{"id":"1fc06a98-f7e3-4466-a12a-a192b9c8ee3f","arxiv_id":"2508.07172","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"By projecting user-task gradients orthogonal to the alignment gradient and using a KL-divergence safety loss, SafeGrad keeps fine-tuned LLMs safe under high harmful-data ratios without sacrificing task accuracy.","lead":"SafeGrad is a fine-tuning defense that detects when the user task update fights the model's safety alignment and projects away the harmful part of the gradient. It keeps models safe even when a quarter of the fine-tuning data is malicious, with almost no loss on the intended task.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"SafeGrad's core claim that projecting onto the orthogonal plane of g_align nullifies the harmful component is unproven: the paper never measures whether the harmful update direction actually lies along g_align.","rationale":"The reader's weakest assumption is precisely that g_align is a reliable safety-bearing direction such that removing the g_align-parallel component of g_user eliminates harmful influence. My concern is the same: the paper provides only correlational evidence (Table 1) that the aggregate user gradient conflicts with the alignment gradient, but the central 'nullification' claim requires that the harmful component itself be parallel to g_align. This is load-bearing because the entire novelty and stated security guarantee rest on Eq. 4's projection. If the harmful direction is orthogonal to g_align, the surgery does nothing to remove it, and the empirical results might be explained by other factors (e.g., the KL loss's regularizing effect). The proposed test—computing Δg and its alignment with g_align—would settle this directly. I agree with the reader that the paper needs a conditional verdict: the method shows promise and the numbers are consistent, but the mechanism is not established. I do not change the verdict: UNCHANGED means the reader's CONDITIONAL remains the right call, reinforced by a concrete missing measurement.","tokens_in":15284,"tokens_out":4346,"duration_ms":42517,"concrete_test":"On the paper's default setting (Gemma-3-4B, SST2, hr=0.25, batch size 10), compute g_user^poisoned on a batch with 25% harmful examples and g_user^clean on the same batch with harmful examples replaced by benign ones. Let Δg = g_user^poisoned - g_user^clean. Measure cosine(Δg, g_align). If |cos| is close to 1, the projection removes the harmful component. If |cos| is near 0, the projection does not; then also measure the safety impact of the orthogonal component by projecting Δg onto the orthogonal complement and checking whether a single projected update increases the harmful score. This directly tests the central nullification claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"SafeGrad's central mechanism (Eq. 4) removes from g_user only its component parallel to g_align, the gradient of the KL alignment loss on 100 trusted prompts (Eq. 6). This guarantees at most first-order non-increase of that specific alignment objective. It does not guarantee removal of the 'harmful component' of the poisoned user gradient. The paper's only evidence for the existence and direction of the harmful component is the negative cosine similarity in Table 1 between the aggregate g_user and g_align, measured on one configuration without error bars. The harmful component is more precisely the difference Δg = g_user^poisoned - g_user^clean; Table 1 never measures whether Δg is parallel to g_align. If Δg has a large component orthogonal to g_align, the projection leaves that harmful influence untouched, and SafeGrad's empirical success would have to be attributed to the KL loss or to accidental regularization rather than to the stated surgery. The cosine values themselves are small (-0.05 at hr=0.25, -0.16 at hr=1.0) and reported without variance, so the conflict trigger is noisy. Without a direct test that the harmful update direction lies in span(g_align), the paper's causal claim is unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SafeGrad, a fine-tuning-stage defense against harmful fine-tuning attacks in the Fine-tuning-as-a-Service setting. The method detects conflicts between the user-task gradient and a safety-alignment gradient, and when conflict occurs (negative cosine similarity), projects the user gradient onto the plane orthogonal to the alignment gradient. The alignment objective is a KL-divergence against a frozen aligned reference model, intended to provide a dense safety signal. Experiments across three LLMs (Gemma-3-4B, Llama-3-8B, Qwen2.5-7B) and three datasets (SST2, AGNEWS, GSM8K) report consistently low Harmful Scores while maintaining Finetune Accuracy close to undefended SFT, outperforming five baselines (SFT, SafeInstr, LISA, BESA, PTST). The paper also includes analyses of alignment-data size, trade-off parameter lambda, overhead, and gradient cosine dynamics.","tokens_in":15634,"tokens_out":2606,"duration_ms":26152,"significance":"If the claims hold, SafeGrad would be a simple and effective defense that is robust to high harmful ratios, a regime where existing multi-objective defenses degrade sharply. The paper's strengths include public code, tests across multiple models and datasets, and a parameter-light design (only lambda is tuned). The reported HS reductions are large and consistent (e.g., Table 2: average HS 4.02 vs. 11.70 for the best baseline). However, the paper's central mechanistic claim—that projecting onto the orthogonal plane of the alignment gradient nullifies the harmful component of the user gradient—is not directly supported by the evidence presented. The significance of the method therefore depends on whether this mechanism can be validated, or whether the empirical success is primarily due to the KL alignment loss or other regularization effects.","major_comments":[{"comment":"The paper claims that projecting g_user onto the normal plane of g_align 'nullifies the harmful component of the user-task gradient.' This is mathematically only guaranteed to remove the component of g_user parallel to g_align. The harmful component is more precisely Δg = g_user^poisoned − g_user^clean, but the paper never measures whether Δg lies along g_align. Table 1 reports cosine similarity between the aggregate g_user and g_align, which is not the same quantity. If Δg has a large component orthogonal to g_align, the projection leaves that harmful influence untouched, and the reported safety gains would be attributable to the KL loss or incidental regularization. The paper should either prove a bound on the orthogonal harmful component, or add a direct empirical test: compare Δg's alignment with g_align (e.g., cosine or projection norm), and/or ablate the surgery while keeping the K","section":"§3.2, Eq. (4); §2.3, Table 1"},{"comment":"All results are reported as single numbers with no variance, error bars, or number of seeds. Given that the core empirical claim is robustness across ratios, models, and datasets, the absence of repeated runs makes it impossible to assess whether the large HS differences (e.g., 4.02 vs. 11.70 in Table 2) are statistically reliable. At minimum, the paper should report mean±std over 3–5 seeds for the main tables. This is load-bearing for the 'state-of-the-art' claim.","section":"§4.2, Tables 2–4"},{"comment":"Figure 4(a) plots the cosine similarity before and after surgery under hr=0.25. The 'After' line is clamped at zero, but this is a definitional consequence of Eq. (4) (the projected gradient is orthogonal to g_align by construction). It does not provide evidence that the harmful component has been removed. The figure should instead show the effect on an external safety metric over a time course, or a direct measurement of the persistence of harmful influence. As presented, this panel is not an independent confirmation of the mechanism.","section":"§4.5, Fig. 4(a)"},{"comment":"The paper does not isolate the contribution of the gradient-surgery component from the contribution of the KL-divergence alignment loss. Table 6 compares KL vs. SFT alignment objectives, and Table 8 compares SafeGrad(SFT) vs. SafeGrad(KL), but there is no condition that removes the surgery while keeping the KL objective (e.g., KL-only weighted sum, without projection). Without this ablation, the reader cannot tell whether the reported robustness comes from the surgery, the KL loss, or their combination. Given that the title and central contribution emphasize gradient surgery, this ablation is necessary.","section":"§4.3, Table 6; §4.4, Table 8"},{"comment":"The related-work section cites several recent fine-tuning-stage defenses (e.g., Vaccine, Booster, SafeLoRA, safety-layer freezing, and others in §5) that are not included in the experimental comparison. The paper claims 'state-of-the-art defense,' but the baseline set is limited to five methods, and some cited works propose mechanisms closely related to gradient modulation. The authors should either add these baselines or clearly state the scope of comparison and justify the selection.","section":"§4.1, Baselines"}],"minor_comments":[{"comment":"The Harmful Score is evaluated with Llama-Guard-3-8B on 1,000 BeaverTails prompts. Please specify whether the same harmful prompts used for poisoning are reused in evaluation, and whether the evaluation prompts are disjoint from the poisoning and alignment data.","section":"§4.1, Metrics"},{"comment":"The batch size of 10 with 1,000 samples implies 100 steps per epoch. Please clarify the total number of optimizer steps and report the wall-clock time per method, since overhead is a claimed consideration.","section":"§4.1, Training Details"},{"comment":"The table caption says 'Harmful score of KL Divergence and SFT with different alignment numbers,' but the setup is ambiguous: are both configurations using SafeGrad's gradient surgery? If so, state this explicitly. If not, the comparison confounds the alignment loss with the surgery.","section":"§4.3, Table 6"},{"comment":"Figure 2(a) shows SafeInstr HS rising from 3.10 to 37.50 and Lisa from 13.10 to 44.50, but the figure axes and data points are not legible in the preprint. Please ensure vector figures and readable labels in the final version.","section":"§2.3, Fig. 2"},{"comment":"The KL loss is defined as D_KL(P_{θ0}(·|x_a) || P_θ(·|x_a)). The direction of the KL (forward vs. reverse) and whether the reference is frozen should be stated clearly; the text says 'frozen reference model,' which is good, but the direction has implications for mode-seeking behavior. A brief justification of the chosen direction would help.","section":"§3.3, Eq. (6)"},{"comment":"There are several typographical and formatting issues (e.g., 'harmful ratio' vs. 'hr' consistency, missing spaces around equations, garbled text in the abstract of the arXiv version). A thorough copyedit is recommended.","section":"General"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things about this one. First, the empirical result is genuinely good: SafeGrad keeps Harmful Score around 4-5% at poison ratios where SafeInstr and LISA collapse to 20-40%, and it holds across three models, three datasets, and ratios from 0.05 to 0.25. Second, the name is fancier than the actual novelty: the projection step is exactly PCGrad (Yu et al., 2020), which the authors cite, and the KL-to-reference alignment is a standard distillation trick. The contribution is the specific application to harmful fine-tuning and the pairing of the two, which is legitimate but not groundbreaking.\n\nWhat the paper does well: it is honest about its lineage, the internal numbers are consistent, the data-efficiency result with 20 alignment examples is nice, and the authors release code. The ablation in Table 6 shows the KL loss matters a lot at low data regimes, which is a real finding. If the numbers hold up, this is a useful practical recipe for FaaS providers.\n\nThe soft spots are real but not fatal. No error bars, no seeds, no repeated runs anywhere, despite a section titled \"Statistical Evaluation\" that contains zero statistics. The causal story in Section 3.2 is the weakest part: the paper says projecting g_user onto the normal plane of g_align \"nullifies the harmful component,\" but the stress-test note is correct that this only guarantees first-order non-interference with the KL objective. The harmful update direction, Δg = g_poisoned - g_clean, is never measured. Table 1's negative cosine correlation is suggestive but variance-free and small (-0.05 at hr=0.25). So the mechanism claim is unsupported. The real driver of the safety gains might be the KL loss, and there is no ablation isolating the projection alone.\n\nAlso, the baseline set omits several recent fine-tuning-stage defenses the paper itself cites (Vaccine, Booster, SafeLoRA, etc.), so \"state-of-the-art\" is overstated. And Figure 4(a)'s \"After\" line is clamped at zero by definition, so it proves nothing about conflict removal.\n\nNone of this sinks the paper. The method is simple, the evidence is consistent, and the practical value is plausible even if the mechanism is more \"conservative update\" than \"harm nullification.\" This deserves serious peer review, but the authors should be asked for error bars, an ablation without projection, and a softer causal claim.\n\nI'd bring it to a reading group focused on safety or fine-tuning robustness, and I'd cite it if I were working on harmful fine-tuning defenses.","headline":"A practical-sounding defense with strikingly low harmful scores across models and datasets, but the gradient-surgery mechanism is oversold and the paper needs error bars and a cleaner ablation.","tokens_in":16083,"tokens_out":1896,"would_cite":true,"duration_ms":20106,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"When a fine-tuned model's task gradient and safety gradient point in opposite directions, projecting away the conflict keeps both safety and task accuracy.","keywords":["harmful fine-tuning","safety alignment","gradient surgery","multi-objective optimization","KL divergence alignment","fine-tuning-as-a-service","large language models","defense against poisoning"],"falsifier":"Construct a poisoned fine-tuning set in which harmful examples are adversarially chosen so their per-example gradients are nearly orthogonal to $g_{\\mathrm{align}}$, then run SafeGrad and measure Harmful Score: if the score rises while benign accuracy stays high, the projection is not what is carrying the defense. A second check is to replace the trusted alignment set with an equal-sized set of ordinary, non-safety prompts: if Harmful Score barely changes, the alignment gradient's direction, not the KL regularization, is doing the work.","tokens_in":15235,"feed_emoji":"🛡️","tokens_out":12261,"duration_ms":106219,"temperature":0.7,"pith_summary":"The paper argues that existing defenses against harmful fine-tuning fail at high poison ratios because the user-task gradient and the safety-alignment gradient point against each other, and that this conflict can be repaired by a projection. When the two gradients have negative cosine similarity, SafeGrad replaces the user-task gradient with its component orthogonal to the alignment gradient, removing the part of the update that pushes the model away from safety while keeping the part that learns the task. The paper also replaces sparse refusal-token supervision with a KL-divergence loss between the fine-tuned model and the frozen, well-aligned reference model over a small set of safe prompts, giving a denser safety signal. If the claim is right, a fine-tuning service can accept partly poisoned user data without its model becoming unsafe and without giving up task fidelity. In the headline experiments, SafeGrad holds average Harmful Score at 4.02 while the best baseline, PTST, sits at 11.70, and it keeps Finetune Accuracy at 93.71, close to the undefended SFT baseline.","feed_headline":"Gradient surgery blocks harmful fine-tuning with accuracy intact","feed_subtitle":"SafeGrad holds harmful responses around 4% on average and keeps task accuracy near 94%, even as poison ratios rise.","key_machinery":"The central object is a conditional orthogonal projection: when $g_{\\mathrm{user}}\\cdot g_{\\mathrm{align}} < 0$, the update replaces $g_{\\mathrm{user}}$ with $g_{\\mathrm{user}}' = g_{\\mathrm{user}} - \\frac{g_{\\mathrm{user}}\\cdot g_{\\mathrm{align}}}{\\|g_{\\mathrm{align}}\\|^2} g_{\\mathrm{align}}$, and uses $g_{\\mathrm{user}}' + \\lambda g_{\\mathrm{align}}$ as the final direction. This makes the user-task update orthogonal to the alignment gradient, so task progress is kept while any component that would reduce safety is removed. The second mechanism is the distributional alignment loss, a KL divergence between the frozen reference model and the fine-tuned model on the trusted alignment prompts,","core_discovery":"On its own terms, the paper's discovery is that gradient conflict is the mechanism by which poisoned data defeats multi-objective safe fine-tuning: cosine similarity between the user and alignment gradients falls from 0.02 on clean data to $-0.16$ on fully malicious data. SafeGrad detects the conflict and applies the projection $g_{\\mathrm{user}}' = g_{\\mathrm{user}} - \\frac{g_{\\mathrm{user}}\\cdot g_{\\mathrm{align}}}{\\|g_{\\mathrm{align}}\\|^2}g_{\\mathrm{align}}$, then updates with $g_{\\mathrm{user}}' + \\lambda g_{\\mathrm{align}}$, so the user update no longer opposes the safety objective. The companion claim is that refusal-token supervision is too sparse; matching the frozen aligned model's","pith_inferences":["One extension is algorithmic: the projection rule does not depend on safety semantics, so the same conditional surgery could protect other alignment objectives (fairness, style, factuality) whenever a trusted gradient direction exists; the paper tests only safety.","A targeted adversary could try to defeat the projection by crafting harmful examples whose gradients are nearly orthogonal to the trusted alignment gradient; nothing in the paper rules this out, and it is a concrete attack to attempt.","The low-data ablation suggests part of the defense may come from the regularizing effect of matching the reference distribution rather than from surgery alone; separating these two contributions would sharpen the causal claim."],"forward_implications":["Safety ceases to degrade with attacker budget: SafeGrad's Harmful Score stays between 3.3 and 4.4 as the harmful ratio rises from 0.05 to 0.25, while SafeInstr and LISA escalate to averages of 22.84 and 32.84.","Task accuracy survives the defense: 93.71 average Finetune Accuracy on SST2 versus 94.29 for undefended SFT, and best average accuracy among all methods across SST2, AGNEWS, and GSM8K at 81.94.","The KL alignment loss makes safe fine-tuning practical with very few trusted examples: 20 alignment prompts give a Harmful Score of 3.50, and 10 prompts already beat the SFT alignment loss by a wide margin (4.6 vs 31.5).","The method transfers: results hold on Gemma-3-4B, Llama-3-8B, and Qwen2.5-7B and on three different task families, so the mechanism is not tied to one architecture or one dataset.","A variant using SFT alignment instead of KL offers a cheaper deployment path, with lower GPU memory-time than LISA and a substantially lower Harmful Score at high ratio."],"supporting_citations":[{"why":"Introduces the gradient-surgery projection for multi-task learning that SafeGrad adapts to conflict resolution.","marker":"Yu et al., 2020"},{"why":"Defines the SafeInstr mixing baseline and frames safe fine-tuning as multi-objective optimization with trusted alignment data.","marker":"Bianchi et al., 2024"},{"why":"Formulates LISA, the bi-state multi-objective baseline, and the evaluation setup SafeGrad inherits.","marker":"Huang et al., 2024b"},{"why":"Defines PTST, the best-performing baseline in the headline safety comparisons.","marker":"Lyu et al., 2024"},{"why":"Defines BESA, the backdoor-based baseline defense that SafeGrad is compared against.","marker":"Wang et al., 2024"},{"why":"Provides the enriched BeaverTails dataset used for both poisoning examples and trusted alignment data.","marker":"Rosati et al., 2024d"},{"why":"Provides BeaverTails, the source of harmful prompt-answer pairs and the safety evaluation test set.","marker":"Ji et al., 2023"},{"why":"Establishes the harmful fine-tuning vulnerability that motivates the FaaS threat model.","marker":"Qi et al., 2023"},{"why":"Supplies LoRA, the parameter-efficient training method used in all experiments.","marker":"Hu et al., 2021"}],"fun_headline_variants":["SafeGrad: gradient surgery keeps LLM safe and accurate","Surgical fix: block poison gradients, keep 94% accuracy","Gradient surgery: 4% harmful responses, 94% task accuracy","For poisoned fine-tunes, SafeGrad cuts harm to 4%","Safe fine-tuning: project away harmful gradient conflicts"],"cache_read_input_tokens":2816,"weakest_assumption_plain":"The load-bearing assumption is that the trusted alignment gradient is a reliable safety-bearing direction, so deleting the user gradient's component along it also deletes the harm; if poisoned influences live in directions orthogonal to that gradient, or the gradient itself is noisy, the projection can both miss the harm and damage utility.","fun_headline_variants_meta":{"raw":{"variants":["SafeGrad: gradient surgery keeps LLM safe and accurate","Surgical fix: block poison gradients, keep 94% accuracy","Gradient surgery: 4% harmful responses, 94% task accuracy","For poisoned fine-tunes, SafeGrad cuts harm to 4%","Safe fine-tuning: project away harmful gradient conflicts"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000214,"raw_usage":{"total_tokens":1263,"prompt_tokens":750,"completion_tokens":513,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":494,"completion_tokens_details":{"reasoning_tokens":423}},"tokens_in":494,"tokens_out":513,"duration_ms":4495,"temperature":1.0,"reasoning_tokens":423,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T22:16:57.143655+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Construct a poisoned fine-tuning set in which harmful examples are adversarially chosen so their per-example gradients are nearly orthogonal to $g_{\\mathrm{align}}$, then run SafeGrad and measure Harmful Score: if the score rises while benign accuracy stays high, the projection is not what is carrying the defense. A second check is to replace the trusted alignment set with an equal-sized set of ordinary, non-safety prompts: if Harmful Score barely changes, the alignment gradient's direction, not the KL regularization, is doing the work.","supporting_citations":[],"review_version":1}