{"id":"a6dd5bb9-4a7d-49a5-8ee1-82d42b0ed15d","arxiv_id":"2607.11475","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A hypernetwork maps layer-wise activation fingerprints of a fine-tuned LLM to a Safe Side Network that routes harmful prompts to refusal without editing model weights.","lead":"HyperSafe restores safety in fine-tuned LLMs by generating a small side network from each model’s activation fingerprints in one forward pass, without changing weights. It cuts harmful compliance from ~20–30% to under 1% on held-out checkpoints while nearly preserving task accuracy.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"The load-bearing risk is that domain-specific calibration fingerprints may not encode recipe-specific safety failure modes for truly unseen fine-tunes, so zero-shot SSN generation could fail outside the paper's domain-holdout protocol.","rationale":"The reader's weakest_assumption correctly isolates the activation-fingerprint premise (Eqs. 1–8 and the §4 holdout). That premise is load-bearing: without it the hypernetwork cannot produce a model-specific SSN in one forward pass, and the post-hoc non-invasive claim collapses. The paper's multi-split results (Table 2), ablations (Figs. 3–4, Tables 10–12), and LoRA-to-full transfer (Table 4) make the claim credible inside the tested support, which is why CONDITIONAL with high confidence remains appropriate rather than REJECT. The concrete test above is the minimal experiment that would either confirm the fingerprint captures recipe-level safety shifts or expose that current numbers only demonstrate domain interpolation. No stronger internal inconsistency appears; the remaining caveats (judge-model dependence, BeaverTails comparison asymmetry) are secondary to this generalization gap.","tokens_in":16994,"tokens_out":678,"duration_ms":6999,"concrete_test":"Take one held-out domain (e.g., BoolQ or Alpaca). Produce a second fine-tune of the same backbone using a deliberately different recipe (full FT with different LR/epochs, or LoRA rank 64 / different target modules, or a mixed-domain mixture never seen in the 22). Extract its Ncal=50 fingerprint, generate the SSN with the already-trained hypernetwork, and re-evaluate BeaverTails / AdvBench / HEx-PHI harmful rates plus task accuracy. If harmful rate rises above ~5% or accuracy drops >2 points relative to the paper's Table 2 numbers, the fingerprint-generalization premise fails.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim (harmful rates 19–31% → <1% on every held-out checkpoint, task accuracy within ~1%) rests on the premise that layer-wise mean final-token activations A(Md) = {al} from Ncal=50 domain-specific calibration prompts (Eqs. 3–4) form a fingerprint from which a hypernetwork trained on other domains can generate a working SSN (Eqs. 1, 8). The holdout protocol in §4 and Table 7 only withholds entire domains while keeping the same LoRA recipe (rank 16, α=32, 3 epochs) and the same backbone family; Table 4 further reuses an SSN generated from a LoRA fingerprint on a full-FT counterpart of the same domain. Nothing in the reported experiments tests a fine-tune whose data distribution, PEFT recipe, or safety-degradation pattern lies outside the 22-domain training support. If the fingerprint mainly encodes domain identity rather than the particular safety-subspace shift induced by an arbitrary fine-tune, the generated SSN would not recover refusal on a genuinely novel checkpoint, and the strongest claim would not hold for the post-hoc setting the introduction advertises.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"HyperSafe proposes a post-hoc, model-specific, non-invasive recovery of safety for fine-tuned LLMs. Given a fine-tuned checkpoint Md, it extracts layer-wise mean last-token activation fingerprints A(Md) from a small set of domain calibration prompts (Eqs. 3–4), then uses a hypernetwork G to generate the weights θ of a lightweight Safe Side Network (SSN) in one forward pass (Eqs. 1, 8). The SSN is a ladder side-transformer that scores prompts and routes harmful ones to refusal while leaving safe prompts to the frozen fine-tuned model. The hypernetwork is supervised by ground-truth SSNs trained per domain on domain data plus BeaverTails, using reconstruction, classification, and functional losses. On Qwen2-7B and LLaMA-3-8B, across three domain-holdout splits (18 train / 4 held-out domains each), HyperSafe reduces harmful rates from 19–31% (fine-tuned averages) to below 1% on BeaverTails, AdvBench, and HEx-PHI for every held-out checkpoint, while keeping task accuracy within ~1% of the fine-tuned baseline. Ablations cover loss components, training-domain diversity, Ncal, architecture capacity, and transfer of a LoRA-generated SSN to full fine-tuning counterparts.","tokens_in":17372,"tokens_out":1445,"duration_ms":12226,"significance":"If the central claim holds under the stated protocol, the paper offers a practically useful third path between weight-editing defenses and model-agnostic guards: checkpoint-specific safety recovery without gradients, safety data at deploy time, or weight modification. Strengths include a clear problem formulation, a reproducible multi-split holdout design on two 7–8B families, fully zero-shot evaluation on AdvBench and HEx-PHI, systematic ablations (Figs. 3–4, Tables 10–12), transfer evidence from LoRA to full FT (Table 4), and public code. The combination of activation-conditioned hypernetworks with ladder side networks for safety is a concrete systems contribution. The result is significant for practitioners who receive already-fine-tuned checkpoints and cannot re-run alignment, provided the fingerprint premise generalizes beyond the paper’s domain-holdout and fixed-recipe setting.","major_comments":[{"comment":"The strongest claim (harmful rates 19–31% → <1% on every held-out checkpoint, task accuracy within ~1%, no weight edits) is demonstrated only under domain holdouts with a fixed LoRA recipe (rank 16, α=32, 3 epochs) on the same backbone family (§4, Table 7, Table 2). Table 4 reuses an SSN generated from a LoRA fingerprint on a full-FT counterpart of the same domain; it does not test a new PEFT recipe, optimizer, data mixture, or safety-degradation pattern outside the 22-domain support. The load-bearing premise is that A(Md) from Ncal=50 domain calibration prompts (Eqs. 3–4) encodes recipe-specific safety failure modes rather than mainly domain identity (§3.1–3.3). Without at least one experiment on a genuinely novel fine-tuning recipe or out-of-support degradation pattern, the post-hoc generality advertised in the introduction and Table 1 remains incompletely supported. A limited addition","section":"§4, Tables 2 and 4; Eqs. 3–4, 1, 8"},{"comment":"Ground-truth SSN supervision mixes per-domain safe data with BeaverTails harmful data (§3.4); BeaverTails is also one of the three evaluation benchmarks (disjoint split). AdvBench and HEx-PHI are zero-shot and show near-zero harmful rates, which is strong, but the paper should more explicitly quantify how much of the BeaverTails recovery is attributable to the shared harmful-data distribution versus the activation-conditioned generation. A short analysis (e.g., SSN trained without BeaverTails, or hypernetwork trained with a different harmful source) would clarify that the method is not primarily transferring a BeaverTails-specific classifier.","section":"§3.4, §4.1, Table 2"}],"minor_comments":[{"comment":"Table 1 lists Llama Guard 4 as model-agnostic and standalone; the quantitative comparison in Table 3 is useful but should note that Guard is a separate 12B model with its own full forward pass, while HyperSafe adds 3–4% parameters and bypasses on safe prompts—so cost comparison is not only accuracy.","section":"Table 1, Table 3, §4"},{"comment":"The selective routing description (§3.2) states that safe prompts bypass the SSN during decoding; it would help to state explicitly whether the SSN still requires a full backbone forward pass to obtain ladder activations for scoring, or whether early-exit / partial-layer scoring is used.","section":"§3.2"},{"comment":"Notation for the gate μk = σ(gk/τ) and the mapping ϕ(k) is clear in Eq. (2), but the temperature τ is only mentioned as a fixed hyperparameter; give its value in Table 5 or the text.","section":"Eq. (2), Table 5"},{"comment":"Figure 1 stages are helpful; a one-sentence note on whether the hypernetwork is backbone-family-specific (separate G for Qwen2 vs LLaMA-3) would avoid ambiguity for multi-family deployment.","section":"Figure 1, §3.4"},{"comment":"Minor presentation: abstract and intro use both “post hoc” and “post-hoc”; pick one. Also ensure AdvBench/HEx-PHI “never seen in any training phase” is stated once in the main evaluation protocol without relying only on the appendix.","section":"Abstract, §4"}],"recommendation":"minor_revision","confidential_remarks":"The manuscript is a solid systems/ML paper with strong empirical support under its protocol. The main risk is overclaiming post-hoc generality beyond domain holdouts with a fixed recipe; that is fixable with either a limited extra experiment or a clearer scope statement. Fit for a serious ML venue is good if the authors tighten the claim language. No integrity or citation-pattern concerns."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The punchline is simple: they train a hypernetwork once so that, for a new fine-tuned checkpoint, a single forward pass on ~50 calibration activations produces a lightweight Safe Side Network that routes harmful prompts to refusal while leaving the frozen model alone on safe ones. On every held-out domain for Qwen2-7B and LLaMA-3-8B, harmful rates fall from the 19–31% fine-tuned range to under 1% on BeaverTails/AdvBench/HEx-PHI, with task accuracy within about a point of the LoRA baseline. That is a real, usable systems result for the post-hoc, non-invasive gap they set up in Table 1.\n\nWhat is new is the combination, not any single piece. Hypernetworks, ladder side-tuning, and external guards are all cited. The useful move is conditioning SSN weights on layer-wise mean final-token activations (direction + log-magnitude, then factorized layer-wise generators) so the side net is checkpoint-specific without gradient steps or weight edits at deploy time. The experimental design is careful: three domain holdouts, two families, two fully zero-shot safety sets, loss and Ncal ablations, and transfer of a LoRA-generated SSN to the matching full-FT model. Code is linked. Citations look standard and fair.\n\nSoft spots, in proportion. The stress-test concern is real but narrower than a collapse of the paper: the holdouts keep the same LoRA recipe and backbone family, so the fingerprint may be carrying domain identity more than arbitrary safety-subspace shifts. Nothing here tests a wild PEFT recipe or a fine-tune far outside the 22-domain support. That weakens the broadest “any subsequent checkpoint” language, not the reported domain-holdout numbers. Harmful rates depend on beaver-dam-7b; the Llama Guard 4 comparison is uneven on BeaverTails (where they trained) though still favorable on the zero-shot sets. One-time cost of training many GT SSNs is non-trivial before the cheap path exists. None of these look like load-bearing math or data fraud; they are scope and measurement caveats.\n\nThis is for people who ship or host open-weight fine-tunes and need a practical recovery tool, not for foundational alignment theory. I would bring it to reading group, cite it when discussing post-hoc safety tooling, and send it to peer review. Tighten the claim language around recipe generality and the judge, and it is a clear accept-with-revisions candidate.","headline":"Solid systems paper: activation-conditioned hypernetwork generates a model-specific safety side net that restores refusal on held-out fine-tunes without touching weights; the domain-holdout evidence is strong, the truly-arbitrary-recipe claim is not fully tested.","tokens_in":17993,"tokens_out":651,"would_cite":true,"duration_ms":6975,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"A hypernetwork can restore a fine-tuned LLM's safety from activation fingerprints alone, without touching its weights.","keywords":["LLM safety","fine-tuning degradation","hypernetworks","side networks","activation fingerprints","inference-time recovery","refusal behavior"],"falsifier":"On a held-out fine-tuned checkpoint whose domain was never seen by the hypernetwork, measure whether the generated Safe Side Network still drives harmful rates on AdvBench or HEx-PHI above a few percent while task accuracy stays near the fine-tuned baseline; failure of either metric would falsify the claim.","tokens_in":17854,"feed_emoji":"🛡️","tokens_out":622,"duration_ms":6921,"temperature":0.7,"pith_summary":"Fine-tuning a safety-aligned language model for a useful task often quietly raises how often it answers harmful prompts. Existing fixes either retrain or edit the model (risking task skill) or bolt on a generic safety filter that may miss failures unique to that checkpoint. HyperSafe treats safety recovery as a one-shot generation problem: from a small set of calibration prompts it reads layer-wise activation fingerprints of the fine-tuned model, then a hypernetwork emits the weights of a lightweight Safe Side Network that rides beside the frozen model. Harmful prompts are routed to refusal; safe prompts still go through the original model unchanged. On held-out fine-tunes of Qwen2-7B and LLaMA-3-8B the method drops harmful rates from the 19-31% range to under 1% while holding task accuracy within about one point of the fine-tuned baseline, with no gradients, no safety data at deploy time, and no weight edits.","feed_headline":"Safety restored from activations alone, weights untouched","feed_subtitle":"HyperSafe cuts harmful replies under 1% on held-out fine-tunes while task accuracy stays within 1%.","key_machinery":"Activation-conditioned hypernetwork: layer-wise mean activations from ~50 calibration prompts are split into direction and magnitude, fused into a global embedding, and fed to factorized generators that emit the weights of a ladder-side Safe Side Network that scores prompts and routes only the harmful ones to refusal.","core_discovery":"For any fine-tuned checkpoint of a given backbone, a hypernetwork trained on other domains can map that checkpoint's layer-wise activation fingerprint into a model-specific Safe Side Network that restores near-baseline refusal behavior at inference time while leaving the deployed weights and task performance essentially intact.","pith_inferences":[],"forward_implications":[],"fun_headline_variants":["HyperSafe turns activation fingerprints into a frozen-weight safety sidecar","Layer activations alone spawn a model-specific Safe Side Network","Inference-time SSN from fingerprints drops harm below 1% without weight edits","Hypernetwork maps fine-tune fingerprints to refusal routing, accuracy intact","Post-hoc safety recovery: activations to SSN in one pass, model untouched"],"cache_read_input_tokens":128,"weakest_assumption_plain":"A small set of domain-specific calibration prompts produces an activation fingerprint rich enough that a hypernetwork trained on other domains can generate a safety classifier that works for unseen fine-tuning recipes and for harmful prompts never seen in training.","fun_headline_variants_meta":{"raw":{"variants":["HyperSafe turns activation fingerprints into a frozen-weight safety sidecar","Layer activations alone spawn a model-specific Safe Side Network","Inference-time SSN from fingerprints drops harm below 1% without weight edits","Hypernetwork maps fine-tune fingerprints to refusal routing, accuracy intact","Post-hoc safety recovery: activations to SSN in one pass, model untouched"]},"model":"grok-4.5","effort":"low","cost_usd":0.006266,"raw_usage":{"total_tokens":1613,"prompt_tokens":853,"num_sources_used":0,"completion_tokens":96,"cost_in_usd_ticks":62660000,"prompt_tokens_details":{"text_tokens":853,"audio_tokens":0,"image_tokens":0,"cached_tokens":0},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":664,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":853,"tokens_out":96,"duration_ms":6895,"temperature":1.0,"reasoning_tokens":664,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-14T05:20:37.438973+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"On a held-out fine-tuned checkpoint whose domain was never seen by the hypernetwork, measure whether the generated Safe Side Network still drives harmful rates on AdvBench or HEx-PHI above a few percent while task accuracy stays near the fine-tuned baseline; failure of either metric would falsify the claim.","supporting_citations":[],"review_version":1}