Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning

2026-08-05

AI Summary

This work addresses the vulnerability of open-source large language models to malicious fine-tuning attacks, even when partial weights are protected, noting that existing defenses rely on downstream user cooperation and thus suffer from limited practicality. To overcome this, the authors propose a Unidirectional Safety Gate (USG) mechanism that appends a nullspace cubic layer and an inverse adapter to the model. The former blocks gradient updates from harmful examples during fine-tuning, while the latter restores the original forward behavior, enabling proactive defense without requiring downstream collaboration. This approach is the first to leverage nullspace gradient masking in the representation space at release time to counteract malicious fine-tuning. Combined with threshold calibration and Transformer ensembling, USG demonstrates consistent efficacy across six model–dataset pairs: attack success rates remain at pre-release levels, safety pass rates are high, and a clear safety–utility trade-off is observed on BeaverTails.

Abstract

Released aligned large language models remain vulnerable to malicious downstream finetuning. Existing defenses are largely designed for the fine-tuning-as-a-service (FTaaS) paradigm or rely on downstream users to follow additional safety procedures, and therefore do not directly address the setting we study: a provider controlled partially protected open-weight (PPOW) release setting in which most weights remain trainable while a small safety-critical component is preserved at release. We propose a Unidirectional Safety Gate (USG), instantiated as a Null Space Cubic Layer together with an Inverse Adapter inserted after the final Transformer layer. During downstream fine-tuning, the cubic layer suppresses or blocks gradients from harmful samples whose hidden states fall in a calibrated protected region, while the Inverse Adapter restores the base model's forward behavior. In practice, we calibrate a threshold using defender-held harmful data, allowing protection to generalize to nearby in-distribution harmful samples. Across six evaluated model-dataset settings, USG keeps post-finetuning attack success rate close to the pre-release level under a fixed release threshold, while maintaining high safe-pass rates on easier settings and exhibiting a clearer safety-utility trade-off on unsafe samples from BeaverTails. These results suggest that release-time representation-space blocking can raise the cost of malicious downstream adaptation without requiring downstream cooperation. The code is available at https://github.com/OpenCausaLab/Gradient-Immunity.

Problem

• malicious fine-tuning
• aligned large language models
• open-weight release
• safety-critical component
• downstream adaptation

Innovation

• Gradient Immunity
• Null Space Cubic Layer
• Unidirectional Safety Gate
• Malicious Fine-Tuning Defense
• Open-Weight Model Protection