Refusal Localizes, the Damage Relocates: Safety Layers Under Few-Sample Fine-Tuning

arXiv:2610.00320 · cs.CL, cs.CR, cs.LG · Submitted 2026-09-29 · Read on arXiv

cs.CL, cs.CR, cs.LG

Submitted: 2026-09-29

Updated: 2026-09-29

Code: https://github.com/js-lee-AI/refusal-relocates

Terminology

• Fine-Tuning — 40× in this paper · explained in 5 episodes
• Alignment — 18× in this paper · explained in 1 episode
• Accuracy — 12× in this paper · explained in 1 episode
• Calibration — 8× in this paper · explained in 7 episodes
• Ablation — 7× in this paper · explained in 1 episode
• Perplexity — 7× in this paper · explained in 3 episodes
• Activation Patching — 5× in this paper · explained in 2 episodes
• In International Conference on Learning Representations — 5× in this paper
• Benchmark — 4× in this paper · explained in 2 episodes
• Adaptation — 3× in this paper · explained in 1 episode
• Robustness — 3× in this paper · explained in 5 episodes
• Downstream Tasks — 2× in this paper · explained in 2 episodes
• Foundation Model — 2× in this paper · explained in 3 episodes
• Foundation Models — 2× in this paper · explained in 7 episodes
• Large Language Models (LLMs) — 2× in this paper · explained in 6 episodes
• Steering — 2× in this paper · explained in 2 episodes
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Adversarial Examples — 1× in this paper · explained in 2 episodes
• Adversarial Robustness — 1× in this paper · explained in 3 episodes
• Distillation — 1× in this paper · explained in 2 episodes
• Embeddings — 1× in this paper · explained in 2 episodes
• International Conference on Machine Learning — 1× in this paper
• KV cache — 1× in this paper · explained in 3 episodes
• Linear probe — 1× in this paper · explained in 2 episodes
• LoRA Fine-Tuning — 1× in this paper · explained in 3 episodes
• Supervised Fine-Tuning (SFT) — 1× in this paper · explained in 8 episodes

Sources

• The Llama 3 Herd of Models
• Antidote: Post-fine-tuning Safety Alignment for Large Language Models against Harmful Fine-tuning
• Mistral 7B
• Tulu 3: Pushing Frontiers in Open Language Model Post-Training
• Skin-Deep: A Geometric Diagnostic for Alignment Fragility in Large Language Model Representations
• Answer-Conditioned Chains of Thought Degrade Verifiable-Reasoning Distillation in Large Language Models
• LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70B
• 2 OLMo 2 Furious
• Qwen2.5 Technical Report
• Yi: Open Foundation Models by 01.AI
• Universal and Transferable Adversarial Attacks on Aligned Language Models

Related papers

• Exploring Solution Divergence and Its Effect on Large Language Model Problem Solving
• Ishigaki-IDS-Bench: A Benchmark for Generating Information Delivery Specification from BIM Information Requirements
• Subliminal Steering: Stronger Encoding of Hidden Signals
• MedStruct-S: A Benchmark for Key Discovery, Key-Conditioned QA and Semi-Structured Extraction from OCR Clinical Reports
• The End of Transformers? On Challenging Attention and the Rise of Sub-Quadratic Architectures
• Untangling the Mechanisms of Misleading Context in Medical Question Answering