Fine-tuning an AI model for a new task can quietly gut its safety training, and a new paper says it knows why.
Researchers studied why fine-tuning safety-aligned models like LLaMA, Gemma, and Qwen for specific tasks makes them more likely to comply with harmful requests. They found the culprit is representation-level: task-specific training shifts the internal activation patterns that encode refusal behavior, distorts their geometric structure, and creates interference with the optimization happening for the new task. Based on that diagnosis, the team built RefusalGuard, a fine-tuning method that constrains updates to the safety-relevant directions in a model's hidden representations while still letting the model learn the new task along the remaining directions. Tested on benchmarks including AdvBench, DirectHarm4, and JailbreakBench, models tuned with RefusalGuard reportedly matched the refusal rates of their untouched, safety-aligned originals while still performing competitively on the downstream tasks they were adapted for.
This isn't just an incremental patch. It's evidence that the tradeoff between safety and customization is more fixable than assumed, if you treat safety as a geometric property of a model's internals rather than a behavior to reinforce with more training data. That framing matters because most safety work to date has leaned on curating better fine-tuning data or bolting on filters after the fact, both of which tend to erode the moment someone fine-tunes on top of them again.
The catch: these are the paper's own benchmark numbers, and "attack success rate comparable to the base model" only sounds good if that base model's safety training was solid to begin with.