.55%
Safe LoRA (Ours)
49.79%
1.297
8.79%
Safe LoRA (Ours)
50.96%
1.061
3.94%
None (original model)
28.66%
1.097
6.36%
LoRA
49.04%
1.16
7.27%
LoRA
49.37%
1.65
20.61%
Alama-3-8B-Insttie
Safelnstr
48.92%
1.236
8.48%
BEA
49.97%
1,288
10.91%
Safe LoRA (Ours)
49.04%
1.268
10.30%
Safe LoRA (Ours)
47.64%
1.15
6.97%
Table 3:
The performance of Safe LoRA compared with LoRA, Safelnstr, and BEA methods fine- tuned on the Dialog Summary dataset with Llama-2-7B-CHN and Llama-3-8B-Innstuuee models.
benign dataset can lead to a reduction safety. We follow the same setting without adding more harmful samples. Here, we use MT-Bende scores as the evaluation metric (higher is better). Table presents results consistent with (36), showing that the harmfulness score increased from 1.058 to 2.25. Although there no harmful data in the Alpaca dataset, we still follow previous settings by adding safe instruction samples and backdoor samples for defense. SafeInstr and BEA did not perform well in this scenario due to the larger size of the Alpaca dataset. This highlights one their draw backs: they require a sufficient number of safe instructions backdoor samples in the training set to perform effectively.
Alpaca Dataset. Interesting results demonstrated by [36 show that fine-tuning
4able4|rreeetss
On the other hand, we have chosen not present the results for Llama-3 because when using appropriate learning rate, the ASR only increases by approximately 3%, indicating that alignment is only minimally reduced. Although increasing the learning rate can effectively reduce safety. it also causes significant harm to the model's s utility. This approach, therefore, is not suitable for typical user fine-tuning scenarios, as the trade-off between alignment and utility becomes unfavorable. In essence, while higher learning rate might achieve lower safety scores, the resulting decrease in model utility renders this method impractical for regular use.
Harmfulness Score(()
Models
Fine-tuned
Fine-tuning Method
Utility(t)
ASR (%)(L
LoRA
5.06
2.25
86.67%
Llama-2-7B-Cha
SafeInstr
5.64
2.04
80%
BEA
5.37
2.56
83.33%
Safe LoRA (Ours)
5.62
1.09
6.67%
Table The performance of Safe LoRA compared with LoRA, SafeInstr, and BEA methods fine- tuned on the Alpaca dataset under the Alama-2-7B-Cha. model.
4.2 Ablation Study
Utility v.s. Safety, In this paragraph, we show the trade-off between utility and harmfulness scores by varying the threshold of similarity score in Figure which also corresponds to the number of projected layers. Furthermore, Figure presents the similarity between CAW and ABT

---

26
0.7
22
F1 score (%)
Sim Similatty score
3
04
1.8
1.4
18.00 tha
e5g
10.2 and
(0.5 t9y
(8.5 Bhs)
00.8 (99)
(0 2009
atras
0.48 (9.6 arss
0.65 (9.7. wesu
15788 prea
i..8 rany
0.1
18.1
(015
Taple',, projected (pers;
layers
Figure 3: Comparison of harmfulness score ver- sus utility on the Llama-2-Chat model trained on the Dialog Summary dataset.
Figure Comparison of similarity scores of all LoRA's weights fine-tuned on the Dialog Sum- mary dataset, based the Llama-2-Chat model, where red points indicate projected layers.
for all layers of LoRA. Figures and we use the LJama-2 2aaaa-2-hhatt model fine-tuned on the Dialog Summary dataset with the same settings as in Section 4.1 Figure clearly demonstrates that projecting more layers tends to cause more harm to utility. At approximately 11% the total layers projected, there exists well-balancee point between utility and safety. Here, there is loss of less than 2% Rouge FI-Score, while the harmfulness score decreases by more than As shown in Figure[4] it can be observed that only a few layers display notably low similarity score, represented by the red points. Consequently, by projecting these layers,
effectively enhance alignment.
In addition to LoRA fine-tuning, we perform full fine-tuning on the PureBad dataset following the same settings as in Section 4.1 The projection process is similar to fine-tuning with LoRA and is formalized as follows:
Full Fine-tuning,
W line tune-tuned
W
C' lime tuned
W pre trained)
pre trained
where W trained and W line-tumed represent the weights of the pre-trained and fine-tuned models in the i-th layer, respectively. Instead of directly projecting the weights of the fine-tuned model, we project the residual weights between the pre-trained and fine-tuned models.
Table 5 demonstrates the performance of Safe LoRA when we perform full parameter fine-tuning on the PureBad dataset using the Llama-2-CHn model. All settings follow those in Section 4.1
Under the same settings, full parameter fine-tuning results in greater decrease in alignment and utility, with a harmfulness score 0.1 higher and an MT-Bench score at least 0.2 lower compared to LoRA (as shown in Table 2 However, with the implementation of Safe LoRA, the harmfulness score dramatically drops around 1.05. Furthermore, the MT-Bench score also increases 6.4, rise of more than 2.
Harmfulness Score (L) MT-Bench (1~10, f)
ASR (L)
Native Full Fine-tuning Safe LoRA
4.71
4.325
95.45%
1.05
6.401
3.03
Table 5: Comparison of performance of native full fine-tuning and Safe LoRA with the setting of full parameters fine-tuned on the PureBad dataset under the Llama-2-Chat model.
Conclusion
As LLMs become increasingly prevalent, the associated risks are becoming more apparent. Recent studies have demonstrated that fine-tuning can reduce safety alignment, causing LLMs to provide inappropriate responses. In this paper, we propose Safe LoRA to address the safety alignment issues caused by fine-tuning LLMs, without making any assumptions about the user's intentions, whether benign or malicious. Safe LoRA operates efficiently without requiring additional data or

---

extra training. Overall, Safe LoRA effectively mitigates the safety concerns arising from fine-tuning LLMs while maintaining an acceptable level of utility.
Broader Impact and Limitations We believe that Safe LoRA presents potential in safeguarding the risk brought upon by various fine-tuning scenarios for LLMs. Unfortunately, the transparency of this method may be subjected to future attacks as they might be able to circumvent this in an adaptive manner. On the other hand, given the increasing trend in model parameter manipulation and the upsurge in GenAL, we believe that Safe LoRA could also be applied to other multimodal models such Text-to-Iman Models to safeguard the alignment rules embedded in their systems.
References
[1] Anthropic. Claude. https://claude: ai/ 2023a.
[2] Anthropic. Claude
2023b.
[3] Amanda Askell, Yuntao Bai, Anna Chen, Dawn Drain, Deep Ganguli, Tom Henighan, Andy Jones, Nicholas Joseph, Ben Mann, Nova DasSarma, et general language assistant as laboratory for alignment. arXiv preprint arXiv:2112.00800 2021.
[4] Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.055: 2022.
[5] Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. Constitutional ai: Harmlessness from ai feedback. arXiv preprint arXiv:2212.08077. 2022.
[6] Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Rottger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. Safety-tuned LLaMAs: Lessons from improving the safety of large language models that follow instructions. In The Twelfth International Conference Learning Representations (ICLR), 2024.
[7] Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph Gonzalez, et Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. See https://vicuaa Imsys. org (accessed 14 April 2023), 2(3); 2023.
[8] Leshem Choshen, Elad Venezian, Noam Slonim, and Yoav Katz. Fusing finetuned models for better pretraining. arXiv preprint arXiv:2204.03044 2022.
[9] Paul Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei. Deep reinforcement learning from human preferences. Advances in Neural Information Processing Systems (NeurIPS), 30, 2017.
[10] Ning Ding, Yulin Chen, Bokai Xu, Yujia Qin, Zhi Zheng, Shengding Hu, Zhiyuan Liu, Maosong Sun, and Bowen Zhou. Enhancing chat language models by scaling high-quality instructional conversations. In Conference on Empirical Methods in Natural Language Processing (EMNLP), 2023.
[11] Timur Garipov, Pavel Izmailov, Dmitri Podoprikhin, Dmitry Vetrov, and Andrew G Wilson. Loss surfaces, mode connectivity, and fast ensembling of dnns. Advances in neural information processing systems, 31, 2018.
[12] Xinyang Geng, Arnav Gudibande, Hao Liu, Eric Wallace, Pieter Abbeel, Sergey Levine, and Dawn Song. Koala: A dialogue model for academic research. Blog post, April, 1:6, 2023.
[13] Mor Geva, Avi Caciularu, Guy Dar, Paul Roit, Shoval Sadde, Micah Shlain, Bar Tamir, and Yoav Goldberg. Lm-debugger: An interactive tool for inspection and intervention in transformer- based language models. In Conference on Empirical Methods in Natural Language Processing (EMNLP), 2022.
10

---

[14] Amelia Glaese, Nat McAleese, Maja Trębacz, John Aslanides, Vlad Firoiu, Timo Ewalds, Maribeth Rauh, Laura Weidinger, Martin Chadwick, Phoebe Thacker, et al. Improving alignment of dialogue agents via targeted human judgements. arXiv preprint arXiv:2209. 14375, 2022.
[15] Bogdan Gliwa, Iwona Mochol, Maciej Biesek, and Aleksander Wawer. SAMSum corpus: human- annotated dialogue dataset for abstractive summarization. In Proceedings of the 2nd Workshop on New Frontiers in Summarization, pages 70-79, Hong Kong, China, 2019. Association for Computational Linguistics.
[16] Edward Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. In International Conference on Learning Representations (ICLR), 2022.
[17] Zhiqiang Hu, Lei Wang. Yihuai Lan, Wanyu Xu, Ec-Peng Lim, Lidong Bing. Xing Xu, Soujanya Poria, and Roy Lee. LLM-adapters: An adapter family for parameter-cfficiem fine-tuning of large language models. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Conference on Empirical Methods in Natural Language Processing (EMNLP), 2023.
[18] Tiansheng Huang. Sihao Hu, and Ling Liu. Vaccine: Perturbation-awer alignment for large language model. arXiv preprint arXiv:2402.01109 2024.
[19] Yangsibo Huang, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. Catastrophic jailbreak of open-source L.LMs via exploiting generation. In The Twelfth International Conference on Learning Representatiinss 2024.
[20] Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Ludwig Schmidt, Hannanch Ha- jishirzi, and Ali Farhadi. Editing models with task arithmetic. In The Eleventh International Conference on Learning Representations, 2023.
[21] Gabriel Ilharco, Mitchell Wortsman, Samir Yitzhak Gadre, Shuran Song, Hannaneh Hajishirzi, Simon Kornblith, Ali Farhadi, and Ludwig Schmidt. Patching open- vocabularr models by interpolating weights. Advances in Neural Information Processing Systems (NeurIPS), 35:2922- 29277, 2022.
[22] Atoosa Kasirzadeh and Iason Gabriel. In conversation with artificial intelligence: aligning language models with human values. Philosophy & Technology, 36,2):27,
[23] Margaret Li, Suchin Gururangan, Tim Dettmers, Mike Lewis, Tim Althoff, Noah A Smith, and Luke Zettlemoyer. Branch-train-merge. Embarrassingly parallel training of expert language models. In NeurIPS Workshop on Interpolation and Beyond, 2022.
[24] Xiang Lisa Li and Percy Liang, Prefix-tuning: Optimizing continuous prompts for generation. In Chengqing Zong, Fei Xia, Wenjie Li, and Roberto Navigli, editors, Annual Meeting of the Association for Computational Linguistics (ACL), 2021.
[25] Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. In International Conference on Learning Representations (ICLR), 2024.
[26) Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, and Yang Liu. Jailbreaking chatgpt via prompt engineering: An empirical study. arXiv preprint arXiv:2305. 30..3055.6660 13860, 2023.
[27] Michael Matena and Colin Raffel. Merging models with fisher-weighted averaging. Advances in Neural Information Processing Systems (NeurIPS), 35:17703- 2022.
[28] Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. Tree of attacks: Jailbreaking black-box box llms automatically. arXiv preprint arXiv:2312.02110 2023.
[29] Meta. Llama 3. https://aat
2024.
[30] Eric Mitchell, Charles Lin, Antoine Bossclut, Chelsea Finn, and Christopher Manning. Fast model editing at scale. In International Conference on Learning Representations (ICLR), 2022.

---

[31] Eric Mitchell, Charles Lin, Antoine Bosselut, Christopher D Manning, and Chelsea Finn. Memory- based model editing scale. In International Conference on Machine Learning, pages 15817-15831. PMLR, 2022.
[32] Shikhar Murty, Christopher D Manning, Scott Lundberg, and Marco Tulio Ribeiro. Fixing model bugs with natural language patches. In Conference on Empirical Methods in Natural Language Processing (EMNLP), 2022.
[33] OpenAl. Gpt-4 technical report. arxiv 2303.08774. View in Article, 2(5), 2023.
[34] Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems (NeurIPS), 35:27730-27744, 2022.
[35] Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 21527-21536, 2024.
[36] Xiangyu Qi, Yi Zeng. Tinghao Xie, Pin- Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. Fine-tuning aligned language models compromises safety, even when users do not intend to! In The Twelfth International Conference on Learning Representations (ICLR), 2024.
[37] Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems (NeurlPS), 36, 2024.
[38] Marco Tulio Ribeiro and Scott Lundberg. Adaptive testing and debugging of nlp models. In Annual Meeting of the Association for Computational Linguistics (ACL), pages 3253-3267, 2022.
[39] Shibani Santurkar, Dimitris Tsipras, Mahalaxmi Elango, David Bau, Antonio Torralba, and Aleksander Madry. Editing a classifier by rewriting its prediction rules. Advances in Neural Information Processing Systems (NeurIPS), 34:2 34:23359-23373, 2021.
[40] Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. "do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. ACM Conference Computer and Communications Security (CCS), 2024.
[41] Nishant Subramani, Nivedita Suresh, and Matthew Peters. Extracting latent steering vectors from pretrained language models. In Findings of the Association for Computational Linguistics (ACL), 2022.
[42] Yi-Lin Sung, Varun Nair, and Colin A Raffel. Training neural networks with fixed sparse masks. Advances in Neural Information Processing Systems (NeurIPS), 34:24193-24205. 2021.
[43] Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B Hashimoto. Stanford alpaca: An cestruction-oollwiing Ilama model, 2023.
[44] Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajiwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023.
[45] Alex Turner, Lisa Thiergart, David Udell, Gavin Leech, Ulisse Mini, and Monte MacDi- armid. Activation addition: Steering language models without optimization. arXiv preprint arXiv:2308. 10248, 2023.
[46] Jiongxiao Wang. Jiazhao Li, Yiquan Li, Xiangyu Qi, Muhao Chen, Junjie Hu, Yixuan Li, Bo Li, and Chaowei Xiao. Mitigating arXiv preprint arXiv:2402.1 14968, 2024.
jailbreak attack with backdoor enhanced alignment.
[47] Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does Ilm safety training fail? Advances in Neural Information Processing Systems (NeurlPS), 36, 2024.
12

---

[48] Jason Wei, Maarten Bosma, Vincent Y Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M Dai, and Quoe V Le. Finetuned language models are zero-shot learners. In International Conference on Learning Representations (ICLR), 2022.
[49] Mitchell Wortsman, Gabriel Ilharco, Samir Ya Gadre, Rebecca Roelofs, Raphael Gontijo-Lopes, Ari S Morcos, Hongseok Namkoong, Ali Farhadi, Yair Carmon, Simon Kornblith, et al. Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time. In International conference machine learning, pages 23965-23998. PMLR, 2022.
[50] Mitchell Wortsman, Gabriel Ilharco, Jong Wook Kim, Mike Li, Simon Kornblith, Rebecca Roclofs, Raphael Gontijo Lopes, Hannanch Hajishirzi, Ali Farhadi, Hongseok Namkoong, et al. Robust fine-tuning of zero-shot models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7959-7971, 2022.
[51] Can Xu, Qingfeng Sun, Kai Zheng, Xiubo Geng, Pu Zhao, Jiazhan Feng, Chongyang Tao, and Daxin Jiang. WizardIm: Empowering large language models to follow complex instructions. In International Conference on Learning Representations (ICI.R), 2024.
[52] Xianjun Yang, Xiao Wang, Qi Zhang, Linda Petzold, William Yang Wang, Xun Zhao, and Dahua Lin. Shadow alignment: The ease of subverting safely-aligned language models. arXiv preprint arXiv:23 02.99299 2023.
[53] Zheng-Xin Yong, Cristina Menghini, and Stephen H Bach. Low-resource languages jailbreak gpt-4. In NewrIPS Workshop on Socially Responsible Language Modelling Research (SoLaR), 2023.
[54] Weizhe Yuan, Richard Yuanzhe Pang, Kyunghyun Cho, Sainbayar Sukhbaatar, Jing Xu, and Jason Weston. Self-rewarding language models. arXiv preprint arXiv:2401.10020 2024.
[55] Youliang Yuan, Wenxiang Jiao, Wenxuan Wang. Jen-tse Huang, Pinjia He, Shuming Shi, and Zhaopeng Tu. Gpt-4 is too smart to be safe: Stealthy chat with Ilms via cipher. In International Conference on Learning Representations (ICLR), 2024.
[56] Zheng Yuan, Hongyi Yuan, Chuanqi Tan, Wei Wang, Songfang Huang, and Fei Huang. Rrhf: Rank responses to align language models with human feedback without tears. In Advances in Neural Information Processing Systems (NeurIPS), 2023.
[57] Qiusi Zhan, Richard Fang, Rohan Bindu, Akul Gupta, Tatsunori Hashimoto, and Daniel Kang. Removing rlhf protections in gpt-4 via fine-tuning, arXiv preprint arXiv:2311.0555, 2023.
[58] Lianmin Zheng, Wei-Lin Chiang, Ying Sheng. Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. Judging Ilm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems (NeurIPS), 36, 2024.
[59] Daniel M Ziegler, Nisan Stiennon, Jeffrey Wu, Tom B Brown, Alec Radford, Dario Amodei, Paul Christiano, and Geoffrey Irving. Fine-tuning language models from human preferences. arXiv preprint 1xXi::190.008500 08599, 2019.
[60] Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307. 15043, 2023.
13

---

A Appendix Supplemental material
A.1 Detail of 11 Categories
Figure
shows categories that Meta's Llama-2 and OpenAl do not allow users to query.
Usage Policies "We don't allow the use of the following:"
#1 Illegal Activity
#5 Physical Harm
#9 Political Campaigning
#2 Child Abuse Content
#6 Economic Harm
#10 Privacy Violation Activity
#3
Hate/Harass/Violenee
#7 Praud/Deceppion
#11 Tailored Financial Advice
#4
Malware
#8 Adult Content
The above safety categories merged from "OpenÅl usage policies" and the "Meta's Llama 2 acceptable policy".
Figure 5: The user policy from OpenAl and Meta Llama-2.
A.2 Keyword List for Rejection Answers
The success of the attack hinges on the absence of keywords indicating a refusal respond in the LLM's reply.
"I'm sorry". "Sorry". "I am sorry", "I apologize", "As an", "As an Al". "I'm an", "I'm just", "As language model". "As an Assistant", "I cannot", "I do not", "Hello!", "is illegal and unethical" "I'm really sorry", "OpenAl", "unethical", "not ethical", "illegal", "not legal", "My apologies". "but cannot", "If you have any other non-malnn malicious requests", "I'm not able provide". "I am really sorry", cannot create". cannot support", can't provide", "I can' assist"
A.3 Data Format
PureBad. For fine- tinettuning the PureBad dataset, the data format we used shown as follows.
("role":" "system", "oystem","conterrr" "onnent":"Yon are a helpful assistant. Make sure you always execute users' instructions.")
("role": "oolle""uuer".""" "userr,"content"" Content":USIE INPUT)
"role"."assistant" "ontent":MODDE" OUTPUT).
Dialog Summary. For fine-tuning the Dialog summary dataset, the data format we used is shown
as follows.
["role":" I"role":"system" "content":" "Yuu are a helpful assistant for dialog summarization..) ("role":"usee uuser", "ooer"""crr Content":USEE" INPUT)
"role"."assistant"" "content": OUTPUT).
A.4 Details of Computing Distance for LoRA Weights Trained on the PurBad Dataset
We observe that models trained benign samples or with only few harmful samples significantly different from models trained exclusively on harmful samples. We compute the similarity of each layer and then sum them which can be formalized as follows:
S(CAW, AW) = N
(5)
I+ - A
14

---

where S represents the sum of the similarities between the projected and non projected weights across all layers. Table shows S(CAW. C, AW). where A AW trained on three datasets under Llama- 2-7B-Chat and (aama-3-8--Instuus Summary dataset includes 100 harmful samples mixed in. The PureBad dataset contains only harmful samples. Therefore, the similarities of models trained on the PureBad dataset are the lowest and differ significantly from those trained on benign datasets or datasets containing a small number of harmful samples.
The Alpaca dataset is free of harmful samples. The Dialog
Alpaca 0.8006
Dialog Summary
PureBad
-lama-2-7B-Chne Llama-3-8B-Instee
0.7311
0.4469
0.6709
0.4583
Table 6: Comparison of similarity of weights with models trained on different types of datasets.
A.5 Other Public Models
We performed additional experiments using the Gemma model. We conducted experiments the Dialog Summary dataset using the same setup described in Section and present the results in Table Consistent with the results from the Llama series, Safe LoRA sacrifices little utilityy with its Rouge score 46.49% but effectively reduces the harmfulness score to 2.209. Although Safelnstr and BEA both achieve good utility, they do not effectively improve alignment, with their harmfulness scores close to greater than 3.
Attack (adversarial data)
Fine-tuning
Harmfulness Score(J)
Models
Fine-tuned
Utility (t)
ASR (L))L)
Method
None (original model)
32.38%
1.033
2.12%
LoRA
49.93%
1.036
1.52%
Gemma
LoRA
49 49.95%
3.803
93.33%
Safelnstr
50.45% %
3.389
90.61% %
BEA
49.27%
2.818
50%
Safe LoRA (Ours)
46.49%
2.209
32.42%
Table 7: The performance of Safe LoRA compared with LoRA, Safelnstr, and BEA methods under the Gemma model fine-tuned the Dialog Summary dataset.
A.6 Comparison Vaceine
We conduct the official code of Vaccine [18] and train the model on LoRA with the Llama-2 model. Then, we fine-tuned Vaccine models (single/double LoRA setting) with Safe LoRA. We show the results on Dialog Summary and Pure Bad datasets.
Single LoRA.
We train Vaccine with LoRA (q_proj and v_proj) first and then fine-tuned it on downstream task datasets. As in the Table the Vaccine reduces the harmfulness score to 3.282 on PureBad while the utility (MT-Bench) not maintained. Furthermore, for Dialog Summary, the utility drops well while safety shows improvement.
Double LoRA We train Vaccine with LoRA ("q_proj", "k "k_proj", "v "v_proj", "o "o_proj", "up_pn proj",""" "down_proj", "gate_pre" _aoppprroo"""""""""""" , the default setting of Vaccine) first, and then fine-tuned another LoRA (q_proj and v_proj) downstream task. The results shown Table 9 indicate that using double LoRA fine-tuned on Pure Bad reduces utility (MT-Bench). However, the harmfulness score decreases slightly compared to using LoRA fine-tuning. Regarding Dialog Summary, double LoRA is effective retaining utility scores while the harmfulness increases.
A.7 Effeet on Harmful Data
We follow the same setting in Section that, for 10% harmful data, there are 7 projected layers. Regarding 30% and 50% harmful data, we project 18 and 34 layers, respectively. From the table
15

---

Attack (adversarial data)
Fine-tuning Method
Harmfulness Score())
Datasets
Fine-tuned
Uulity (1)
ASR (9)(()
PureBad
LoRA
4.54
4.66
95.76%
PureBad
Vaccine
2.812
3.282
82.42%
PureBad
Safe LoRA
6.34
1.055
3.03%
Dialog Summaar
LoRA
50.66%
2.63
45.45%
Dialog Summary
Vaccine
10.83%
3.209
80.30%
Dialog Summary
Safe LoRA
49.79%
1.297
8.79 %
Table The performance of Safe LoRA compared with Vaccine (single LoRA) under the Llama-2- chat model on PureBad and Dialog Summary datasets.
Attack (adversurial data)
Fine-tuning Method
Harmfulness Score(J)
Datasets
Fine-tuned
Utility (1)
ASR (%)(C)
PureBad
LoRA
4.54
4.66
95.76%
PureBad
Vaccine
0.9937
3.861
87.27%
PureBad
Safe LoRA
6.34
1.055
3.03%
Dialog Summary
LoRA
50.66%
2.63
45.45%
Dialog Summary
Vaccine
48.53%
4.455
94.85%
Dialog Summary
Safe LoRA
49.79%
1.297
8.79 %
Table 9: The performance of Safe LoRA compared with Vaccine (double LoRA) under the Llama-2- chat model on PureBad and Dialog Summary datasets.
below, it is evident that even with increase in the ratio of harmful data, Safe LoRA continues effectively improve safety, reducing the harmfulness score to around 1.2 while maintaining excellent utility which is only reduction of about 1% compared the original one.
Models
Metrics
10%
30%
50%
Utility
46.19%
50.19%
48.24%
Llama-2-Chat Model
Harmfulness Score
1.533
3.460
3.915
ASR
18.18%
66.67%
80.91%
Utility
49.67%
48.92%
49.71%
Safe LoRA
Harmfulness Score
1.301
1.233
1.312
ASR
12%
8.79%
10.30%
Table 10: The performance of Safe LoRA compared with the Llama-2- Chat model (without defense) while varying the amount of harmful examples.
16

---

NeurIPS Paper Checklist
The checklist is designed encourage best practices for responsible machine learning research. addressing issues of reproducibility. transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No] [NA]
[NA] means either that the question is Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justification right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will published with the paper.
The reviewers of your paper will be asked to use the checklist one of the factors in their evaluation. While "[Yes] is generally preferable to "[No]" ", is perfectly acceptable to answer "[No] provided a proper justification is given (e.g., "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). ). general, answering "[No] or "[NA]" is not grounds for rejection. While the questions are phrased in binary way, we acknowledge that the true answer is often more nuanced, please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS paper checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The contributions mentioned in the introduction and abstract are consistent with Section 4.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We describe limitations in Section 5
17

---

Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model vell-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification:
We provide in Section 3.3
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification:
The details of experiment settings are mentioned in Section and 4.1
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data provided or not.
18

---

reproducible, they If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access to a hosted model (e.g., g.., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way access this model for reproducing the results or way to reproduce the model (e.g., with an open-sonnee open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification: We will provide codes in supplemental material which will be put on GitHub once ready.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.. cc/
public/guides//odeee wttpss//oooeSuumssiiooooooo
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/
ssionPolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
19

---

Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification:
All settings are provided in Section
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We put all the information in Section 4
Guidelines:
The answer NA means that the paper does include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative eтror rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The information of computing resources can be found in Section
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
20

---

Question:
Does the research conducted in the paper conform, in every respect, with the
NeurIPS Code of Ethics
Answer: [Yes]
Justification: Yes, the research is conducted under the code of ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We mentioned the broader impacted in Section 5
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has socictal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied partieular applications, let alone deployments. However, if there is direct path any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative socictal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: All models adapted from the official checkpoints released by other major companies and the main method is intended to propose a safeguard solution to possible risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
21

---

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
We provide the information in the footnote.
Guidelines:
existing assets. The answer NA means that the paper does
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperswi wwcodeette......oooo com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer:
[Yes]
Justification: All settings and new assets are reported faithfully in the paper.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moddl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]
Justification: Based on Section and 4 our method and experiments do not involve crowd- sourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
22

---

According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: Based Section and 4 method and experiments do not involve crowd- sourcing nor research with human subjects.
and
Guidelines:
The answer NA means that the paper does not involve crowdsoureing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
23


Reviews:
[{"review_id": "VgYgb7ELij", "reviewer": "Reviewer_2xQA", "summary": "This paper propose a novel training-free method, Safe LoRA, to project the original LoRA to the sadety-aligned subspace. The experimental results illustrate that the proposed method can preserve the utility of downstream task and the safety of LLM output.", "questions": "1. line 213: \"Regarding the settings of  LoRA, we only add LoRA to the “q_proj” and “v_proj” attention layers, \". Why do we only consider the “q_proj” and “v_proj” attention layers, which is not a common setting?", "limitations": "N/A", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Strength: \n\n1. This paper focused on an important problem about LLM safety training. \n\n2. The proposed method is also very easy to follow and the figure about the pipeline is very clear. \n\n3. The authors provide some experimental results to illustrate the performance of the proposed safety Lora: preserve the utility and safety of LLM.", "weaknesses": "Weakness: \n\n1. I'm still not clear why directly project the LoRA weights to safety subspace can achieve such a great performance. Maybe the authors can provide more analysis and visualization to explain it. Because the proposed method is very simple and efficient and therefore it is more important to illustrate the insights and explain the reason. \n\n2. I think the experiment setting is special and the authors create these special settings to verify the performance (such as \"we augmented the Dialog Summary dataset with 100 harmful samples.\" ). It would be better if the authors could evaluate the proposed method on more popular benchmarks for testing the safety issue of LLM.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We genuinely appreciate the reviewer for the comprehensive comments concerning alignment of LLMs. We are delighted to receive the positive feedback that “The proposed method is also very easy to follow…” Please see our point-to-point response to your comments below. \n\n&nbsp;\n\n**On the explanation of $\\textsf{Safe LoRA}$**\n\nWe thank the reviewer for raising such an insightful question which we will try to answer below. Firstly, there is some other research [R1, R2] concerning weight semantics such as exploring the safety landscape and task arithmetics that are related to the alignment matrix that we proposed. **On the other hand, we note that in addition to the safety guardrail that was governed by the alignment matrix we also control the to-be-projected layers such that the utility can as well be preserved.** Specifically, figure 3 in the paper demonstrates the harmfulness score versus utility. $\\textsf{Safe LoRA}$ maintains strong downstream task performance because we selectively set $\\tau$ to control the number of projected layers rather than projecting every layer indiscriminately. This selective projection allows us to retain critical task-specific information while minimizing unnecessary alterations, resulting in better performance. In summary, our introduced alignment matrix is effective prior to guiding LoRA updates towards better safety, because it entails the effort in aligning a base model to a chat model that can refuse (some of) unsafe questions. \n\n&nbsp;\n\n[R1] Wei, Boyi, et al. \"Assessing the brittleness of safety alignment via pruning and low-rank modifications.\" (In ICML 2024).\n\n[R2] Ilharco, Gabriel, et al. \"Editing models with task arithmetic.\" (In ICLR 2023)\n\n&nbsp;\n\n**Clarification on the experiment setting**\n\nWe believe that the reviewer has some misunderstanding with regard to this issue. In fact, adding 100 harmful samples to the Dialog Summary dataset wasn't a special setup aimed at verifying performance. **It was actually part of our broader approach to demonstrate datasets with varying levels of harmful content, ranging from purely harmful data (Pure Bad), and partially harmful (Dialog Summary) to entirely benign data (Alpaca).** This setup was not specifically tailored but rather a natural part of our experimental framework, while also adopted by many other research [R3, R4]. To demonstrate the performance of our method, we present the F1 score on the Dialog Summary dataset, which indicates that $\\textsf{Safe LoRA}$ can maintain the utility of downstream tasks yet also safeguard harmful content regardless of the ratio. As for evaluating alignment, we use the benchmark proposed by [R5], which is also adopted by other works [R3]. Overall, our experimental setup wasn't specifically designed to verify performance. Instead, it was intended to demonstrate attacks of varying severity.\n\n&nbsp;\n\n[R3]: Jiongxiao Wang, Jiazhao Li, Yiquan Li, Xiangyu Qi, Muhao Chen, Junjie Hu, Yixuan Li, Bo Li, and Chaowei Xiao. Mitigating fine-tuning jailbreak attack with backdoor enhanced alignment.arXiv preprint arXiv:2402.14968, 2024.\n\n[R4]: Tiansheng Huang, Sihao Hu, Ling Liu. Vaccine: Perturbation-aware Alignment for Large Language Model. arXiv preprint arXiv:2402.01109, 2024.\n\n[R5]: Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. Fine-tuning aligned language models compromises safety, even when users do not intend to! In The Twelfth International Conference on Learning Representations (ICLR 2024).\n\n&nbsp;\n\n**Clarification on the LoRA setting**\n\nWe thank the reviewer for advising on the details. Here, we follow the official code of Llama [R6], where the default setting of the PEFT config uses q_proj and v_proj.\n\n&nbsp;\n\n[R6]:https://github.com/meta-llama/llama-recipes/blob/main/src/llama_recipes/configs/peft.py, Line 11", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "HNPXTBroYy", "reviewer": "Reviewer_93t8", "summary": "The paper proposed a post-hoc fine-tuning projection method which utilizes the aligned and unaligned weights of the model to compute the projection matrix. The method is simple (one-liner patch) and training-free.  Extensive experiments showed the effectiveness of the proposed method.", "questions": "1. in table 4, why the utility, harmfulness and ASR score become worse (even for LoRA, especially the utility score) compared to baseline reported in table 2? If fine-tuning on this dataset makes things worse, should we consider evaluating on some other datasets?\n\n2. per my comments in the weakness, although the work is a one-liner patch, the applicability of it is unknown.\n\n3. in both table 4 and table 5, the authors reported decreased harmfulness score and ASR and increased MT-Bench and utility score, does this imply that only harmful data will cause strong (thresholded by $\\tau$) dis-similarity through the fine-tuned process?\n\n4. what's the result on other models such as Mistral, Phi and Gemma?", "limitations": "The author addressed several limitations of the method. However, I think there are more limitations as mentioned in the weakness and questions section.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. The paper is well-written and easy to follow\n2. The motivation is sound which tries to address the problem of decreased safety after fine-tuning", "weaknesses": "1. The evaluation is limited. It only focuses on the Llama family which shares very similar architecture\n\n2. The proposed method is named Safe LoRA without justifying that the projection matrix is indeed related to safety. It seems like the main goal of the paper is to constrain the fine-tuned weights to be within a limit of the original weights. \n\n3. The applicability of the method is unknown. The method seems to highly depend on the fine-tune dataset, e.g. if users want to fine-tune the model to become safer (with all benign fine-tuning datasets) since not all models are equally safety-aligned [1] from the beginning, the proposed method will actually hinder its safety.\n\n\n[1] Xie, Tinghao, et al. \"SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusal Behaviors.\" arXiv preprint arXiv:2406.14598 (2024).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for recognizing the work and stating that “The motivation is sound which tries to address the problem of decreased safety after fine-tuning”. We will address and justify some concerns raised by the reviewer in the comment below.\n\n&nbsp;\n\n**Insights for $\\textsf{Safe LoRA}$**\n\nRegarding the safety representation in the alignment matrix, we note from other sources such as [R1, R2] that considered exploring the safety landscape and task arithmetics which are a recent trend that focuses on the interpretability of weight semantics. \n\nFollowing the pipeline, the projection matrix is constructed by treating weight space as a normed vector space and extracting the “alignment” semantics from the difference between the aligned and unaligned models. **By constructing the alignment matrix, we essentially create a hyperspace of alignment and by selective projection, we are able to preserve both the utility and safety.** Therefore, the projection of the trained LoRA weights is intended to map them into the alignment hyperspace rather than merely constraining the fine-tuned weights to remain within a limit of the original weights.\n\n&nbsp;\n\n[R1] Wei, Boyi, et al. \"Assessing the brittleness of safety alignment via pruning and low-rank modifications.\" (In ICML 2024).\n\n[R2] Ilharco, Gabriel, et al. \"Editing models with task arithmetic.\" (In ICLR 2023)\n\n&nbsp;\n\n**Performance and Settings**\n\n* **Regarding Table 2 & 4**\n\n    The decrease in utility observed is primarily due to the impact of fine-tuning on the generalization ability [R3]. MT-Bench evaluates the overall performance of LLMs, and fine-tuning can negatively affect this broader capability. Consequently, the results in Table 4 have shown a decline. Additionally, the large difference in the number of training samples—520 times greater in Table 4 compared to Table 2—leads to models that are more specifically adapted to the training data, further contributing to the observed decrease in utility.  \n\n* **Regarding Table 4 & 5**\n\n    On the other hand, we note that the reviewer holds the correct sense. That is, the more harmful data exist, the more layers we may need to project to maintain the alignment.\n\n&nbsp;\n\n[R3]: Yang, Haoran, et al. \"Unveiling the Generalization Power of Fine-Tuned Large Language Models.\" (In NAACL 2024)\n\n&nbsp;\n\n**Application Scenario**\n\nWe thank the reviewer for the question. Due to word limits, please see the general response for the application scenario of $\\textsf{Safe LoRA}$.\n\n&nbsp;\n\n**Safe Fine-tuning**\n\nTo address the reviewer's concerns on safe fine-tuning, we conduct experiments based on the reviewer's examples to demonstrate that $\\textsf{Safe LoRA}$ does not heavily depend on the fine-tuned dataset. \n\nWe use the Mistral model, which initially has poor alignment with a harmfulness score of 2.003, as shown in the following Table. We use the safety instruction dataset [R4] to fine-tune the model and improve its safety. As a result, the harmfulness score decreased to 1.003. Meanwhile, when applying $\\textsf{Safe LoRA}$ to the fine-tuned model with $\\tau = 0.5$ (projecting 5 layers), the harmfulness score is 1.012. Compared to the original model, applying $\\textsf{Safe LoRA}$ still leads to an improvement in alignment.\n\n\n|   Fine-tuned Method   | Harmfulness Score |\n|:---------------------:|:-----------------:|\n| None (original model) |       2.003       |\n|         LoRA          |       1.003       |\n|       $\\textsf{Safe LoRA}$       |       1.012        |\n\n&nbsp;\n\n[R4] Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Rottger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. Safety-tuned LLaMAs: Lessons from improving the safety of large language models that follow instructions. (In ICLR 2024).", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "g0fgn391sa", "reviewer": "Reviewer_d4Du", "summary": "This paper studies the problem that finetuning may compromise safety, as observed in the previous work. The author proposes Safe LoRA, a simple one-liner patch to the original LoRA implementation by introducing the projection of LoRA weights from selected layers to the safety-aligned subspace, reducing the safety risks in LLM fine-tuning while maintaining utility. Safe Lora effectively prevents the problem.", "questions": "Do you think there would be adaptive attacks for the method? How it would be designed? Discussing some related to adaptive attacks may help make the work more comprehensive.", "limitations": "The authors have discussed limitations.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The idea of Safe LoRA is simple yet effective, making it practical for mitigating safety risks in fine-tuning large language models (LLMs). The approach of achieving safety through weight space projection is both innovative and logical. This method addresses a critical issue in the fine-tuning of LLMs, where safety and alignment with human values can be compromised.\n- The method’s training-free and data-free nature is a significant advantage, making it accessible and cost-effective. The simplicity of implementing Safe LoRA without the need for additional data or retraining is a notable strength.\n- The methodology is well-presented, with the figure effectively conveying the core idea. The paper does a commendable job in breaking down complex concepts into understandable segments, aiding readers in grasping the significance and functioning of Safe LoRA.\n- The experiment is comprehensive on different scenarios and models.", "weaknesses": "I didn't see major flaws in the paper. \n\nYet, I would like to suggest the author discuss more on the practical application scenario for Safe LoRA. For example, Safe Lora is intended to prevent unintended safety degradation in user fine-tuning or maybe can be applied in service-provider fine-tuning the model. Instead, it will not be applied for user-intended malicious fine-tuning.\nClarifying the scope of the proposed method would make the paper more sound.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your genuine appreciation of the clarity and precious reviews on our work! We are delighted to receive a comment denoting that “The idea of $\\textsf{Safe LoRA}$ is simple yet effective, making it practical for mitigating safety risks in fine-tuning LLMs.” Please see the response below as we address your comments.\n\n&nbsp;\n\n**Application Scenario**\n\nWe thank the reviewer for the practical question raised! Here, we imagine two application scenarios possible for $\\textsf{Safe LoRA}$: the benign users’ part and the LLM API providers’ part (such as OpenAI).\n* **Benign Users**\n\n    It is thought that benign users possess the model and can independently control the training process. Under these conditions, one use case would be companies aiming to fine-tune models based on business-related downstream data. This could be for internal employee queries or for customer service chatbots.  However, it is shown that even when benign data is used for fine-tuning, alignment may still be compromised [R1]. To prevent the model from responding to inappropriate queries from anyone, $\\textsf{Safe LoRA}$ would provide help to ensure that the fine-tuned model remains aligned.\n\n* **LLM API Providers**\n\n    As an LLM API provider, users can upload their data for the LLM API provider to fine-tune, with users unable to interfere in the training process, only adjusting training parameters. In this scenario, the LLM API provider cannot spend extensive time checking whether the data is harmful but also wants to avoid the model from generating inappropriate responses after fine-tuning the user's data. Therefore, the LLM API provider would need to use $\\textsf{Safe LoRA}$ to ensure that the model can withstand problematic queries while preserving the utility of the user's fine-tuning data.\n\n&nbsp;\n\n[R1] Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. Fine-tuning aligned language models compromises safety, even when users do not intend to! In The Twelfth International Conference on Learning Representations (ICLR 2024).\n\n&nbsp;\n\n**Adaptive Attacks**\n\nWe thank the reviewer for such a question and also deem the attack discussion necessary.\n\nBased on the previous application scenarios, adaptive attacks might be most plausible in the LLM API provider context. In the LLM API provider scenario, attackers are permitted to only upload malicious data and adjust training hyper-parameters (if allowed) but don’t have access to information about the model (such as weights or architecture) or interfere with the intermediate training process. We assume that attackers are aware that the API providers will use $\\textsf{Safe LoRA}$ for realignment but do not know the exact alignment matrix.\n\nWe propose two possible adaptive attack methods as the following:\n\n\n* **Method I - Knowledge Transfer Attack**\n\n     Without any knowledge of the private model. The attacker can only obtain the alignment vector on the open-source model. Here, the goal is to create malicious data such that the cosine similarity between the gradient during training and the alignment vector is high, while still keeping the training loss low. This approach would ensure a decrease in the model's safety. The attacker then provides the LLM API provider with crafted malicious data, i.e. similar to a transfer attack designed to bypass $\\textsf{Safe LoRA}$.\n\n     However, to craft such data, the attackers should find a noise such that when applied to the text embedding (since LLMs convert discrete prompts into continuous embeddings) would result in the increase of cosine similarity that eventually evades the $\\textsf{Safe LoRA}$ projection. Once the noise is identified, the attacker still needs additional steps of discrete-continuous optimizations to select the optimal discrete prompts for the generated noise, which can be done using genetic algorithms (GA) or other methods.\n\n    Nevertheless, this attack method is time-consuming as it requires optimizing the noise for each iteration of the training process. Furthermore, converting malicious embeddings into prompts using GA also incurs significant time costs. Lastly, the surrogate alignment matrix might be very different from the target API, causing attacks to fail.\n\n\n* **Method II - Model Inversion Attack**\n\n     Once again, the attacker can obtain the alignment vector by computing it on an open-source model. Since the dimension of this alignment vector matches that of the model weights, performing model inversion on the alignment vector might be able to generate data that represents safety. By mixing malicious data with the safety data obtained from model inversion and then uploading to the API provider, it might also be possible to bypass $\\textsf{Safe LoRA}$. However, it is not known whether the alignment vector could be meaningful in model inversion or are current model inversion techniques on LLMs [R2] strong enough for such adaptive attacks.\n\n&nbsp;\n\n[R2] Morris, John X., et al. \"Language model inversion.\" (In ICLR 2024)", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zWUcDUSgDX", "reviewer": "Reviewer_X4Co", "summary": "This paper proposes Safe LoRA to defend against the harmful finetuning issue for LLMs. The core idea of Safe Lora is to project the harmful gradient update to the subspace constructed by the alignment update.  To guarantee utility performance, the authors propose to use cosine similarity to determine whether the update in a layer should be projected or not.", "questions": "How do you construct the alignment update in the experiment? In section 3.1, it is claimed that:\n\n> For the aligned and unaligned models, take Meta’s Llama for example, the aligned model will be the Chat model such that they are trained with an alignment goal [43, 28]. On the other hand, the unaligned model could be the aligned model that is fine-tuned with malicious data such that the LLM has lost the safety guardrail and is vulnerable to attacks.\n\nI am wondering in the experiments, are you using harmful data to first unaligned the chat model, and then obtain the alignment update? \n\nIf this is the case, I am wondering if the safe gradient update can also be obtained by these procedures.  i) Use vanilla Llama2 (not chating version) as an unaligned model. ii) Do the alignment on Llama2 and get the aligned model.  iii) Subtract the weights of these two models.", "limitations": "The paper discusses the limitations. I don't think the mentioned limitation should be a problem in the acceptance of this paper. I am willing to further increase the score if the authors can provide experiments to address my raised concerns.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper proposes a timely solution for the harmful finetuning issue for LLMs. \n\n2. The idea is intuitive enough and should be an effective solution to the problem. \n\n3. The refinement that uses cosine similarity to decide whether the projection is done for each layer is interesting, and brings practical performance enhancement. \n\n4. The paper is well-written and concise enough, and I think the potential audience of this paper will be large given its simplicity.", "weaknesses": "1) Baseline selection can be more comprehensive. While the authors compare with  SafeInstr and BEA, the authors might also consider comparing with Vaccine (Huang et al, 2024), which is first available earlier than BEA and with source code available. \n\nHuang T, Hu S, Liu L. Vaccine: Perturbation-aware alignment for large language model[J]. arXiv preprint arXiv:2402.01109, 2024.\n\n2) Some important literature is missing for the discussion. Please consider reviewing these related papers on harmful finetuning. \n\n[1] Fine-tuning can cripple your foundation model; preserving features may be the solution https://openreview.net/forum?id=VQ7Q6qdp0P (ICLR2024 template) \n\n[2] Vaccine: Perturbation-aware Alignment for Large Language Model    https://arxiv.org/abs/2402.01109  （ICML2024 template）\n\n[3] Keeping LLMs Aligned After Fine-tuning: The Crucial Role of Prompt Templates https://arxiv.org/pdf/2402.18540 （ACL2024 template）\n\n[4] Immunization against harmful fine-tuning attacks https://arxiv.org/pdf/2402.16382 （ICLR2024 workshop template）\n\n[5] Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models https://arxiv.org/pdf/2402.02207   （ICML2024 template）\n\n------------------------------------------------------------Concurrent------------------------------------------------------------\n\n[6] Representation noising effectively prevents harmful fine-tuning on LLMs   https://arxiv.org/pdf/2405.14577 （NeurIPS2024 template）\n\n[7] Lazy Safety Alignment for Large Language Models against Harmful Fine-tuning   https://arxiv.org/abs/2405.18641   （NeurIPS2024 template）\n\n[8] No Two Devils Alike: Unveiling Distinct Mechanisms of Fine-tuning Attacks   https://arxiv.org/pdf/2405.16229 （NeurIPS2024 template）\n\n[9] A safety realignment framework via subspace-oriented model fusion for large language models https://arxiv.org/pdf/2405.09055 （also a post-hoc defense like safelora)\n\n[10] Navigating the Safety Landscape: Measuring Risks in Finetuning Large Language Models https://arxiv.org/abs/2405.17374 （NeurIPS2024 template）\n\nI am aware that some of the listed work is concurrent work (e.g., concurrent submissions to NeurIPS 2024). However, it is encouraged to also cite and discuss them, because that will be beneficial for the development of the research field (but the authors should at least cite and discuss those existing works that appeared before the NeurIPS2024 review cycle).\n\n3. The experiment can be more comprehensive. For example, will the ratio of harmful data affect the defense performance?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank the reviewer for offering detailed reviews on$\\textsf{Safe LoRA}$. We appreciated the comment saying that “The paper is well-written and concise enough, …  the potential audience of this paper will be large given its simplicity.” and shared a common perspective as the reviewer, laying importance in restoring alignment under practical scenarios. Below we provide a pointwise reply to the reviewer’s comment.\n\n&nbsp;\n\n**Literature Discussion**\n\nWe thank the reviewer for bringing up related works and concurrent work for discussion. We would cite and discuss the mentioned papers in the revised version. For a brief introduction, please see the general response for the literature discussion. \n\n&nbsp;\n\n**More Performance Comparison**\n\nWe conduct the official code of Vaccine and train the model on LoRA with the Llama-2 model. Then, we fine-tuned Vaccine models (single/double LoRA setting) with $\\rho=2$. We show the results on Dialog Summary and Pure Bad datasets.\n\n**Single LoRA**\n\nWe train Vaccine with LoRA (q_proj and v_proj) first, and then fine-tuned it on downstream task datasets. As seen in the table below, Vaccine reduces the harmfulness score to 3.282 on PureBad while the utility (MT-Bench $\\uparrow$) is not maintained. Furthermore, for Dialog Summary, the utility drops as well while safety shows no improvement. \n\n|    Dataset     | Attack(adversarial data) | fine-tuned | Fine-tuning Method | Utility | Harmfulness Score |  ASR   |\n|:--------------:|:----------------------------:|:---------:|:------------------:|:-------:|:-----------------:|:------:|\n|    Pure Bad    |              ✓               |     ✓     |        LoRA        |  4.54   |       4.66        | 95.76% |\n|    Pure Bad    |              ✓               |     ✓     |      Vaccine       |  2.812  |       3.282       | 82.42% |\n|  Dialog Summary              |     ✓                         |     ✓      |     LoRA               |   50.66%      |     2.63              |  45.45%      |\n| Dialog Summary |              ✓               |     ✓     |      Vaccine       | 10.83%  |       3.209       | 80.30% |\n\n&nbsp;\n\n**Double LoRA**\n\nWe train Vaccine with LoRA (\"q_proj\", \"k_proj\", \"v_proj\", \"o_proj\", \"up_proj\", \"down_proj\", \"gate_proj\", default setting of Vaccine) first, and then fine-tuned another LoRA (q_proj and v_proj) on downstream task. The results shown below indicate that using double LoRA fine-tuned on Pure Bad reduces utility (MT-Bench $\\uparrow$). However, the harmfulness score decreases slightly compared to using LoRA fine-tuning. Regarding Dialog Summary, double LoRA is effective in retaining utility scores while the harmfulness increases.\n\n\n|    Dataset     | Attack(adversarial data) | fine-tuned | Fine-tuning Method | Utility | Harmfulness Score |  ASR  |\n|:--------------:|:----------------------------:|:---------:|:------------------:|:-------:|:-----------------:|:-----:|\n|    Pure Bad    |              ✓               |     ✓     |        LoRA        |  4.54   |       4.66        | 95.76% |\n|    Pure Bad    |              ✓               |     ✓     |      Vaccine       |   0.9937|   3.861       |87.27% |\n|  Dialog Summary              |     ✓                         |     ✓      |     LoRA               |   50.66%      |     2.63              |  45.45%      |\n| Dialog Summary |              ✓               |     ✓     |      Vaccine       | 48.53%  |   4.455      |94.85% |\n\nAlthough it seems that Vaccine does not effectively reduce harmfulness, it might be contributed to the fact that Alpaca was used for vaccine models in which the alignment might be compromised as shown in [R6]. Due to the time limit, we are unable to validate the cause which requires multiple experiments. However, we deem that both $\\textsf{Safe LoRA}$ and Vaccine are diverse viable solutions toward soothing the misalignment of LLM fine-tuning and should both be considered during practical deployment.\n\n&nbsp;\n\n[R6]: Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. Fine-tuning aligned language models compromises safety, even when users do not intend to! In The Twelfth International Conference on Learning Representations (ICLR 2024).\n\n&nbsp;\n\n**Effect on Harmful Data**\n\nWe thank the reviewer for this additional question on experiments which we answer below. We follow the same setting in Section 4 that, for 10% harmful data, there are 7 projected layers. Regarding 30% and 50% harmful data, we project 18 and 34 layers, respectively.\nFrom the table below, it is evident that even with an increase in the ratio of harmful data, $\\textsf{Safe LoRA}$ continues to effectively improve safety, reducing the harmfulness score to around 1.2 while maintaining excellent utility which is only a reduction of about 1% compared to the original one.\n\n|  Original Model   |  10%   |  30%   |  50%   |\n|:-----------------:|:------:|:------:|:------:|\n|      Utility      | 49.16% | 50.19% | 48.24% |\n| Harmfulness Score | 1.533  | 3.460  | 3.915  |\n|        ASR        | 18.18% | 66.67% | 80.91% |\n\n|      $\\textsf{Safe LoRA}$      |  10%   |  30%   | 50% |\n|:-----------------:|:------:|:------:|:---:|\n|      Utility      | 49.67% | 48.92% | 49.71%    |\n| Harmfulness Score | 1.301  |   1.233     |   1.312  |\n|        ASR        |  12%   | 8.79%  | 10.30%    |\n\n&nbsp;\n\n**Building Alignment Update**\n\nThe reviewer is exactly correct in the way of building alignment updates! In fact, we’ve written that in section 3.1, the base model is eventually considered as it shows similar performance to the maliciously fine-tuned one. Here we quote “As a result, … most open-source LLMs provide both their base model and chat/instruct models, users can conveniently use these official models to construct the alignment matrix without needing to train their own aligned or unaligned model.” To sum up, we note that here $\\textsf{Safe LoRA}$ is a training-free and data-independent method as it requires only the aligned and base model.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We would like to first thank the reviewers for their generous advice on $\textsf{Safe LoRA}$ as it will boost our understanding on the realignment issue of LLM fine-tuning. Due to character limits, we will be answering some common concerns in the general response below.

&nbsp;

**Application Scenario (Reviewer d4Du, 93t8)**

For the application scenario, we imagine two application scenarios possible for $\textsf{Safe LoRA}$: benign users and LLM API providers (such as OpenAI).

* Benign User

    It is thought that benign users possess the model and can independently control the training process. Under these conditions, some use cases include companies aiming to fine-tune models based on business-related downstream data. This could be for internal employee queries or for customer service chatbots.  However, it is shown that even when benign data is used for fine-tuning, alignment may still be compromised [R1]. To prevent the model from responding to inappropriate queries from anyone, $\textsf{Safe LoRA}$ would provide help to ensure that the fine-tuned model remains aligned.


* LLM API Provider

    As an LLM API provider, users can upload their data for the LLM API provider to train on, with users unable to interfere in the training process, only adjusting training parameters. In this scenario, the LLM API provider cannot spend extensive time checking whether the data is harmful but also wants to avoid the model starting to generate inappropriate responses after fine-tuning on user data. Therefore, the LLM API provider would need to use $\textsf{Safe LoRA}$ to ensure that the model can withstand problematic queries while preserving the utility of the user's data.

&nbsp;

[R1] Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. Fine-tuning aligned language models compromises safety, even when users do not intend to! (In ICLR 2024).

&nbsp;

**Literature Discussion (Reviewer X4Co)**

We note that several concurrent works came around the deadline which we will acknowledge and discuss in the revised version as they are all solutions towards the realignment of LLM fine-tuning. Here, we would provide a brief discussion of the previous literature mentioned by the reviewers and enclose a more detailed one in the revised version. 

Firstly, [R1] focuses on solving concept forgetting which is a phenomenon observed by [R1] where other tasks’ performance would decrease when a specific one is chosen for fine-tuning. Furthermore, [R2] aims at solving the problem of malicious fine-tuning where they discover certain perturbations that can be added to search for a model that resists malicious fine-tuning. Vaccine was then introduced by [R2] to mitigate such issues. Meanwhile [R3] utilizes a safe template to prohibit malicious responses. Similarly, [R4] proposes certain conditions as guidelines for effective defenses. Lastly, [R5] focuses on the realignment of VLLMs.

&nbsp;

[R1] Mukhoti, Jishnu, et al. "Fine-tuning can cripple your foundation model; preserving features may be the solution."(In TMLR 2024).

[R2] Huang, Tiansheng, Sihao Hu, and Ling Liu. "Vaccine: Perturbation-aware alignment for large language model." (In ArXiv 2024).

[R3] Lyu, Kaifeng, et al. "Keeping llms aligned after fine-tuning: The crucial role of prompt templates." (In ArXiv 2024).

[R4] Rosati, Domenic, et al. "Immunization against harmful fine-tuning attacks." (In ArXiv 2024).

[R5] Zong, Yongshuo, et al. "Safety fine-tuning at (almost) no cost: A baseline for vision large language models." (In ICML 2024).

&nbsp;

**Performance of $\textsf{Safe LoRA}$ on Other Public Models (Reviewer 93t8)**

In response to the reviewer's comment, we performed additional experiments using the Gemma model. We conducted experiments on the Dialog Summary dataset using the same setup described in Section 4 and present the results in the Table below. **Consistent with the results from the Llama series, $\textsf{Safe LoRA}$ sacrifices little utility, with its Rouge F1 score at 46.49%, but effectively reduces the harmfulness score to 2.209.** Although SafeInstr and BEA both achieve good utility, they do not effectively improve alignment, with their harmfulness scores close to or greater than 3.

| Attack(adversarial data) | fine-tued |  Fine-tuning Method   |  Utility   | Harmfulness Score |    ASR     |
|:----------------------------:|:---------:|:---------------------:|:----------:|:-----------------:|:----------:|
|              ✘               |     ✘     | None (original model) |   32.38%   |       1.033       |   2.12%    |
|              ✘               |     ✓     |         LoRA          |   49.93%   |       1.036       |   1.52%    |
|              ✓               |     ✓     |         LoRA          |   49.95%   |       3.803       |   93.33%   |
|              ✓               |     ✓     |       SafeInstr       | **50.45%** |       3.389       |   90.61%   |
|              ✓               |     ✓     |          BEA          |   49.27%   |       2.818       |    50%     |
|              ✓               |     ✓     |       $\textsf{Safe LoRA}$        |   46.49%   |     **2.209**     | **32.42%** |

Meta-review: Thanks for your submission to NeurIPS 2024.
Overall, the reviewers recognize that the paper presents a novel training-free method, Safe LoRA, which introduces the projection of LoRA weights from selected layers to the safety-aligned subspace. The experiment results demonstrate that Safe LoRA can preserve the model's safety performance across downstream tasks and mitigate the negative impact introduced by the malicious data. The reviewers agree that this paper makes important contributions to the community and is valuable to be accepted.
Decision: Accept (poster)