LSSF: Safety Alignment for Large Language Models through Low-Rank Safety Subspace Fusion

TL;DR

This work tackles safety fragility in LLMs post-finetuning by introducing LSSF, a post-hoc safety realignment framework that leverages a low-rank safety subspace. It constructs a low-rank projection P^(r) from left singular vectors of activations and uses a novel safety singular value entropy threshold η to select the retentive rank, enabling linear arithmetic with δ_safe to counteract safety drift while preserving task performance. The approach is validated on Qwen2.5 and Llama3.1 variants, showing effective safety restoration with minimal impact on downstream metrics and robust ablations demonstrating the roles of η and α in controlling information density and drift. Overall, LSSF provides a model-agnostic, computationally efficient mechanism for post-hoc safety alignment through principled subspace fusion, with potential extensions to multimodal and mixture-of-experts models.

Abstract

The safety mechanisms of large language models (LLMs) exhibit notable fragility, as even fine-tuning on datasets without harmful content may still undermine their safety capabilities. Meanwhile, existing safety alignment methods predominantly rely on the fine-tuning process, which inadvertently leads to the increased complexity and computational resources required. To address these issues, we introduce LSSF, a novel safety re-alignment framework with \underline{L}ow-Rank \underline{S}afety \underline{S}ubspace \underline{F}usion. Our proposed method exploits the low-rank characteristics of safety information in LLMs by constructing a low-rank projection matrix to extract the principal components of safety vectors. Notably, this projection matrix represents the low-rank safety subspace of the LLMs, which we have observed to remain stable during fine-tuning process and is isolated from the model's general capabilities. These principal components are used to effectively restore safety alignment when combined with fine-tuned LLMs through linear arithmetic. Additionally, to account for the varying encoding densities of safety information across different layers of LLMs, we propose a novel metric called safety singular value entropy. This metric quantifies the encoding density and allows for the dynamic computation of the safety-critical rank for each safety vector. Extensive experiments demonstrate that our proposed post-hoc alignment method can effectively restore the safety alignment of fine-tuned models with minimal impact on their performance in downstream tasks.

Figures (10)

• Figure 1: Illustration of using low-rank safety principal components to restore model safety alignment, where all safety components share the same low-rank subspace.
• Figure 2: Overview of our safety re-alignment framework. Step I: ① $\rightarrow$ ②, obtain an unsafe model through unsafe fine-tuning. Step II: ② $\rightarrow$ ③, invert the delta parameters to derive the safety vector. Step III: ③ $\rightarrow$ ④, construct a low-rank projection matrix to extract the safety principal components of the safety vector and perform linear arithmetic with the downstream fine-tuned model to restore its safety alignment.
• Figure 3: Visualization of safety vector (a) and low-rank safety principal components (b, c) with different $\eta$ at the layer model.layers.5.mlp.down_proj, where $\alpha=1$. Visual representations of 2500 random sample positions are provided.
• Figure 4: Impact of different singular value entropy thresholds on the performance of downstream fine-tuning models, with left singular vector weight $\alpha=1.0$
• Figure 5: Impact of different left singular vector weights on the performance of downstream fine-tuning models, with singular value entropy ratio threshold of $\eta=0.5$