---
title: "CSULoRA: Closest Safe Update Low-Rank Adaptation (2026)"
description: "Fine-tuning an aligned LLM with LoRA can erode its refusal behaviour, even when only a small share of the training data is… 23 references."
authors: ["Oleksandr Marchenko", "Adelaide Danilov", "Aria Nourbakhsh", "Salima Lamsiyah"]
year: 2026
venue: "Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security"
source: "https://aclanthology.org/2026.nlpaics-1.11/"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/marchenko-2026-csulora-closest-safe-update-low/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/marchenko-2026-csulora-closest-safe-update-low/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/28/) / CSULoRA: Closest Safe Update Low-Rank Adaptation

# CSULoRA: Closest Safe Update Low-Rank Adaptation

**Authors:** Oleksandr Marchenko, Adelaide Danilov, Aria Nourbakhsh and [Salima Lamsiyah](https://md.research.elamur.ai/free/en/authors/salima-lamsiyah/) · **Year:** 2026 · **Venue:** [Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security](https://md.research.elamur.ai/free/en/venues/nlpaics/) ([International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security 2026](https://md.research.elamur.ai/free/en/venues/nlpaics/2026/)) · **Publisher:** [Department of Languages and Information Systems, University of Alicante](https://md.research.elamur.ai/free/en/publishers/department-of-languages-and-information-systems-university-of-alicante/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.nlpaics-1.11/) · [PDF](https://aclanthology.org/2026.nlpaics-1.11.pdf) · [OpenAlex](https://openalex.org/W7163036520)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Fine-tuning an aligned LLM with LoRA can erode its refusal behaviour, even when only a small share of the training data is harmful. Earlier fixes rely on hard projection, pruning, thresholds or extra training, and these can remove useful task knowledge. CSULoRA repairs an already trained adapter without any retraining. It first takes the weight difference between an aligned checkpoint and its pre-alignment base. That difference serves as a proxy for alignment-relevant input and output subspaces, which are estimated cheaply with a randomized range finder. Each LoRA update is then divided into four blocks according to how much it overlaps these subspaces. A closed-form minimum-change problem keeps the fully aligned block intact and shrinks the other blocks in proportion to their relative energy. The result is refactored into LoRA matrices of the original rank. The authors tested the method on adversarially mixed instruction-following data. Across two models, CSULoRA reached the lowest attack success rate and the best safety-utility balance among all compared methods.

## Key points
- Models tested: Llama-3.2-3B-Instruct and Gemma-3-4B-it.
- Fine-tuning data: the benign constrained-instruction set UniLu/IF_multi_constraints_upto5_SFT, mixed with a small fraction of unsafe examples.
- Evaluation: IFEval for utility, ARC-Challenge for general capability, ASR for safety, and a combined SUT score.
- Llama results: ASR fell from 60.58% (plain LoRA) to 1.73%, below the base model's 2.69%. Average IFEval utility was 79.20%, a 3.76-point drop from LoRA. SUT was 77.83, the best in this group.
- Gemma results: ASR was 1.35%, IFEval average 85.78%, ARC-Challenge 77.30% and SUT 84.62, all the best in this group.
- Baselines: SafeLoRA, SPLoRA, SaLoRA, AlignGuard and RESTA. RESTA lowers ASR but loses much utility (66.47% on Llama).
- Settings: subspace rank keeps 95% of the displacement energy, and β = 0.05. No new parameters are added and no validation-based threshold is needed.
- Limitations: the authors present the method as a practical heuristic correction, not a formal guarantee of safe behaviour.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [University of Luxembourg](https://md.research.elamur.ai/free/en/universities/university-of-luxembourg/) — University, Luxembourg, Luxembourg · 28 works · 337 citations

Also on the byline: [Arbed](https://ror.org/03wgsss62).

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

🧭 Topics (1): [🪶 Efficient models & compression](https://md.research.elamur.ai/free/en/topics/efficient-models/) · 297 works

## Cite

Cite as: Oleksandr Marchenko, Adelaide Danilov, Aria Nourbakhsh and Salima Lamsiyah. 2026. CSULoRA: Closest Safe Update Low-Rank Adaptation. Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{marchenko2026csulora,
  title = {{CSULoRA: Closest Safe Update Low-Rank Adaptation}},
  author = {Oleksandr Marchenko, Adelaide Danilov, Aria Nourbakhsh and Salima Lamsiyah},
  booktitle = {Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security},
  year = {2026},
  url = {https://aclanthology.org/2026.nlpaics-1.11/}
}
```

- [← previous CSMCIR: CoT-Enhanced Symmetric Alignment with Memory Bank for Composed Image Retrieval](https://md.research.elamur.ai/free/en/papers/qian-2026-csmcir-cot-enhanced-symmetric-alignment/)
- [next → CT-FineBench: A Diagnostic Fidelity Benchmark for Fine-Grained Evaluation of CT Report Generation](https://md.research.elamur.ai/free/en/papers/yuan-2026-ct-finebench-diagnostic-fidelity-benchmark/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/28/)

## References

23 references, 12 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Shuang Ao, Yi Dong, Jinwei Hu, and Sarvapali D Ramchurn. 2025. Safe pruning lora: Robust distance-guided pruning for safety alignment in adaptation of llms. Transactions of the Association for Computational Linguistics, 13:1474–1487. [find](https://scholar.google.com/scholar?q=Shuang+Ao%2C+Yi+Dong%2C+Jinwei+Hu%2C+and+Sarvapali+D+Ramchurn%2E+2025%2E+Safe+pruning+lora%3A+Robust+distance%2Dguided+pruning+for+safety+alignment+in+adaptation+of+llms%2E+Transactions+of+the+Association+for+Computa)
2. Rishabh Bhardwaj, Duc Anh Do, and Soujanya Poria. 2024. [Language models are Homer simpson! safety re-alignment of fine-tuned language models through task arithmetic](https://md.research.elamur.ai/free/en/papers/bhardwaj-2024-language-models-are-homer-simpson/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 14138– 14149…
3. Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Röttger, Dan Jurafsky, Tatsunori Hashimoto, and James Y Zou. 2024. [Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions](https://md.research.elamur.ai/free/en/papers/bianchi-2023-safety-tuned-llamas-lessons-improving/). In International Conference on Learning Representations, volume 2024,…
4. Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. 2018. [Think you have solved question answering? try arc, the ai2 reasoning challenge](https://md.research.elamur.ai/free/en/papers/clark-2018-think-have-solved-question-answering/). arXiv:1803.05457v1.
5. This study has several limitations. First, we evaluate CSULoRA on a limited number of instruction-tuned models and adaptation settings. Second, our comparison focuses on LoRA-based safety-Amitava Das, Abhilekh Borah, Vinija Jain, and preserving methods and does not include broader Aman Chadha. 2025.… — [arXiv:2508.02079](https://arxiv.org/abs/2508.02079) [find](https://scholar.google.com/scholar?q=This+study+has+several+limitations%2E+First%2C+we+evaluate+CSULoRA+on+a+limited+number+of+instruction%2Dtuned+models+and+adaptation+settings%2E+Second%2C+our+comparison+focuses+on+LoRA%2Dbased+safety%2DAmitava+Das%2C)
6. N. Halko, P. G. Martinsson, and J. A. Tropp. 2011. Find-Finally, CSULoRA relies on a safety-aligned ing structure with randomness: Probabilistic algorithms for constructing approximate matrix decom-subspace estimated from the difference between positions. SIAM Review, 53(2):217–288. an aligned check… [find](https://scholar.google.com/scholar?q=N%2E+Halko%2C+P%2E+G%2E+Martinsson%2C+and+J%2E+A%2E+Tropp%2E+2011%2E+Find%2DFinally%2C+CSULoRA+relies+on+a+safety%2Daligned+ing+structure+with+randomness%3A+Probabilistic+algorithms+for+constructing+approximate+matrix+decom%2Dsu)
7. Parameter-efficient transfer learning for nlp. In International conference on machine learning, pages 2790–2799. PMLR. even when users do not intend to! In International Conference on Learning Representations, volume 2024, pages 30988–31043. [find](https://scholar.google.com/scholar?q=Parameter%2Defficient+transfer+learning+for+nlp%2E+In+International+conference+on+machine+learning%2C+pages+2790%E2%80%932799%2E+PMLR%2E+even+when+users+do+not+intend+to%21+In+International+Conference+on+Learning+Represe)
8. Chia-Yi Hsu, Yu-Lin Tsai, Chih-Hsun Lin, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. 2024. Safe lora: The silver lining of reducing safety risks when fine-tuning large language models. Advances in Neural Information Processing Systems, 37:65072–65094. [find](https://scholar.google.com/scholar?q=Chia%2DYi+Hsu%2C+Yu%2DLin+Tsai%2C+Chih%2DHsun+Lin%2C+Pin%2DYu+Chen%2C+Chia%2DMu+Yu%2C+and+Chun%2DYing+Huang%2E+2024%2E+Safe+lora%3A+The+silver+lining+of+reducing+safety+risks+when+fine%2Dtuning+large+language+models%2E+Advances+in+N)
9. Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn. 2023. [Direct preference optimization: your language model is secretly a reward model](https://md.research.elamur.ai/free/en/papers/rafailov-2023-direct-preference-optimization-language-model/). In Proceedings of the 37th International Conference on Neural Information Processing Systems, NIPS ’23, Red Ho…
10. Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Liang Wang, Weizhu Chen, et al. 2022. [Lora: Low-rank adaptation of large language models](https://md.research.elamur.ai/free/en/papers/hu-2021-lora-low-rank-adaptation-large/). Iclr, 1(2):3.
11. Jiaming Ji, Mickel Liu, Juntao Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2023. [Beavertails: towards improved safety alignment of llm via a human-preference dataset](https://md.research.elamur.ai/free/en/papers/ji-2023-beavertails-towards-improved-safety-alignment/). In Proceedings of the 37th International Conference on Neural Information Processin…
12. Shaan Shah, Kaustubh Ponkshe, Raghav Singhal, and Praneeth Vepakomma. 2025. Safety subspaces are not distinct: A fine-tuning case study. In The First Workshop on the Interplay of Model Behavior and Model Internals. [find](https://scholar.google.com/scholar?q=Shaan+Shah%2C+Kaustubh+Ponkshe%2C+Raghav+Singhal%2C+and+Praneeth+Vepakomma%2E+2025%2E+Safety+subspaces+are+not+distinct%3A+A+fine%2Dtuning+case+study%2E+In+The+First+Workshop+on+the+Interplay+of+Model+Behavior+and+Mo)
13. Joel A Tropp and Robert J Webber. 2023. Randomized algorithms for low-rank matrix approximation: Design, analysis, and applications. arXiv preprint arXiv:2306.12418. — [arXiv:2306.12418](https://arxiv.org/abs/2306.12418) [find](https://scholar.google.com/scholar?q=Joel+A+Tropp+and+Robert+J+Webber%2E+2023%2E+Randomized+algorithms+for+low%2Drank+matrix+approximation%3A+Design%2C+analysis%2C+and+applications%2E+arXiv+preprint+arXiv%3A2306%2E12418%2E+%E2%80%94+%5BarXiv%3A2306%2E12418%5D%28https%3A%2F%2Farxiv)
14. Mingjie Li, Wai Man Si, Michael Backes, Yang Zhang, and Yisen Wang. 2025. Salora: Safety-alignment preserved low-rank adaptation. arXiv preprint arXiv:2501.01765. — [arXiv:2501.01765](https://arxiv.org/abs/2501.01765) [find](https://scholar.google.com/scholar?q=Mingjie+Li%2C+Wai+Man+Si%2C+Michael+Backes%2C+Yang+Zhang%2C+and+Yisen+Wang%2E+2025%2E+Salora%3A+Safety%2Dalignment+preserved+low%2Drank+adaptation%2E+arXiv+preprint+arXiv%3A2501%2E01765%2E+%E2%80%94+%5BarXiv%3A2501%2E01765%5D%28https%3A%2F%2Farxiv%2Eor)
15. Yifeng Xiong and Xiaohui Xie. 2025. Oplora: Orthogonal projection lora prevents catastrophic forgetting during parameter-efficient fine-tuning. [find](https://scholar.google.com/scholar?q=Yifeng+Xiong+and+Xiaohui+Xie%2E+2025%2E+Oplora%3A+Orthogonal+projection+lora+prevents+catastrophic+forgetting+during+parameter%2Defficient+fine%2Dtuning%2E)
16. Ning Lu, Shengcai Liu, Jiahao Wu, Weiyu Chen, Zhirui Zhang, Yew-Soon Ong, Qi Wang, and Ke Tang. 2025. Safe delta: consistently preserving safety when fine-tuning llms on diverse datasets. In Proceedings of the 42nd International Conference on Machine Learning, ICML’25. JMLR.org. [find](https://scholar.google.com/scholar?q=Ning+Lu%2C+Shengcai+Liu%2C+Jiahao+Wu%2C+Weiyu+Chen%2C+Zhirui+Zhang%2C+Yew%2DSoon+Ong%2C+Qi+Wang%2C+and+Ke+Tang%2E+2025%2E+Safe+delta%3A+consistently+preserving+safety+when+fine%2Dtuning+llms+on+diverse+datasets%2E+In+Proceedin)
17. Xianjun Yang, Xiao Wang, Qi Zhang, Linda Petzold, William Yang Wang, Xun Zhao, and Dahua Lin. 2023. [Shadow alignment: The ease of subverting safely-aligned language models](https://md.research.elamur.ai/free/en/papers/yang-2023-shadow-alignment-ease-subverting-safely/). arXiv preprint arXiv:2310.02949.
18. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. [Harmbench: a standardized evaluation framework for automated red teaming and robust refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/). In Proceedings of the 41st International Con…
19. Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. 2022. [Train…](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/)
20. Valentina Pyatkin, Saumya Malik, Victoria Graf, Hamish Ivison, Shengyi Huang, Pradeep Dasigi, Nathan Lambert, and Hannaneh Hajishirzi. 2025. [Generalizing verifiable instruction following](https://md.research.elamur.ai/free/en/papers/pyatkin-2025-generalizing-verifiable-instruction-following/). CoRR, abs/2507.02833.
21. Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q. Weinberger, and Yoav Artzi. 2020. Bertscore: Evaluating text generation with bert. In International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Tianyi+Zhang%2C+Varsha+Kishore%2C+Felix+Wu%2C+Kilian+Q%2E+Weinberger%2C+and+Yoav+Artzi%2E+2020%2E+Bertscore%3A+Evaluating+text+generation+with+bert%2E+In+International+Conference+on+Learning+Representations%2E)
22. Jeffrey Zhou, Tianjian Lu, Swaroop Mishra, Siddhartha Brahma, Sujoy Basu, Yi Luan, Denny Zhou, and Le Hou. 2023. [Instruction-following evaluation for large language models](https://md.research.elamur.ai/free/en/papers/zhou-2023-instruction-following-evaluation-large-language/).
23. Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/).

*Updated 2 November 2026*