Source research

Safeguard Fine-Tuned LLMs Through Pre- and Post-Tuning Model Merging

Hua Farn, Hsuan Su, Shachi H Kumar, Saurav Sahay, Shang-Tse Chen, Hung-yi Lee · 2025 · 3 citationsRead the paper

Fine-tuning large language models (LLMs) for downstream tasks often leads to catastrophic forgetting, notably degrading the safety of originally aligned models.While some existing methods attempt to restore safety by incorporating additional safety data, the quality of such data typically falls short of that used in the original alignment process.Moreover, these highquality safety data are generally inaccessible, making it difficult to fully recover the model's original safety.We ask: How can we preserve safety while improving downstream task performance without additional safety data?We show that simply merging the weights of pre-and post-fine-tuned models effectively mitigates safety degradation while enhancing performance.Experiments across different downstream tasks and models validate the method's practicality and effectiveness.

What the full text shows

Working prototype

Merging weights of pre- and post-fine-tuned models reduces the Attack Success Rate (ASR) to levels near the original aligned model while maintaining or improving task performance. (Evaluated across LLaMA-3-8B-Instruct, Gemma-2-2B-It, and Qwen2.5-7B-Instruct on AdvBench and HEx-PHI datasets)
Standard Supervised Fine-Tuning (SFT) consistently leads to safety degradation compared to the original aligned model. (Across all tested models and downstream tasks)
Linear merging provides a controllable trade-off between task performance and safety (Pareto front). (Using interpolation coefficient lambda between 0 and 1)
Model merging outperforms Dropout and Weight Decay regularization in restoring model safety. (Across three LLMs and four downstream tasks)

Setup: Three LLMs (LLaMA-3-8B-Instruct, Gemma-2-2B-It, Qwen2.5-7B-Instruct) tested on four tasks (reasoning, medical assistance, code generation, tool usage) using AdvBench and HEx-PHI for safety and IFEval for instruction following.
How: The approach involves two stages: first, fine-tuning an aligned model on a target downstream task using LoRA, and second, merging the original aligned model weights with the fine-tuned model weights via linear interpolation (or advanced methods like SLERP and DARE).
Limitations: Evaluated only on benign data from four domains; generalizability to law, finance, or multilingual tasks is unknown. · Tested on models ranging from 1.5B to 9B; effectiveness on larger models is not investigated. · Relies on WildGuard classifier, which may struggle with subtle harmful instructions and provides only coarse-grained outputs. · Does not test resistance to specific jailbreak attacks, only standard harmful prompts.

Summarized by Gemma 4 from the open-access full text · 8 Oct 2026. Read it