HarmAlign Enhances Open-Weight Model Safety Against Fine-Tuning

Researchers have introduced HarmAlign, a novel technique designed to safeguard open-weight AI models from malicious fine-tuning without hindering their ability for benign adaptation. The challenge lies in preventing models from being retrained for harmful purposes, such as generating hate speech or aiding in illicit activities, while still allowing them to be customized for legitimate applications. HarmAlign addresses this by applying a function-preserving spectral deformation specifically along an estimated contrastive activation subspace. Unlike previous methods that globally inflate curvature, potentially blocking all adaptation, HarmAlign offers distribution-specific curvature control. The method comes with finite-sample bounds for its estimated subspace energy and the resulting local harmful-distribution curvature lower bound. Empirically, HarmAlign successfully blocks direct fine-tuning and several adaptive attacks in hazardous knowledge relearning and harmful assistance scenarios, demonstrating persistence across optimizers and even under out-of-distribution harmful fine-tuning, extending to accidental safety degradation.