---
title: "Why LLM Safety Guardrails Collapse After Fine-tuning: A"
description: "This paper instead examines an upstream cause: how closely the original safety-alignment data… 78 references, cited by 4 papers here."
authors: ["Lei Hsiung", "Tianyu Pang", "Yung-Chen Tang", "Linyue Song", "Tsung-Yi Ho", "Pin-Yu Chen", "Yaoqing Yang"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.756/"
doi: "10.18653/v1/2026.acl-long.756"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/hsiung-2026-why-llm-safety-guardrails-collapse/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/hsiung-2026-why-llm-safety-guardrails-collapse/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/4/) / Why LLM Safety Guardrails Collapse After Fine-tuning: A Similarity Analysis Between Alignment and Fine-tuning Datasets

# Why LLM Safety Guardrails Collapse After Fine-tuning: A Similarity Analysis Between Alignment and Fine-tuning Datasets

**Authors:** [Lei Hsiung](https://md.research.elamur.ai/free/en/authors/lei-hsiung/), [Tianyu Pang](https://md.research.elamur.ai/free/en/authors/tianyu-pang/), Yung-Chen Tang, Linyue Song, [Tsung-Yi Ho](https://md.research.elamur.ai/free/en/authors/tsung-yi-ho/), [Pin-Yu Chen](https://md.research.elamur.ai/free/en/authors/pin-yu-chen/) and [Yaoqing Yang](https://md.research.elamur.ai/free/en/authors/yaoqing-yang/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.756/) · [PDF](https://aclanthology.org/2026.acl-long.756.pdf) · [DOI 10.18653/v1/2026.acl-long.756](https://doi.org/10.18653/v1/2026.acl-long.756) · [OpenAlex](https://openalex.org/W4416139154)

**Citations:** 0 citations (OpenAlex, 2026-10-14) · [4](https://md.research.elamur.ai/free/en/papers/hsiung-2026-why-llm-safety-guardrails-collapse/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
Open-weight chat models are released with safety alignment, but further fine-tuning, even on harmless data, often erodes these guardrails. Earlier defenses act during or after fine-tuning. This paper instead examines an upstream cause: how closely the original safety-alignment data resembles the downstream task data in representation space.

The authors rebuilt a LLAMA-2-7B-CHAT-like pipeline. They applied instruction tuning on an UltraChat subset, then safety alignment on BeaverTails data chosen to be highly similar, randomly sampled, or minimally similar to the downstream data. Each aligned model was then fine-tuned on benign or harmful instruction datasets. Similarity was measured with cosine scores over last-token final hidden states from an uncensored instruction-following model.

All three variants started out equally safe. After fine-tuning, however, the high-similarity variant lost the most safety, and the low-similarity variant kept the most, with up to 10.33% lower harmfulness. This suggests that keeping alignment data private and selecting models by similarity can help fine-tuning providers reduce jailbreak risk.

## Key points
- **Preliminary finding:** Clustering Alpaca representations without harmful anchors produced list-format subsets that weakened LLAMA-2-7B-CHAT's guardrails even more than the anchor-based Top-100 Harmful selection of He et al. (2024).
- **Core hypothesis:** Benign data becomes "harmful" in fine-tuning because it resembles the upstream safety-alignment data in representation space.
- **Experimental design:** Three alignment subsets (High-Sim, Random, Low-Sim) yielded low, medium, and high guardrail durability respectively, with up to a 10.33% gap in harmfulness.
- **Practical proposal:** Providers can score a pool of candidate aligned models against a user's dataset and fine-tune the one with the lowest similarity. Public alignment datasets are a risk, because attackers could exploit high-similarity data.
- **Limitations:** The study is text-only and uses a reconstructed rather than production alignment pipeline. It relies on a single representation choice and on automated safety and utility evaluators.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [University of California, Berkeley](https://md.research.elamur.ai/free/en/universities/university-of-california-berkeley/) — University, Berkeley, United States · 175 works · 227,440 citations
- [IBM](https://md.research.elamur.ai/free/en/companies/ibm/) — Company, Armonk, United States · 139 works · 70,691 citations
- [Chinese University of Hong Kong](https://md.research.elamur.ai/free/en/universities/chinese-university-of-hong-kong/) — University, Hong Kong, China · 126 works · 14,073 citations
- [École Polytechnique Fédérale de Lausanne](https://md.research.elamur.ai/free/en/universities/ecole-polytechnique-federale-de-lausanne/) — University, Lausanne, Switzerland · 44 works · 7,050 citations
- [Idiap Research Institute](https://md.research.elamur.ai/free/en/labs/idiap-research-institute/) — Research institute, Martigny-Combe, Switzerland · 32 works · 1,954 citations
- [Dartmouth College](https://md.research.elamur.ai/free/en/universities/dartmouth-college/) — University, Hanover, United States · 37 works · 42,625 citations

📚 Shelves (6): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,772 works · [🤝 Safety Research](https://md.research.elamur.ai/free/en/shelves/social-sciences/safety-research/) · 543 works

🧭 Topics (2): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works · [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 517 works

## Cite

Cite as: Lei Hsiung, Tianyu Pang, Yung-Chen Tang, Linyue Song, Tsung-Yi Ho, Pin-Yu Chen and Yaoqing Yang. 2026. Why LLM Safety Guardrails Collapse After Fine-tuning: A Similarity Analysis Between Alignment and Fine-tuning Datasets. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{hsiung2026why,
  title = {{Why LLM Safety Guardrails Collapse After Fine-tuning: A Similarity Analysis Between Alignment and Fine-tuning Datasets}},
  author = {Lei Hsiung, Tianyu Pang, Yung-Chen Tang, Linyue Song, Tsung-Yi Ho, Pin-Yu Chen and Yaoqing Yang},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.756},
  url = {https://doi.org/10.18653/v1/2026.acl-long.756}
}
```

- [← previous Which Reasoning Trajectories Teach Students to Reason Better? A Simple Metric of Informative Alignment](https://md.research.elamur.ai/free/en/papers/yang-2026-which-reasoning-trajectories-teach-students/)
- [next → Writing-RL: Advancing Long-form Writing via Adaptive Curriculum Reinforcement Learning](https://md.research.elamur.ai/free/en/papers/lei-2026-writing-rl-advancing-long-form/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/4/)

## References

78 references, 19 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, Carol Chen, Catherine Olsson, Christopher Olah, Danny Hernandez, Dawn Drain, Deep Ganguli, Dustin Li, Eli Tran-Johnson, Ethan Perez, and 32 others. 20… — [Constitutional AI: Harmlessness from AI Feedback](https://md.research.elamur.ai/free/en/papers/bai-2022-constitutional-ai-harmlessness-ai-feedback/)
2. Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Röttger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. 2024. [Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructions](https://md.research.elamur.ai/free/en/papers/bianchi-2023-safety-tuned-llamas-lessons-improving/). In The Twelfth International Conference on Learning Representations.
3. Hyeong Kyu Choi, Xuefeng Du, and Yixuan Li. 2024. [find](https://scholar.google.com/scholar?q=Hyeong+Kyu+Choi%2C+Xuefeng+Du%2C+and+Yixuan+Li%2E+2024%2E)
4. Safety-aware fine-tuning of large language models. Preprint, arXiv:2410.10014. — [arXiv:2410.10014](https://arxiv.org/abs/2410.10014) [find](https://scholar.google.com/scholar?q=Safety%2Daware+fine%2Dtuning+of+large+language+models%2E+Preprint%2C+arXiv%3A2410%2E10014%2E+%E2%80%94+%5BarXiv%3A2410%2E10014%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2410%2E10014%29)
5. Paul F Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei. 2017. Deep reinforcement learning from human preferences. Advances in Neural Information Processing Systems, 30. [find](https://scholar.google.com/scholar?q=Paul+F+Christiano%2C+Jan+Leike%2C+Tom+Brown%2C+Miljan+Martic%2C+Shane+Legg%2C+and+Dario+Amodei%2E+2017%2E+Deep+reinforcement+learning+from+human+preferences%2E+Advances+in+Neural+Information+Processing+Systems%2C+30%2E)
6. Ning Ding, Yulin Chen, Bokai Xu, Yujia Qin, Shengding Hu, Zhiyuan Liu, Maosong Sun, and Bowen Zhou. 2023. [Enhancing chat language models by scaling high-quality instructional conversations](https://md.research.elamur.ai/free/en/papers/ding-2023-enhancing-chat-language-models-scaling/). In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 3029–3051, Si…
7. Yanrui Du, Sendong Zhao, Jiawei Cao, Ming Ma, Danyang Zhao, Shuren Qi, Fenglei Fan, Ting Liu, and Bing Qin. 2025. Toward secure tuning: Mitigating security risks from instruction fine-tuning. Preprint, arXiv:2410.04524. [find](https://scholar.google.com/scholar?q=Yanrui+Du%2C+Sendong+Zhao%2C+Jiawei+Cao%2C+Ming+Ma%2C+Danyang+Zhao%2C+Shuren+Qi%2C+Fenglei+Fan%2C+Ting+Liu%2C+and+Bing+Qin%2E+2025%2E+Toward+secure+tuning%3A+Mitigating+security+risks+from+instruction+fine%2Dtuning%2E+Preprint)
8. Francisco Eiras, Aleksandar Petrov, Philip Torr, M Pawan Kumar, and Adel Bibi. 2025. Do as I do (Safely): Mitigating Task-Specific Fine-tuning Risks in Large Language Models. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Francisco+Eiras%2C+Aleksandar+Petrov%2C+Philip+Torr%2C+M+Pawan+Kumar%2C+and+Adel+Bibi%2E+2025%2E+Do+as+I+do+%28Safely%29%3A+Mitigating+Task%2DSpecific+Fine%2Dtuning+Risks+in+Large+Language+Models%2E+In+The+Thirteenth+Interna)
9. Junfeng Fang, Yukai Wang, Ruipeng Wang, Zijun Yao, Kun Wang, An Zhang, Xiang Wang, and Tat-Seng Chua. 2025. SafeMLRM: Demystifying Safety in Multi-modal Large Reasoning Models . Preprint, arXiv:2504.08813. — [arXiv:2504.08813](https://arxiv.org/abs/2504.08813) [find](https://scholar.google.com/scholar?q=Junfeng+Fang%2C+Yukai+Wang%2C+Ruipeng+Wang%2C+Zijun+Yao%2C+Kun+Wang%2C+An+Zhang%2C+Xiang+Wang%2C+and+Tat%2DSeng+Chua%2E+2025%2E+SafeMLRM%3A+Demystifying+Safety+in+Multi%2Dmodal+Large+Reasoning+Models+%2E+Preprint%2C+arXiv%3A2504%2E0)
10. GemmaTeam. 2024. Gemma: Open models based on gemini research and technology. Preprint, arXiv:2403.08295. [find](https://scholar.google.com/scholar?q=GemmaTeam%2E+2024%2E+Gemma%3A+Open+models+based+on+gemini+research+and+technology%2E+Preprint%2C+arXiv%3A2403%2E08295%2E)
11. Bogdan Gliwa, Iwona Mochol, Maciej Biesek, and Aleksander Wawer. 2019. [SAMSum corpus: A human-annotated dialogue dataset for abstractive summarization](https://md.research.elamur.ai/free/en/papers/gliwa-2019-samsum-corpus-human-annotated-dialogue/). In Proceedings of the 2nd Workshop on New Frontiers in Summarization, pages 70–79, Hong Kong, China. Association for Computational Linguistics.
12. Zihan Guan, Mengxuan Hu, Ronghang Zhu, Sheng Li, and Anil Vullikanti. 2025. Benign samples matter! fine-tuning on outlier benign samples severely breaks safety. In Forty-second International Conference on Machine Learning. [find](https://scholar.google.com/scholar?q=Zihan+Guan%2C+Mengxuan+Hu%2C+Ronghang+Zhu%2C+Sheng+Li%2C+and+Anil+Vullikanti%2E+2025%2E+Benign+samples+matter%21+fine%2Dtuning+on+outlier+benign+samples+severely+breaks+safety%2E+In+Forty%2Dsecond+International+Conferenc)
13. GuardrailsAI. 2024. Mitigate gen ai risks with guardrails. [https://www.guardrailsai.com/](https://www.guardrailsai.com/). Accessed: 2025-05-24. [↗](https://www.guardrailsai.com/)
14. Danny Halawi, Alexander Wei, Eric Wallace, Tony T Wang, Nika Haghtalab, and Jacob Steinhardt. 2024. Covert malicious finetuning: Challenges in safeguarding llm adaptation. Preprint, arXiv:2406.20053. [find](https://scholar.google.com/scholar?q=Danny+Halawi%2C+Alexander+Wei%2C+Eric+Wallace%2C+Tony+T+Wang%2C+Nika+Haghtalab%2C+and+Jacob+Steinhardt%2E+2024%2E+Covert+malicious+finetuning%3A+Challenges+in+safeguarding+llm+adaptation%2E+Preprint%2C+arXiv%3A2406%2E20053%2E)
15. Luxi He, Mengzhou Xia, and Peter Henderson. 2024. What is in Your Safe Data? Identifying Benign Data that Breaks Safety. In First Conference on Language Modeling. [find](https://scholar.google.com/scholar?q=Luxi+He%2C+Mengzhou+Xia%2C+and+Peter+Henderson%2E+2024%2E+What+is+in+Your+Safe+Data%3F+Identifying+Benign+Data+that+Breaks+Safety%2E+In+First+Conference+on+Language+Modeling%2E)
16. Melissa Heikkiläarchive. 2024. AI companies promised to self-regulate one year ago. What’s changed? MIT Technology Review. Accessed on September, 2024. [find](https://scholar.google.com/scholar?q=Melissa+Heikkil%C3%A4archive%2E+2024%2E+AI+companies+promised+to+self%2Dregulate+one+year+ago%2E+What%E2%80%99s+changed%3F+MIT+Technology+Review%2E+Accessed+on+September%2C+2024%2E)
17. Chia-Yi Hsu, Yu-Lin Tsai, Chih-Hsun Lin, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. 2024. Safe LoRA: the Silver Lining of Reducing Safety Risks when Fine-tuning Large Language Models. Advances in Neural Information Processing Systems, 37:65072–65094. [find](https://scholar.google.com/scholar?q=Chia%2DYi+Hsu%2C+Yu%2DLin+Tsai%2C+Chih%2DHsun+Lin%2C+Pin%2DYu+Chen%2C+Chia%2DMu+Yu%2C+and+Chun%2DYing+Huang%2E+2024%2E+Safe+LoRA%3A+the+Silver+Lining+of+Reducing+Safety+Risks+when+Fine%2Dtuning+Large+Language+Models%2E+Advances+in+N)
18. Position: TrustLLM: Trustworthiness in large language models. In Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages 20166–20270. PMLR. [find](https://scholar.google.com/scholar?q=Position%3A+TrustLLM%3A+Trustworthiness+in+large+language+models%2E+In+Proceedings+of+the+41st+International+Conference+on+Machine+Learning%2C+volume+235+of+Proceedings+of+Machine+Learning+Research%2C+pages+201)
19. Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. 2023. [Editing models with task arithmetic](https://md.research.elamur.ai/free/en/papers/ilharco-2022-editing-models-task-arithmetic/). In The Eleventh International Conference on Learning Representations.
20. Tiansheng Huang, Gautam Bhattacharya, Pratik Joshi, Josh Kimball, and Ling Liu. 2025a. Antidote: Post-fine-tuning Safety Alignment for Large Language Models against Harmful Fine-tuning. In Forty-second International Conference on Machine Learning. [find](https://scholar.google.com/scholar?q=Tiansheng+Huang%2C+Gautam+Bhattacharya%2C+Pratik+Joshi%2C+Josh+Kimball%2C+and+Ling+Liu%2E+2025a%2E+Antidote%3A+Post%2Dfine%2Dtuning+Safety+Alignment+for+Large+Language+Models+against+Harmful+Fine%2Dtuning%2E+In+Forty%2Dsecon)
21. Samyak Jain, Ekdeep Singh Lubana, Kemal Oksuz, Tom Joy, Philip HS Torr, Amartya Sanyal, and Puneet K Dokania. 2024. What Makes and Breaks Safety Fine-tuning? Mechanistic Study. Advances in Neural Information Processing Systems, 37:93406–93478. [find](https://scholar.google.com/scholar?q=Samyak+Jain%2C+Ekdeep+Singh+Lubana%2C+Kemal+Oksuz%2C+Tom+Joy%2C+Philip+HS+Torr%2C+Amartya+Sanyal%2C+and+Puneet+K+Dokania%2E+2024%2E+What+Makes+and+Breaks+Safety+Fine%2Dtuning%3F+Mechanistic+Study%2E+Advances+in+Neural+Info)
22. Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, and Ling Liu. 2024a. Harmful fine-tuning attacks and defenses for [large language models: A survey](https://md.research.elamur.ai/free/en/papers/minaee-2024-large-language-models-survey/). Preprint, arXiv:2409.18169. — [arXiv:2409.18169](https://arxiv.org/abs/2409.18169)
23. Jiaming Ji, Boyuan Chen, Hantao Lou, Donghai Hong, Borong Zhang, Xuehai Pan, Juntao Dai, and Yaodong Yang. 2024a. Aligner: Achieving efficient alignment through weak-to-strong correction. Advances in Neural Information Processing Systems, 37:93406– 93478. [find](https://scholar.google.com/scholar?q=Jiaming+Ji%2C+Boyuan+Chen%2C+Hantao+Lou%2C+Donghai+Hong%2C+Borong+Zhang%2C+Xuehai+Pan%2C+Juntao+Dai%2C+and+Yaodong+Yang%2E+2024a%2E+Aligner%3A+Achieving+efficient+alignment+through+weak%2Dto%2Dstrong+correction%2E+Advances+in+)
24. Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, and Ling Liu. 2024b. Lisa: Lazy Safety Alignment for Large Language Models against Harmful Fine-tuning Attack. Advances in Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=Tiansheng+Huang%2C+Sihao+Hu%2C+Fatih+Ilhan%2C+Selim+Furkan+Tekin%2C+and+Ling+Liu%2E+2024b%2E+Lisa%3A+Lazy+Safety+Alignment+for+Large+Language+Models+against+Harmful+Fine%2Dtuning+Attack%2E+Advances+in+Neural+Informatio)
25. Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, and Ling Liu. 2025b. Booster: Tackling Harmful Fine-tuning for Large Language Models via Attenuating Harmful Perturbation. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Tiansheng+Huang%2C+Sihao+Hu%2C+Fatih+Ilhan%2C+Selim+Furkan+Tekin%2C+and+Ling+Liu%2E+2025b%2E+Booster%3A+Tackling+Harmful+Fine%2Dtuning+for+Large+Language+Models+via+Attenuating+Harmful+Perturbation%2E+In+The+Thirteenth)
26. Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, and Ling Liu. 2025c. Virus: Harmful Fine-tuning Attack for Large Language Models Bypassing Guardrail Moderation. Preprint, arXiv:2501.17433. — [arXiv:2501.17433](https://arxiv.org/abs/2501.17433) [find](https://scholar.google.com/scholar?q=Tiansheng+Huang%2C+Sihao+Hu%2C+Fatih+Ilhan%2C+Selim+Furkan+Tekin%2C+and+Ling+Liu%2E+2025c%2E+Virus%3A+Harmful+Fine%2Dtuning+Attack+for+Large+Language+Models+Bypassing+Guardrail+Moderation%2E+Preprint%2C+arXiv%3A2501%2E17433%2E)
27. Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, Zachary Yahn, Yichang Xu, and Ling Liu. 2025d. Safety tax: Safety alignment makes your large reasoning models less reasonable. Preprint, arXiv:2503.00555. — [arXiv:2503.00555](https://arxiv.org/abs/2503.00555) [find](https://scholar.google.com/scholar?q=Tiansheng+Huang%2C+Sihao+Hu%2C+Fatih+Ilhan%2C+Selim+Furkan+Tekin%2C+Zachary+Yahn%2C+Yichang+Xu%2C+and+Ling+Liu%2E+2025d%2E+Safety+tax%3A+Safety+alignment+makes+your+large+reasoning+models+less+reasonable%2E+Preprint%2C+arX)
28. Tiansheng Huang, Sihao Hu, and Ling Liu. 2024c. Vaccine: Perturbation-aware Alignment for Large Language Models against Harmful Fine-tuning Attack. Advances in Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=Tiansheng+Huang%2C+Sihao+Hu%2C+and+Ling+Liu%2E+2024c%2E+Vaccine%3A+Perturbation%2Daware+Alignment+for+Large+Language+Models+against+Harmful+Fine%2Dtuning+Attack%2E+Advances+in+Neural+Information+Processing+Systems%2E)
29. Yue Huang, Chujie Gao, Siyuan Wu, Haoran Wang, Xiangqi Wang, Yujun Zhou, Yanbo Wang, Jiayi Ye, Jiawen Shi, Qihui Zhang, Yuan Li, Han Bao, Zhaoyi Liu, Tianrui Guan, Dongping Chen, Ruoxi Chen, Kehan Guo, Andy Zou, Bryan Hooi Kuen-Yew, and 47 others. 2025e. On the Trustworthiness of Generative Foundati… [find](https://scholar.google.com/scholar?q=Yue+Huang%2C+Chujie+Gao%2C+Siyuan+Wu%2C+Haoran+Wang%2C+Xiangqi+Wang%2C+Yujun+Zhou%2C+Yanbo+Wang%2C+Jiayi+Ye%2C+Jiawen+Shi%2C+Qihui+Zhang%2C+Yuan+Li%2C+Han+Bao%2C+Zhaoyi+Liu%2C+Tianrui+Guan%2C+Dongping+Chen%2C+Ruoxi+Chen%2C+Kehan+Guo)
30. Yue Huang, Lichao Sun, Haoran Wang, Siyuan Wu, Qihui Zhang, Yuan Li, Chujie Gao, Yixin Huang, Wenhan Lyu, Yixuan Zhang, and 1 others. 2024d. [find](https://scholar.google.com/scholar?q=Yue+Huang%2C+Lichao+Sun%2C+Haoran+Wang%2C+Siyuan+Wu%2C+Qihui+Zhang%2C+Yuan+Li%2C+Chujie+Gao%2C+Yixin+Huang%2C+Wenhan+Lyu%2C+Yixuan+Zhang%2C+and+1+others%2E+2024d%2E)
31. Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2024b. [BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Dataset](https://md.research.elamur.ai/free/en/papers/ji-2023-beavertails-towards-improved-safety-alignment/) . Advances in Neural Information Processing Systems, 36.
32. Jiaming Ji, Kaile Wang, Tianyi Qiu, Boyuan Chen, Jiayi Zhou, Changye Li, Hantao Lou, Josef Dai, Yunhuai Liu, and Yaodong Yang. 2024c. Language models resist alignment: Evidence from data compression. Preprint, arXiv:2406.06144. [find](https://scholar.google.com/scholar?q=Jiaming+Ji%2C+Kaile+Wang%2C+Tianyi+Qiu%2C+Boyuan+Chen%2C+Jiayi+Zhou%2C+Changye+Li%2C+Hantao+Lou%2C+Josef+Dai%2C+Yunhuai+Liu%2C+and+Yaodong+Yang%2E+2024c%2E+Language+models+resist+alignment%3A+Evidence+from+data+compression%2E+)
33. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix,… [find](https://scholar.google.com/scholar?q=Albert+Q%2E+Jiang%2C+Alexandre+Sablayrolles%2C+Arthur+Mensch%2C+Chris+Bamford%2C+Devendra+Singh+Chaplot%2C+Diego+de+las+Casas%2C+Florian+Bressand%2C+Gianna+Lengyel%2C+Guillaume+Lample%2C+Lucile+Saulnier%2C+L%C3%A9lio+Renard+Lav)
34. Fengqing Jiang, Zhangchen Xu, Yuetai Li, Luyao Niu, Zhen Xiang, Bo Li, Bill Yuchen Lin, and Radha Poovendran. 2025. SafeChain: Safety of Language Models with Long Chain-of-Thought Reasoning Capabilities. Preprint, arXiv:2502.12025. [find](https://scholar.google.com/scholar?q=Fengqing+Jiang%2C+Zhangchen+Xu%2C+Yuetai+Li%2C+Luyao+Niu%2C+Zhen+Xiang%2C+Bo+Li%2C+Bill+Yuchen+Lin%2C+and+Radha+Poovendran%2E+2025%2E+SafeChain%3A+Safety+of+Language+Models+with+Long+Chain%2Dof%2DThought+Reasoning+Capabiliti)
35. Mintong Kang and Bo Li. 2025. R 2 -Guard: Robust reasoning enabled llm guardrail via knowledge-enhanced logical reasoning. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Mintong+Kang+and+Bo+Li%2E+2025%2E+R+2+%2DGuard%3A+Robust+reasoning+enabled+llm+guardrail+via+knowledge%2Denhanced+logical+reasoning%2E+In+The+Thirteenth+International+Conference+on+Learning+Representations%2E)
36. Nir Kshetri. 2024. Navigating EU Regulations: Challenges for U.S. Technology Firms and the Rise of Europe’s Generative AI Ecosystem. Computer, 57(10):112–117. [find](https://scholar.google.com/scholar?q=Nir+Kshetri%2E+2024%2E+Navigating+EU+Regulations%3A+Challenges+for+U%2ES%2E+Technology+Firms+and+the+Rise+of+Europe%E2%80%99s+Generative+AI+Ecosystem%2E+Computer%2C+57%2810%29%3A112%E2%80%93117%2E)
37. Chak Tou Leong, Yi Cheng, Kaishuai Xu, Jian Wang, Hanlin Wang, and Wenjie Li. 2024. No two devils alike: Unveiling distinct mechanisms of fine-tuning attacks. Preprint, arXiv:2405.16229. — [arXiv:2405.16229](https://arxiv.org/abs/2405.16229) [find](https://scholar.google.com/scholar?q=Chak+Tou+Leong%2C+Yi+Cheng%2C+Kaishuai+Xu%2C+Jian+Wang%2C+Hanlin+Wang%2C+and+Wenjie+Li%2E+2024%2E+No+two+devils+alike%3A+Unveiling+distinct+mechanisms+of+fine%2Dtuning+attacks%2E+Preprint%2C+arXiv%3A2405%2E16229%2E+%E2%80%94+%5BarXiv%3A2405)
38. Simon Lermen, Charlie Rogers-Smith, and Jeffrey Ladish. 2024. LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70B. Preprint, arXiv:2310.20624. [find](https://scholar.google.com/scholar?q=Simon+Lermen%2C+Charlie+Rogers%2DSmith%2C+and+Jeffrey+Ladish%2E+2024%2E+LoRA+Fine%2Dtuning+Efficiently+Undoes+Safety+Training+in+Llama+2%2DChat+70B%2E+Preprint%2C+arXiv%3A2310%2E20624%2E)
39. Mingjie Li, Wai Man Si, Michael Backes, Yang Zhang, and Yisen Wang. 2025. SaLoRA: Safety-Alignment Preserved Low-Rank Adaptation. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Mingjie+Li%2C+Wai+Man+Si%2C+Michael+Backes%2C+Yang+Zhang%2C+and+Yisen+Wang%2E+2025%2E+SaLoRA%3A+Safety%2DAlignment+Preserved+Low%2DRank+Adaptation%2E+In+The+Thirteenth+International+Conference+on+Learning+Representations)
40. Guozhi Liu, Weiwei Lin, Tiansheng Huang, Ruichao Mo, Qi Mu, and Li Shen. 2025a. Targeted Vaccine: Safety Alignment for Large Language Models against Harmful Fine-Tuning via Layer-wise Perturbation. Preprint, arXiv:2410.09760. [find](https://scholar.google.com/scholar?q=Guozhi+Liu%2C+Weiwei+Lin%2C+Tiansheng+Huang%2C+Ruichao+Mo%2C+Qi+Mu%2C+and+Li+Shen%2E+2025a%2E+Targeted+Vaccine%3A+Safety+Alignment+for+Large+Language+Models+against+Harmful+Fine%2DTuning+via+Layer%2Dwise+Perturbation%2E+Pr)
41. Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, and 1 others. 2025b. Rethinking machine unlearning for large language models. Nature Machine Intelligence, pages 1–14. [find](https://scholar.google.com/scholar?q=Sijia+Liu%2C+Yuanshun+Yao%2C+Jinghan+Jia%2C+Stephen+Casper%2C+Nathalie+Baracaldo%2C+Peter+Hase%2C+Yuguang+Yao%2C+Chris+Yuhao+Liu%2C+Xiaojun+Xu%2C+Hang+Li%2C+and+1+others%2E+2025b%2E+Rethinking+machine+unlearning+for+large+la)
42. Xiao-Yang Liu, Guoxuan Wang, Hongyang Yang, and Daochen Zha. 2023. FinGPT: Democratizing Internet-scale Data for Financial Large Language Models. Preprint, arXiv:2307.10485. — [arXiv:2307.10485](https://arxiv.org/abs/2307.10485) [find](https://scholar.google.com/scholar?q=Xiao%2DYang+Liu%2C+Guoxuan+Wang%2C+Hongyang+Yang%2C+and+Daochen+Zha%2E+2023%2E+FinGPT%3A+Democratizing+Internet%2Dscale+Data+for+Financial+Large+Language+Models%2E+Preprint%2C+arXiv%3A2307%2E10485%2E+%E2%80%94+%5BarXiv%3A2307%2E10485%5D%28https)
43. Xuyuan Liu, Shengyu Chen, Xinshuai Dong, Yanchi Liu, Xujiang Zhao, Haoyu Wang, Yujun Yan, Haifeng Chen, and Zhengzhang Chen. 2026. [Representation interventions enable lifelong knowledge memory control in llms](https://md.research.elamur.ai/free/en/papers/liu-2026-representation-interventions-enable-lifelong-knowledge/). In Proceedings of the 64nd Annual Meeting of the Association for Computational Linguistics…
44. Xuyuan Liu, Lei Hsiung, Yaoqing Yang, and Yujun Yan. 2025c. Spectral insights into data-oblivious critical layers in large language models. In Findings of the Association for Computational Linguistics: ACL 2025, Vienna, Austria. Association for Computational Linguistics. [find](https://scholar.google.com/scholar?q=Xuyuan+Liu%2C+Lei+Hsiung%2C+Yaoqing+Yang%2C+and+Yujun+Yan%2E+2025c%2E+Spectral+insights+into+data%2Doblivious+critical+layers+in+large+language+models%2E+In+Findings+of+the+Association+for+Computational+Linguistics)
45. Yang Liu, Yuanshun Yao, Jean-Francois Ton, Xiaoying Zhang, Ruocheng Guo, Hao Cheng, Yegor Klochkov, Muhammad Faaiz Taufiq, and Hang Li. 2024a. [Trustworthy llms: a survey and guideline for evaluating large language models’ alignment](https://md.research.elamur.ai/free/en/papers/liu-2023-trustworthy-llms-survey-guideline-evaluating/). Preprint, arXiv:2308.05374.
46. Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. 2024b. [Jailbreaking chatgpt via prompt engineering: An empirical study](https://md.research.elamur.ai/free/en/papers/liu-2023-jailbreaking-chatgpt-prompt-engineering-empirical/). Preprint, arXiv:2305.13860.
47. LlamaTeam. 2024. [The llama 3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). Preprint, arXiv:2407.21783.
48. Ning Lu, Shengcai Liu, Jiahao Wu, Weiyu Chen, Zhirui Zhang, Yew-Soon Ong, Qi Wang, and Ke Tang. 2025. Safe Delta: Consistently Preserving Safety when Fine-Tuning LLMs on Diverse Datasets. In Forty-second International Conference on Machine Learning. [find](https://scholar.google.com/scholar?q=Ning+Lu%2C+Shengcai+Liu%2C+Jiahao+Wu%2C+Weiyu+Chen%2C+Zhirui+Zhang%2C+Yew%2DSoon+Ong%2C+Qi+Wang%2C+and+Ke+Tang%2E+2025%2E+Safe+Delta%3A+Consistently+Preserving+Safety+when+Fine%2DTuning+LLMs+on+Diverse+Datasets%2E+In+Forty%2Dsec)
49. MetaAI. 2023. Llama 2 - acceptable use policy - meta ai. Accessed on May, 2025. [find](https://scholar.google.com/scholar?q=MetaAI%2E+2023%2E+Llama+2+%2D+acceptable+use+policy+%2D+meta+ai%2E+Accessed+on+May%2C+2025%2E)
50. MetaAI. 2025. Developer use guide: your resource for building responsibly. Accessed on May, 2025. [find](https://scholar.google.com/scholar?q=MetaAI%2E+2025%2E+Developer+use+guide%3A+your+resource+for+building+responsibly%2E+Accessed+on+May%2C+2025%2E)
51. Jishnu Mukhoti, Yarin Gal, Philip HS Torr, and Puneet K Dokania. 2024. Fine-tuning can cripple your foundation model; preserving features may be the solution . Preprint, arXiv:2308.13320. — [arXiv:2308.13320](https://arxiv.org/abs/2308.13320) [find](https://scholar.google.com/scholar?q=Jishnu+Mukhoti%2C+Yarin+Gal%2C+Philip+HS+Torr%2C+and+Puneet+K+Dokania%2E+2024%2E+Fine%2Dtuning+can+cripple+your+foundation+model%3B+preserving+features+may+be+the+solution+%2E+Preprint%2C+arXiv%3A2308%2E13320%2E+%E2%80%94+%5BarXiv%3A230)
52. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul F Christiano, Jan Leike, and Ryan Lowe. 2022. Tra… — [Training language models to follow instructions with human feedback](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/)
53. ShengYun Peng, Pin-Yu Chen, Matthew Hull, and Duen Horng Chau. 2024. Navigating the safety landscape: Measuring risks in finetuning large language models. In Advances in Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=ShengYun+Peng%2C+Pin%2DYu+Chen%2C+Matthew+Hull%2C+and+Duen+Horng+Chau%2E+2024%2E+Navigating+the+safety+landscape%3A+Measuring+risks+in+finetuning+large+language+models%2E+In+Advances+in+Neural+Information+Processing+)
54. Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2025. Safety alignment should be made more than just a few tokens deep. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Xiangyu+Qi%2C+Ashwinee+Panda%2C+Kaifeng+Lyu%2C+Xiao+Ma%2C+Subhrajit+Roy%2C+Ahmad+Beirami%2C+Prateek+Mittal%2C+and+Peter+Henderson%2E+2025%2E+Safety+alignment+should+be+made+more+than+just+a+few+tokens+deep%2E+In+The+Thir)
55. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2024. [Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!](https://md.research.elamur.ai/free/en/papers/qi-2023-fine-tuning-aligned-language-models/) In The Twelfth International Conference on Learning Representations.
56. QwenTeam. 2023. [Qwen technical report](https://md.research.elamur.ai/free/en/papers/bai-2023-qwen-technical-report/). Preprint, arXiv:2309.16609.
57. QwenTeam. 2025. [Qwen3 technical report](https://md.research.elamur.ai/free/en/papers/yang-2025-qwen3-technical-report/). Preprint, arXiv:2505.09388.
58. Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2024. [Direct Preference Optimization: Your Language Model is Secretly a Reward Model](https://md.research.elamur.ai/free/en/papers/rafailov-2023-direct-preference-optimization-language-model/). Advances in Neural Information Processing Systems, 36.
59. Traian Rebedea, Razvan Dinu, Makesh Narsimhan Sreedhar, Christopher Parisien, and Jonathan Cohen. 2023. NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: System Dem… [find](https://scholar.google.com/scholar?q=Traian+Rebedea%2C+Razvan+Dinu%2C+Makesh+Narsimhan+Sreedhar%2C+Christopher+Parisien%2C+and+Jonathan+Cohen%2E+2023%2E+NeMo+Guardrails%3A+A+Toolkit+for+Controllable+and+Safe+LLM+Applications+with+Programmable+Rails%2E+I)
60. Domenic Rosati, Jan Wehner, Kai Williams, Łukasz Bartoszcze, David Atanasov, Robie Gonzales, Subhabrata Majumdar, Carsten Maple, Hassan Sajjad, and Frank Rudzicz. 2024. Representation Noising: A Defence Mechanism Against Harmful Finetuning. Advances in Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=Domenic+Rosati%2C+Jan+Wehner%2C+Kai+Williams%2C+%C5%81ukasz+Bartoszcze%2C+David+Atanasov%2C+Robie+Gonzales%2C+Subhabrata+Majumdar%2C+Carsten+Maple%2C+Hassan+Sajjad%2C+and+Frank+Rudzicz%2E+2024%2E+Representation+Noising%3A+A+Defen)
61. Han Shen, Pin-Yu Chen, Payel Das, and Tianyi Chen. 2025. SEAL: Safety-enhanced Aligned LLM Fine-tuning via Bilevel Data Selection. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Han+Shen%2C+Pin%2DYu+Chen%2C+Payel+Das%2C+and+Tianyi+Chen%2E+2025%2E+SEAL%3A+Safety%2Denhanced+Aligned+LLM+Fine%2Dtuning+via+Bilevel+Data+Selection%2E+In+The+Thirteenth+International+Conference+on+Learning+Representation)
62. Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. 2024. Detecting pretraining data from large language models. In The Twelfth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Weijia+Shi%2C+Anirudh+Ajith%2C+Mengzhou+Xia%2C+Yangsibo+Huang%2C+Daogao+Liu%2C+Terra+Blevins%2C+Danqi+Chen%2C+and+Luke+Zettlemoyer%2E+2024%2E+Detecting+pretraining+data+from+large+language+models%2E+In+The+Twelfth+Intern)
63. Karan Singhal, Tao Tu, Juraj Gottweis, Rory Sayres, Ellery Wulczyn, Mohamed Amin, Le Hou, Kevin Clark, Stephen R Pfohl, Heather Cole-Lewis, and 1 others. 2025. Toward expert-level medical question answering with large language models. Nature Medicine, pages 1–8. [find](https://scholar.google.com/scholar?q=Karan+Singhal%2C+Tao+Tu%2C+Juraj+Gottweis%2C+Rory+Sayres%2C+Ellery+Wulczyn%2C+Mohamed+Amin%2C+Le+Hou%2C+Kevin+Clark%2C+Stephen+R+Pfohl%2C+Heather+Cole%2DLewis%2C+and+1+others%2E+2025%2E+Toward+expert%2Dlevel+medical+question+ans)
64. Nisan Stiennon, Long Ouyang, Jeffrey Wu, Daniel Ziegler, Ryan Lowe, Chelsea Voss, Alec Radford, Dario Amodei, and Paul F Christiano. 2020. Learning to summarize with human feedback. Advances in Neural Information Processing Systems, 33:3008– 3021. [find](https://scholar.google.com/scholar?q=Nisan+Stiennon%2C+Long+Ouyang%2C+Jeffrey+Wu%2C+Daniel+Ziegler%2C+Ryan+Lowe%2C+Chelsea+Voss%2C+Alec+Radford%2C+Dario+Amodei%2C+and+Paul+F+Christiano%2E+2020%2E+Learning+to+summarize+with+human+feedback%2E+Advances+in+Neural)
65. Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. Stanford alpaca: An instruction-following llama model. GitHub Repository. [find](https://scholar.google.com/scholar?q=Rohan+Taori%2C+Ishaan+Gulrajani%2C+Tianyi+Zhang%2C+Yann+Dubois%2C+Xuechen+Li%2C+Carlos+Guestrin%2C+Percy+Liang%2C+and+Tatsunori+B%2E+Hashimoto%2E+2023%2E+Stanford+alpaca%3A+An+instruction%2Dfollowing+llama+model%2E+GitHub+Repo)
66. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, and 49 others… — [Llama 2: Open Foundation and Fine-Tuned Chat Models](https://md.research.elamur.ai/free/en/papers/touvron-2023-llama-2-open-foundation-fine/)
67. Cheng Wang, Yue Liu, Baolong Bi, Duzhen Zhang, Zhongzhi Li, Junfeng Fang, and Bryan Hooi. 2025. Safety in Large Reasoning Models: A Survey. Preprint, arXiv:2504.17704. [find](https://scholar.google.com/scholar?q=Cheng+Wang%2C+Yue+Liu%2C+Baolong+Bi%2C+Duzhen+Zhang%2C+Zhongzhi+Li%2C+Junfeng+Fang%2C+and+Bryan+Hooi%2E+2025%2E+Safety+in+Large+Reasoning+Models%3A+A+Survey%2E+Preprint%2C+arXiv%3A2504%2E17704%2E)
68. Jiongxiao Wang, Jiazhao Li, Yiquan Li, Xiangyu Qi, Junjie Hu, Yixuan Li, Patrick McDaniel, Muhao Chen, Bo Li, and Chaowei Xiao. 2024. BackdoorAlign: Mitigating Fine-tuning based Jailbreak Attack with Backdoor Enhanced Safety Alignment. Advances in Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=Jiongxiao+Wang%2C+Jiazhao+Li%2C+Yiquan+Li%2C+Xiangyu+Qi%2C+Junjie+Hu%2C+Yixuan+Li%2C+Patrick+McDaniel%2C+Muhao+Chen%2C+Bo+Li%2C+and+Chaowei+Xiao%2E+2024%2E+BackdoorAlign%3A+Mitigating+Fine%2Dtuning+based+Jailbreak+Attack+with+)
69. Di Wu, Xin Lu, Yanyan Zhao, and Bing Qin. 2025. Separate the Wheat from the Chaff: A Post-Hoc Approach to Safety Re-Alignment for Fine-Tuned Language Models. Preprint, arXiv:2412.11041. [find](https://scholar.google.com/scholar?q=Di+Wu%2C+Xin+Lu%2C+Yanyan+Zhao%2C+and+Bing+Qin%2E+2025%2E+Separate+the+Wheat+from+the+Chaff%3A+A+Post%2DHoc+Approach+to+Safety+Re%2DAlignment+for+Fine%2DTuned+Language+Models%2E+Preprint%2C+arXiv%3A2412%2E11041%2E)
70. Xianjun Yang, Xiao Wang, Qi Zhang, Linda Petzold, William Yang Wang, Xun Zhao, and Dahua Lin. 2023. Shadow alignment: The ease of subverting safely-aligned language models. Preprint, arXiv:2310.02949. [find](https://scholar.google.com/scholar?q=Xianjun+Yang%2C+Xiao+Wang%2C+Qi+Zhang%2C+Linda+Petzold%2C+William+Yang+Wang%2C+Xun+Zhao%2C+and+Dahua+Lin%2E+2023%2E+Shadow+alignment%3A+The+ease+of+subverting+safely%2Daligned+language+models%2E+Preprint%2C+arXiv%3A2310%2E02949%2E)
71. Jingwei Yi, Rui Ye, Qisi Chen, Bin Zhu, Siheng Chen, Defu Lian, Guangzhong Sun, Xing Xie, and Fangzhao Wu. 2024. On the Vulnerability of Safety Alignment in Open-Access LLMs. In Findings of the Association for Computational Linguistics: ACL 2024, pages 9236–9260, Bangkok, Thailand. Association for C… [find](https://scholar.google.com/scholar?q=Jingwei+Yi%2C+Rui+Ye%2C+Qisi+Chen%2C+Bin+Zhu%2C+Siheng+Chen%2C+Defu+Lian%2C+Guangzhong+Sun%2C+Xing+Xie%2C+and+Fangzhao+Wu%2E+2024%2E+On+the+Vulnerability+of+Safety+Alignment+in+Open%2DAccess+LLMs%2E+In+Findings+of+the+Associ)
72. Xin Yi, Shunfan Zheng, Linlin Wang, Gerard de Melo, Xiaoling Wang, and Liang He. 2025. NLSR: Neuron-Level Safety Realignment of Large Language Models Against Harmful Fine-Tuning. In Proceedings of the AAAI Conference on Artificial Intelligence. [find](https://scholar.google.com/scholar?q=Xin+Yi%2C+Shunfan+Zheng%2C+Linlin+Wang%2C+Gerard+de+Melo%2C+Xiaoling+Wang%2C+and+Liang+He%2E+2025%2E+NLSR%3A+Neuron%2DLevel+Safety+Realignment+of+Large+Language+Models+Against+Harmful+Fine%2DTuning%2E+In+Proceedings+of+the)
73. Yi Zeng, Weiyu Sun, Tran Huynh, Dawn Song, Bo Li, and Ruoxi Jia. 2024. BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 13189–13215, Miami, Florida, US… [find](https://scholar.google.com/scholar?q=Yi+Zeng%2C+Weiyu+Sun%2C+Tran+Huynh%2C+Dawn+Song%2C+Bo+Li%2C+and+Ruoxi+Jia%2E+2024%2E+BEEAR%3A+Embedding%2Dbased+Adversarial+Removal+of+Safety+Backdoors+in+Instruction%2Dtuned+Language+Models%2E+In+Proceedings+of+the+2024+C)
74. Yiran Zhao, Wenxuan Zhang, Yuxi Xie, Anirudh Goyal, Kenji Kawaguchi, and Michael Shieh. 2025. Understanding and enhancing safety mechanisms of LLMs via safety-specific neuron. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Yiran+Zhao%2C+Wenxuan+Zhang%2C+Yuxi+Xie%2C+Anirudh+Goyal%2C+Kenji+Kawaguchi%2C+and+Michael+Shieh%2E+2025%2E+Understanding+and+enhancing+safety+mechanisms+of+LLMs+via+safety%2Dspecific+neuron%2E+In+The+Thirteenth+Intern)
75. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. 2023. [Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena](https://md.research.elamur.ai/free/en/papers/zheng-2023-judging-llm-judge-mt-bench/). Advances in Neural Information Processing Systems, 36:4659…
76. Kaiwen Zhou, Chengzhi Liu, Xuandong Zhao, Shreed-har Jangam, Jayanth Srinivasa, Gaowen Liu, Dawn Song, and Xin Eric Wang. 2025. [The Hidden Risks of Large Reasoning Models: A Safety Assessment of R1](https://md.research.elamur.ai/free/en/papers/zhou-2025-hidden-risks-large-reasoning-models/). Preprint, arXiv:2502.12659.
77. Minjun Zhu, Linyi Yang, Yifan Wei, Ningyu Zhang, and Yue Zhang. 2024. Locking Down the Finetuned LLMs Safety. Preprint, arXiv:2410.10343. — [arXiv:2410.10343](https://arxiv.org/abs/2410.10343) [find](https://scholar.google.com/scholar?q=Minjun+Zhu%2C+Linyi+Yang%2C+Yifan+Wei%2C+Ningyu+Zhang%2C+and+Yue+Zhang%2E+2024%2E+Locking+Down+the+Finetuned+LLMs+Safety%2E+Preprint%2C+arXiv%3A2410%2E10343%2E+%E2%80%94+%5BarXiv%3A2410%2E10343%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2410%2E10343%29)
78. Boyi Wei, Kaixuan Huang, Yangsibo Huang, Tinghao Xie, Xiangyu Qi, Mengzhou Xia, Prateek Mittal, Mengdi Wang, and Peter Henderson. 2024. Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modifications. In Proceedings of the 41st International Conference on Machine Learning, volum… [find](https://scholar.google.com/scholar?q=Boyi+Wei%2C+Kaixuan+Huang%2C+Yangsibo+Huang%2C+Tinghao+Xie%2C+Xiangyu+Qi%2C+Mengzhou+Xia%2C+Prateek+Mittal%2C+Mengdi+Wang%2C+and+Peter+Henderson%2E+2024%2E+Assessing+the+Brittleness+of+Safety+Alignment+via+Pruning+and+Lo)

*Updated 1 November 2026*