{"id":"a4b480fd-1cd2-4295-b636-4b9656954eab","arxiv_id":"2505.12038","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Safe Delta preserves LLM safety after fine-tuning by pruning delta parameters with a utility-per-safety ratio and compensating the safety loss with an OBS-style weight adjustment.","lead":"This paper introduces Safe Delta, a method that repairs safety in fine-tuned LLMs by selectively keeping only the parameter changes that improve task utility while using a Hessian-based safety compensation vector to cancel out the rest. It reports consistently low attack success rates across harmful and benign fine-tuning datasets while retaining most of the fine-tuning utility gain.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Multi-delta compensation in Eq. (10) is not proven: summing per-parameter OBS vectors ignores H⁻¹ correlations, so the safety-loss bound ε can be violated.","rationale":"The reader's weakest assumption is precisely the load-bearing concern I identify: Theorem 4.1 proves optimal compensation for a single delta, while Eq. (10) sums individual compensations for multiple deltas, assuming additive safety losses and diagonal H⁻¹ among selected indices. Because the central claim 'consistently preserves safety' depends on the joint compensation staying within ε, and no proof or empirical check of the off-diagonal interaction is provided, the theoretical guarantee is incomplete. My proposed test is a direct computation using the paper's own Hessian and a real selected set, so it would settle whether the concern lands. The paper has independent strengths: clear formulation, reproducible code link, extensive experiments across models and datasets, a cached-Hessian design that makes the method practical, and honest limitations section. I do not see a reason to reject or to change the reader's CONDITIONAL verdict; the same gap remains and should be closed by either a joint optimality proof or an empirical demonstration that H⁻¹_{S,S} off-diagonals are negligible in the actual operating regime.","tokens_in":25750,"tokens_out":4483,"duration_ms":43098,"concrete_test":"Using the paper's cached H⁻¹ and a real fine-tuning run (e.g., Llama-2-7B on PureBad, and also Dirty Summary), record the selected set S from Step 1. Compute (a) the paper's compensation C_eq10 from Eq. (10); (b) the exact joint OBS compensation C_joint = H⁻¹E(EᵀH⁻¹E)⁻¹δw_S, applied only to unselected components while keeping selected deltas fixed. For both, evaluate δL_safe = ½ΔWᵀHΔW with ΔW = M⊙δw_S + C. Report δL_safe(C_eq10), δL_safe(C_joint), Σ_{m∈S} δL^m_safe, and the layer threshold ε. If δL_safe(C_eq10) > ε or δL_safe(C_eq10) substantially exceeds Σ δL^m_safe, the additivity assumption fails and the safety guarantee is unsupported. Also report the maximum off-diagonal ratio |[H⁻¹]_{ij}|/[H⁻¹]_{ii} for i,j∈S to quantify the correlation that the summation ignores.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central safety guarantee rests on Eq. (10), which sets C = (I−M)⊙Σ_{m∈S} C_m, with each C_m from Theorem 4.1 (Eq. 6). Theorem 4.1 solves the single-constraint problem min_{ΔW} ½ΔWᵀHΔW s.t. e_mᵀΔW = δw_m; its solution is C_m = (δw_m/[H⁻¹]_{mm}) H⁻¹_{:,m}. For a selected set S, the correct joint compensation that keeps the selected deltas fixed and minimizes safety loss is ΔW = H⁻¹E(EᵀH⁻¹E)⁻¹δw_S, where E = [e_m]_{m∈S}; the unselected part is H⁻¹_{U,S}(H⁻¹_{S,S})⁻¹δw_S. Eq. (10) instead uses H⁻¹_{U,S} diag(1/[H⁻¹]_{mm})δw_S, which coincides with the joint solution only if H⁻¹_{S,S} is diagonal — i.e., the selected deltas are uncorrelated under H⁻¹. No such condition is stated or verified. Moreover, the greedy selection in §4.3 budgets safety degradation as Σ_{m∈S} δL^m_safe, ignoring the cross terms in ½ΔWᵀHΔW. Consequently, the actual post-compensation safety loss can exceed the threshold ε even when the selection constraint is satisfied, so the abstract's claim that Safe Delta 'consistently preserves safety' is not established for multiple deltas. The empirical ASR/HS results are encouraging, but they do not close this gap because they do not measure the layer-output safety loss against ε, and coarse safety metrics may not reveal a violation of the stated quadratic bound.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"Safe Delta proposes a post-hoc defense for fine-tuned LLMs. After standard fine-tuning, the method selects a subset of delta parameters (W_sft - W_orig) that are judged to give high utility per unit safety cost, and then adds a compensation vector inspired by Optimal Brain Surgeon to mitigate safety degradation. The safety cost is computed via the Hessian of a layer-wise quadratic output-distance loss on a fixed safety dataset. The paper proves a single-delta optimal compensation theorem (Thm 4.1) and uses a greedy selection with ratio r_m = 2[H^{-1}]_{mm}, followed by summing per-delta compensation vectors. Experiments on PureBad, Identity Shift, Dirty Summary, and Math datasets with Llama-2-7B-Chat, Llama-3-8B-instruct, and Llama-2-13B-chat show that Safe Delta preserves low ASR/HS while retaining most utility, compared with data-based (SafeInstr, BEA) and weight-based (Safe LoRA, Resta) baselines.","tokens_in":26102,"tokens_out":7944,"duration_ms":76904,"significance":"If the safety guarantee held, Safe Delta would be a valuable practical defense: it requires a one-time Hessian computation, adds ~62s per request, is model-agnostic, supports LoRA, and empirically outperforms baselines across dataset types and sizes. The paper's strengths are its extensive empirical evaluation and the clean OBS derivation for a single delta, together with open-source code and detailed implementation notes. However, the central theoretical claim — that the method 'consistently preserves safety' for arbitrary multi-delta fine-tunes — is not established, because the multi-delta compensation is asserted rather than derived, and the safety guarantee is for a layer-output quadratic proxy rather than the evaluated ASR/HS. The utility claim similarly rests on a parameter-distance proxy rather than measured task utility. These gaps are significant but appear addressable in revision.","major_comments":[{"comment":"The multi-delta compensation in Eq. (10) is not proven. Theorem 4.1 solves the single-constraint problem min_ΔW 1/2 ΔW^T H ΔW s.t. e_m^T ΔW = δw_m, giving C_m = δw_m/[H^{-1}]_{mm} H^{-1}_{:,m}. For a selected set S, the compensation that actually minimizes the quadratic safety loss while fixing all selected deltas is the joint OBS solution, whose unselected components are H^{-1}_{U,S}(H^{-1}_{S,S})^{-1} δw_S. Equation (10), which sums per-delta vectors and masks selected positions, coincides with the joint solution only when H^{-1}_{S,S} is diagonal. For the actual Hessian H = 2 X_safe^T X_safe, the selected delta coordinates can be strongly correlated, so cross-terms in 1/2 ΔW^T H ΔW are generally nonzero and the post-compensation safety loss can exceed the cumulative estimate Σ_{m∈S} δL_safe^m used in the greedy selection. Thus the abstract's claim that Safe Delta 'consistently preserves safety' is not established for multiple deltas. The ASR/HS experiments do not measure the quadratic layer-output loss against ε, so they cannot close this gap; I suggest either deriving the joint compensation (with a practical approximation) or stating and verifying a diagonality/uncorrelatedness condition.","section":"§4.3, Eq. (10)"},{"comment":"The theoretical guarantee is for a proxy, not the declared safety objective. Equation (2) constrains L_safe(W_sd) - L_safe(W_orig) ≤ ε, where L_safe is a loss on the safety dataset, but the method subsequently replaces this with layer-wise quadratic output distances in Eqs. (4)-(5) and per-layer thresholds of the form ε = s·mean(...). The paper never shows that the layer-output distance bound implies a bound on the actual safety loss L_safe, nor that it implies the ASR/HS metrics on which safety is evaluated. Consequently, the statement 'consistently preserves safety' in the abstract is not a theorem about the evaluated metrics; it is an empirical observation. The authors should either prove a transfer bound from the quadratic proxy to the safety loss/metric or clearly limit the theoretical claim to the proxy.","section":"§3, Eq. (2) vs §4.2, Eqs. (4)-(5)"},{"comment":"The utility objective in Eq. (2) is task loss on D_sft, but the method optimizes parameter distance L_util = ||W_sd - W_orig||^2. The claim that small parameter distance 'naturally constrains' output perturbation (Appendix E.2) is a heuristic; it is not proven and does not directly control task utility. The empirical utility scores in Tables 3-4 are close to the fine-tuned model, but the selection procedure does not explicitly maximize task performance. If the authors wish to claim 'utility gain remains unaffected', they should measure task utility directly in the selection or provide a Lipschitz-style argument connecting parameter distance to the task loss.","section":"§4.3, Eqs. (7)-(8)"},{"comment":"The Safe LoRA threshold is tuned on the Dirty Summary dataset, which is also the evaluation dataset for that scenario ('we optimize this parameter on the Dirty Summary dataset, selecting a threshold of 0.52'). This is test-set tuning. The comparison in Table 3 and Figure 5(b) is therefore not apples-to-apples: Safe Delta's s=0.1 is fixed, while Safe LoRA is given access to the evaluation split. Please re-tune the baseline on a separate validation set or report results without tuning.","section":"§5.1 / Appendix E.3"}],"minor_comments":[{"comment":"There is a typo in 'senario' in the first sentence; please correct it.","section":"§5.3"},{"comment":"The main results report single runs without error bars or standard deviations, even though Section 5.9 averages time cost over five trials. Given the randomness of fine-tuning and the use of GPT-4 as a judge, please report means and variances over multiple seeds for the main safety and utility numbers.","section":"Tables 2-4"},{"comment":"The figure caption and text refer to a 'Selective metric' that is not defined in the main text; please clarify what the y-axis represents and how the numbers are computed.","section":"Figure 2"},{"comment":"The Hessian is computed on 512 safe examples generated from AdvBench, while the evaluation benchmark uses 330 questions across 11 policy categories. Please discuss whether the safety examples cover the same distribution as the benchmark, since a mismatch could affect the validity of the layer-output proxy.","section":"Appendix E.2"},{"comment":"The claim that Safe Delta is 'the first method to jointly estimate safety degradation and dynamically optimize delta parameter' is strong; consider softening it or substantiating the novelty in light of related safety re-alignment methods (e.g., NLSR, Booster) cited in the paper.","section":"§1, Contributions"}],"recommendation":"major_revision","confidential_remarks":"The multi-delta compensation issue is the main correctness concern; the empirical results are promising but the paper currently overclaims. The Safe LoRA test-set tuning is a methodological flaw that should be fixed. I see potential for a strong paper after revision, provided the authors either prove the joint compensation (or add a verifiable condition) and clearly align the theoretical claims with the measured metrics."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Hi,\n\nHere's my read on Safe Delta (2505.12038). The core idea is genuinely new: use the Hessian of a safety loss on the original model to (a) rank delta parameters by a utility-per-safety-loss score and (b) apply OBS-style compensation to undo the safety damage of the selected deltas. Caching H^{-1} ahead of time keeps per-request overhead low (62s), and the experiments cover harmful, benign, and dirty datasets, LoRA, and multiple model sizes. The results are encouraging—Safe Delta consistently beats the baselines on ASR/HS while retaining most utility.\n\nThe problem is the theoretical centerpiece. Theorem 4.1 derives the optimal compensation for a single delta parameter. Equation (10) then sums those individual compensations and masks out the selected positions. That sum coincides with the true joint minimizer only when the selected deltas are uncorrelated under H^{-1} (i.e., the off-diagonal entries of H^{-1}_{S,S} vanish). The paper never states or verifies that condition, and the greedy selection uses the sum of individual δL^m_safe, ignoring cross terms. So the abstract's 'consistently preserves safety' is not actually established for multiple deltas. The empirical ASR/HS numbers are good, but they do not directly measure the layer-output safety distance against the ε threshold. This is fixable in revision: the authors could either prove a bound for the correlated case or present Eq. (10) as a heuristic and validate that the residual safety loss stays below ε in practice.\n\nTwo smaller concerns. First, the utility proxy is parameter distance, not measured task utility, and the selection ratio r_m = 2[H^{-1}]_mm does not depend on the actual delta values at all. That means the ranking of parameters is fixed per layer, independent of the fine-tuning dataset; only the count of selected deltas varies. That weakens the 'dataset-adaptive' narrative somewhat, though the threshold s still provides some adaptivity. Second, the Safe LoRA baseline is tuned on the Dirty Summary test set and no error bars are reported. Both are minor relative to the multi-delta gap.\n\nWho gets value? Anyone building or evaluating post-hoc defenses for fine-tuning APIs, and researchers working on LLM safety more broadly. The paper deserves a serious referee: the idea is original, the experiments are rich, and the issues I've flagged are addressable in revision. I would send it to review, with the main request being to either prove the joint compensation or explicitly downgrade the claim from a guarantee to a heuristic and show empirically that the residual safety loss stays near the intended bound.","headline":"Genuinely useful post-hoc fine-tuning safety defense with strong experiments, but the multi-delta compensation in Eq. (10) is an unproven approximation, so the central guarantee is weaker than claimed.","tokens_in":26649,"tokens_out":3927,"would_cite":true,"duration_ms":37968,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68T07","68T50"],"pacs":[],"model":"deepseek-v4-flash","headline":"Fine-tuned LLM safety can be restored post-hoc: keep only the parameter changes that buy utility cheaply, then add a Hessian-derived compensation vector, preserving nearly all task gains across datasets and models.","keywords":["fine-tuning safety","safety alignment","delta parameters","optimal brain surgeon","Hessian compensation","harmful fine-tuning defense","utility-safety trade-off","greedy parameter selection"],"falsifier":"After running Safe $\\Delta$, directly measure the final model's safety loss on a hold-out safety set and compare it with the summed per-delta estimates the method uses to declare the constraint satisfied; if the measured loss (or the attack success rate on the safety benchmark) exceeds the predicted value when the selected deltas are chosen to lie in the same Hessian subspace, the joint-compensation assumption fails. A simpler version: fine-tune on a dataset engineered so that the kept deltas have overlapping compensation columns and check that the model actually stays within the claimed safety budget.","tokens_in":25539,"feed_emoji":"🛡️","tokens_out":12264,"duration_ms":104392,"temperature":0.7,"pith_summary":"The paper claims that the safety damage caused by fine-tuning an aligned LLM can be repaired after the fact, without giving up the task improvements the fine-tuning was meant to deliver. It proposes a defence, Safe $\\Delta$, that works on the parameter change itself: each individual weight change is scored for how much utility it buys per unit of safety loss, the high-scoring changes are kept up to a safety budget, and a compensation vector derived from the safety Hessian is added to cancel the safety damage the kept changes would otherwise cause. On datasets spanning explicitly harmful, implicitly harmful, dirty benign, and clean benign fine-tuning, with varying data sizes and several base models, the method reports safety close to the original aligned model while retaining nearly all of the fine-tuning utility gain. If this holds, fine-tuning service providers gain a single per-request post-processing step that adapts to any user dataset instead of per-dataset tuning of defense strength.","feed_headline":"Post-fine-tuning patch restores LLM safety without losing utility","feed_subtitle":"Cancelling the weight changes that damage alignment keeps task gains intact across dataset sizes, tasks, and models.","key_machinery":"The load-bearing object is the compensation identity of Theorem 4.1, an Optimal Brain Surgeon-style result reapplied to a safety objective: for a single delta $\\delta w_m$, the parameter perturbation that realizes that change at minimal safety cost is $C_m = \\delta w_m [H^{-1}]_{mm}^{-1} H^{-1}_{:,m}$, with residual cost $\\delta L^m_{\\text{safe}} = (\\delta w_m)^2 / (2[H^{-1}]_{mm})$. Because the utility proxy is simply the squared delta, the selection score simplifies to $r_m = 2[H^{-1}]_{mm}$: the ranking of parameters depends only on the precomputed inverse Hessian diagonal, not on the fine-tuning data. The machinery then does three jobs: it prices each parameter change in safety units, it ranks changes for the greedy knapsack-style selection up to the threshold $\\epsilon = s \\cdot \\tfrac{1}{N_m} \\sum_m \\tfrac{1}{2}[H^{-1}]_{mm}$, and it constructs the final model $W_{\\text{sd}} = W_{\\text{orig}} + M \\odot \\Delta W_{\\text{sft}} + C$ with the mask $(I - M)$ protecting the selected utility gains.","core_discovery":"On the paper's own terms, the central claim is stated in Theorem 4.1 and the two-step procedure built on it. Adding a single fine-tuning delta $\\delta w_m$ to the original aligned weights raises the safety loss $L_{\\text{safe}} = \\|W X_{\\text{safe}} - W_{\\text{orig}} X_{\\text{safe}}\\|_2^2$, and the minimal such increase is $\\delta L^m_{\\text{safe}} = (\\delta w_m)^2 / (2[H^{-1}]_{mm})$, achieved by spreading the change along the vector $C_m = (\\delta w_m / [H^{-1}]_{mm}) H^{-1}_{:,m}$, where $H$ is the safety Hessian at the original weights. Safe $\\Delta$ uses this quantity as a per-parameter safety price, sorts the deltas by the utility-per-safety-loss ratio $r_m = 2[H^{-1}]_{mm}$, keeps the most favourable ones until the cumulative price reaches a threshold $\\epsilon$, and then adds the sum of the individual compensation vectors on the unselected positions. The paper argues this consistently preserves safety while leaving the utility gain from benign fine-tuning nearly intact, and reports experiments supporting it across harmful, dirty, and clean datasets, dataset sizes from 50 to 10,000 examples, three LLMs, and LoRA.","pith_inferences":["Because the selection ratio $r_m = 2[H^{-1}]_{mm}$ is independent of the delta magnitudes, the parameter ranking is fixed once the Hessian is known; only the cutoff moves per request. A testable consequence is that an adversary who knows the cached Hessian can predict which changes will be kept and which compensated, then shape fine-tuning data to hide harmful directions among low-ranked parameter","The selection step is a 0/1 knapsack solved greedily; since item ratios are static, an exact or better combinatorial selection is a natural extension that could push the utility-safety frontier further, an improvement the paper itself signals.","The utility estimate is a proxy — squared parameter distance, not task loss; on a small model where a per-request utility Hessian is affordable, one could test whether the proxy-chosen mask differs from an output-space-utility mask and whether that changes reported utility at equal safety.","The method is linear in the deltas, so an adversary could spread harmful content across many small parameter changes that individually fall under the per-parameter screen; stress-testing Safe Delta against such obfuscated harmful fine-tuning sets would probe a gap the paper's benchmarks do not cover."],"forward_implications":["Fine-tuning providers can post-process any user-trained model with one cached object — the inverse safety Hessian computed once from the aligned model and a safety dataset — adding roughly 62 seconds per request instead of re-tuning defense hyperparameters per dataset.","The defence scales with harmful data: attack success rate stays near the original model's level as the harmful fine-tuning set grows from 50 to 200 examples (and to 1K–10K in the extended experiments), where data-augmentation baselines degrade sharply.","Benign-task utility is largely preserved: on Dirty Summary, Safe Delta reaches 0.489 Rouge-1 F1 versus 0.491 for undefended fine-tuning while cutting ASR from 63.94% to 5.15%, and on Math it keeps 0.334 accuracy versus 0.337 while cutting ASR from 11.52% to 3.33%.","The same procedure transfers across model families and parameter-efficient fine-tuning: it works on Llama-2-7B-Chat, Llama-2-13B-Chat, Llama-3-8B-Instruct, and on LoRA deltas formed as $\\Delta W = AB$.","A user-controlled threshold $s$ provides a practical safety-utility dial, and the measured trade-off shows a wide range of $s$ where utility is near fine-tuning level while safety remains high."],"supporting_citations":[{"why":"Supplies the Optimal Brain Surgeon second-order compensation principle that Theorem 4.1 adapts to the safety objective.","marker":"Hassibi & Stork, 1992"},{"why":"Optimal Brain Damage, the earlier second-order pruning basis cited alongside OBS for the compensation derivation.","marker":"LeCun et al., 1989"},{"why":"Provides the moving-average Hessian computation technique used to obtain and cache the inverse Hessian efficiently.","marker":"Frantar & Alistarh, 2023"},{"why":"Supplies the harmful fine-tuning datasets (PureBad, Identity Shift) and the policy-oriented safety evaluation benchmark used for ASR and harmfulness scores.","marker":"Qi et al., 2024"},{"why":"Source of the BackdoorAlign (BEA) baseline and of the Dirty Summary dataset construction with 100 harmful examples mixed into benign data.","marker":"Wang et al., 2024"},{"why":"The SafeInstr data-augmentation baseline that Safe Delta is compared against on safety-utility trade-offs.","marker":"Bianchi et al., 2024"},{"why":"The Safe LoRA weight-projection baseline, the main weight-modification competitor in the experiments.","marker":"Hsu et al., 2024"},{"why":"The Resta safety task-vector baseline that Safe Delta outperforms on the harmful fine-tuning benchmarks.","marker":"Bhardwaj et al., 2024"},{"why":"Provides the Llama-2 aligned base models used in the main experiments and the model family extended to 13B.","marker":"Touvron et al., 2023"}],"fun_headline_variants":["Delta patch keeps LLM safety, spares utility","Safe Delta: post-tuning safety without utility hit","Weight-delta fix preserves LLM alignment","Selective delta edits keep fine-tuned LLMs safe"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The safety guarantee assumes that the compensation vectors computed for each selected weight change in isolation still work when all of them are added together, so overlapping or correlated effects cannot push the final model's actual safety loss above the budget the estimates claim.","fun_headline_variants_meta":{"raw":{"variants":["Delta patch keeps LLM safety, spares utility","Safe Delta: post-tuning safety without utility hit","Weight-delta fix preserves LLM alignment","Selective delta edits keep fine-tuned LLMs safe"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000437,"raw_usage":{"total_tokens":2255,"prompt_tokens":1013,"completion_tokens":1242,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":629,"completion_tokens_details":{"reasoning_tokens":1181}},"tokens_in":629,"tokens_out":1242,"duration_ms":9659,"temperature":1.0,"reasoning_tokens":1181,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:42:22.610534+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"After running Safe $\\Delta$, directly measure the final model's safety loss on a hold-out safety set and compare it with the summed per-delta estimates the method uses to declare the constraint satisfied; if the measured loss (or the attack success rate on the safety benchmark) exceeds the predicted value when the selected deltas are chosen to lie in the same Hessian subspace, the joint-compensation assumption fails. A simpler version: fine-tune on a dataset engineered so that the kept deltas have overlapping compensation columns and check that the model actually stays within the claimed safety budget.","supporting_citations":[{"cited_title":"and Stork, D","cited_arxiv_id":null,"evidence_quote":"Supplies the Optimal Brain Surgeon second-order compensation principle that Theorem 4.1 adapts to the safety objective."},{"cited_title":"S., and Solla, S","cited_arxiv_id":null,"evidence_quote":"Optimal Brain Damage, the earlier second-order pruning basis cited alongside OBS for the compensation derivation."},{"cited_title":"and Alistarh, D","cited_arxiv_id":null,"evidence_quote":"Provides the moving-average Hessian computation technique used to obtain and cache the inverse Hessian efficiently."},{"cited_title":"Backdooralign: Mitigating fine-tuning based jailbreak attack with backdoor enhanced safety alignment","cited_arxiv_id":null,"evidence_quote":"Source of the BackdoorAlign (BEA) baseline and of the Dirty Summary dataset construction with 100 harmful examples mixed into benign data."},{"cited_title":"Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions","cited_arxiv_id":null,"evidence_quote":"The SafeInstr data-augmentation baseline that Safe Delta is compared against on safety-utility trade-offs."},{"cited_title":"Safe lo RA : The silver lining of reducing safety risks when finetuning large language models","cited_arxiv_id":null,"evidence_quote":"The Safe LoRA weight-projection baseline, the main weight-modification competitor in the experiments."},{"cited_title":"D., and Poria, S","cited_arxiv_id":null,"evidence_quote":"The Resta safety task-vector baseline that Safe Delta outperforms on the harmful fine-tuning benchmarks."},{"cited_title":"Llama 2: Open foundation and fine-tuned chat models","cited_arxiv_id":null,"evidence_quote":"Provides the Llama-2 aligned base models used in the main experiments and the model family extended to 13B."}],"review_version":1}