SLDR: Defending Against Malicious Fine-tuning via Selective Layers Recovery and Dynamic Routing

What it claims

SLDR repairs a model that a user has compromised through a fine-tuning service. It retrains just two transformer layers with LoRA, then routes only prompts that look malicious through that repair. The motivating finding is that layer-wise safety sensitivity has a sign. Scaling some layers up increases refusal. Scaling others up suppresses it. Most layers do little either way. Prior layer-localization work (Safety Layers, LARF) found where safety lives but not which direction each layer pushes.

How it works

1. Signed probe, run on the aligned model before any fine-tuning. - For each layer l, scale its attention and FFN weights by (1+α) and by (1−α). - Count refusals on an over-refusal dataset: benign prompts containing safety terms such as "kill time". - The layer's score is κ_l = max over α ∈ {0.1, 0.2} of (c⁺ − c⁻)/α.
2. Layer selection. Take only l_max (the most refusal-enhancing layer) and l_min (the most refusal-suppressing layer). All other layers stay frozen.
3. Recovery. Start from the attacked LoRA-fine-tuned model. Train a LoRA adapter on those two layers only, using an alignment set of harmful prompts paired with safe responses (from BDS, an extended BeaverTails).
4. Routing. - Take the last-token hidden state at l_max and L2-normalize it. - Compute the mean cosine-similarity gap between the prompt and N harmful reference prompts versus N benign reference prompts. - If the score is above τ (default τ = 0), use the recovered model. Otherwise use the attacked task model unchanged.

flowchart LR
  P[User prompt] --> H[Hidden state at l_max]
  RU[Harmful refs] --> S[Malicious score]
  RS[Benign refs] --> S
  H --> S
  S -->|"> tau"| R[Attacked model + recovery LoRA]
  S -->|"<= tau"| A[Attacked model, no adapter]

Evidence

Default setting: Llama3.1-8B-Instruct, SST2, |D_train| = 1000, LoRA attack. Results are harmful score (HS, lower is better) / fine-tune accuracy (FA), averaged over poison ratios ρ ∈ {clean, 0.05, 0.1, 0.15, 0.2}:

The point is that the other defenses trade task accuracy for safety: Lisa loses about 18 points of FA and Antidote about 7. SLDR stays essentially at SFT accuracy.

Across architectures (SST2, ρ = 0.1, HS / FA):

Across tasks (Llama3.1):

• SLDR's HS is ≤ 0.20 on all four tasks shown: SST2, AGNEWS, GSM8K and AlpacaEval.
• FA is never above plain SFT, because benign traffic uses the attacked model as-is.
• On GSM8K, SLDR's 72.10 FA is below several baselines; Lisa reaches 76.70 there.

How to use it

Code: https://github.com/Stardust457/SLDR.

What you need:

• Access to the aligned base model, to run the probe.
• An over-refusal probe set.
• A safety alignment set.
• Harmful and benign reference prompt sets. The paper takes these from LARF and from another cited source.

Serving cost: you must host the task model both with and without the recovery adapter. Every request pays for one hidden-state extraction at l_max before routing.

Limits

• Routing is the critical point. A harmful prompt that scores at or below τ is answered by the compromised model with no repair. The visible text does not report router false-negative rates or adaptive attacks against the router. A τ sensitivity study is referenced in Section 5.2 but is not in the fetched text.
• The fetched page is truncated in the experiments section. The fetched text:
• does not contain the ρ up to 0.9 result;
• does not contain the both-layers ablation;
• lists Magicoder as a downstream task but shows no Magicoder results;
• does not define the harmful-score metric.
• Attack scope: only LoRA-based malicious fine-tuning is evaluated, on 7–8B instruct models.
• The probe is scored by counting refusals. The IsRefusal classifier is only described in an appendix.