Paper deep dive
Harmful SFT Leaves a Continuous Trace in LLM Checkpoint Updates
Ziqun Bao, Xinyu Zhang, Yuchen Shao, Chengcheng Wan
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 89%
Last extracted: 10/13/2026, 3:31:32 AM
Summary
This paper introduces TRACE, a weights-only auditing method that detects harmful supervised fine-tuning (SFT) in large language models by analyzing checkpoint updates. The authors find that harmful-compliance SFT induces a continuous, objective-dependent ordering in checkpoint-update space, quantified by a coordinate s_H. TRACE localizes unknown checkpoints relative to frozen harmful and non-harmful reference prototypes to generate a continuous harmful-objective score, requiring no model queries or training data access. The method demonstrates high stability across model scales, fine-tuning types (LoRA/full), and distribution shifts, correlating strongly with behavioral attack success rates.
Entities (13)
Relation Signals (7)
TRACE → uses → s_H
confidence 95% · TRACE builds on the harmful-objective coordinate s_H from Section 2.3... s_H scores the unknown update by its relative association with harmful-compliance and non-harmful references.
s_H → correlateswith → Harmful-Compliance
confidence 94% · s_H tracks controlled harmful-objective composition with Spearman correlations of 0.986-0.992
TRACE → audits → Harmful-Compliance
confidence 92% · TRACE... operationalizes this finding as TRACE and demonstrate its utility for weights-only checkpoint auditing... detecting harmful supervised fine-tuning
Harmful-Compliance → induces → Continuous Trace
confidence 90% · harmful-compliance SFT induces a continuous, objective-dependent ordering in checkpoint-update space.
TRACE → requires → Checkpoint Updates
confidence 90% · TRACE requires neither model queries nor access to the unknown SFT data, and can be evaluated directly from checkpoint updates.
TRACE → isstableacross → Model Scale
confidence 85% · the same ordering persisting at larger model scales
TRACE → isstableacross → LoRA
confidence 85% · Across distribution shifts... and LoRA/full-parameter fine-tuning, the trace remains stable
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Safety auditing of post-trained large language models typically relies on model behavior, requiring model execution and depending on the coverage of available evaluations. This work asks a different question: Do the target behaviors optimized during supervised fine-tuning (SFT) leave readable evidence directly in checkpoint updates? We find that harmful-compliance SFT induces a continuous, objective-dependent ordering in checkpoint-update space. Using a reference geometry defined by pure harmful-compliance, safety-targeted, and benign-utility SFT, we find that a checkpoint-level coordinate s_H tracks controlled harmful-objective composition with Spearman correlations of 0.986-0.992 across four 7-8B backbones, with the same ordering persisting at larger model scales. Matched compliance-versus-refusal controls show that this checkpoint trace reflects the SFT objective rather than harmful-input exposure, while additional controls rule out simple explanations based on harmful-example count or generic training intensity. Building on this structure, we introduce TRACE, a weights-only auditing method that localizes an unknown checkpoint update relative to frozen harmful and non-harmful reference prototypes and converts this geometry into a continuous harmful-objective score. TRACE requires neither model queries nor access to the unknown SFT data, and can be evaluated directly from checkpoint updates. Across distribution shifts, unseen data, different SFT configurations, partial checkpoint access, and LoRA/full-parameter fine-tuning, the trace remains stable and is positively associated with independently measured attack success rates. TRACE remains informative even at low harmful-objective proportions, providing a complementary auditing signal when behavioral evaluation is unavailable or incomplete. Code is available at this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2610.07518v1
- Canonical: https://arxiv.org/abs/2610.07518v1
Trouble viewing inline? Open PDF directly →
Full Text
107,108 characters extracted from source content.
Expand or collapse full text
Harmful SFT Leaves a Continuous Trace in LLM Checkpoint Updates Ziqun Bao Affiliation: SEI, East China Normal University Xinyu Zhang Affiliation: SEI, East China Normal University Yuchen Shao Affiliation: SEI, East China Normal University Chengcheng Wan Affiliation: SEI, East China Normal University Abstract Safety auditing of post-trained large language models typically relies on model behavior, requiring model execution and depending on the coverage of available evaluations. This work asks a different question: Do the target behaviors optimized during supervised fine-tuning (SFT) leave readable evidence directly in checkpoint updates? We find that harmful-compliance SFT induces a continuous, objective-dependent ordering in checkpoint-update space. Using a reference geometry defined by pure harmful-compliance, safety-targeted, and benign-utility SFT, we find that a checkpoint-level coordinate sHs_H tracks controlled harmful-objective composition with Spearman correlations of 0.9860.986–0.9920.992 across four 7–8B backbones, with the same ordering persisting at larger model scales. Matched compliance-versus-refusal controls show that this checkpoint trace reflects the SFT objective rather than harmful-input exposure, while additional controls rule out simple explanations based on harmful-example count or generic training intensity. Building on this structure, we introduce TRACE, a weights-only auditing method that localizes an unknown checkpoint update relative to frozen harmful and non-harmful reference prototypes and converts this geometry into a continuous harmful-objective score. TRACE requires neither model queries nor access to the unknown SFT data, and can be evaluated directly from checkpoint updates. Across distribution shifts, unseen data, different SFT configurations, partial checkpoint access, and LoRA/full-parameter fine-tuning, the trace remains stable and is positively associated with independently measured attack success rates. TRACE remains informative even at low harmful-objective proportions, providing a complementary auditing signal when behavioral evaluation is unavailable or incomplete. Code is available at https://anonymous.4open.science/r/Code4TRACE-54D3. 1 Introduction Supervised fine-tuning (SFT) is widely used to adapt large language models (LLMs), but it can also substantially alter safety properties established during alignment (Qi et al., 2024; Lyu et al., 2024; Peng et al., 2024b; Bowen et al., 2025). This is particularly concerning for open-weight models, whose checkpoints can be further adapted and redistributed while their post-training data and objectives remain unknown. Existing safety auditing largely relies on model behavior—through benchmarks, adversarial prompting, or red teaming (Mazeika et al., 2024; Chao et al., 2024)—and therefore requires model execution and depends on the coverage of available queries. This raises a different question: can the objective of harmful SFT leave measurable evidence directly in checkpoint updates, without querying the model or accessing its training data? Our main empirical finding is that harmful-compliance SFT induces a continuous, objective-dependent structure in checkpoint-update space: as the proportion of harmful-compliance training increases, the resulting checkpoints become systematically ordered relative to pure-objective references. As illustrated in Figure 1, checkpoints trained on pure harmful-compliance (C), safety-targeted (S), and benign-utility (B) objectives define distinct reference regions, while mixed-objective checkpoints occupy ordered intermediate positions and shift progressively toward the harmful-compliance reference as the harmful objective becomes more prevalent. Crucially, this structure does not imply that mixed-objective SFT follows an exact linear trajectory in raw parameter space. Rather, even under nonlinear and stochastic optimization, harmful-objective composition remains consistently reflected in the relative geometry of the resulting checkpoint updates. To characterize this phenomenon, we use a simple descriptive lens: each post-SFT checkpoint is represented by its SFT-induced parameter change relative to a trusted base model. Pure-objective checkpoints define a reference geometry, in which an unknown checkpoint is summarized by a harmful-objective coordinate sHs_H, used here as a descriptive readout rather than a learned detector. Across LLMs spanning 7B–32B parameters, sHs_H is strongly ordered by the controlled harmful-objective proportion, with Spearman correlations of 0.9600.960–0.9940.994. Because changing this proportion also changes harmful-prompt exposure, this association alone is ambiguous. Matched compliance-versus-refusal controls hold the prompts and training conditions fixed while changing only the target behavior, showing that the observed structure reflects the SFT objective rather than harmful-input exposure alone. Additional controls rule out absolute harmful-example count and generic SFT intensity as primary explanations. We use the term trace to refer to this continuous ordering of checkpoint updates with SFT objective composition. Figure 1: Objective-induced checkpoint geometry. Pure harmful-compliance (C), safety-targeted (S), and benign-utility (B) SFT define distinct reference regions in checkpoint-update space, while mixed-objective checkpoints occupy ordered intermediate positions and shift toward the harmful-compliance reference as the harmful-objective ratio increases. Here, μC _C, μS _S, and μB _B denote the reference locations associated with the three pure objectives, and μN _N denotes a combined non-harmful reference. The trace is also stable across a broad range of conditions. Its ordering persists when the frozen reference geometry is applied to unseen SFT data, under changes in learning rate, training duration, LoRA rank and scaling, and when only a subset of model layers is available. It also persists across model scales and from LoRA to full-parameter fine-tuning. Moreover, sHs_H is positively associated with independently measured attack success rates, providing external evidence that the checkpoint-level structure is behaviorally relevant. Together, these results show that the trace persists across substantial changes in data, optimization, model scale, checkpoint access, and fine-tuning parameterization. This finding has a direct auditing implication. If SFT objective composition is reflected in an ordered structure in checkpoint-update space, an unknown checkpoint can be assessed by locating its update relative to a small set of known objective references. We operationalize this idea as TRACE, a weights-only auditing procedure that operates directly on checkpoint updates, requires neither model queries nor access to the checkpoint’s SFT data, and remains effective with small reference banks and at low harmful-objective ratios. Our contributions are threefold: (1) we discover a continuous, objective-dependent ordering in checkpoint-update space; (2) we determine what this structure reflects and establish its robustness across diverse SFT conditions; and (3) we operationalize this finding as TRACE and demonstrate its utility for weights-only checkpoint auditing. 2 A Simple Lens on SFT Checkpoint Updates The central question is whether the target behavior optimized during SFT leaves a readable trace in checkpoint updates. An SFT objective denotes the behavior that the supervised targets train the model to produce, such as harmful compliance, refusal, or benign utility. We represent each post-SFT model by its parameter update relative to a trusted base model and summarize it by a harmful-objective coordinate sHs_H with respect to pure-objective references. This provides a lens for testing whether SFT objective composition induces an ordered structure in checkpoint-update space. 2.1 Effective Checkpoint Updates Let M0M_0 be a trusted base model with parameters W0W_0 and MθM_θ a post-SFT checkpoint with parameters WθW_θ. The SFT-induced modification is represented by ΔWθ=Wθ−W0 W_θ=W_θ-W_0, which captures the fine-tuning-induced change relative to the base model. Let ℳM denote the audited modules. For full-parameter SFT, ΔWθ,m=Wθ,m−W0,m W_θ,m=W_θ,m-W_0,m; for LoRA, ΔWθ,m=(αm/rm)BmAm W_θ,m=( _m/r_m)B_mA_m. Both therefore admit the same effective-update representation, independent of the parameterization used during optimization. Similarity between checkpoints i and j is measured by K(i,j)=∑m∈ℳ⟨ΔWi,m,ΔWj,m⟩F,K(i,j)= _m W_i,m, W_j,m _F, (1) which is equivalently the inner product ⟨ϕ(ΔWi),ϕ(ΔWj)⟩ φ( W_i),φ( W_j) in the space obtained by concatenating the audited effective updates. Positive semidefiniteness, LoRA reparameterization invariance, and factorized evaluation without materializing dense LoRA updates are established in Appendix B. 2.2 Pure Objectives Define a Reference Geometry Three pure SFT objective families provide semantic references in update space: harmful-compliance (C), safety-targeted (S), and benign-utility (B). For each objective o∈C,S,Bo∈\C,S,B\, let ℛoR_o be a bank of checkpoints trained from the same base model using only objective o. For a reference checkpoint i, WiW_i denotes its model parameters and ΔWi W_i its SFT-induced update relative to the base model. The prototype for objective o is μo=1|ℛo|∑i∈ℛoϕ(ΔWi). _o= 1|R_o| _i _oφ( W_i). (2) Thus, μC _C, μS _S, and μB _B summarize the characteristic update locations induced by the three objectives. Since the auditing goal is to measure evidence of harmful-compliance SFT rather than distinguish different forms of non-harmful adaptation, we combine the safety-targeted and benign-utility prototypes into a balanced non-harmful reference, μN=12(μS+μB) _N= 12( _S+ _B), where the equal weighting gives the two non-harmful objectives the same influence regardless of reference-bank size. 2.3 A Harmful-Objective Coordinate Given the harmful-compliance prototype μC _C and the non-harmful prototype μN _N, we describe an SFT update by its position relative to these two references. Specifically, ϕ(ΔWθ)φ( W_θ) denotes the vector representation of the audited effective update, and we approximate it as ϕ(ΔWθ)≈γCμC+γNμN,γC,γN≥0,φ( W_θ)≈ _C _C+ _N _N, _C, _N≥ 0, (3) where γC _C and γN _N are nonnegative coefficients representing the contributions of the harmful-compliance and non-harmful prototypes, respectively. We estimate these coefficients by nonnegative least squares: (γ^C,γ^N)=argminγC,γN≥0‖ϕ(ΔWθ)−γCμC−γNμN‖2,( γ_C, γ_N)= _ _C, _N≥ 0 \|φ( W_θ)- _C _C- _N _N \|^2, (4) where γ^C γ_C and γ^N γ_N denote the fitted coefficients. We then define the harmful-objective coordinate sHs_H as their normalized ratio: sH(ΔWθ)=γ^Cγ^C+γ^N+ϵ,s_H( W_θ)= γ_C γ_C+ γ_N+ε, (5) where ϵ>0ε>0 is a small constant for numerical stability. A larger sHs_H indicates that the checkpoint update is more strongly associated with the harmful-compliance prototype relative to the non-harmful reference. All quantities in Equations 4–5 can be computed directly from the kernel in Equation 1; the derivation is given in Appendix B.5. Importantly, sHs_H is a geometric coordinate rather than a direct estimator of the fraction of harmful training examples. The following sections use this coordinate to characterize the observed checkpoint structure, examine how broadly it persists, and study its implications for checkpoint auditing. 3 Harmful SFT Leaves a Continuous Trace in Checkpoint Updates Section 2 introduces a reference geometry and the checkpoint-level coordinate sHs_H for describing SFT-induced updates. This lens is used here to characterize how controlled SFT objective composition is reflected in checkpoint-update space, first establishing the continuous ordering induced by harmful-compliance strength and then examining whether it reflects the training objective rather than harmful-input exposure or other training-related factors. Experimental setup. Three SFT objectives are used: harmful-compliance (C), safety-targeted (S), and benign-utility (B). C examples come from PKU-SafeRLHF (Ji and others, 2025) and BeaverTails (Ji et al., 2023); S uses harmful prompts from the same sources with deterministic refusal targets (Appendix A.2); and B uses UltraChat (Ding et al., 2023), GSM8K (Cobbe and others, 2021), and MBPP (Austin and others, 2021). Reference banks are built separately for each backbone with 64 examples per trajectory. Experiments cover Llama-3.1-8B-Instruct (Grattafiori and others, 2024), Mistral-7B-Instruct-v0.3 (Jiang and others, 2023), Qwen3-8B (Yang and others, 2025), and OLMo-3-7B-Instruct (Olmo et al., 2026). Unless stated otherwise, LoRA uses r=8r=8, α=16α=16, zero dropout, and all q_proj/v_proj modules; AdamW uses learning rate 2×10−42× 10^-4, batch size 16, bfloat16, maximum sequence length 512, and 100 optimization steps. Pure-objective references are trained for 25 epochs using one NVIDIA A100 80GB GPU per trajectory. Spearman’s ρ, R2R^2, and AUROC measure ordering, approximate linearity, and checkpoint-level discrimination; formal definitions are given in Appendix A.1. 3.1 Mixed Objectives Form a Continuous Trace Harmful-compliance strength is varied directly through mixed C/BC/B trajectories constructed over 19 harmful-objective ratios spanning 0%0\%–100%100\%. Each trajectory contains 100 training examples and is trained for 100 optimization steps, with p%p\% harmful-compliance examples and the remainder benign. Ten independent trajectories are trained for every ratio and backbone, yielding 190 checkpoints per backbone and 760 in total. All checkpoints are evaluated against the corresponding frozen reference geometry. Figure 2: Matched C/SC/S objective traces. (a) Full mixture range. (b) 00–10%10\% regime. Figure 3: Harmful SFT leaves a continuous trace in checkpoint updates. Lines show mean sHs_H; shaded bands denote ±1± 1 standard deviation across trajectories. Figure 3 reveals a strong and consistent progression in checkpoint-update geometry. Spearman correlations between harmful-objective ratio and sHs_H are 0.9880.988, 0.9860.986, 0.9870.987, and 0.9920.992 for Llama, Mistral, Qwen, and OLMo, respectively, with corresponding R2R^2 values of 0.9640.964, 0.9910.991, 0.9840.984, and 0.9480.948. Although the absolute coordinate range differs across backbones, the same ordering emerges independently in all four model families. The enlarged 00–10%10\% view further shows that the trace remains visible when harmful compliance constitutes only a small fraction of SFT, although variability increases at the lowest ratios. Importantly, this ordering does not require mixed-objective updates to follow exact linear interpolation in raw parameter space; Appendix B.6 examines this distinction directly. 3.2 Is the Trace Objective-Specific? A continuous relationship alone does not establish what the trace represents: increasing the harmful ratio simultaneously changes both the SFT objective and exposure to harmful-domain prompts. To separate these factors, matched harmful-compliance (C) and safety-targeted (S) trajectories are constructed at harmful-prompt proportions of 1%1\%, 2%2\%, 5%5\%, 10%10\%, 25%25\%, 50%50\%, 75%75\%, and 100%100\%. Each pair uses identical harmful prompts, benign examples, example ordering, random seed, and training configuration; only the target on harmful prompts changes from harmful compliance to refusal. Full construction details are provided in Appendix C.1. Figure 2 shows a clear divergence despite matched inputs. Increasing the harmful-prompt proportion raises sHs_H for harmful-compliance checkpoints, whereas the corresponding refusal-targeted checkpoints remain substantially lower and generally decrease. Because the two trajectories in each pair see the same inputs, this separation cannot be explained by harmful-prompt exposure alone. Instead, the checkpoint trace reflects what behavior SFT optimizes on those prompts—compliance versus refusal—supporting an objective-specific interpretation. 3.3 Relative Composition or Absolute Exposure? Objective specificity still leaves a second ambiguity: sHs_H could reflect the relative strength of harmful compliance within the SFT objective, or simply the cumulative number of harmful examples encountered during training. This is tested by varying dataset size N∈50,100,200N∈\50,100,200\ and harmful-compliance ratio ρ∈0,10,20,40,50,100%ρ∈\0,10,20,40,50,100\\%, with five seeds and a fixed 100-step optimization budget. Holding ρ fixed changes the absolute harmful-example count while preserving composition; holding the harmful count nCn_C fixed changes composition while preserving absolute exposure. At the same ratio, changing dataset size by 4×4× produces only small changes in sHs_H, with mean deviations of 0.00880.0088–0.01590.0159. Conversely, at a fixed harmful-example count, larger harmful-compliance ratios produce larger sHs_H with 100%100\% pairwise ordering accuracy. The complete controlled trajectories are provided in Appendix C.2. Table 1: Seed-group CV R2R^2 for predicting sHs_H. Model ρ nCn_C ρ+nCρ+n_C Llama 0.923 0.757 0.962 Mistral 0.969 0.606 0.970 Qwen 0.936 0.627 0.951 OLMo 0.922 0.757 0.980 The same conclusion appears quantitatively when sHs_H is predicted from relative ratio ρ, absolute harmful-example count nCn_C, or both. Table 1 reports cross-validated R2R^2 over held-out seed groups. Ratio alone explains 0.9220.922–0.9690.969 of the variation, substantially more than the 0.6060.606–0.7570.757 explained by count alone; adding count to ratio provides only a smaller additional gain. The checkpoint trace therefore tracks the relative composition of the SFT objective more strongly than cumulative harmful exposure. Additional controls. Additional analyses rule out two simple explanations. Although update magnitude grows with SFT, sHs_H remains strongly objective-dependent (Appendix C.3); likewise, controlling for prompt and target length preserves the trace, while length alone is much less discriminative (Appendix C.4). These results further support interpreting the trace as an objective-specific SFT signal rather than a generic training artifact. 4 From Checkpoint Trace to Auditing Building on the descriptive checkpoint geometry in Section 2 and the objective-dependent trace established in Section 3, this section operationalizes the finding as TRACE, a weights-only auditing method using a continuous harmful-objective score. We examine its design choices, reference requirements, and auditing performance across different settings. 4.1 TRACE: Operationalizing the Checkpoint Trace TRACE builds on the harmful-objective coordinate sHs_H from Section 2.3. Given a trusted base checkpoint, an unknown post-SFT checkpoint, and frozen pure-objective reference banks, sHs_H scores the unknown update by its relative association with harmful-compliance and non-harmful references. Figure 4 summarizes the procedure. The audit uses only checkpoint weights, requiring neither model queries, generated responses, nor access to the unknown checkpoint’s SFT data. Figure 4: Overview of TRACE. A frozen pure-objective geometry localizes an unknown checkpoint update relative to a trusted base and produces sHs_H. Figure 5 examines three design choices. For reference geometry, C/BC/B and C/SC/S each use one non-harmful prototype, whereas 3-way jointly fits μC _C, μS _S, and μB _B. The balanced C/NC/N geometry performs best overall, reaching 0.9880.988 trace correlation and 0.9910.991 matched C/SC/S AUROC, versus 0.901/0.9540.901/0.954 for 3-way. For scoring, normalizing the raw harmful coefficient γ^C γ_C into sHs_H improves the metrics from 0.917/0.8920.917/0.892 to 0.978/0.9900.978/0.990. Combining q_proj and v_proj yields 0.9890.989 trace correlation and 0.9870.987 AUROC, outperforming either alone. The default TRACE configuration therefore uses balanced C/NC/N references, normalized sHs_H, and combined q/v updates. Figure 5: TRACE design choices. Balanced C/NC/N references, normalized scoring, and combined q/v updates provide the strongest joint preservation of objective ordering and compliance-versus-refusal separation. How few references are needed? Reference-bank sensitivity is evaluated with K∈1,2,4,8,12,16K∈\1,2,4,8,12,16\ trajectories per objective, with K=16K=16 as the full bank. For each reduced K, five independently sampled banks are tested on the same 90 held-out checkpoints per backbone. Table 2 reports ρ/σsρ/ _s, where Spearman ρ measures preservation of harmful-objective ordering and σs _s score variation across sampled banks. Even K=1K=1 retains substantial ordering (ρ=0.919ρ=0.919–0.9590.959), while four to eight references approach full-bank performance. Defining K∗K as the smallest bank with correlation to full-bank scores at least 0.950.95, mean absolute error at most 0.050.05, and AUROC at least 0.970.97 for separating 0%0\% from 10%10\% harmful-compliance SFT gives K∗=4K =4 for Llama/Mistral and K∗=8K =8 for Qwen/OLMo. Metric definitions are in Appendix A.1. Table 2: Reference-bank sensitivity. Each entry reports ρ/σsρ/ _s; K=16K=16 is the full bank. Model K=1K=1 K=2K=2 K=4K=4 K=8K=8 K=12K=12 K=16K=16 K∗K Llama 0.955/0.0917 0.959/0.0919 0.973/0.0570 0.973/0.0294 0.977/0.0155 0.976/0.0073 4 Mistral 0.919/0.1152 0.924/0.0577 0.924/0.0464 0.959/0.0091 0.965/0.0047 0.968/0.0010 4 Qwen 0.949/0.0725 0.949/0.0774 0.961/0.0444 0.966/0.0334 0.971/0.0059 0.971/0.0040 8 OLMo 0.959/0.0539 0.968/0.0527 0.976/0.0355 0.979/0.0242 0.980/0.0112 0.980/0.0610 8 4.2 Auditing Harmful Fine-Tuning Across Settings The TRACE score and all baselines are evaluated under four settings. ID compares harmful-compliance and benign checkpoints trained under the same data distribution and SFT configuration as the reference banks; Matched C/SC/S fixes prompts, benign examples, ordering, seed, and training configuration while changing only the target from compliance to refusal; OOD changes the harmful-data family between reference and query SFT (PKU-SafeRLHF↔ ); and Unseen uses independent harmful, refusal, code, and mathematics data with no prompt overlap. Appendix E.2 details unseen-set construction and overlap checks. UpdateNorm uses the Frobenius norm ‖ΔW‖F\| W\|_F; Spectral uses LoRA spectral statistics (Paul, 2026); WeightWatch-SVD applies the weight-difference SVD representation of Watch the Weights (Zhong and Raghunathan, 2026) to the qproj/vprojq_proj/v_proj updates modified by our LoRA checkpoints; CANARY uses probe-based representation differences (Parekh, 2026); and PEFTGuard (Sun et al., 2025) uses a supervised PEFT-weight score. Full implementation and adaptation details for all baselines are provided in Appendix H. AUROC is computed within each backbone and macro-averaged; its definition is in Appendix A.1. Table 3: Audit separation by setting. Macro AUROC across four backbones. Method Access ID Matched C/SC/S OOD Unseen UpdateNorm weights only 0.7090 0.7439 0.6425 0.7036 Spectral weights only 0.6395 0.6814 0.6317 0.6636 WeightWatch-SVD weights only 0.5864 0.5659 0.6134 0.6610 PEFTGuard weights + labels 0.4345 0.1519 0.3334 0.3529 CANARY forward + probes 0.6755 0.6605 0.7343 0.7274 TRACE weights only 0.9110 0.9881 1.0000 0.9998 Table 3 shows the strongest separation for TRACE in all four settings. WeightWatch-SVD obtains macro AUROCs of 0.58640.5864, 0.56590.5659, 0.61340.6134, and 0.66100.6610 on ID, matched C/SC/S, OOD, and unseen data, respectively, remaining substantially below TRACE, particularly under the matched C/SC/S control (0.56590.5659 vs. 0.98810.9881). At 5%5\% harmful-objective proportion, macro AUROC reaches 0.9950.995 against benign and 0.9980.998 against matched refusal checkpoints, with both reaching 1.0001.000 at 10%10\%. The complete 1%1\%–100%100\% sweep is reported in Appendix D.2, with the protocol in Appendix D.1. Extension to trigger-conditioned backdoors. The original C/S/BC/S/B geometry does not directly represent qualitatively different modification families. A separate experiment uses Toxic Backdoors Alpaca (Ewart, 2024), which inserts the trigger SolidGoldMagikarp into Alpaca instructions paired with toxic targets. The dataset contains 24,099 training, 3,012 validation, and 3,013 test examples. With 1,000-example SFT sets at 50%50\% poison rate and 200 steps, triggered ASR reaches 0.9970.997–1.0001.000, while clean-prompt toxicity remains 0.0030.003–0.0050.005. A backdoor prototype μT _T is constructed from 24 reference trajectories per backbone, using four reference seeds at each poison rate of 1%1\%, 2%2\%, 5%5\%, 10%10\%, 25%25\%, and 50%50\%, with disjoint reference, validation, and test seeds. Table 4: Backdoor auditing across methods. AUROC on held-out 1%1\%–50%50\% poison-rate checkpoints. Method Llama Mistral Qwen OLMo Macro PEFTGuard-BD 0.464 0.510 0.854 0.432 0.565 WeightWatch-SVD 0.333 0.625 0.479 0.385 0.456 WeightWatch-SVD +BackdoorRef 0.531 0.583 0.281 0.375 0.443 TRACE original 0.260 0.385 0.146 0.135 0.232 TRACE +BackdoorRef 0.719 0.615 0.990 0.563 0.721 Adding the backdoor reference raises TRACE macro AUROC from 0.2320.232 to 0.7210.721, compared with 0.5650.565 for PEFTGuard-BD and 0.4560.456 for WeightWatch-SVD. Applying the same backdoor-reference expansion to WeightWatch-SVD does not improve its aggregate performance (0.4430.443), with mixed effects across backbones. These results indicate that representative attack-family updates can substantially improve TRACE without implying that the original C/S/BC/S/B geometry audits arbitrary attacks. Appendix F.2 reports full poison-rate results, attack validation, and reference-count sensitivity, while Appendix F.3 examines backward compatibility: adding μT _T preserves matched C/SC/S, dataset-family OOD, and the underlying harmful-objective ordering, with only modest degradation on ID and unseen auditing. 5 How General Is the Checkpoint Trace? Section 2 introduces a checkpoint-level lens for SFT-induced updates, Section 3 establishes the continuous, objective-dependent trace it reveals, and Section 4 operationalizes this trace as TRACE for checkpoint auditing. This section examines how broadly the structure persists across data distributions, SFT configurations, fine-tuning parameterizations, model scales, and independently measured harmful behavior. 5.1 Generalization Across Data and SFT Configurations Table 5: Generalization across SFT data distributions. Setting Trace ρ C/SC/S AUROC OOD 0.791–0.970 1.0000 Unseen 0.983–0.990 0.9997 Distribution shifts. The OOD and Unseen settings from Section 4.2 are reused to test whether the trace persists beyond the data used to construct the reference geometry. OOD transfers between PKU-SafeRLHF and BeaverTails, while Unseen uses the independently constructed, prompt-disjoint SFT pool; the reference geometry remains frozen in both. Full protocols are given in Appendices E.1 and E.2. Table 5 shows trace correlations of 0.7910.791–0.9700.970 under dataset-family transfer, with seven of eight backbone–direction combinations above 0.9380.938, while matched C/SC/S AUROC remains 1.00001.0000. On unseen data, correlations remain 0.9830.983–0.9900.990 with macro AUROC 0.99970.9997, showing that the ordering extends beyond the datasets used to construct the reference geometry. Table 6: SFT configuration robustness. Model Spearman ρ Llama 0.997–1.000 Mistral 0.994–1.000 Qwen 0.993–1.000 OLMo 0.999–1.000 SFT configuration changes. Robustness to the training recipe is tested by varying learning rate, training duration, LoRA rank, and LoRA scaling one factor at a time with the reference geometry fixed. Each configuration uses the same harmful-objective proportion grid, and its median sHs_H curve is compared with the canonical setting. Table 6 shows correlations of 0.9930.993–1.0001.000 across all configurations, each retaining more than 70%70\% of the canonical dynamic range. Training choices can shift the absolute scale of sHs_H, but leave its ordering with harmful-objective strength largely unchanged. The complete sweep is reported in Appendix E.3. 5.2 Generalization Across Fine-Tuning Parameterizations Parameterization robustness is tested beyond LoRA using separate LoRA (L) and full-parameter SFT (F) reference geometries built from matched training data and the same harmful-objective proportion grid. Four settings distinguish reference and query parameterizations: L→L\!→\!L uses LoRA references and queries, F→F\!→\!F uses Full-FT references and queries, L→FL\!→\!F evaluates Full-FT checkpoints using LoRA references, and F→LF\!→\!L performs the reverse transfer. Table 7: Transfer between LoRA and full-parameter SFT. Entries report Spearman ρ / R2R^2. Model L→L\!→\!L F→F\!→\!F L→FL\!→\!F F→LF\!→\!L Llama 0.991/0.976 0.940/0.949 0.967/0.915 0.975/0.921 Mistral 0.948/0.869 0.952/0.979 0.916/0.883 0.936/0.753 Qwen 0.923/0.956 0.979/0.988 0.916/0.827 0.963/0.975 OLMo 0.991/0.960 0.991/0.980 0.991/0.930 0.991/0.986 Table 7 shows strong objective ordering under full-parameter SFT and both cross-parameterization directions, indicating that the trace is not LoRA-specific. Transfer does not require matching raw update directions: LoRA and Full-FT harmful-versus-non-harmful directions have cosine similarities of 0.0060.006, 0.0040.004, 0.0030.003, and 0.9510.951 for Llama, Mistral, Qwen, and OLMo, respectively. The shared structure is therefore better characterized as objective-related ordering across parameterizations than a universal parameter-space direction. Appendix E.4 studies partial checkpoint access, including the fraction and location of audited layers, while Appendix E.5 evaluates persistence with model scale on Qwen3-14B and Qwen3-32B. 5.3 Behavioral Relevance Table 8: sHs_H vs. ASR. Model Spearman ρ R2R^2 Llama 0.931 0.803 Mistral 0.716 0.485 Qwen 0.887 0.724 OLMo 0.854 0.546 Behavioral relevance is evaluated on 300 checkpoints spanning benign (B), refusal-targeted (S), and harmful-compliance (C) SFT across four backbones and five training stages. AdvBench (Zou et al., 2023) is evaluated with four attacks— AdvPrompter (Paulus et al., 2024), AutoDAN (Liu et al., 2024), GCG (Zou et al., 2023), and PAIR (Chao et al., 2025)—and responses are judged by a frozen HarmBench classifier (Mazeika et al., 2024). ASR is the fraction classified as successful harmful responses. These measurements are used only for evaluation and do not enter the construction of sHs_H. Table 8 shows positive checkpoint-level associations across all four backbones, with Spearman correlations of 0.7160.716–0.9310.931 and R2R^2 values of 0.4850.485–0.8030.803, indicating that a linear relationship captures substantial ASR variation with backbone-dependent strength. The association is also positive across all 16 backbone–attack combinations and most longitudinal trajectories. Larger sHs_H therefore tends to correspond to higher independently measured attack success, providing behavioral external validity for the trace. Confidence intervals, attack-wise and longitudinal analyses, leave-one-attack-out results, and partial correlations are reported in Appendix F.1. Practical-scale validation. As a stress test, we evaluate the frozen reference geometry under 10,000-example heterogeneous instruction tuning, a 100× increase over the controlled trajectories. Without rebuilding or recalibrating references, the trace remains strongly ordered on Llama and Qwen (ρ=0.979ρ=0.979 and 0.9920.992), separates matched compliance from refusal objectives, and remains positively associated with independently measured ASR (ρ≈0.89ρ≈ 0.89 and 0.920.92). Full data construction, training dynamics, behavioral results, and controls are reported in Appendix G. 6 Related Work Safety risks from post-training. Additional fine-tuning can substantially weaken LLM safety alignment or introduce harmful objectives, even through small, benign-looking, or covert adaptations (Qi et al., 2024; Lyu et al., 2024; Peng et al., 2024b; Halawi et al., 2024; Xie et al., 2026). Mechanistic studies show that such changes are reflected in model parameters and representations (Jain et al., 2024; Wei and others, 2024; Peng et al., 2024a), while complementary work develops methods to better preserve alignment (Huang et al., 2024b; Huang et al., 2024a; Li et al., 2025). These studies establish the fragility of post-training safety; this work instead examines whether the SFT objective itself leaves a readable structure in checkpoint updates. Behavioral auditing and objective inference. Safety benchmarks, adversarial prompting, and red-teaming frameworks assess post-training behavior through model interaction (Mazeika et al., 2024; Chao et al., 2024; Souly et al., 2024; Han et al., 2024; Mou et al., 2024). Related approaches infer hidden objectives or behavioral shifts from model outputs using inverse reinforcement learning, Bayesian auditing, or behavioral analysis (Joselowitz et al., 2024; Bou et al., 2026; Marks et al., 2025). These methods provide direct behavioral evidence but require model execution and depend on the available queries. In contrast, the setting here uses only checkpoint modifications, without querying the audited model or accessing its SFT data. Traces of fine-tuning in parameters and representations. Parameter differences and task vectors are known to encode structured information about acquired capabilities (Wortsman et al., 2022; Ilharco et al., 2022; Yadav et al., 2023). Recent work further uses weight differences, LoRA parameters, or activation differences to recover fine-tuning-induced behaviors and task information (Zhong and Raghunathan, 2026; Goel et al., 2026; Han et al., 2026; Minder et al., 2026; Paul, 2026). Our focus differs in what is traced: rather than recovering a task attribute or behavior-specific direction, we study the continuous ordering induced by harmful-objective composition in checkpoint-update space and its use for weights-only auditing. 7 Conclusion This work identifies a continuous, objective-dependent ordering in checkpoint updates induced by harmful-compliance SFT. Across 7B–32B models, the trace tracks objective composition, remains distinct from harmful-input exposure and generic training effects, and persists across data, SFT configurations, partial checkpoint access, and LoRA/full-parameter fine-tuning. We operationalize this structure as TRACE, a weights-only auditing method based on frozen reference geometry, with larger sHs_H associated with higher attack success. The trace also remains informative under 10,000-example heterogeneous instruction tuning. These results show that post-training objectives leave measurable structure in model updates, enabling auditing without training data or model queries. Limitations include SFT-only evaluation, models up to 32B, and controlled objective settings; extending to reinforcement-learning and multi-stage post-training remains future work. References Austin et al. (2021) J. Austin et al. Program synthesis with large language models. arXiv preprint arXiv:2108.07732. Cited by: §3. Bou et al. (2026) M. Bou, N. Patel, A. Jagota, S. Krishna, and S. Parbhoo The alignment auditor: a bayesian framework for verifying and refining llm objectives. In International Conference on Learning Representations, Vol. 2026, p. 603–623. Cited by: §6. Bowen et al. (2025) D. Bowen, B. Murphy, W. Cai, D. Khachaturov, A. Gleave, and K. Pelrine Scaling trends for data poisoning in llms. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39, p. 27206–27214. Cited by: §1. Chao et al. (2024) P. Chao, E. Debenedetti, A. Robey, M. Andriushchenko, F. Croce, V. Sehwag, E. Dobriban, N. Flammarion, G. J. Pappas, F. Tramer, et al. Jailbreakbench: an open robustness benchmark for jailbreaking large language models. Advances in Neural Information Processing Systems 37, p. 55005–55029. Cited by: §1, §6. Chao et al. (2025) P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong Jailbreaking black box large language models in twenty queries. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), p. 23–42. Cited by: §5.3. Cobbe et al. (2021) K. Cobbe et al. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168. Cited by: §3. Ding et al. (2023) N. Ding, Y. Chen, B. Xu, Y. Qin, S. Hu, Z. Liu, M. Sun, and B. Zhou Enhancing chat language models by scaling high-quality instructional conversations. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, p. 3029–3051. Cited by: §3. Ewart (2024) A. Ewart Hugging face: baidicoot/toxic-backdoors-alpaca. Note: Hugging Face External Links: Link Cited by: §F.2, §4.2. Goel et al. (2026) A. Goel, Y. Kim, N. Shavit, and T. Wang Learning to interpret weight differences in language models. In International Conference on Learning Representations, Vol. 2026, p. 151176–151212. Cited by: §6. Grattafiori et al. (2024) A. Grattafiori et al. The llama 3 herd of models. External Links: 2407.21783, Link Cited by: §3. Halawi et al. (2024) D. Halawi, A. Wei, E. Wallace, T. T. Wang, N. Haghtalab, and J. Steinhardt Covert malicious finetuning: challenges in safeguarding llm adaptation. arXiv preprint arXiv:2406.20053. Cited by: §6. Han et al. (2024) S. Han, K. Rao, A. Ettinger, L. Jiang, B. Y. Lin, N. Lambert, Y. Choi, and N. Dziri Wildguard: open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms. Advances in neural information processing systems 37, p. 8093–8131. Cited by: §6. Han et al. (2026) X. Han, F. Neri, Z. Jiang, F. Wu, Y. Ye, L. Yin, and Z. Wang W2t: lora weights already know what they can do. arXiv preprint arXiv:2603.15990. Cited by: §6. Huang et al. (2024a) T. Huang, S. Hu, F. Ilhan, S. F. Tekin, and L. Liu Lisa: lazy safety alignment for large language models against harmful fine-tuning attack. Advances in Neural Information Processing Systems 37, p. 104521–104555. Cited by: §6. Huang et al. (2024b) T. Huang, S. Hu, and L. Liu Vaccine: perturbation-aware alignment for large language models against harmful fine-tuning attack. Advances in Neural Information Processing Systems 37, p. 74058–74088. Cited by: §6. Ilharco et al. (2022) G. Ilharco, M. T. Ribeiro, M. Wortsman, S. Gururangan, L. Schmidt, H. Hajishirzi, and A. Farhadi Editing models with task arithmetic. arXiv preprint arXiv:2212.04089. Cited by: §6. Jain et al. (2024) S. Jain, E. S. Lubana, K. Oksuz, T. Joy, P. H. Torr, A. Sanyal, and P. K. Dokania What makes and breaks safety fine-tuning? a mechanistic study. Advances in Neural Information Processing Systems 37, p. 93406–93478. Cited by: §6. Ji et al. (2023) J. Ji, M. Liu, J. Dai, X. Pan, C. Zhang, C. Bian, B. Chen, R. Sun, Y. Wang, and Y. Yang Beavertails: towards improved safety alignment of llm via a human-preference dataset. Advances in Neural Information Processing Systems 36, p. 24678–24704. Cited by: §3. Ji et al. (2025) J. Ji et al. Pku-saferlhf: towards multi-level safety alignment for llms with human preference. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 31983–32016. Cited by: §3. Jiang et al. (2023) A. Q. Jiang et al. Mistral 7b. External Links: 2310.06825, Link Cited by: §3. Joselowitz et al. (2024) J. Joselowitz, R. Majumdar, A. Jagota, M. Bou, N. Patel, S. Krishna, and S. Parbhoo Insights from the inverse: reconstructing llm training goals through inverse reinforcement learning. arXiv preprint arXiv:2410.12491. Cited by: §6. Lambert et al. (2025) N. Lambert, J. Morrison, V. Pyatkin, S. Huang, H. Ivison, F. Brahman, L. J. V. Miranda, A. Liu, N. Dziri, S. Lyu, Y. Gu, S. Malik, V. Graf, J. D. Hwang, J. Yang, R. L. Bras, O. Tafjord, C. Wilhelm, L. Soldaini, N. A. Smith, Y. Wang, P. Dasigi, and H. Hajishirzi Tulu 3: pushing frontiers in open language model post-training. External Links: 2411.15124, Link Cited by: Appendix G. Li et al. (2025) M. Li, W. M. Si, M. Backes, Y. Zhang, and Y. Wang Salora: safety-alignment preserved low-rank adaptation. In International Conference on Learning Representations, Vol. 2025, p. 90827–90843. Cited by: §6. Liu et al. (2024) X. Liu, N. Xu, M. Chen, and C. Xiao Autodan: generating stealthy jailbreak prompts on aligned large language models. In International Conference on Learning Representations, Vol. 2024, p. 56174–56194. Cited by: §5.3. Lyu et al. (2024) K. Lyu, H. Zhao, X. Gu, D. Yu, A. Goyal, and S. Arora Keeping llms aligned after fine-tuning: the crucial role of prompt templates. Advances in Neural Information Processing Systems 37, p. 118603–118631. Cited by: §1, §6. Marks et al. (2025) S. Marks, J. Treutlein, T. Bricken, J. Lindsey, J. Marcus, S. Mishra-Sharma, D. Ziegler, E. Ameisen, J. Batson, T. Belonax, et al. Auditing language models for hidden objectives. arXiv preprint arXiv:2503.10965. Cited by: §6. Mazeika et al. (2024) M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li, et al. Harmbench: a standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249. Cited by: §1, §5.3, §6. Minder et al. (2026) J. Minder, C. Dumas, S. Slocum, H. Casademunt, C. Holmes, R. West, and N. Nanda Narrow finetuning leaves clearly readable traces in activation differences. Vol. 2026, p. 35340–35406. Cited by: §6. Mou et al. (2024) Y. Mou, S. Zhang, and W. Ye Sg-bench: evaluating llm safety generalization across diverse tasks and prompt types. Advances in Neural Information Processing Systems 37, p. 123032–123054. Cited by: §6. Olmo et al. (2026) T. Olmo, :, A. Ettinger, A. Bertsch, B. Kuehl, D. Graham, D. Heineman, D. Groeneveld, F. Brahman, F. Timbers, H. Ivison, J. Morrison, J. Poznanski, K. Lo, L. Soldaini, M. Jordan, M. Chen, M. Noukhovitch, N. Lambert, P. Walsh, P. Dasigi, R. Berry, S. Malik, S. Shah, S. Geng, S. Arora, S. Gupta, T. Anderson, T. Xiao, T. Murray, T. Romero, V. Graf, A. Asai, A. Bhagia, A. Wettig, A. Liu, A. Rangapur, C. Anastasiades, C. Huang, D. Schwenk, H. Trivedi, I. Magnusson, J. Lochner, J. Liu, L. J. V. Miranda, M. Sap, M. Morgan, M. Schmitz, M. Guerquin, M. Wilson, R. Huff, R. L. Bras, R. Xin, R. Shao, S. Skjonsberg, S. Z. Shen, S. S. Li, T. Wilde, V. Pyatkin, W. Merrill, Y. Chang, Y. Gu, Z. Zeng, A. Sabharwal, L. Zettlemoyer, P. W. Koh, A. Farhadi, N. A. Smith, and H. Hajishirzi Olmo 3. External Links: 2512.13961, Link Cited by: §3. Parekh (2026) S. Parekh CANARY: zero-label detection of fine-tuning contamination in language models. arXiv preprint arXiv:2606.01695. Cited by: §4.2. Paul (2026) R. Paul Spectral geometry of lora adapters encodes training objective and predicts harmful compliance. arXiv preprint arXiv:2604.08844. Cited by: §4.2, §6. Paulus et al. (2024) A. Paulus, A. Zharmagambetov, C. Guo, B. Amos, and Y. Tian Advprompter: fast adaptive adversarial prompting for llms. arXiv preprint arXiv:2404.16873. Cited by: §5.3. Peng et al. (2024a) S. Y. Peng, P. Chen, M. Hull, and D. H. Chau Navigating the safety landscape: measuring risks in finetuning large language models. Advances in Neural Information Processing Systems 37, p. 95692–95715. Cited by: §6. Peng et al. (2024b) S. Y. Peng, P. Chen, M. Hull, and D. H. Chau Navigating the safety landscape: measuring risks in finetuning large language models. Advances in Neural Information Processing Systems 37, p. 95692–95715. Cited by: §1, §6. Qi et al. (2024) X. Qi, Y. Zeng, T. Xie, P. Chen, R. Jia, P. Mittal, and P. Henderson Fine-tuning aligned language models compromises safety, even when users do not intend to!. In International Conference on Learning Representations, Vol. 2024, p. 30988–31043. Cited by: §1, §6. Souly et al. (2024) A. Souly, Q. Lu, D. Bowen, T. Trinh, E. Hsieh, S. Pandey, P. Abbeel, J. Svegliato, S. Emmons, O. Watkins, et al. A strongreject for empty jailbreaks. Advances in Neural Information Processing Systems 37, p. 125416–125440. Cited by: §6. Sun et al. (2025) Z. Sun, T. Cong, Y. Liu, C. Lin, X. He, R. Chen, X. Han, and X. Huang Peftguard: detecting backdoor attacks against parameter-efficient fine-tuning. In 2025 IEEE Symposium on Security and Privacy (SP), p. 1713–1731. Cited by: §4.2. Wei et al. (2024) B. Wei et al. Assessing the brittleness of safety alignment via pruning and low-rank modifications. ICML’24. Cited by: §6. Wortsman et al. (2022) M. Wortsman, G. Ilharco, S. Y. Gadre, R. Roelofs, R. Gontijo-Lopes, A. S. Morcos, H. Namkoong, A. Farhadi, Y. Carmon, S. Kornblith, et al. Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time. In International conference on machine learning, p. 23965–23998. Cited by: §6. Xie et al. (2026) Z. Xie, X. Song, and J. Luo Attack via overfitting: 10-shot benign fine-tuning to jailbreak llms. Advances in Neural Information Processing Systems 38, p. 31136–31170. Cited by: §6. Yadav et al. (2023) P. Yadav, D. Tam, L. Choshen, C. A. Raffel, and M. Bansal Ties-merging: resolving interference when merging models. Advances in neural information processing systems 36, p. 7093–7115. Cited by: §6. Yang et al. (2025) A. Yang et al. Qwen3 technical report. External Links: 2505.09388, Link Cited by: §3. Zhong and Raghunathan (2026) Z. Zhong and A. Raghunathan Watch the weights: unsupervised monitoring and control of fine-tuned llms. In International Conference on Learning Representations, Vol. 2026, p. 75198–75234. Cited by: §4.2, §6. Zou et al. (2023) A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043. Cited by: §5.3. Appendix A Supplementary Evaluation and Target Construction This appendix collects supplementary definitions used throughout our experiments. We first provide the formal definitions of the evaluation metrics, and then describe the construction of the safety-targeted SFT objective. The common model, dataset, and SFT configurations are given in the main experimental setup and are not repeated here. A.1 Evaluation Metrics and Statistical Computation Unless otherwise specified, evaluation metrics are computed independently within each model backbone so that differences in the absolute scale of the harmful-objective coordinate sHs_H do not affect cross-model comparisons. Spearman rank correlation. Let (pi,si)i=1n\(p_i,s_i)\_i=1^n denote n evaluated SFT checkpoints from the same backbone, where pip_i is the controlled harmful-objective ratio and si=sH(ΔWi)s_i=s_H( W_i) (6) is the corresponding harmful-objective coordinate. Spearman’s rank correlation is ρ=Corr(rank(p),rank(s)).ρ=Corr (rank(p),rank(s) ). (7) Thus, ρ measures whether checkpoints trained with larger harmful-objective ratios tend to receive larger sHs_H, without assuming a linear relationship. Coefficient of determination. To characterize approximate linearity, we fit si=β0+β1pi+εi.s_i= _0+ _1p_i+ _i. (8) Let s^i s_i denote the fitted value and s¯=1n∑i=1nsi. s= 1n _i=1^ns_i. (9) We report R2=1−∑i=1n(si−s^i)2∑i=1n(si−s¯)2.R^2=1- _i=1^n(s_i- s_i)^2 _i=1^n(s_i- s)^2. (10) Spearman’s ρ therefore evaluates monotonic ordering, whereas R2R^2 characterizes the extent to which the relationship is approximately linear. Area under the ROC curve. For binary harmful-SFT detection, let yi∈0,1y_i∈\0,1\ denote the ground-truth class and let ziz_i denote the continuous detector score. For TRACE, zi=sH(ΔWi).z_i=s_H( W_i). (11) We report the area under the receiver operating characteristic curve (AUROC), which can equivalently be interpreted as AUROC=Pr(z+>z−),AUROC= (z^+>z^-), (12) where z+z^+ and z−z^- are scores from randomly selected positive and negative checkpoints, respectively, with ties receiving half credit. Because score scales are not assumed to be comparable across backbones, AUROC is computed independently for each backbone and then macro-averaged: AUROCmacro=1M∑m=1MAUROCm.AUROC_macro= 1M _m=1^MAUROC_m. (13) Experiment-specific statistics. Some controlled analyses additionally report Pearson correlation, partial correlation, mean absolute deviation, score variability, or pairwise ordering accuracy. These statistics are defined in the corresponding experimental sections when used. A.2 Safety-Target Construction For safety-targeted SFT (S), we sample harmful prompts from the same PKU-SafeRLHF and BeaverTails pools used for harmful-compliance SFT (C), but replace the original harmful response with a predefined refusal or safe-redirection target. We use eight static templates with no prompt-dependent placeholders. The template assigned to each sampled prompt is determined deterministically from its prompt UID, making the target construction reproducible across runs. The eight templates are: 1. I cannot assist with that request. If you or someone you know needs help, please contact a qualified professional or local emergency services. 2. I’m sorry, but I can’t help with that. This request involves activities that could cause harm. I’d be happy to help you with something else instead. 3. I must decline this request. What you’re asking about could be dangerous and potentially illegal. Please consider speaking with a professional if you need guidance. 4. I am unable to assist with this request as it involves potentially harmful activities. If you’re facing a difficult situation, please reach out to appropriate support services. 5. I won’t be able to help with that. This falls outside what I can safely assist with. Is there a different topic I can help you with today? 6. I cannot provide assistance with this request. It involves content that could lead to harm. If you have questions about safety, I recommend consulting official safety resources. 7. I’m not able to help with that particular request. Engaging with this topic could be unsafe. Please feel free to ask me about other subjects where I can be more helpful. 8. I must respectfully decline. This request involves potential harm to individuals or property. I encourage you to seek guidance from authorized professionals in this area. This construction changes the response objective while retaining the same harmful-prompt domain used for harmful-compliance SFT. It therefore provides a controlled non-harmful objective for separating target-dependent changes from changes induced merely by exposure to harmful inputs. The matched C/SC/S protocol used for the objective-specificity analysis is described in Appendix C.1. Appendix B Effective-Update Geometry: Properties and Computation This appendix provides the mathematical and computational details of the effective-update geometry used in our analysis. We first show that LoRA and full-parameter SFT admit a common representation in terms of their induced parameter updates, and establish basic properties of the resulting inner-product geometry. We then derive an efficient factorized computation for LoRA checkpoints and show that the harmful-objective coordinate can be evaluated entirely through kernel quantities. Finally, we empirically clarify the notion of coordinate-level compositionality used in the main text: mixed SFT updates need not follow exact linear interpolation in raw parameter space for their objective-induced ordering to remain predictable. B.1 Effective Updates for Full-Parameter and LoRA SFT Let ℳM denote the set of audited model modules, and let m∈ℳm index one such module. We represent an SFT checkpoint by the parameter modification it induces relative to a trusted base checkpoint. For full-parameter SFT, let W0,mW_0,m and Wθ,mW_θ,m denote the weights of module m in the base and post-SFT checkpoints, respectively. The effective update is ΔWmfull=Wθ,m−W0,m. W_m^full=W_θ,m-W_0,m. (14) For LoRA-based SFT, the corresponding induced update is ΔWmLoRA=αmrmBmAm, W_m^LoRA= _mr_mB_mA_m, (15) where Am∈ℝrm×din,mA_m ^r_m× d_in,m and Bm∈ℝdout,m×rmB_m ^d_out,m× r_m are the LoRA factors, rmr_m is the LoRA rank, and αm _m is the scaling coefficient. Both parameterizations can therefore be represented as ΔW=ΔWmm∈ℳ. W=\ W_m\_m . (16) This formulation separates the resulting model modification from the parameterization used to obtain it. All geometric quantities considered below are defined on the induced effective updates rather than on the optimization variables themselves. B.2 LoRA Reparameterization Invariance Although LoRA uses a factorized parameterization, the individual factors are not unique. Consider a LoRA update ΔWm=αmrmBmAm. W_m= _mr_mB_mA_m. (17) Let R∈ℝrm×rmR ^r_m× r_m be any invertible matrix and define an equivalent factorization Bm′=BmR,Am′=R−1Am.B_m =B_mR, A_m =R^-1A_m. (18) The induced update remains unchanged: αmrmBm′Am′ _mr_mB_m A_m =αmrm(BmR)(R−1Am) = _mr_m(B_mR)(R^-1A_m) (19) =αmrmBm(RR−1)Am = _mr_mB_m(R^-1)A_m (20) =αmrmBmAm = _mr_mB_mA_m (21) =ΔWm. = W_m. (22) Therefore, any quantity defined solely on the effective update is invariant to equivalent LoRA reparameterizations. In particular, the similarities, objective prototypes, and harmful-objective coordinate used throughout the paper do not depend on an arbitrary choice of LoRA factors. B.3 Effective-Update Kernel For two SFT checkpoints i and j, we define their effective-update similarity as K(i,j)=∑m∈ℳ⟨ΔWi,m,ΔWj,m⟩F,K(i,j)= _m W_i,m, W_j,m _F, (23) where ⟨X,Y⟩F=tr(X⊤Y) X,Y _F=tr(X Y) is the Frobenius inner product. To make the induced geometry explicit, define ϕ(ΔWi)=⨁m∈ℳvec(ΔWi,m),φ( W_i)= _m vec( W_i,m), (24) where ⊕ denotes concatenation. Then K(i,j)=⟨ϕ(ΔWi),ϕ(ΔWj)⟩.K(i,j)= φ( W_i),φ( W_j) . (25) For arbitrary coefficients a1,…,an∈ℝa_1,…,a_n , ∑i∑jaiajK(i,j) _i _ja_ia_jK(i,j) =∑i∑jaiaj⟨ϕ(ΔWi),ϕ(ΔWj)⟩ = _i _ja_ia_j φ( W_i),φ( W_j) (26) =‖∑iaiϕ(ΔWi)‖2≥0. = \| _ia_iφ( W_i) \|^2≥ 0. (27) Hence, K is positive semidefinite and defines a valid inner-product geometry over SFT-induced parameter updates. The explicit feature representation ϕ(ΔW)φ( W) is useful for interpretation, but does not need to be materialized in practice. B.4 Efficient Factorized Computation for LoRA For LoRA checkpoints, the effective-update kernel can be evaluated directly from the low-rank factors without explicitly constructing dense update matrices. Factorized Frobenius inner product. For two LoRA-based updates of module m, write ΔWi,m=si,mBi,mAi,m,ΔWj,m=sj,mBj,mAj,m, W_i,m=s_i,mB_i,mA_i,m, W_j,m=s_j,mB_j,mA_j,m, (28) where si,m=αi,mri,m,sj,m=αj,mrj,m.s_i,m= _i,mr_i,m, s_j,m= _j,mr_j,m. (29) The module-level contribution to the kernel is ⟨ΔWi,m,ΔWj,m⟩F W_i,m, W_j,m _F (30) =si,msj,mtr[(Bi,mAi,m)⊤(Bj,mAj,m)] =s_i,ms_j,mtr [(B_i,mA_i,m) (B_j,mA_j,m) ] (31) =si,msj,mtr[Ai,m⊤Bi,m⊤Bj,mAj,m] =s_i,ms_j,mtr [A_i,m B_i,m B_j,mA_j,m ] (32) =si,msj,mtr[(Bi,m⊤Bj,m)(Aj,mAi,m⊤)]. =s_i,ms_j,mtr [(B_i,m B_j,m)(A_j,mA_i,m ) ]. (33) Thus, K(i,j)=∑m∈ℳsi,msj,mtr[(Bi,m⊤Bj,m)(Aj,mAi,m⊤)].K(i,j)= _m s_i,ms_j,mtr [(B_i,m B_j,m)(A_j,mA_i,m ) ]. (34) This expression is exactly equivalent to the Frobenius inner product between the dense induced updates. Avoiding dense update materialization. For a module with Bm∈ℝdout,m×rm,Am∈ℝrm×din,m,B_m ^d_out,m× r_m, A_m ^r_m× d_in,m, (35) explicitly materializing ΔWm W_m requires dout,mdin,md_out,md_in,m entries. In contrast, the factorized computation only requires products such as Bi,m⊤Bj,m∈ℝri,m×rj,mB_i,m B_j,m ^r_i,m× r_j,m (36) and Aj,mAi,m⊤∈ℝrj,m×ri,m.A_j,mA_i,m ^r_j,m× r_i,m. (37) Therefore, kernel similarities can be computed directly from stored LoRA adapters without constructing the corresponding dense update matrices. Computational complexity. The dominant module-level operations have complexity O((dout,m+din,m)ri,mrj,m).O ((d_out,m+d_in,m)r_i,mr_j,m ). (38) This avoids explicitly constructing and comparing dout,m×din,md_out,m× d_in,m matrices. Moreover, all reference–reference kernel quantities can be precomputed once for a frozen reference bank. Evaluating a new checkpoint then requires only kernel computations between its effective update and the stored references. B.5 Kernel-Space Computation of the Harmful-Objective Coordinate The harmful-objective coordinate can be computed entirely from effective-update kernel evaluations. Let xθ=ϕ(ΔWθ)x_θ=φ( W_θ) (39) denote the implicit feature representation of an audited checkpoint update. For each pure objective c∈C,S,Bc∈\C,S,B\, recall the prototype μc=1|ℛc|∑i∈ℛcϕ(ΔWi), _c= 1|R_c| _i _cφ( W_i), (40) and the balanced non-harmful prototype μN=12(μS+μB). _N= 12( _S+ _B). (41) We approximate the audited update by a nonnegative combination of the harmful-compliance and balanced non-harmful prototypes: xθ≈γCμC+γNμN,γC,γN≥0.x_θ≈ _C _C+ _N _N, _C, _N≥ 0. (42) The coefficients are obtained from (γ^C,γ^N)=argminγC,γN≥0‖xθ−γCμC−γNμN‖2.( γ_C, γ_N)= _ _C, _N≥ 0 \|x_θ- _C _C- _N _N \|^2. (43) Expanding the objective gives ‖xθ‖2−2γC⟨xθ,μC⟩−2γN⟨xθ,μN⟩ \|x_θ\|^2-2 _C x_θ, _C -2 _N x_θ, _N +γC2⟨μC,μC⟩+2γCγN⟨μC,μN⟩+γN2⟨μN,μN⟩. + _C^2 _C, _C +2 _C _N _C, _N + _N^2 _N, _N . (44) Define γ=[γCγN],γ= bmatrix _C\\ _N bmatrix, (45) the prototype Gram matrix G=[⟨μC,μC⟩⟨μC,μN⟩⟨μN,μC⟩⟨μN,μN⟩],G= bmatrix _C, _C & _C, _N \\ _N, _C & _N, _N bmatrix, (46) and the query–prototype similarity vector bθ=[⟨xθ,μC⟩⟨xθ,μN⟩].b_θ= bmatrix x_θ, _C \\ x_θ, _N bmatrix. (47) Since ‖xθ‖2\|x_θ\|^2 is constant with respect to γ, Equation 43 is equivalent to γ^=argminγ≥0(12γ⊤Gγ−bθ⊤γ). γ= _γ≥ 0 ( 12γ Gγ-b_θ γ ). (48) Because G is a Gram matrix induced by the positive-semidefinite effective-update kernel, this is a convex two-variable quadratic program. All entries of G and bθb_θ can be computed directly from kernel evaluations. For objectives c,d∈C,S,Bc,d∈\C,S,B\, ⟨μc,μd⟩=1|ℛc||ℛd|∑i∈ℛc∑j∈ℛdK(i,j), _c, _d = 1|R_c||R_d| _i _c _j _dK(i,j), (49) while ⟨xθ,μc⟩=1|ℛc|∑i∈ℛcK(θ,i). x_θ, _c = 1|R_c| _i _cK(θ,i). (50) For the balanced non-harmful prototype, ⟨μC,μN⟩ _C, _N =12(⟨μC,μS⟩+⟨μC,μB⟩), = 12 ( _C, _S + _C, _B ), (51) ⟨μN,μN⟩ _N, _N =14(⟨μS,μS⟩+2⟨μS,μB⟩+⟨μB,μB⟩), = 14 ( _S, _S +2 _S, _B + _B, _B ), (52) and ⟨xθ,μN⟩=12(⟨xθ,μS⟩+⟨xθ,μB⟩). x_θ, _N = 12 ( x_θ, _S + x_θ, _B ). (53) Thus, neither ϕ(ΔW)φ( W) nor the prototype vectors need to be explicitly constructed. After solving for the two nonnegative coefficients, the harmful-objective coordinate is sH(ΔWθ)=γ^Cγ^C+γ^N+ϵ,s_H( W_θ)= γ_C γ_C+ γ_N+ε, (54) where ϵ>0ε>0 is a small constant for numerical stability. B.6 Coordinate-Level Compositionality under Realistic SFT The interpretation of the harmful-objective coordinate does not require mixed-objective SFT to follow exact linear interpolation in raw parameter space. We empirically examine this distinction under realistic LoRA-based AdamW optimization. The experiment uses Llama-3.1-8B with the canonical SFT configuration. Mixed-objective trajectories are constructed at ρ∈0.1,0.25,0.5,0.75,ρ∈\0.1,0.25,0.5,0.75\, (55) while the corresponding pure-objective endpoints are trained using the same initialization and optimization recipe. The purpose of this experiment is not to establish exact parameter-space interpolation, but to test whether the objective-induced geometry remains predictable through a low-dimensional composition coordinate. (a) Parameter reconstruction error. (b) Coordinate linearity. (c) Directional alignment. Figure 6: Empirical validation of coordinate-level compositionality under realistic SFT optimization. (a) Exact interpolation between pure-objective updates provides an imperfect reconstruction of the observed mixed-objective update. (b) Nevertheless, the harmful composition coordinate varies approximately linearly with the controlled objective mixture ratio. (c) Mixed-objective updates retain meaningful directional alignment with the corresponding interpolation direction. Exact parameter-space interpolation is imperfect. We first compare the observed mixed-objective update with the interpolation between the pure-objective endpoints: Eparam(ρ)=‖ΔWρ−[(1−ρ)ΔWN+ρΔWC]‖ΔWρ‖.E_param(ρ)= \| W_ρ- [(1-ρ) W_N+ρ W_C ] \|\| W_ρ\|. (56) As shown in Figure 6(a), the reconstruction error remains relatively large. Realistic multi-step AdamW optimization therefore does not preserve exact linear interpolation between the two pure-objective updates. The composition coordinate remains predictable. We next evaluate whether the coordinate induced by the frozen C/NC/N geometry preserves the controlled mixture strength. As shown in Figure 6(b), the estimated composition coordinate varies approximately linearly with the true mixture ratio, with a linear fitting score of R2=0.95.R^2=0.95. (57) Thus, substantial deviation in raw parameter space does not prevent the objective mixture from inducing a stable low-dimensional ordering. Mixed updates retain objective-related directionality. Finally, we compute the cosine similarity between the observed mixed update and the corresponding interpolation direction, cos(ΔWρ,(1−ρ)ΔWN+ρΔWC). ( W_ρ,(1-ρ) W_N+ρ W_C ). (58) Figure 6(c) shows that the mixed updates retain meaningful directional alignment above the estimated seed-noise level. Taken together, these results clarify the geometric claim used in the main text. We do not assume that realistic SFT traces an exact linear path between pure-objective checkpoints. Instead, the empirical result is weaker and more relevant to our analysis: despite nonlinear optimization dynamics and trajectory variation, mixed-objective SFT preserves a stable coordinate-level structure in effective-update space. Appendix C What Does the Harmful-SFT Trace Capture? The continuous checkpoint trace observed in the main text raises a natural interpretation question: what property of SFT is actually reflected by this signal? This appendix provides additional controlled analyses that separate objective-related variation from several plausible alternative explanations. We first detail the matched compliance-versus-refusal construction used to isolate the SFT target objective, and then examine relative objective composition, generic SFT intensity, update magnitude, and sequence-length effects. C.1 Matched Harmful-Compliance and Safety-Targeted Controls To distinguish the SFT target objective from exposure to harmful-domain inputs, we construct matched pairs of harmful-compliance (C) and safety-targeted (S) trajectories. For each harmful-prompt proportion p∈1,2,5,10,25,50,75,100%,p∈\1,2,5,10,25,50,75,100\\%, (59) each harmful-compliance trajectory is paired with a safety-targeted trajectory. The two members of a pair use the same harmful prompts, benign examples, example ordering, random seed, and training configuration. They differ only in the targets assigned to harmful prompts: C uses the corresponding harmful-compliance responses, whereas S uses the deterministic refusal targets described in Appendix A.2. Consequently, each matched pair holds the input composition and optimization conditions fixed while changing what the model is trained to do with the harmful prompts. Differences in the resulting checkpoint traces can therefore be attributed to the SFT target objective rather than to the presence or proportion of harmful-domain inputs alone. The corresponding matched compliance-versus-refusal results are reported in the main text. C.2 Relative Composition vs. Absolute Harmful Exposure This analysis distinguishes whether the harmful-objective coordinate is driven primarily by relative harmful-compliance composition or by the absolute number of harmful examples encountered during training. Trajectories are constructed with dataset sizes N∈50,100,200N∈\50,100,200\ and harmful-compliance ratios ρ∈0,10,20,40,50,100%ρ∈\0,10,20,40,50,100\\%, using five seeds per condition across all four backbones and a fixed 100-step optimization budget. Here, N is the total number of SFT examples, ρ is the harmful-compliance fraction, and nC=Nρn_C=Nρ is the corresponding number of harmful-compliance examples, with ρ expressed as a fraction. Two complementary controls separate the two factors: varying N at fixed ρ changes absolute harmful exposure while preserving relative composition, whereas varying ρ at fixed nCn_C changes relative composition while preserving absolute harmful exposure. (a) Fixed ratio, varying dataset size. (b) Fixed harmful count, varying ratio. Figure 7: Relative composition versus absolute harmful exposure. Left: dataset size varies at fixed harmful-compliance ratio. Right: harmful-compliance ratio varies at fixed harmful-example count. At fixed harmful-compliance ratio, changing the dataset size by a factor of four produces only small changes in sHs_H, with mean same-ratio absolute deviations of 0.00880.0088–0.01590.0159 across backbones (Figure 7(a)). In contrast, when the absolute harmful-example count is fixed, sHs_H continues to follow changes in the relative harmful-compliance ratio, with 100%100\% pairwise ordering accuracy across models and paired seeds (Figure 7(b)). Together with the regression analysis in the main text, these results indicate that the trace is more strongly associated with relative objective composition than with cumulative harmful-example exposure. C.3 Controlling for SFT Intensity and Update Magnitude A further possibility is that the harmful-objective coordinate reflects generic fine-tuning intensity rather than the SFT objective itself. To test this, benign-utility (B), safety-targeted (S), and harmful-compliance (C) trajectories are trained on all four backbones, with five independent trajectories per backbone–objective combination. Checkpoints are evaluated at t∈10,25,50,100,200t∈\10,25,50,100,200\ optimization steps, yielding 300 checkpoints in total, all scored using the same frozen reference geometry. For each checkpoint, both sHs_H and the Frobenius norm of the effective update are recorded. Update growth is normalized within each trajectory as nt=‖ΔWt‖F‖ΔW10‖F,n_t= \| W_t\|_F\| W_10\|_F, (60) where ntn_t measures update magnitude relative to the checkpoint at 10 optimization steps. Figure 8: SFT intensity and update magnitude. Update magnitude grows under all three objectives, while sHs_H remains strongly objective dependent. As shown in Figure 8, effective-update magnitude grows substantially with training under all three objectives, whereas sHs_H remains strongly objective dependent. Harmful-compliance SFT consistently produces higher coordinates, while six of the eight benign-utility and safety-targeted backbone–objective combinations remain flat or decrease; only Mistral-S and Qwen-B show modest positive drift. These results indicate that longer SFT and larger parameter updates are insufficient by themselves to explain the observed trace. C.4 Controlling for Sequence-Length Effects Differences in sequence length between harmful-compliance and non-harmful SFT examples could confound the observed trace. For each SFT trajectory, the mean prompt length ℓprompt ^prompt and mean target length ℓtarget ^target are recorded. Within each backbone, sHs_H and the harmful-compliance ratio p are separately regressed on (ℓprompt,ℓtarget)( ^prompt, ^target), and the correlation between the resulting residuals is reported as the length-controlled partial correlation. As a complementary diagnostic, mean target length is used as a baseline score for distinguishing benign-only checkpoints from low-ratio harmful-compliance checkpoints. (a) Length-controlled trace correlation. (b) Trace versus length-only baseline. Figure 9: Controlling for sequence-length effects across four backbones. After controlling for mean prompt and target length, the correlations between sHs_H and harmful-compliance ratio remain 0.9530.953, 0.9590.959, 0.9760.976, and 0.9720.972 for Llama, Mistral, Qwen, and OLMo, respectively (Figure 9(a)). Mean target length alone provides substantially weaker low-ratio discrimination: for 0%0\% versus 5%5\% harmful-compliance SFT, its AUROC is 0.630.63–0.700.70, compared with 0.980.98–1.001.00 for sHs_H; for 0%0\% versus 10%10\%, the corresponding values are 0.670.67–0.790.79 versus 1.001.00 (Figure 9(b)). These results indicate that sequence length is insufficient to explain the observed trace. Appendix D Supplementary Checkpoint-Auditing Results This appendix provides the full proportion-wise evaluation of checkpoint-level harmful-SFT detection. The main text reports the primary checkpoint-auditing results and highlights performance in the low-ratio regime; here we provide the complete sweep from 1%1\% to 100%100\% harmful-objective SFT under fixed detector definitions and evaluation protocols. D.1 Evaluation Protocol Across Harmful-Objective Proportions We evaluate binary discrimination as the harmful-objective proportion varies over r∈1,2,5,10,25,50,75,100%.r∈\1,2,5,10,25,50,75,100\\%. (61) All detectors and score definitions remain fixed throughout the sweep. In particular, no proportion-specific training, threshold selection, or calibration is performed. We consider two complementary evaluation views. Harmful compliance vs. benign-only SFT. The first comparison, Crvs.B0,C_r\;vs.\;B_0, (62) compares harmful-compliance checkpoints trained with harmful-objective proportion r against benign-only checkpoints. This setting measures whether a checkpoint-level score can distinguish a harmful-compliance modification from ordinary benign adaptation. Harmful compliance vs. matched refusal-targeted SFT. The second comparison, Crvs.Sr,C_r\;vs.\;S_r, (63) uses the matched harmful-compliance and refusal-targeted construction described in Appendix C.1. Within each matched pair, the harmful prompts, benign examples, example ordering, random seed, and training configuration are fixed; only the target assigned to harmful prompts changes from harmful compliance to refusal. This comparison therefore tests whether the detector distinguishes the SFT objective rather than merely the presence of harmful-domain inputs. For proportions from 1%1\% through 10%10\%, each backbone contributes ten checkpoints per class, and the matched evaluation uses ten C/SC/S pairs. At higher proportions, five matched pairs are used per backbone. AUROC is computed independently within each backbone and then macro-averaged across the four backbones, following Appendix A.1. D.2 Full Ratio-Wise Detection Results Figure 10 shows detection performance across the full harmful-objective proportion sweep, while Table 9 reports the corresponding macro-averaged AUROC values. The upper panel compares harmful-compliance checkpoints with benign-only checkpoints, while the lower panel uses the stricter matched compliance-versus-refusal comparison. Figure 10: Binary detection across harmful-objective proportions. Top: harmful-compliance checkpoints at proportion r are compared with benign-only checkpoints (CrC_r vs. B0B_0). Bottom: harmful-compliance checkpoints are compared with matched refusal-targeted checkpoints (CrC_r vs. SrS_r). Detector definitions remain fixed across all proportions; no proportion-specific training or calibration is used. Table 9: Binary detection AUROC across harmful-objective proportions. Values are macro-averaged across the four model backbones. View Method 1%1\% 2%2\% 5%5\% 10%10\% 25%25\% 50%50\% 75%75\% 100%100\% CrC_r vs. B0B_0 TRACE 0.718 0.843 0.995 1.000 1.000 1.000 1.000 1.000 UpdateNorm 0.500 0.513 0.605 0.665 0.770 0.910 0.943 0.963 Spectral 0.553 0.583 0.570 0.540 0.688 0.723 0.863 0.828 WeightWatch-SVD 0.471 0.481 0.484 0.534 0.551 0.655 0.705 0.810 PEFTGuard 0.481 0.509 0.435 0.439 0.404 0.409 0.323 0.316 CANARY 0.548 0.573 0.650 0.768 0.793 0.785 0.790 0.735 CrC_r vs. SrS_r TRACE 0.843 0.955 0.998 1.000 1.000 1.000 1.000 1.000 UpdateNorm 0.538 0.498 0.625 0.548 0.660 0.820 1.000 1.000 Spectral 0.478 0.510 0.530 0.523 0.670 0.900 1.000 0.950 WeightWatch-SVD 0.491 0.535 0.455 0.591 0.515 0.675 0.677 0.661 PEFTGuard 0.000 0.000 0.230 0.144 0.245 0.220 0.300 0.300 CANARY 0.553 0.575 0.605 0.740 0.750 0.800 0.850 0.760 The full sweep reveals that the advantage of the checkpoint-derived trace is most pronounced when the harmful objective is weak. For CrC_r vs. B0B_0, TRACE reaches AUROC 0.7180.718 at 1%1\%, 0.8430.843 at 2%2\%, and 0.9950.995 at 5%5\%. Under the stricter matched CrC_r vs. SrS_r comparison, the corresponding values are 0.8430.843, 0.9550.955, and 0.9980.998. From 10%10\% onward, TRACE achieves complete separation in both evaluation views. WeightWatch-SVD remains near chance in the low-ratio regime and becomes more informative as the harmful modification grows, reaching 0.8100.810 at 100%100\% for CrC_r vs. B0B_0; however, its matched CrC_r vs. SrS_r performance remains substantially weaker and non-monotonic. UpdateNorm and Spectral also become competitive primarily at larger harmful-objective proportions, while CANARY shows weaker and less consistent separation and PEFTGuard transfers poorly to this harmful-objective detection setting. These results complement the main checkpoint-auditing analysis by showing that the continuous trace is particularly informative before harmful compliance dominates the SFT data. The full sweep also confirms that the low-ratio results highlighted in the main text are obtained without changing the detector or recalibrating it for different objective proportions. Appendix E Generalization and Robustness of the Harmful-SFT Trace This appendix provides the complete generalization and robustness analyses supporting Section 5. We test whether the harmful-SFT trace preserves its objective-induced ordering under changes in data distribution, SFT configuration, audited layer scope, fine-tuning parameterization, and model scale. Absolute sHs_H values are not assumed to remain invariant across settings or model backbones; the focus throughout is the stability of the underlying ordering. E.1 Dataset-Family Generalization Dataset-family transfer tests whether the harmful-objective trace remains readable when the harmful-data source used for reference construction differs from that used to train the audited checkpoint. Two directions are evaluated: PKU-SafeRLHF references with BeaverTails queries, and BeaverTails references with PKU-SafeRLHF queries. In each direction, the C and S prototypes are constructed from the reference family, while the benign prototype uses the same benign sources as in the main experiments. Query checkpoints are trained at harmful-objective proportions of 5%5\%, 10%10\%, 25%25\%, and 50%50\%, with five independent trajectories per condition. Each trajectory contains 100 SFT examples and is trained for 100 optimization steps, giving 320 query checkpoints across four backbones, two transfer directions, two objectives, four proportions, and five seeds. Continuous transfer is evaluated by Spearman correlation between harmful-compliance proportion and sHs_H, separately for each backbone and direction. Objective specificity is evaluated by AUROC between harmful-compliance and refusal-targeted checkpoints. Table 10: Dataset-family transfer in both directions. C-trace Spearman ρ C/SC/S AUROC Model PKU→ BT→ PKU→ BT→ Llama 0.9695 0.7911 1.0000 1.0000 Mistral 0.9384 0.9695 1.0000 1.0000 Qwen 0.9695 0.9695 1.0000 1.0000 OLMo 0.9695 0.9695 1.0000 1.0000 Figure 11: Cross-family harmful-compliance traces. References and queries use different harmful-data families. Table 10 and Figure 11 show that the trace persists in both directions. Spearman correlations range from 0.79110.7911 to 0.96950.9695, with seven of eight backbone–direction combinations above 0.93840.9384, and C/SC/S AUROC is 1.00001.0000 throughout. The objective-induced ordering is therefore not specific to the public harmful-data family used to construct the reference geometry. E.2 Generalization to Manually Constructed Unseen Data Figure 12: Traces on manually constructed unseen data. Solid and dashed lines denote C and S, respectively. Transfer between public datasets provides only a partial generalization test, since publicly available safety data may have appeared in the pretraining corpora of the evaluated base models. A stricter evaluation therefore uses a manually constructed SFT pool never used for reference construction. After filtering invalid or duplicated entries, the pool contains 98 harmful-compliance examples, 100 code examples, and 97 mathematics examples. Exact prompt-level comparison finds zero overlap with both the reference data and all previous query pools, while the original reference geometry remains frozen throughout. The refusal-targeted branch reuses the same 98 harmful prompts but replaces their targets with the fixed refusal templates from Appendix A.2. For each backbone, matched C and S checkpoints are trained at nominal proportions of 5%5\%, 10%10\%, 25%25\%, 50%50\%, 75%75\%, and 100%100\%, using five seeds per condition. Each trajectory contains 100 examples and is trained for 100 optimization steps; matched C/SC/S pairs share harmful prompts and benign examples and differ only in the harmful-response target. Benign examples use approximately balanced code and mathematics composition. Because only 98 harmful-compliance examples remain after filtering, the nominal 100%100\% condition contains 98 harmful and two benign examples. Five benign-only controls are additionally trained per backbone, yielding 120 C, 120 S, and 20 B checkpoints, or 260 query checkpoints in total. Figure 12 shows that increasing harmful-compliance proportion raises sHs_H across all four backbones, while the matched refusal-targeted branch remains substantially lower. Because the two branches share their inputs and differ only in target behavior, the separation cannot be attributed to input-domain differences. Table 11: Unseen-data generalization. Model ρC+B _C+B ρC _C C/SC/S AUROC Llama 0.9873 0.9821 1.0000 Mistral 0.9887 0.9843 0.9989 Qwen 0.9831 0.9753 1.0000 OLMo 0.9901 0.9866 1.0000 Including benign-only controls as the 0%0\% condition gives ρC+B=0.9831 _C+B=0.9831–0.99010.9901, while restricting the calculation to the six nonzero C conditions gives ρC=0.9753 _C=0.9753–0.98660.9866. Per-backbone C/SC/S AUROC ranges from 0.99890.9989 to 1.00001.0000, with macro AUROC 0.99970.9997 (Table 11). Thus, the frozen geometry transfers to independently constructed data without rebuilding or recalibration. Notably, the unseen pool has no prompt overlap with the reference or previous query data, yet preserves the same objective-dependent ordering. The matched C/SC/S separation further shows that this transfer remains sensitive to the target behavior rather than merely to the input domain. E.3 Robustness to SFT Configuration Configuration robustness tests whether the trace depends on a particular SFT recipe. Starting from the canonical setting—learning rate 2×10−42× 10^-4, 100 optimization steps, LoRA rank r=8r=8, and scaling α=16α=16—one factor is changed at a time. Alternative settings use learning rates of 1×10−41× 10^-4 and 5×10−45× 10^-4, 50 or 200 training steps, LoRA ranks r∈4,16r∈\4,16\, and scaling factors α∈8,32α∈\8,32\. Each of the nine configurations is evaluated at harmful-objective proportions of 0%0\%, 5%5\%, 10%10\%, 25%25\%, 50%50\%, 75%75\%, and 100%100\%, with three independent trajectories per proportion and backbone, giving 756 trajectories in total. The reference geometry and scoring procedure remain fixed. Table 12: Correlation with the canonical sHs_H curve under SFT configuration changes. Model Base LR↓ LR↑ Step↓ Step↑ r=4r=4 r=16r=16 α=8α=8 α=32α=32 Llama 1.000 0.998 0.998 0.997 0.998 0.999 1.000 0.998 0.999 Mistral 1.000 1.000 0.996 1.000 0.998 0.994 0.998 1.000 0.998 Qwen 1.000 0.999 0.993 0.999 0.994 1.000 0.999 0.999 0.999 OLMo 1.000 1.000 0.999 0.999 1.000 0.999 1.000 1.000 1.000 Figure 13: Harmful-objective traces under SFT configuration changes. Table 12 reports correlations of 0.9930.993–1.0001.000 between the modified and canonical median sHs_H curves. Figure 13 shows that configuration changes can shift the absolute score scale while preserving the dose–response ordering. The high correlations are not explained by score collapse: every tested configuration retains more than 70%70\% of the canonical dynamic range maxρsH−minρsH _ρs_H- _ρs_H. The trace is therefore largely insensitive to the particular SFT configuration at the level of objective ordering. E.4 Sensitivity to Audited Layer Scope Layer-scope sensitivity tests whether recovering the trace requires access to all Transformer layers. With checkpoints, reference geometry, and all other components fixed, only the audited q_proj/v_proj modules are varied. Uniformly spaced subsets containing 25%25\%, 50%50\%, 75%75\%, and 100%100\% of the layers are first compared. A second experiment fixes the audit budget at 25%25\% and compares early, middle, late, and uniformly spaced layer subsets. (a) Varying audited layer fraction. (b) Layer location at a 25%25\% audit budget. Figure 14: Sensitivity of the checkpoint trace to audited layer scope. Figure 14 shows that uniformly auditing only 25%25\% of the layers already retains Spearman correlations of 0.9680.968–0.9870.987, compared with 0.9880.988–0.9920.992 when all layers are used. At the same 25%25\% audit budget, middle-layer subsets reach 0.9830.983–0.9900.990 and consistently outperform early-layer subsets. These results indicate that the trace is distributed across the model rather than confined to a narrow layer region. All layers are nevertheless retained in the main experiments to avoid introducing additional layer-selection choices or hyperparameters. E.5 Scaling to Larger Qwen Models We test whether the harmful-objective trace persists as model scale increases within the same model family. In addition to Qwen3-8B used in the main experiments, we evaluate Qwen3-14B and Qwen3-32B using the same TRACE construction and canonical SFT configuration. For each model, the reference geometry is built from eight harmful-compliance (C), eight safety-targeted (S), and eight benign-utility (B) trajectories. Query checkpoints are trained at harmful-objective proportions 0,1,2,5,10,25,50,75,100%\0,1,2,5,10,25,50,75,100\\% with three independent seeds per condition. The matched C/S control is additionally evaluated at 5,10,25,50%\5,10,25,50\\%, again with three matched pairs per condition. In total, 75 trajectories are trained for each larger backbone. Qwen3-32B uses a smaller per-device micro-batch with gradient accumulation to preserve the same effective batch size; all other training and scoring settings remain unchanged. Figure 15: Continuous harmful-objective traces on larger Qwen3 models. The reference geometry is constructed independently within each backbone; absolute sHs_H values are therefore not compared across models. Table 13: TRACE on larger Qwen3 models. Model Trace ρ R2R^2 Matched C/S 5% C/B Qwen3-14B 0.994 0.976 1.000 1.000 Qwen3-32B 0.960 0.997 1.000 1.000 Figure 15 shows that the continuous ordering persists at both scales. For Qwen3-14B, the harmful-objective coordinate has Spearman correlation ρ=0.994ρ=0.994 with the controlled objective proportion and R2=0.976R^2=0.976; the ratio-wise mean score increases monotonically from 0.1030.103 at 0% to 0.8490.849 at 100%. Qwen3-32B similarly retains a strong trace, with ρ=0.960ρ=0.960 and R2=0.997R^2=0.997, and its mean score increases monotonically from 0.1500.150 to 0.9240.924. The ordering is already visible in the low-ratio regime: both models achieve AUROC 1.000 for separating 5% harmful-compliance checkpoints from benign-only checkpoints. Objective specificity also survives scaling. Under the matched C/S control, where prompts, benign examples, ordering, seed, and training configuration are held fixed and only the harmful-response target changes, both Qwen3-14B and Qwen3-32B achieve AUROC 1.000. Every matched pair assigns a larger sHs_H to harmful-compliance than to refusal-targeted SFT, with mean paired gaps of 0.1750.175 and 0.2640.264, respectively. Together with the existing Qwen3-8B result (ρ=0.987ρ=0.987), these experiments indicate that the continuous, objective-specific checkpoint trace persists as the Qwen3 backbone scales from 8B to 14B and 32B parameters. Appendix F Behavioral External Validity and Extensions This appendix examines two questions beyond the core characterization of the harmful-SFT trace. First, the checkpoint-derived coordinate is compared with independently measured harmful behavior to assess its external validity. Second, the reference-geometry formulation is tested on a qualitatively different checkpoint modification: trigger-conditioned backdoors. The latter is treated as an extension rather than evidence required for the main harmful-SFT trace. F.1 Behavioral External Validity Detailed results for the behavioral evaluation in Section 5.3 are reported in Table 14 and Figure 16. Table 14: Behavioral validity of sHs_H. Model Spearman ρ 95% CI Pearson R2R^2 Partial Corr. Llama 0.931 [0.890, 0.952] 0.896 0.803 0.52 Mistral 0.716 [0.568, 0.806] 0.697 0.485 -0.18 Qwen 0.887 [0.791, 0.936] 0.851 0.724 0.31 OLMo 0.854 [0.743, 0.912] 0.739 0.546 0.30 Figure 16: Checkpoint-level association between sHs_H and attack success rate. Each panel corresponds to one backbone. The association is strongest for Llama (ρ=0.931ρ=0.931, R2=0.803R^2=0.803) and Qwen (ρ=0.887ρ=0.887, R2=0.724R^2=0.724), while Mistral and OLMo remain positive but weaker. All four correlations are significant under permutation tests (p<10−4p<10^-4), with Pearson correlations of 0.6970.697–0.8960.896. The pattern also holds across attacks: all 16 backbone–attack combinations are positively correlated (0.550.55–0.940.94), and leave-one-attack-out results remain stable. Across longitudinal trajectories, 46 of 60 show positive sHs_H–ASR associations, with median Spearman correlation 0.520.52. After controlling for SFT objective and training stage, partial correlations are 0.520.52, −0.18-0.18, 0.310.31, and 0.300.30 for Llama, Mistral, Qwen, and OLMo, respectively, indicating that part of the aggregate relationship is explained by objective and training progress, while a positive within-condition association remains for three of four backbones. F.2 Backdoor Attack-Family Adaptation A separate experiment tests whether the reference geometry extends to a qualitatively different post-training modification. Toxic Backdoors Alpaca (Ewart, 2024) inserts the trigger SolidGoldMagikarp into poisoned Alpaca-style instructions and pairs them with toxic targets. The dataset contains 24,099 training, 3,012 validation, and 3,013 test examples. Attack validation uses 1,000-example SFT sets with 500 poisoned and 500 clean examples trained for 200 steps. Across four backbones, triggered ASR reaches 0.9970.997–1.0001.000, while clean-prompt toxicity remains 0.0030.003–0.0050.005. Figure 17: Triggered ASR across poison rates. Checkpoint auditing uses poison rates of 1%1\%, 2%2\%, 5%5\%, 10%10\%, 25%25\%, and 50%50\%, with ten backdoor trajectories per rate and five clean controls per backbone. For each rate, four seeds are used as references, two for validation, and four for held-out testing. Because the original C/S/BC/S/B geometry does not represent trigger-conditioned modifications, a backdoor prototype μT _T is constructed from 24 reference trajectories per backbone; test checkpoints and behavioral ASR remain excluded from reference construction. As shown in Figure 17, the attack is largely ineffective at 1%1\%, becomes established on Llama and Mistral by 2%2\%, and shows a clearer transition on Qwen and OLMo by 5%5\%. Table 15: Backdoor detection across poison rates. Method 1%1\% 2%2\% 5%5\% 10%10\% 25%25\% 50%50\% UpdateNorm 0.313 0.375 0.500 0.469 0.438 0.125 PEFTGuard-BD 0.531 0.531 0.656 0.406 0.281 0.188 WeightWatch-SVD 0.531 0.469 0.438 0.398 0.469 0.430 WeightWatch-SVD +BackdoorRef 0.438 0.438 0.547 0.422 0.438 0.375 TRACE original 0.250 0.250 0.250 0.062 0.000 0.000 TRACE +BackdoorRef 0.625 0.625 0.750 0.625 0.688 0.692 Table 15 shows that TRACE +BackdoorRef provides the strongest separation at every poison rate, although performance is not monotonic with poisoning strength. WeightWatch-SVD yields moderate separation across the sweep, while adding the same backdoor-reference expansion does not provide a consistent improvement. This is expected because attack efficacy and checkpoint detectability need not evolve together: at low rates the triggered behavior may not yet be reliably learned, while higher poison rates can alter the scale and direction of the resulting update in ways that do not monotonically increase geometric separability. UpdateNorm remains substantially weaker, indicating that update magnitude alone is insufficient for reliable backdoor auditing. Pooling held-out checkpoints over 1%1\%–50%50\%, TRACE +BackdoorRef raises macro AUROC from 0.2320.232 to 0.7210.721, exceeding PEFTGuard-BD (0.5650.565), WeightWatch-SVD (0.4560.456), and WeightWatch-SVD +BackdoorRef (0.4430.443), as shown in Figure 18. Per-backbone AUROC for TRACE improves from 0.2600.260 to 0.7190.719 on Llama, 0.3850.385 to 0.6150.615 on Mistral, 0.1460.146 to 0.9900.990 on Qwen, and 0.1350.135 to 0.5630.563 on OLMo. Reference-count sensitivity rises from approximately 0.280.28 with one or two attack-family references to 0.300.30 with four, 0.350.35 with eight, and 0.720.72 with all 24, indicating that new modification families benefit from references that explicitly represent their update pattern. Figure 18: Backdoor auditing and reference adaptation. (A) Pooled held-out backdoor detection across baselines and reference-adapted variants over 1%1\%–50%50\% poison rates. (B) Association between the TRACE checkpoint score and triggered ASR before and after adding the backdoor reference. F.3 Backward Compatibility of Reference Expansion Adding a backdoor prototype raises a separate question: whether expanding the reference space preserves the original harmful-SFT audit. The original harmful-compliance and balanced non-harmful prototypes, μC _C and μN _N, remain frozen, while μT _T is constructed from the same 24 backdoor reference trajectories used above. No checkpoint is retrained and no behavioral labels or score recalibration are introduced. The expanded three-component geometry estimates (γ^C,γ^T,γ^N)=argminγC,γT,γN≥0‖ϕ(ΔWθ)−γCμC−γTμT−γNμN‖2,( γ_C, γ_T, γ_N)= _ _C, _T, _N≥ 0 \|φ( W_θ)- _C _C- _T _T- _N _N \|^2, (64) and defines the combined harmful-modification coordinate sC+T=γ^C+γ^Tγ^C+γ^T+γ^N+ϵ.s_C+T= γ_C+ γ_T γ_C+ γ_T+ γ_N+ε. (65) Recomputing the original two-component coordinate reproduces the stored TRACE scores to numerical precision. Table 16: Backward compatibility after adding the backdoor reference. Δ reports the change in macro AUROC after reference-space expansion. Setting Original +μT+ _T Δ 95% CI ID 0.9110 0.8745 -0.0365 [−0.0710,−0.0045][-0.0710,-0.0045] Matched C/S 0.9881 0.9924 +0.0043 [+0.0004,+0.0088][+0.0004,+0.0088] OOD 1.0000 1.0000 +0.0000 [0.0000,0.0000][0.0000,0.0000] Unseen 0.9998 0.9543 -0.0455 [−0.0762,−0.0181][-0.0762,-0.0181] Figure 19: Backward compatibility of backdoor reference expansion. Left: change in the original harmful-SFT detection tasks after adding μT _T. Right: retention of continuous harmful-objective ordering. Table 16 and Figure 19 show that the expanded geometry preserves matched C/SC/S discrimination and dataset-family OOD performance, while ID and unseen AUROC decrease by 0.03650.0365 and 0.04550.0455, respectively; both decreases have paired-bootstrap confidence intervals excluding zero. Importantly, continuous harmful-objective ordering remains stable: the expanded coordinate retains Spearman correlations of 0.98040.9804, 0.98720.9872, 0.98310.9831, and 0.99230.9923 with harmful-objective proportion on Llama, Mistral, Qwen, and OLMo, and the rank correlation between original and expanded scores is at least 0.98860.9886 on every backbone. The remaining performance change is therefore more consistent with score renormalization than with loss of the underlying objective structure; adding μT _T assigns nonzero mass to some original B/S/CB/S/C checkpoints and shifts their normalized scores by median amounts of approximately 0.060.06–0.450.45 across backbone–objective combinations. Appendix G TRACE under Practical-Scale Heterogeneous SFT The main experiments use small, controlled SFT trajectories to isolate objective-induced checkpoint structure. This section tests whether the same trace and auditing signal persist under larger, heterogeneous instruction tuning. Practical SFT setup. The benign pool is built from a filtered Tulu 3 SFT mixture (Lambert et al., 2025). From 939,343 examples across 19 sources, safety-, jailbreak-, refusal-, and open-chat-oriented sources are removed, leaving 715,082 examples from 13 benign/utility sources spanning instruction following, mathematics, reasoning, code, scientific tasks, table understanding, and multilingual data. Each trajectory contains 10,000 examples, with harmful-compliance examples from PKU-SafeRLHF and BeaverTails replacing benign examples at 00, 0.50.5, 11, 22, 55, and 10%10\%. Llama-3.1-8B-Instruct and Qwen3-8B are evaluated with three trajectories per condition, each trained for one epoch (625 steps) using the canonical LoRA configuration: r=8r=8, α=16α=16, q/v projections, learning rate 2×10−42× 10^-4, effective batch size 16, maximum sequence length 512, and bfloat16. The original reference geometry remains frozen throughout, and all training manifests have zero prompt-level overlap with reference, previous-query, and evaluation pools. Figure 20: Construction of practical heterogeneous SFT trajectories. (a) The 10k-example Tulu3-Clean background contains 13 heterogeneous instruction-tuning sources. (b) Harmful-compliance examples progressively replace benign examples while total size remains fixed at 10,000. Checkpoint trace and behavioral relevance. Despite the 100× increase in dataset size and the more heterogeneous benign distribution, sHs_H remains strongly ordered by harmful-objective proportion, with Spearman correlations of 0.9790.979 for Llama and 0.9920.992 for Qwen; ratio-wise means increase monotonically on both backbones. Using the same behavioral protocol as Section 5.3, ASR also rises with harmful-objective composition. Figure 21 shows checkpoint-level sHs_H–ASR correlations of approximately 0.890.89 for Llama and 0.920.92 for Qwen, with positive associations for each attack individually. Behavioral measurements remain excluded from TRACE construction and calibration. Figure 21: TRACE under practical heterogeneous SFT. Harmful-objective proportion versus sHs_H, proportion versus ASR, and checkpoint-level sHs_H–ASR association. Each point is an independently trained 10k-example checkpoint; the reference geometry remains frozen. Objective controls and training dynamics. Matched C/SC/S controls are repeated at 1%1\% and 5%5\%, holding prompts, benign examples, ordering, seed, and training configuration fixed while changing only the harmful-response target. All three matched pairs on both backbones satisfy sH(C)>sH(S)s_H(C)>s_H(S) and ASR(C)>ASR(S)ASR(C)>ASR(S) (Figure 22(a–b)). Mean sHs_H gaps at 1%/5%1\%/5\% are +0.257/+0.462+0.257/+0.462 for Llama and +0.064/+0.226+0.064/+0.226 for Qwen, with corresponding ASR gaps of +0.381/+0.516+0.381/+0.516 and +0.115/+0.206+0.115/+0.206. Along six 5%5\% harmful-compliance trajectories, both sHs_H and ASR increase overall across 2020, 4040, 6060, 8080, and 100%100\% of training (Figure 22(c–d)); four of six trajectories have positive within-trajectory correlations, with median Spearman correlation approximately 0.40.4. Figure 22: Objective controls and training dynamics. (a–b) Matched C/SC/S trajectories differ only in harmful-response targets. (c–d) Along 5%5\% harmful-compliance trajectories, sHs_H and ASR generally increase during SFT. Thin lines show seeds and thick lines show means. As a scale-only control, the original UltraChat/GSM8K/MBPP benign construction is expanded to 10,000 examples for Llama. The harmful-objective ordering remains intact, indicating that scale transfer is not specific to Tulu3-Clean; the behavioral result is noisier with only eight checkpoints and is treated as supporting evidence. Overall, the trace remains informative under 10,000-example heterogeneous SFT without rebuilding or recalibrating the reference geometry. Appendix H Baseline Implementation Details This appendix provides implementation details for the checkpoint-auditing baselines used in Section 4. Unless otherwise specified, all methods use the same frozen train/validation/test splits. AUROC is computed independently within each backbone and macro-averaged across the four backbones. Higher scores always indicate stronger evidence of harmful fine-tuning, and no test-time score flipping is applied. UpdateNorm. UpdateNorm is a weights-only baseline that measures the magnitude of the fine-tuning-induced update. For each LoRA checkpoint, we compute snorm=(∑m∈ℳ‖ΔWm‖F2)1/2,s_norm= ( _m \| W_m\|_F^2 )^1/2, where ℳM contains all modified qprojq_proj and vprojv_proj modules and ΔWm=(αm/rm)BmAm W_m=( _m/r_m)B_mA_m. The score requires no reference checkpoints, labels, or model execution. Spectral. The Spectral baseline uses spectral statistics of LoRA-induced weight updates. Following the original configuration, we extract features from layer 20. Since our adapters modify only qprojq_proj and vprojv_proj, we apply the spectral analysis to these two projections. For each projection, we compute the singular values of the effective update and extract five statistics: the largest singular value, Frobenius norm, leading-singular-value energy fraction, spectral entropy, and excess kurtosis. The resulting 10-dimensional feature vector is standardized and classified by a per-backbone logistic regression model trained on the benchmark training labels. Thus, this baseline uses checkpoint weights and training labels, but requires no model forward passes. PEFTGuard. PEFTGuard is evaluated as a supervised PEFT-weight baseline. For every layer, the qprojq_proj and vprojv_proj LoRA factors are converted to their effective updates and spatially pooled before being passed to a memory-adapted convolutional classification head. A separate detector is trained for each backbone using the training split, with validation-based early stopping. The final score is the predicted harmful-class probability. The implementation follows the original optimization recipe while adapting tensor shapes and the classification head to the model architectures and available q/vq/v LoRA modules. CANARY. CANARY is an activation-based baseline reconstructed from the method description because no official implementation was available. For each checkpoint, we compare the final-token hidden representation of the base and fine-tuned models at the middle Transformer layer using 30 fixed unlabeled probe prompts. Hidden representations are encoded by a per-backbone k-sparse autoencoder trained on base-model activations. After masking high-variance noise features, the checkpoint score is sCANARY=1||∑x∈‖D(M[E(hft(x))−E(hbase(x))])‖22,s_CANARY= 1|P| _x \|D\! (M\! [E(h_ft(x))-E(h_base(x)) ] ) \|_2^2, where E and D denote the sparse encoder and decoder and M removes the preidentified noise features. CANARY therefore requires model forward passes and fixed probe inputs, but no harmful labels are used to produce the checkpoint score. WeightWatch-SVD. Watch the Weights analyzes leading singular directions of the weight difference between a fine-tuned model and its base model. The original method operates on oprojo_proj and MLP downprojdown_proj updates and combines these directions with activation-based monitoring and clean-data calibration. However, our canonical LoRA checkpoints modify only qprojq_proj and vprojv_proj, making the original module scope uninformative in our setting. We therefore evaluate an adapted checkpoint-level, weights-only version, denoted WeightWatch-SVD. For each modified module, we compute the singular subspace of the effective LoRA update without materializing the dense matrix. Writing ΔW=BA W=BA for the stored scaled factors, we use thin QR decompositions B=QBRB,A⊤=QARA,B=Q_BR_B, A =Q_AR_A, followed by an SVD of the small core matrix RBRA⊤=UcΣVc⊤.R_BR_A =U_c V_c . The right singular vectors are then V=QAVc.V=Q_AV_c. We retain up to the original default of 20 directions, capped by the numerical rank of the LoRA update. To compare two checkpoints i and j, we use the sign-invariant projection kernel Km(i,j)=‖Vi,m⊤Vj,m‖F2kij,K_m(i,j)= \|V_i,m V_j,m\|_F^2k_ij, where kijk_ij is the number of shared retained directions. Module-level similarities are averaged across all audited q/vq/v modules to obtain KWW(i,j)K_W(i,j). Because the original Watch the Weights method does not define a checkpoint-level scalar score, we use the same frozen C/S/BC/S/B reference split as TRACE to convert this representation into a continuous audit score. Let μC _C be the harmful-compliance prototype and μN=12(μS+μB) _N= 12( _S+ _B) the balanced non-harmful prototype in the WeightWatch-SVD kernel space. We fit xθ≈γCμC+γNμN,γC,γN≥0,x_θ≈ _C _C+ _N _N, _C, _N≥ 0, and report sWW=γCγC+γN+ϵ.s_W= _C _C+ _N+ε. No model queries, calibration data, ratio-specific tuning, or test labels are used. We therefore refer to this method throughout as WeightWatch-SVD (adapted), rather than as an unmodified reproduction of the original monitoring pipeline.