Active Adaptation, Not Static Defense: Temporal Dynamics of Preventative Steering in Adversarial Fine-Tuning
Researchers analyze why Preventative Steering protects LLMs against malicious fine-tuning, finding active adaptation drives protection, and propose Progressive Intensity Scheduling.
The paper studies Preventative Steering, a training-time defense that injects undesirable-trait persona vectors during adversarial fine-tuning and removes them at evaluation time. Temporal analysis shows protection emerges from an early compensatory adaptation phase followed by a steady-state phase, with attention output projections acting as the dominant residual-write route for defensive updates. Intervention Delta Preservation experiments show that preserving or reinjecting weight offsets fails to maintain protection, indicating reliance on active adaptation rather than a static defense. The proposed Progressive Intensity Scheduling improves safety robustness on Qwen2.5 and Gemma-3 while reducing harmful trait expression.
- Preventative Steering's lasting protection stems from early compensatory adaptation, not static weight offsets
- Attention output projections are the dominant residual-write route for defensive updates
- Progressive Intensity Scheduling raises injection strength as static alignment decays
- Evaluated on Qwen2.5 and Gemma-3 with improved robustness and reduced harmful trait expression
Full article161 words · extracted from arxiv.org · click to collapse
Large language models remain fragile against malicious fine-tuning, motivating training-time defenses against harmful persona drift. Preventative Steering injects undesirable-trait persona vectors during fine-tuning and removes them at evaluation time, yet the mechanism behind its lasting protection remains unclear. Analyzing its temporal optimization dynamics, we find that the defense emerges from an early compensatory adaptation phase followed by a steady-state phase where the corrective signal decays; in parameter space, attention output projections emerge as the dominant residual-write route for defensive updates. Through Intervention Delta Preservation (IDP) and IDP Continuation experiments, we further show that preserving or reinjecting the weight offset fails to maintain protection, indicating that preventative steering relies on active adaptation rather than a static defense. Motivated by this finding, we propose Progressive Intensity Scheduling (PIS), which starts with a moderate injection strength and increases it after static-strength alignment begins to decay. Across the evaluated Qwen2.5 and Gemma-3 models, PIS improves safety robustness over static-strength steering while reducing harmful trait expression.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.10142