Dynamic Adversarial Fine-Tuning Reorganizes Refusal Geometry

• URL: http://arxiv.org/abs/2604.27019v1
• Date: Wed, 29 Apr 2026 12:44:05 GMT
• Title: Dynamic Adversarial Fine-Tuning Reorganizes Refusal Geometry
• Abstract summary: We present a measurement-driven mechanism study on one 7B backbone under supervised fine-tuning (SFT) and R2D2-style adversarial fine-tuning.<n>Our protocol aligns fixed-source HarmBench, StrongREJECT, and XSTest with a five-anchor refusal-geometry suite and causal interventions.
• Score: 13.93757841610393
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Safety-aligned language models must refuse harmful requests without collapsing into broad over-refusal, but the training-time mechanisms behind this tradeoff remain unclear. Prior work characterizes refusal directions and jailbreak robustness, yet does not explain how dynamic adversarial fine-tuning changes refusal carriers across training. We present a measurement-driven mechanism study, not a new defense, on one 7B backbone under supervised fine-tuning (SFT) and R2D2-style dynamic adversarial fine-tuning. Our protocol aligns fixed-source HarmBench, StrongREJECT, and XSTest with a five-anchor refusal-geometry suite and causal interventions. R2D2 drives fixed-source HarmBench ASR to 0.000 at steps 50 and 100, then partially reopens to 0.035 at step 250 and 0.250 at step 500; SFT remains less robust, with ASR between 0.505 and 0.588 at the same anchors. On XSTest, R2D2 any-refusal is 1.000 early, then falls to 0.664 and 0.228. Geometrically, R2D2 preserves a late-layer admissible carrier through step 100 before relocating to an early-layer carrier, while effective rank remains near 1.23--1.27. Causal interventions indicate low-dimensional but utility-coupled control. These results support a reorganization account rather than a drift-only account, with evidence limited to one backbone and fixed-source attacks.

Related papers

• ReDraft, Don't Just Distill: Reference-Driven Revision for Continual VLLM Post-Training [66.72708893922605]
  Post-training of large multimodal models should add new capabilities while preserving those from pre-training.<n>SFT gives explicit target supervision that learns a task from near-zero accuracy, but its off-policy targets move the model far enough to cause forgetting.<n>We introduce ReDraft, which obtains both from the model's own failures.
  arXiv  Detail & Related papers  (2026-09-15T04:59:03Z)
• Adaptive Cost-Sensitive Machine Learning for Autonomous Robot Navigation Failure Prediction: When Not All Errors Are Equal [0.0]
  A near-miss at low speed under reliable sensing is not equivalent to the same event during rapid motion, close obstacle approach or degraded perception.<n>This paper reframes navigation failure prediction as consequence-sensitive forecasting.<n>We evaluate on 2,000 simulated differential-drive episodes using episode-level GroupKFold.
  arXiv  Detail & Related papers  (2026-09-04T17:45:51Z)
• Fast Test-Time Refinement for Robust Learned Image Compression [76.1340081619183]
  Learned image compression (LIC) has demonstrated remarkable rate-distortion (RD) performance in benign settings.<n>High representational capacity endowed by deep neural networks (DNNs) comes at the expense of increased adversarial vulnerability.<n>We propose a Fast Test-Time Refinement Tube (FTTR) framework for practical and robust LIC systems.
  arXiv  Detail & Related papers  (2026-08-15T08:30:56Z)
• WDL-OPD: Weak-Driven On-Policy Distillation via Mixture-Constrained Co-Training [48.290951447286744]
  WDL-OPD is a mixture-constrained co-training method with two trainable policies.<n>An anchor policy generates every rollout, an auxiliary policy evaluates the same visited states, and a geometric mixture of their token distributions is matched to a frozen teacher by reverse KL.<n>We show that freezing the auxiliary recovers an anchor-plus-contrast proxy target closely related to OPD$2$ and W2S-OPD, whereas joint training creates branch-level degrees of freedom that a static delta cannot express.
  arXiv  Detail & Related papers  (2026-08-10T11:22:53Z)
• From Refusal Geometry to Safety Geometry: Harmfulness--Refusal Coupling under Dynamic Adversarial Fine-Tuning [14.6508023458559]
  Existing evaluations do not reveal whether a model has learned to recognize harmfulness.<n>We study this question with a dual safety-geometry protocol that measures harmfulness carriers, refusal carriers, and their coupling.
  arXiv  Detail & Related papers  (2026-06-15T07:50:00Z)
• NOVA: Symbolic Regression Discovery of Interpretable Car-Following and Lane-Change Models with Driver Heterogeneity [1.889930012459364]
  NOVA is an autonomous symbolic regression framework for car-following and lane-change structures.<n>It is applied to 4,765,788 active driving observations from the NGSIM I-80 and US-101 datasets.<n>NOVA achieves 67.4% balanced accuracy under strict vehicle-ID holdout on 502 unseen drivers.
  arXiv  Detail & Related papers  (2026-06-09T08:47:39Z)
• TACT: Mitigating Overthinking and Overacting in Coding Agents via Activation Steering [70.99933391739154]
  We focus on two recurring failure modes where the agent repeatedly reasons over information it already has, and where it issues tool calls without integrating recent observations or acquiring new evidence.<n>In this paper, we introduce TACT (Think-Act via activation Steering), to detect and mitigate agent drift in the residual stream before it surfaces as a behavioral failure.<n>In specific, we label trajectory steps as overthinking, overacting, or calibrated, and find that their hidden states can separate linearly along two *drift axes*, pointing from calibrated behavior toward each failure mode.
  arXiv  Detail & Related papers  (2026-05-07T10:24:27Z)
• Dynamic analysis enhances issue resolution [53.50448142467294]
  DAIRA (Dynamic Analysis-enhanced Issue Resolution Agent) is an automated repair framework that embeds dynamic analysis into the agent's reasoning cycle.<n> Driven by a Test Tracing-Driven methodology, DAIRA utilizes lightweight monitors to extract critical runtime data.<n>When powered by Gemini 3 Flash Preview, DAIRA establishes a new state-of-the-art (SOTA) performance, achieving a 79.4% resolution rate on the SWE-bench Verified dataset.
  arXiv  Detail & Related papers  (2026-03-23T14:48:54Z)
• Evaluating Factor-Wise Auxiliary Dynamics Supervision for Latent Structure and Robustness in Simulated Humanoid Locomotion [0.0]
  DynaMITE is a transformer encoder with a factored 24-d latent trained by per-factor auxiliary losses.<n>The supervised latent shows no evidence of decodable or functionally separable factor structure.<n>For locomotion practitioners: auxiliary dynamics supervision does not produce an interpretable estimator.
  arXiv  Detail & Related papers  (2026-03-22T14:56:10Z)
• LeWorldModel: Stable End-to-End Joint-Embedding Predictive Architecture from Pixels [49.35636088613484]
  Joint Embedding Predictive Architectures (JEPAs) offer a compelling framework for learning world models in compact latent spaces.<n>We introduce LeModelWorld, the first JEPA that trains stably end-to-end from raw pixels using only two loss terms.<n>With 15M parameters trainable on a single GPU in a few hours, LeWM plans up to 48x faster than foundation-model-based world models.
  arXiv  Detail & Related papers  (2026-03-13T19:48:14Z)
• SPAARS: Safer RL Policy Alignment through Abstract Exploration and Refined Exploitation of Action Space [1.8763872698583384]
  offline-to-online reinforcement learning (RL) offers a promising paradigm for robotics by pre-training policies on safe, offline demonstrations and fine-tuning them via online interaction.<n>We introduce SPAARS, a curriculum learning framework that initially constrains exploration to the low-dimensional latent manifold for sample-efficient, safe behavioral improvement.<n>We prove an upper bound on the exploitation gap using the Performance Difference Lemma, establish that latent-space policy gradients achieve provable variance reduction over raw-space exploration, and show that concurrent behavioral cloning during the latent phase directly controls curriculum transition stability.
  arXiv  Detail & Related papers  (2026-03-10T08:52:15Z)
• Improving Search Agent with One Line of Code [68.58667107354253]
  Tool-based Agentic Reinforcement Learning (TARL) has emerged as a promising paradigm for training search agents to interact with external tools.<n>We propose textbfSearch textbfAgent textbfPolicy textbfOptimization (textbfSAPO), which stabilizes training via a conditional token-level KL constraint.
  arXiv  Detail & Related papers  (2026-03-10T04:07:39Z)
• Less is More: Robust Zero-Communication 3D Pursuit-Evasion via Representational Parsimony [7.6658082440595186]
  Asymmetric 3D pursuit-evasion in cluttered voxel environments is difficult under communication latency, partial observability, and nonholonomic maneuver limits.<n>We build on an inherited path-guided decentralized pursuit scaffold to improve communication-free coordination.<n>We show that explicitly severing redundant cross-agent channels can suppress compounding error cascades and improve robustness in latency-prone deployment.
  arXiv  Detail & Related papers  (2026-03-09T11:44:04Z)
• BadCLIP++: Stealthy and Persistent Backdoors in Multimodal Contrastive Learning [73.46118996284888]
  Research on backdoor attacks against multimodal contrastive learning models faces two key challenges: stealthiness and persistence.<n>We propose BadCLIP++, a unified framework that tackles both challenges.<n>For stealthiness, we introduce a semantic-fusion QR micro-trigger that embeds imperceptible patterns near task-relevant regions.<n>For persistence, we stabilize trigger embeddings via radius shrinkage and centroid alignment.
  arXiv  Detail & Related papers  (2026-02-19T08:31:16Z)
• MSign: An Optimizer Preventing Training Instability in Large Language Models via Stable Rank Restoration [48.446476072756276]
  Training instability remains a critical challenge in large language model pretraining.<n>We study training failures in a 5M NanoGPT model scaled via $$P.<n>We propose MSign, a new norm that periodically applies matrix sign operations to restore stable rank.
  arXiv  Detail & Related papers  (2026-02-02T07:18:45Z)
• Risk-Aware Human-in-the-Loop Framework with Adaptive Intrusion Response for Autonomous Vehicles [9.818695109452861]
  We present RAIL, a risk-aware human-in-the-loop framework for autonomous vehicles.<n>RAIL fuses three cues into an Intrusion Risk Score (IRS) via a weighted Noisy-OR.<n>On MetaDrive, RAIL achieves a Test Return (TR) of 360.65, a Test Success Rate (TSR) of 0.85, a Test Safety Violation (TSV) of 0.75, and a Disturbance Rate (DR) of 0.0027.
  arXiv  Detail & Related papers  (2026-01-16T21:08:01Z)
• Alignment Tipping Process: How Self-Evolution Pushes LLM Agents Off the Rails [103.05296856071931]
  We identify the Alignment Tipping Process (ATP), a critical post-deployment risk unique to self-evolving Large Language Model (LLM) agents.<n>ATP arises when continual interaction drives agents to abandon alignment constraints established during training in favor of reinforced, self-interested strategies.<n>Our experiments show that alignment benefits erode rapidly under self-evolution, with initially aligned models converging toward unaligned states.
  arXiv  Detail & Related papers  (2025-10-06T14:48:39Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.