{"id":"98606679-b4bb-431b-bb72-c642d62d61ea","arxiv_id":"2412.19512","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Weight interpolation between a safety-aligned LLM and its task-fine-tuned version lowers attack success rate while preserving or improving task performance.","lead":"This paper shows that averaging the weights of an aligned LLM with its fine-tuned version reduces safety degradation after fine-tuning, while keeping or improving task performance. The approach needs no extra safety data or training, so it could give developers a cheap way to keep adapted models safer.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 1 contradicts the paper's own 'consistently' claim: several merged models are less safe than SFT on both safety benchmarks, so the central universal claim is not supported by the reported evidence.","rationale":"The reader identifies the linear-mode-connectedness assumption as the weakest assumption. I agree that is the deep geometric assumption. But the most load-bearing concern in the actual paper is more immediate: the paper's own Table 1 contains counterexamples to the universal claim, and the manuscript's own text in E.2 admits that no method universally outperforms others and that some categories do not benefit from merging. The reader's verdict is CONDITIONAL with medium confidence, which is appropriate. My concern does not overturn the verdict but sharpens it: condition acceptance on the claim being re-scoped from 'consistently' to 'in most tested settings' and on reporting seed-level variance. The check is cheap and decisive: it uses data already in the paper. If the re-analysis upholds the counterexamples, the abstract and conclusion need revision. The paper's method may still be a useful empirical finding, so CONDITIONAL remains the right verdict rather than REJECT. I partially agree with the reader because they focused on a theoretical assumption, while I focus on an internal inconsistency between the reported numbers and the claimed universality. Both are legitimate; mine is more decisive because it does not depend on extrapolating to untested settings — it is visible in the paper's own results.","tokens_in":14475,"tokens_out":2357,"duration_ms":17454,"concrete_test":"Re-analyze Table 1 row-by-row: compute, for each model-task cell, whether the reported best-validation Linear merging ASR is strictly lower than the SFT ASR on both AdvBench and HEx-PHI, and whether task performance is non-decreasing. If any cell violates this (e.g., Qwen2.5-7B-Instruct Tool Using on HEx-PHI: Linear 9.39% vs SFT 8.08%; Gemma-2-2B-It Medical: Linear 0.5243 vs SFT 0.5254), then the claim 'consistently' fails. Also re-run with error bars over the three seeds to check if the differences are within noise.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The paper's central claim is that merging pre- and post-fine-tuned weights 'consistently' mitigates safety degradation and enhances task performance. Table 1, which reports the best validation-set configuration for each method, directly contradicts this universal claim. On HEx-PHI for Qwen2.5-7B-Instruct, Linear merging yields ASR 11.11% (Medical) and 9.39% (Tool Using), both above the SFT ASRs of 12.42% (Medical: merging is better) — wait, 11.11 < 12.42, so merging is better there. But Tool Using: Linear 9.39% vs SFT 8.08%, so merging is worse. On LLaMA-3-8B-Instruct Tool Using: Linear AdvBench 0.77% vs SFT 0.83% (better), HEx-PHI 2.44% vs 3.45% (better). So the contradiction is Qwen2.5 Tool Using on HEx-PHI (9.39 vs 8.08) and Qwen2.5 Code on HEx-PHI (7.88 vs 7.98, better). Also Qwen2.5 Medical on AdvBench: Linear 0.45 vs SFT 0.77 (better). So the clearest Table-1 counterexample is Qwen2.5-7B-Instruct Tool Using: Linear merging has higher HEx-PHI ASR (9.39%) than SFT (8.08%). Additionally, for Gemma-2-2B-It Tool Using, SLERP HEx-PHI 0.10% vs SFT 0.10% tie, and for LLaMA-3 Tool Using, DARE AdvBench 0.45 vs SFT 0.83 (better). So there is at least one direct counterexample. More importantly, Table 1 also shows that the best-validation merged checkpoint does not consistently improve task performance either: Gemma-2 Medical Linear 0.5243 is below the aligned model 0.5151? No, 0.5243 > 0.5151, but below SFT 0.5254. And LLaMA-3 Tool Using Linear 0.9266 vs SFT 0.8989 (better). So the 'consistently enhances downstream task performance' is also contradicted: Gemma-2 Medical Linear 0.5243 < SFT 0.5254. Thus the evidence base does not support the universalizing language. The failure mode that would make the central claim wrong is that the merged model's safety-performance trade-off is not uniformly better; it is task- and model-dependent, and the paper's selection of λ on validation performance does not guarantee safety recovery.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a simple post-hoc method to mitigate safety degradation of aligned LLMs after fine-tuning: interpolate the weights of the original aligned model θ_base and the fine-tuned model θ_t via θ_merged = (1−λ)θ_base + λθ_t, with λ selected on the downstream validation set. The authors evaluate this on three instruct-tuned models (LLaMA-3-8B, Gemma-2-2B, Qwen2.5-7B), four tasks (reasoning, medical, code, tool use), and two safety benchmarks (AdvBench, HEx-PHI) using WildGuard ASR. They also apply SLERP and DARE variants and report that the merging approach 'consistently' improves task performance while restoring safety, compared with SFT and with Dropout/Weight Decay baselines. The manuscript includes a limitations section and substantial appendix material.","tokens_in":14971,"tokens_out":5358,"duration_ms":51591,"significance":"The proposed method is attractive for practical deployment because it requires no safety data and no additional training, only one interpolation pass over parameters, and it scales to different model families. The authors provide unusually thorough experimental details and a candid limitations section. However, the central claim of consistency is not supported by the paper's own Table 1, and the empirical evaluation lacks variance reporting and any classifier-independent robustness check. The method is closely related to WiSE-FT and model soups, so the incremental novelty is mainly the safety-oriented application; the paper does not sufficiently position the contribution. If the claims are revised to a probabilistic or 'mostly' setting and the evidence is strengthened with variance statistics and at least one alternative safety classifier, the method could be a useful baseline for safe fine-tuning.","major_comments":[{"comment":"The universal claim of 'consistently' improving safety and performance is contradicted by Table 1. Specifically, for Qwen2.5-7B-Instruct Tool Using, Linear merging has HEx-PHI ASR 9.39% versus SFT's 8.08%, so merging is less safe than SFT in this setting. Similarly, Gemma-2-2B-It Medical shows Linear merging's downstream performance (0.5243) slightly below SFT (0.5254). Thus the best-validation merged checkpoint is not always better or safer than SFT. The authors should either remove 'consistently', calibrate the claim to 'in most tested settings', and explicitly analyze the counterexamples.","section":"Abstract, §1, §5.1, Table 1"},{"comment":"The paper reports averages over three random seeds but gives no standard deviations, confidence intervals, or significance tests. Several key differences are small (e.g., Qwen2.5 Code HEx-PHI: Linear 7.88% vs SFT 7.98%; LLaMA-3 Tool Using HEx-PHI: Linear 2.44% vs SFT 3.45%) and may fall within run-to-run variability. Please report per-seed results or error bars in Figures 2-5 and Table 1, and, where applicable, provide paired bootstrap or statistical tests over the three seeds.","section":"§4, Table 1, Figures 2-5"},{"comment":"The entire safety conclusion rests on a single classifier, WildGuard. The limitations section correctly notes the potential for false positives and negatives, but this is still the load-bearing measurement. To make the ASR reductions credible, the authors should verify a random subset of responses with an alternative safety classifier (e.g., Llama Guard or GPT-4) or human annotation. Without such a check, the magnitude of the claimed safety improvement may be partly an artifact of one classifier.","section":"§B.2, §7 (Safety Classifier)"},{"comment":"Figure 3 presents 'average changes ... across all downstream tasks' for model sizes. Averaging can hide per-task counterexamples, such as the Qwen2.5-7B Tool Using HEx-PHI result where merging is worse than SFT. To support the claim that merging mitigates safety degradation across scales, report per-task values for each model size (e.g., in an appendix) and show that the average is not driven by a single task.","section":"§5.2, Figure 3"},{"comment":"The proposed method is essentially WiSE-FT applied to LLM safety, yet the comparison set includes only Dropout and Weight Decay as non-merging baselines. This does not isolate the benefit of interpolation. Please add at least one existing weight-interpolation or task-vector baseline (e.g., adding a tuned task vector to the aligned model) and explicitly discuss the relationship to WiSE-FT and model soups, stating what new non-obvious insight the paper provides beyond transferring those methods to LLM safety.","section":"§2.2, §5"}],"minor_comments":[{"comment":"There is a typo: 'calculat similarity' should be 'calculate similarity'.","section":"Appendix A (Medical Assistance)"},{"comment":"The phrasing 'Tool Using Proficiency' is inconsistent; elsewhere it is 'tool usage proficiency'. Please unify.","section":"Title of Appendix E and Table 1"},{"comment":"The caption says 'Bold indicates the best score per metric', but for ASR lower is better, so bold should mean the lowest ASR. This should be stated explicitly.","section":"Table 1 caption"},{"comment":"The description says DARE 'randomly dropping parameters', but in MergeKit it typically drops and rescales the delta (task vector) parameters. Please clarify the precise mechanism.","section":"§D.1 (DARE)"},{"comment":"The prompt examples concatenate 'You are a helpful assistant.' directly with '{Instruction}' for Gemma-2 and Qwen2.5, which may be an intentional formatting choice; if so, a brief note would help reproducibility.","section":"§C.1 (Prompt Template)"}],"recommendation":"major_revision","confidential_remarks":"The paper is a legitimate but incremental empirical contribution. The main risk is the overclaim in the abstract and Section 5.1, which is directly contradicted by a Table 1 entry. The experimental appendix is detailed and the limitations are honestly stated, but the missing variance reporting and single-classifier safety evaluation weaken the evidentiary basis. I recommend major revision with the specific additions above. The paper is better suited to an applied ML or NLP venue than a theory-focused journal, given the lack of theoretical analysis and the purely empirical nature of the contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a useful, zero-cost empirical result—linearly interpolating an aligned LLM with its benign-task fine-tuned weights lowers attack success rate on most tested settings. The right response is to read it as \"worth testing in your pipeline,\" not as a proven universal law. The paper's own Table 1 contains a counterexample to the headline claim, and the validation-based λ selection means safety recovery is not actually guaranteed.\n\nWhat's new: pointing WiSE-FT-style interpolation at safety after benign fine-tuning is a legitimate extension, even if the algorithm is not new. The paper is honest about what it does: no extra safety data, no extra training, just an interpolation factor chosen on task validation. They also test SLERP and DARE, look at model sizes, and check instruction-following preservation on IFEval. The limitations section is unusually candid—jailbreak attacks, classifier limitations, and domain coverage are all acknowledged up front.\n\nSoft spots, in order of impact:\n\n1. The \"consistently\" claim is not supported by Table 1. For Qwen2.5-7B-Instruct Tool Using, the best-validation Linear merge has HEx-PHI ASR 9.39% vs SFT's 8.08%—merging makes safety worse there. Similarly, Gemma-2 Medical Linear underperforms SFT on task performance (0.5243 vs 0.5254). So the universalizing language should be softened to \"often\" or \"in most tested configurations.\"\n\n2. λ is selected on validation task performance, not on safety. So the method as described does not directly optimize for the safety benefit. It happens to work in many cases, but there's no mechanism preventing the selected λ from landing in an unsafe region—and Table 1 shows that occasionally it does.\n\n3. No variance or error bars. Three seeds are averaged but not reported per-seed; given the small ASR differences in some cells (0.06% vs 0.13%), noise could flip some conclusions.\n\n4. The baseline set is thin. Dropout and weight decay are fine as no-data regularizers, but a comparison to a simple safety-data replay (even a small one) would help calibrate how much you're giving up by avoiding extra data. Also, only LoRA fine-tuning is tested; the claim may not hold for full fine-tuning.\n\nNone of this kills the paper. The empirical core is plausible, the method is cheap to test, and the central finding—that interpolation often restores safety after benign fine-tuning—is new enough to be worth publishing. The right fix is to trim the claims to match the evidence and add a bit more statistical care.\n\nVerdict: worth a serious referee. I'd send it to review, ask for revised claims and error bars, and see whether the safety benefit survives a couple more models and a jailbreak check.","headline":"A cheap and plausible safety-preserving trick for fine-tuned LLMs, but the paper's universal claims outrun its own Table 1.","tokens_in":15577,"tokens_out":2787,"would_cite":true,"duration_ms":24012,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Linearly merging an aligned model with its fine-tuned successor restores lost safety without extra data or training.","keywords":["model merging","safety alignment","catastrophic forgetting","fine-tuning","parameter interpolation","LLM safety","LoRA","attack success rate"],"falsifier":"Run the same merge procedure on models fine-tuned without LoRA (full fine-tuning) or on a task whose data distribution is far from the alignment mix, then check whether there exists any λ in [0,1] that simultaneously keeps ASR near the aligned model's level and task performance at or above the fine-tuned model; finding a setting where every λ either fails safety or fails performance would disprove the claimed universality. Also, a per-category HEx-PHI analysis that surfaces categories where merging never reduces ASR (the paper already notes some categories do not improve) would bound the method's scope.","tokens_in":14318,"feed_emoji":"🛡️","tokens_out":5431,"duration_ms":46553,"temperature":0.7,"pith_summary":"This paper claims that the safety a model loses during task fine-tuning can be largely recovered by linearly interpolating its weights with the original aligned model. The method needs no additional safety data and no extra training: after standard supervised fine-tuning, the merged weights θ_merged = (1−λ)θ_base + λθ_t reduce the Attack Success Rate on harmful-instruction benchmarks close to the aligned model's level while often improving downstream performance. Across three model families, four tasks, and two safety benchmarks, merging produces consistently better safety–performance trade-offs than fine-tuning alone or regularization baselines like dropout and weight decay. If true, this gives practitioners a cheap, data-free safety restoration step after any fine-tuning run.","feed_headline":"Merging pre- and post-tuning weights restores LLM safety","feed_subtitle":"No extra safety data or training: one interpolation parameter cuts harmful outputs while keeping task skill.","key_machinery":"The load-bearing mechanism is linear weight interpolation (Eq. 2), θ_merged = (1−λ)θ_base + λθ_t, between the aligned base model and the fine-tuned model. The paper's argument is that safety alignment survives along this one-dimensional path in weight space, so a suitable λ can move the model back into a region where both the original refusal behavior and the new task skills are present. λ is chosen on a validation set, and the method is instantiated with the standard linear merge; ablations test SLERP and DARE as alternative merge geometries.","core_discovery":"The central discovery is that a straight line in parameter space between a safety-aligned model and its fine-tuned successor passes through models that are both safer and more task-competent than the fine-tuned endpoint alone. The paper demonstrates empirically that θ_merged = (1−λ)θ_base + λθ_t, with λ tuned on a validation grid, yields lower ASR on AdvBench and HEx-PHI than the fine-tuned checkpoints, often nearly matching the aligned model, while matching or exceeding the fine-tuned model's accuracy on reasoning, code generation, medical dialogue, and API-call tasks. The same interpolation also restores instruction-following ability measured by IFEval. The authors frame this as a form of catastrophic-forgetting mitigation that requires no safety data, no auxiliary models, and no extra training.","pith_inferences":["If the linear path is robust, merging could be composed: after each incremental fine-tuning step, re-interpolating with the original aligned model could bound safety drift across a long chain of task adaptations.","The mechanism suggests a testable prediction: the safety benefit should shrink when fine-tuning moves the weights far from the aligned region (e.g., full fine-tuning or very high learning rates, where linear mode connectivity is known to degrade).","A natural extension is to choose λ per layer or per task-vector direction rather than one scalar, potentially recovering more task performance at the same ASR."],"forward_implications":["A post-hoc safety restoration step can be added to any existing fine-tuning pipeline at near-zero cost: keep the aligned checkpoint, interpolate, and pick λ on a small validation set.","Merging can substitute for or complement safety-data mixing during fine-tuning, which matters when the original alignment data are proprietary or unavailable.","The same interpolation preserves other aligned-model capabilities (e.g., instruction following), so merging may serve as a general anti-forgetting tool, not only a safety fix.","Because λ controls the safety–performance trade-off smoothly, practitioners can dial in an acceptable ASR without retraining.","The method applies across model families and scales from 1.5B to 9B, suggesting it may transfer to larger models, though that is untested."],"supporting_citations":[{"why":"Establishes that fine-tuning aligned LLMs compromises safety even on benign data and supplies the HEx-PHI benchmark; the problem the paper solves.","marker":"(Qi et al., 2024)"},{"why":"WiSE-FT, the interpolation method the paper repurposes for LLM safety; the direct technical ancestor of Eq. 2.","marker":"(Wortsman et al., 2022b)"},{"why":"WildGuard, the classifier used to compute Attack Success Rate on harmful responses; the measurement that all safety claims rest on.","marker":"(Han et al., 2024)"},{"why":"Provides the observation that larger models can suffer more catastrophic forgetting, which motivates the model-size analysis and the claim that merging scales.","marker":"(Luo et al., 2025)"},{"why":"Supplies the AdvBench harmful-instruction set used as the second safety benchmark.","marker":"(Chen et al., 2022)"}],"fun_headline_variants":["Merging weights before and after tuning restores LLM safety","No safety data needed: merge pre and post fine-tune weights","Simple weight interpolation saves fine-tuned LLM safety","One weight blend brings back LLM safety and skill"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that the straight line in parameter space between the aligned and fine-tuned models crosses a region where safety and task skill coexist; if that geometric assumption fails for other tasks, scales, or full fine-tuning, the safety benefit may disappear.","fun_headline_variants_meta":{"raw":{"variants":["Merging weights before and after tuning restores LLM safety","No safety data needed: merge pre and post fine-tune weights","Simple weight interpolation saves fine-tuned LLM safety","One weight blend brings back LLM safety and skill"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000749,"raw_usage":{"total_tokens":3275,"prompt_tokens":825,"completion_tokens":2450,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":441,"completion_tokens_details":{"reasoning_tokens":2381}},"tokens_in":441,"tokens_out":2450,"duration_ms":18809,"temperature":1.0,"reasoning_tokens":2381,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T00:15:52.383096+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same merge procedure on models fine-tuned without LoRA (full fine-tuning) or on a task whose data distribution is far from the alignment mix, then check whether there exists any λ in [0,1] that simultaneously keeps ASR near the aligned model's level and task performance at or above the fine-tuned model; finding a setting where every λ either fails safety or fails performance would disprove the claimed universality. Also, a per-category HEx-PHI analysis that surfaces categories where merging never reduces ASR (the paper already notes some categories do not improve) would bound the method's scope.","supporting_citations":[],"review_version":1}