A Guardrail for Safety Preservation: When Safety-Sensitive Subspace Meets Harmful-Resistant Null-Space

TL;DR

GuardSpace tackles the brittleness of safety when adapting pre-trained LLMs by introducing a two-part guardrail: a safety-sensitive subspace that freezes safety-relevant weights and routes learning through safety-irrelevant components, and a harmful-resistant null space that restricts updates to avoid altering safe outputs on harmful prompts. The approach relies on covariance-preconditioned SVD to identify safety-relevant directions and uses a fixed null-space projector derived from the same safety prompts to stabilize behavior. Empirically, GuardSpace achieves near-floor harmful outputs while maintaining or improving downstream task accuracy across multiple models and datasets, outperforming state-of-the-art fine-tuning defenses. This method offers a practical, model- and data-robust way to preserve safety during task-specific adaptation with broad applicability.

Abstract

Large language models (LLMs) have achieved remarkable success in diverse tasks, yet their safety alignment remains fragile during adaptation. Even when fine-tuning on benign data or with low-rank adaptation, pre-trained safety behaviors are easily degraded, leading to harmful responses in the fine-tuned models. To address this challenge, we propose GuardSpace, a guardrail framework for preserving safety alignment throughout fine-tuning, composed of two key components: a safety-sensitive subspace and a harmful-resistant null space. First, we explicitly decompose pre-trained weights into safety-relevant and safety-irrelevant components using covariance-preconditioned singular value decomposition, and initialize low-rank adapters from the safety-irrelevant ones, while freezing safety-relevant components to preserve their associated safety mechanism. Second, we construct a null space projector that restricts adapter updates from altering safe outputs on harmful prompts, thereby maintaining the original refusal behavior. Experiments with various pre-trained models on multiple downstream tasks demonstrate that GuardSpace achieves superior performance over existing methods. Notably, for Llama-2-7B-Chat fine-tuned on GSM8K, GuardSpace outperforms the state-of-the-art method AsFT, reducing the average harmful score from 14.4% to 3.6%, while improving the accuracy from from 26.0% to 28.0%.

Figures (4)

• Figure 1: An overview of GuardSpace. The model is first probed with safety-triggering prompts to obtain the activation $\mathbf{X}$ and the covariance matrix $\mathbf{C}=\mathbf{X}\mathbf{X}^{\top}$. I. Initialization in safety-sensitive subspace. We right-precondition the weight by $\mathbf{C}$ and factorize $\mathbf{W}\mathbf{C}=\mathbf{U}\,\mathbf{\Sigma}\,\mathbf{V}^{\top}$. The components with large singular values constitute the safety-relevant subspace (cyan) and are frozen into $\mathbf{W}'$, while the components with small singular values form the safety-irrelevant subspace (blue) and are used to initialize low-rank adapters $(\mathbf{A},\mathbf{B})$. II. Optimization in harmful-resistant null space. We construct a projector $\mathbf{P}$ that constrains the update of adapters to the null space of harmful inputs, minimizing perturbations caused by fine-tuning on safety behaviors. Together, they preserve the model’s original safety alignment while enabling effective downstream adaptation.
• Figure 2: GuardSpace Null-Space Projector Analysis on Llama-2-7B-Chat (GSM8K) (a) Effect of harmful-dataset choice on GuardSpace’s null space projector for Llama-2-7B-Chat (GSM8K); (b) Effect of data size on GuardSpace’s null-space projector for Llama-2-7B-Chat (GSM8K)
• Figure 3: Effect of safety-irrelevant components removal and null space projection on ASR.
• Figure 4: Effect of the number of safety-irrelevant components used for adapter initialization.