The paper introduces FDCU, a dual‑constrained subspace projection framework designed to improve machine unlearning for large language models. FDCU limits parameter updates with a dual‑masking rule that preserves general knowledge via Fisher Information while preventing the activation of spurious suppressors through the Principle of Minimal Functional Intervention. Experiments show that FDCU achieves state‑of‑the‑art robustness against retraining attacks while maintaining near‑lossless general utility, thereby ensuring durable safety for LLMs.
By Jiaqing Li, Shide Zhou, Zhibo Zhang, Yuxi Li, Tianlong Yu, Kailong Wang
The paper examines the vulnerability of open‑weight large language model safeguards that aim to block harmful usage by assuming new harmful behavior arises only through fine‑tuning. It demonstrates that simple, low‑cost attacks—abliteration and prefilling—can significantly increase attack success rates across multiple benchmarks, and proposes an abliteration‑resistant tuning (ART) method that mitigates these attacks. The study shows that safeguarding defenses must be evaluated against a broader range of attack strategies beyond fine‑tuning.
By Kevin Kuo, Virginia Smith, Chhavi Yadav
arXiv:2608.23181v1 Announce Type: cross
Abstract: As large language models (LLMs) continue to advance in coding capabilities, their potential in cybersecurity has drawn increasing research attention,...
By Jian Yang, Haau-Sing Li, Shawn Guo, Zixi Zhao, Yibo Tan, Jiajun Wu, Aishan Liu, Xianglong Liu, Tianyu Zheng, Bryan Dai, Chengran Yang
TextCloak is a reinforcement‑learning driven framework that generates unlearnable examples (UEs) to protect textual data from unauthorized fine‑tuning of large language models (LLMs). It transforms clean text into perturbations that preserve meaning and naturalness while degrading the utility of models trained on them. Experiments on six datasets and nine LLMs show that TextCloak consistently impairs unauthorized fine‑tuning and remains robust across different architectures, training settings, and adaptive attacks.
By Chengshuai Zhao, Pingchuan Ma, Dawei Li, Bohan Jiang, Zhiyuan Yu, Zhen Tan, Huan Liu
arXiv:2608. 08542v1 Announce Type: new Abstract: Model merging has become the default way to give an aligned language model new skills without retraining: a practitioner folds task vectors from math, code, or domain specialists into a safety-aligned base using task arithmetic, TIES, or DARE.
By Yu Ma, Hongli Shi, Jing Li, Xinran Xu, Weiwei Hou
arXiv:2608. 20338v1 Announce Type: new Abstract: Large Language Models (LLMs) increasingly require selective removal of harmful or sensitive knowledge, called unlearning, yet existing methods and benchmarks fail to evaluate this capability completely.
By Sahil Kale, Ian Harris
The paper introduces SimpleLoRIF, a scalable gradient‑embedding technique that pinpoints fine‑tuning examples whose gradients align with unsafe behavior in large language models. By applying this method, the authors create SafeTulu, a version of Tulu 3 with the 20 % of most unsafe‑aligned examples removed, which reduces GCG attack success by up to 22 % across several LLMs while largely preserving or improving capability. The study also highlights previously under‑studied safety‑degrading data sources such as tool‑execution failures and narrative arithmetic.
By Saket Reddy, Amro Abbas, Anshuman Suri, Ari Morcos, David Schwab, Pratyush Maini
arXiv:2508. 10029v3 Announce Type: replace-cross Abstract: Safety-aligned large language models can still be manipulated through white-box interventions that modify their internal representations.
By Wenpeng Xing, Bohan Yang, Mohan Li, Chunqiang Hu, Haitao Xu, Ningyu Zhang, Bo Lin, Meng Han
arXiv:2508.20766v2 Announce Type: replace-cross
Abstract: Safety alignment in Large Language Models (LLMs) often involves mediating internal representations to refuse harmful requests. Recent researc...
By Harethah Abu Shairah, Hasan Abed Al Kader Hammoud, George Turkiyyah, Bernard Ghanem
Model merging composes specialized capabilities into a single LLM by aggregating task vectors sourced from unverified public platforms, exposing a critical supply-chain attack surface: Because any malicious behavior can be encoded into a task vector, and merging grants third-party vectors direct write access to model weights, an attacker-provided task vector can enable or amplify diverse downstream threats. Prior work studies only backdoor attacks against model merging for classifiers using static arithmetic heuristics, which fail to effectively handle diverse attacks on generative LLMs for three reasons.
The paper introduces NEEDLE, a training‑free technique for removing backdoors from large language models. After a trigger is identified, NEEDLE estimates a backdoor direction and a refusal subspace using activation vectors, then applies sequential weight orthogonalisation to suppress the backdoor while preserving refusal‑related representations. The method requires no clean reference model or original poisoned data and achieves the lowest attack success rate and minimal impact on model performance across multiple model families and attack types.
By Minoo Kim, Vasileios Lampos, George Drayson
The paper proposes Embedding Space Separation (ES2), a fine‑tuning technique that increases the distance between harmful and harmless embeddings in large language models. ES2 uses two regularization losses—a embedding anchor loss and a KL‑divergence loss—to preserve the model’s general capabilities while enhancing safety. Experiments show that ES2 effectively defends against various attack methods with only modest performance loss on some tasks.
By Xu Zhao, Xiting Wang, Weiran Shen