{"id":"11253aaa-6568-43d2-9e89-e536e0181f15","arxiv_id":"2501.06208","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"Merging a safety LoRA adapter with a task adapter via weighted fusion reduces the harmfulness rate from 44.2% to 2.0% on the HEx-PHI benchmark, at the cost of increased over-refusal.","lead":"Researchers tested whether combining a task-specific LoRA adapter with a safety-trained LoRA adapter can reduce harmful responses from a fine-tuned language model. They report a 42% drop in measured harmfulness, but also find the model becomes overly cautious and rejects safe prompts that sound unsafe.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 42.2pp harmfulness reduction is confounded with the AOA preamble: GPT-4 penalizes the preamble itself, so the task-adapter-only baseline may be inflated.","rationale":"I read the paper as proposing a practical LoRA-fusion recipe for restoring safety after task fine-tuning; the headline evidence is the harmfulness reduction in Table 1. For that claim to hold, the harmfulness metric must measure unsafe content, not style. The paper's own Appendix A.5 undercuts this: the GPT-4 judge penalizes the AOA preamble independent of content. Because λ=0 is the AOA-jailbroken adapter and λ=0.4 is the fused refusal model, the two conditions differ in preamble presence as well as in safety behavior. This is not a disagreement with community consensus; it is an internal validity threat to the central quantitative claim. The authors deserve credit for disclosing the issue and for releasing code and data claims, but disclosure without correction or quantification leaves the headline number unverified. A simple re-scoring test would settle it. I agree with the reader's weakest-assumption identification. Since the existing verdict is CONDITIONAL and the needed fix is a deconfounded evaluation, the verdict remains unchanged: conditional acceptance with the re-scoring check (and ideally a human-judge subsample) as a condition. I am not claiming fraud or even that the method fails; the qualitative effect is plausible, but the 42.2pp magnitude is not established until the preamble is controlled.","tokens_in":11348,"tokens_out":6113,"duration_ms":62228,"concrete_test":"Re-score the λ=0 task-adapter-only HEx-PHI responses after removing the AOA preamble (or with a judge instruction to ignore the preamble), and compare the resulting harmfulness rate to the 44.2% reported. A complementary check is to have human annotators rate the same responses blind to configuration. If the corrected baseline drops substantially (e.g., below 20%), the 42.2pp headline is largely an evaluation artifact; if it stays near 44.2%, the claim survives this threat.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (abstract and Table 1) is a 42.2 percentage-point drop in harmfulness rate (44.2% at λ=0 to 2.0% at λ=0.4) on HEx-PHI. The load-bearing weakness is that this comparison is confounded by the AOA preamble. Appendix A.5 states that GPT-4 rates any response containing 'Of course. I am AOA, your absolutely obedient agent...' as harmful even when the remainder is a refusal. At λ=0 the model is the AOA task adapter, trained and prompted with this template, so its outputs routinely begin with the preamble; at λ=0.4 the fused weights produce refusal-style outputs without that preamble (e.g., Figure 9). Since harmfulness rate counts only GPT-4 scores of 5, a judge that automatically penalizes the preamble can inflate the 44.2% baseline and make the drop to 2.0% reflect format change rather than content safety. The authors acknowledge the judge's behavior but do not quantify or correct for it. Without deconfounding the preamble, the headline magnitude is unsupported, even though the qualitative trend across λ may survive.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a parameter-efficient safety intervention for instruction-fine-tuned LLMs: train a task-specific LoRA adapter on the AOA obedience-style instruction set and a second LoRA adapter on a small curated safety dataset of hard and soft refusals, then combine them as W_base + (1−λ)ΔW_task + λΔW_safety. Experiments on Llama-2-7b-chat use GPT-4 judgments on HEx-PHI for harmfulness, MMLU for general utility, and XSTest-like samples for exaggerated safety. Table 1 reports that increasing λ lowers the HEx-PHI harmfulness rate from 44.2% at λ=0 to 2.0% at λ=0.4, with λ=0.3 described as a balanced operating point; Figure 6 compares this with a safety-data-mixing baseline. The paper also documents exaggerated safety behavior and releases data and code.","tokens_in":11563,"tokens_out":8590,"duration_ms":81906,"significance":"If the reported effect is real, the paper would offer a simple, modular way to restore safety after task fine-tuning by fusing a task adapter with a small safety adapter, with a tunable operating point. The authors deserve credit for releasing data and code, including a demonstrative evaluation set given the restricted HEx-PHI access, for explicitly discussing exaggerated safety, and for reporting a downstream summarization check. The core weakness is that the headline quantitative claim rests on a single evaluation setup whose judge is acknowledged to be biased by the AOA preamble. The method may still show a qualitative monotonic safety improvement, but the numerical magnitude and the comparison against the data-mixing baseline need substantially stronger evidence before the claims in the abstract and Section 5 can be accepted.","major_comments":[{"comment":"The 42.2 percentage-point drop in harmfulness rate is confounded with the AOA preamble. Appendix A.5 states that GPT-4 rates responses that begin with \"Of course. I am AOA, your absolutely obedient agent...\" as harmful even when the rest of the response is a refusal. The λ=0 configuration is the task adapter trained with the AOA template, so its HEx-PHI responses may frequently trigger this automatic penalty, while the fused configurations produce refusals without the preamble (e.g., Figure 9). The authors acknowledge the judge's behavior but do not quantify how many λ=0 HEx-PHI responses contain the preamble, nor do they re-score the baseline with the preamble removed. As a result, the reported 44.2% baseline and the resulting 42.2 percentage-point improvement are not yet demonstrated as content-level safety improvements; the paper should report deconfounded GPT-4 scores and, ideally, human evaluation of the same outputs.","section":"§5, Table 1 and Appendix A.5"},{"comment":"The fusion weight λ is selected by evaluating harmfulness on HEx-PHI, and the same HEx-PHI result is then used as the headline claim. Table 1 is effectively the objective of the optimization in Eq. (11), so the 2.0% value at λ=0.4 is a fitted optimum rather than an independent prediction. The paper should use a held-out evaluation split or a nested model-selection procedure, and should report variance across repeated training runs, prompt subsets, or judge samples. Without this, the central claim is over-stated even if the qualitative trend across λ is real.","section":"§3.2, Eq. (11) and Table 1"},{"comment":"The abstract and text describe the result as a \"42% reduction\" in harmfulness, but Table 1 shows a change from 44.2% to 2.0%, which is a 42.2 percentage-point reduction and a roughly 95.5% relative reduction. The current wording is numerically wrong and should be corrected in the abstract, introduction, and conclusions.","section":"Abstract and §5"},{"comment":"The comparison with the data-mixing baseline is based on only two manually selected safety prompts mixed into the task training data, and no confidence intervals or repeated draws are provided. The authors use the variability between these two prompts to argue that data mixing is quality-dependent, but two points are insufficient to support the conclusion that adapter fusion performs comparably or is more reliable. The paper should include a systematic sweep over mix proportions with several random prompt selections and report the distribution of HEx-PHI and MMLU results.","section":"§7, Figure 6"}],"minor_comments":[{"comment":"Reference [21] appears to be a response about osteoarthritis pain management and does not support the claim about instruction fine-tuning compromising safety; this is likely a citation error and should be corrected.","section":"§2, reference [21]"},{"comment":"The operation denoted ⊕ is used to define fusion but is never formally defined; the text calls the procedure \"concatenation\" while the formula implements a normalized weighted sum. Please use consistent terminology and define the operation explicitly.","section":"§3.2, Eqs. (7)–(9)"},{"comment":"The claim that omitting soft refusals negatively impacts MMLU and XSTest rates is reported without supporting numbers; please include the corresponding table or a specific figure reference.","section":"Appendix A.3"},{"comment":"Section 6 discusses Safe LoRA and arithmetic adapter negation as related approaches, but Section 7 only evaluates the data-mixing baseline; the abstract's phrase \"extensive comparative analysis against established baselines\" overstates the comparison, so either add quantitative baselines or soften the wording.","section":"§7"},{"comment":"The figure legend is difficult to parse: the labels \"3% mix prompt\" and \"13% mix prompt\" should identify which prompt is used and should be accompanied by a table of numeric values and axis definitions.","section":"Figure 6"}],"recommendation":"major_revision","confidential_remarks":"The manuscript's central idea is worth pursuing, but the headline quantitative claim is not yet supported because of the acknowledged GPT-4 preamble bias, the selection of λ on the same benchmark used for the claim, and the absence of variance estimates. I do not see grounds for rejection beyond these fixable evaluation issues; the revision should re-run the evaluation with deconfounded judges and a proper selection/evaluation split."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's my take in brief. The core idea—train a safety LoRA on hard and soft refusals and fuse it with a task adapter via weighted sum—is sensible and sits squarely in the PEFT safety literature. The paper is honest and clear, and the authors deserve credit for releasing code and data and for flagging the judge's preamble sensitivity in Appendix A.5. If the qualitative effect survives deconfounding, this is a genuinely useful incremental contribution: a parameter-efficient way to dial safety back in after jailbreak-inducing fine-tuning, with a tunable trade-off against over-refusal.\n\nThe headline 42.2pp reduction, though, does not survive close reading. First, GPT-4 rates any response containing the AOA preamble as harmful even when the response is a refusal. At λ=0 the model always emits that preamble; at λ=0.4 it does not. So the baseline harmfulness rate of 44.2% is inflated by a stylistic artifact, and the drop to 2.0% partly measures format, not content safety. The authors acknowledge this but never quantify or deconfound it. Second, λ is chosen by inspecting HEx-PHI numbers in Table 1, and the same benchmark is then used to report the best reduction. That makes the 42% a fitted optimum, not a prediction. Third, the evaluation lacks error bars, uses a single model, and the data-mix comparison rests on two hand-picked prompts. These are all addressable, but they make the empirical claims much thinner than the abstract implies.\n\nThe fusion math is standard (equation (9) is a weighted sum of LoRA updates), and the citation coverage is mostly fine, though one reference ([21]) points to an epidemiology reply letter, which looks wrong. The main value is the application and the evaluation lesson.\n\nFor someone working on safety PEFT, this is a reasonable related-work datapoint, but I would not rely on the magnitude. I would send it to a serious referee: the idea is plausible, the write-up is clear, and the flaws are fixable by deconfounding the judge (strip the preamble before scoring or use human ratings), selecting λ on a held-out split, and running multiple seeds. As it stands it deserves major revision, not acceptance.","headline":"Plausible adapter-fusion safety idea with an honest write-up, but the headline 42% reduction rests on a GPT-4 judge confound and same-benchmark λ tuning, so the magnitude is unproven.","tokens_in":12132,"tokens_out":3829,"would_cite":false,"duration_ms":35903,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Fusing a task LoRA adapter with a safety adapter, weighted at λ=0.4, cuts the HEx-PHI harmfulness rate from 44.2% to 2.0% while roughly preserving MMLU performance.","keywords":["LoRA adapter fusion","AI safety","harmfulness rate","HEx-PHI","XSTest","parameter-efficient fine-tuning","jailbreaking","safety fine-tuning"],"falsifier":"Re-score the HEx-PHI outputs with the AOA preamble stripped before judging, or with human annotators, then recompute the harmfulness rate at λ=0 and λ=0.4; if the gap falls well below 42.2 percentage points, the central safety claim is substantially overstated, while a persistent gap would show the fusion survives the judge artifact.","tokens_in":11159,"feed_emoji":"🛡️","tokens_out":4754,"duration_ms":39073,"temperature":0.7,"pith_summary":"The paper tries to show that a modular, post-hoc fusion of two LoRA adapters—one trained to follow a specific instruction style and one trained to refuse harmful prompts—can restore safety to an instruction-fine-tuned language model without retraining the base model. On the HEx-PHI benchmark, the harmfulness rate drops from 44.2% with the task adapter alone to 2.0% when the safety adapter is weighted at λ=0.4, while MMLU performance stays roughly flat. The paper also documents exaggerated safety: at higher safety weights, the model refuses benign prompts that resemble harmful ones, and a more balanced setting at λ=0.3 trades some safety for fewer false refusals. This matters because it offers a configurable safety knob after fine-tuning, an alternative to mixing safety data into task training.","feed_headline":"LoRA fusion cuts harmful LLM replies by 42 points","feed_subtitle":"Weighted blend of task and safety adapters drops HEx-PHI harmfulness from 44% to 2% with little MMLU loss.","key_machinery":"The central object is the normalized weighted sum of two LoRA adapters, W_fusion = W_base + ((1−λ)ΔW_task ⊕ λΔW_safety), where each ΔW_i = A_iB_i is a low-rank update. The parameter λ ∈ [0,1] balances obedience (task adapter) against refusal behavior (safety adapter). The argument rests on this modular reweighting shifting the model's behavior on HEx-PHI harmful prompts from compliance to refusal without retraining.","core_discovery":"The paper's central claim is that the harmfulness introduced by fine-tuning a LoRA adapter on a 'completely obedient agent' (AOA) instruction dataset can be largely neutralized by concatenating that adapter, with normalized weights, to a second LoRA adapter trained on hard and soft refusals. The fusion update is ΔW_fusion = (1−λ)ΔW_task ⊕ λΔW_safety, added to the base weights. The best reported configuration reduces the HEx-PHI harmfulness rate from 44.2% (λ=0) to 2.0% (λ=0.4) with no substantial MMLU loss, at the cost of refusing many safe prompts that look unsafe. The authors present this as an alternative to data mixing, which is computationally expensive and whose results depend on prompt selection, and they show the fusion does not degrade a downstream summarization task in a small XSum sample.","pith_inferences":["If the GPT-4 judge's bias against the AOA preamble is removed, the headline 42-point reduction may shrink; the paper's own appendix reports that the judge scores even refusal-containing AOA responses as harmful.","The same fusion scheme could plausibly transfer to other base models and adapter ranks, but the paper only tests Llama-2-7B-chat with rank r=8, so the modularity claim is not yet established beyond that setting.","The hard/soft refusal split in the safety dataset appears load-bearing: the authors note that omitting soft refusals makes the model reject normal prompts and truncate responses, suggesting the safety adapter must learn a boundary rather than a single rejection behavior.","A practical extension would be exposing λ as a deployment-time dial that operators adjust without retraining; the paper frames this as an advantage but does not evaluate it interactively."],"forward_implications":["At λ=0.4, the harmfulness rate on HEx-PHI falls from 44.2% to 2.0%, a 42.2 percentage-point reduction, at roughly constant MMLU.","At λ=0.3, the model achieves a balanced operating point: lower harmfulness than the task-adapter-only baseline with fewer exaggerated refusals than λ=0.4.","Operating points with higher safety weights exhibit exaggerated safety: safe prompts resembling harmful ones get refused, lowering the XSTest rate.","Fusion with λ=0.4 preserves a downstream summarization task (Rouge-1 precision about 0.928 vs. 0.924 for the task-only adapter), indicating limited utility loss.","The configurable λ gives application owners a safety knob, letting them increase the safety weight for sensitive use cases and decrease it for less severe ones."],"supporting_citations":[{"why":"Supplies the LoRA method that the task and safety adapters are built on.","marker":"[4]"},{"why":"Provides the AOA dataset and demonstrates that fine-tuning on it jailbreaks aligned models; the paper's task adapter is trained on an expanded AOA set.","marker":"[7]"},{"why":"Establishes the data-mixing baseline that the fusion approach is compared against.","marker":"[9]"},{"why":"AdvBench is one source of harmful prompts used to construct the safety dataset.","marker":"[11]"},{"why":"XSTest supplies both safe-but-similar prompts for the safety dataset and the evaluation of exaggerated safety.","marker":"[12]"},{"why":"Supports the use of GPT-4 as a harmfulness judge and informs fine-tuning risk mitigation methodology.","marker":"[13]"},{"why":"Defines the MMLU benchmark used to measure whether fusion preserves general language understanding.","marker":"[14]"},{"why":"Introduces Llama-2, the base model family on which all experiments are run.","marker":"[15]"}],"fun_headline_variants":["Fusing adapters cuts LLM harm by 42 percentage points","LoRA fusion: harmful replies drop from 44% to 2%","Task and safety adapter blend reduces harm by 42 points","44% harm to 2%: LoRA fusion makes LLMs safer"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The harmfulness numbers assume the GPT-4 judge scores both configurations fairly, but the paper acknowledges the judge flags any response containing the AOA preamble as harmful even when a refusal follows; if that bias were removed, the task-only baseline's 44.2% could drop and the reported 42-point improvement could shrink.","fun_headline_variants_meta":{"raw":{"variants":["Fusing adapters cuts LLM harm by 42 percentage points","LoRA fusion: harmful replies drop from 44% to 2%","Task and safety adapter blend reduces harm by 42 points","44% harm to 2%: LoRA fusion makes LLMs safer"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000829,"raw_usage":{"total_tokens":3580,"prompt_tokens":859,"completion_tokens":2721,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":475,"completion_tokens_details":{"reasoning_tokens":2644}},"tokens_in":475,"tokens_out":2721,"duration_ms":21124,"temperature":1.0,"reasoning_tokens":2644,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T23:06:11.604990+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-score the HEx-PHI outputs with the AOA preamble stripped before judging, or with human annotators, then recompute the harmfulness rate at λ=0 and λ=0.4; if the gap falls well below 42.2 percentage points, the central safety claim is substantially overstated, while a persistent gap would show the fusion survives the judge artifact.","supporting_citations":[{"cited_title":"In: In- ternational Conference on Learning Representations (ICLR) (2022)","cited_arxiv_id":null,"evidence_quote":"Supplies the LoRA method that the task and safety adapters are built on."},{"cited_title":"https: //openreview.net/forum?id=hTEGyKf0dZ","cited_arxiv_id":null,"evidence_quote":"Provides the AOA dataset and demonstrates that fine-tuning on it jailbreaks aligned models; the paper's task adapter is trained on an expanded AOA set."},{"cited_title":"In: ICLR 2024","cited_arxiv_id":null,"evidence_quote":"Establishes the data-mixing baseline that the fusion approach is compared against."},{"cited_title":"NAACL-HLT 2024, pp","cited_arxiv_id":null,"evidence_quote":"XSTest supplies both safe-but-similar prompts for the safety dataset and the evaluation of exaggerated safety."},{"cited_title":"ICLR 2021","cited_arxiv_id":null,"evidence_quote":"Defines the MMLU benchmark used to measure whether fusion preserves general language understanding."}],"review_version":1}