Paper deep dive
Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning
Yuxuan Huang, Xingyu Zeng, Tianhang Zheng, Chaochao Lu
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Released aligned large language models remain vulnerable to malicious downstream finetuning. Existing defenses are largely designed for the fine-tuning-as-a-service (FTaaS) paradigm or rely on downstream users to follow additional safety procedures, and therefore do not directly address the setting we study: a provider controlled partially protected open-weight (PPOW) release setting in which most weights remain trainable while a small safety-critical component is preserved at release. We propose a Unidirectional Safety Gate (USG), instantiated as a Null Space Cubic Layer together with an Inverse Adapter inserted after the final Transformer layer. During downstream fine-tuning, the cubic layer suppresses or blocks gradients from harmful samples whose hidden states fall in a calibrated protected region, while the Inverse Adapter restores the base model's forward behavior. In practice, we calibrate a threshold using defender-held harmful data, allowing protection to generalize to nearby in-distribution harmful samples. Across six evaluated model-dataset settings, USG keeps post-finetuning attack success rate close to the pre-release level under a fixed release threshold, while maintaining high safe-pass rates on easier settings and exhibiting a clearer safety-utility trade-off on unsafe samples from BeaverTails. These results suggest that release-time representation-space blocking can raise the cost of malicious downstream adaptation without requiring downstream cooperation. The code is available at this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2608.05045v1
- Canonical: https://arxiv.org/abs/2608.05045v1
PDF not stored locally. Use the link above to view on the source site.
Full Text
92,397 characters extracted from source content.
Expand or collapse full text
Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning Yuxuan Huang1,2, Xingyu Zeng3∗, Tianhang Zheng4, Chaochao Lu1 1Shanghai Artificial Intelligence Laboratory 2Shanghai Jiao Tong University 3Shenzhen University of Advanced Technology 4Zhejiang University huangyuxuan@pjlab.org.cn, zengxingyu@suat-sz.edu.cn zthzheng@zju.edu.cn, luchaochao@pjlab.org.cn Corresponding authors. Abstract Released aligned large language models remain vulnerable to malicious downstream fine-tuning. Existing defenses are largely designed for the fine-tuning-as-a-service (FTaaS) paradigm or rely on downstream users to follow additional safety procedures, and therefore do not directly address the setting we study: a provider-controlled partially protected open-weight (PPOW) release setting in which most weights remain trainable while a small safety-critical component is preserved at release. We propose a Unidirectional Safety Gate (USG), instantiated as a Null Space Cubic Layer together with an Inverse Adapter inserted after the final Transformer layer. During downstream fine-tuning, the cubic layer suppresses or blocks gradients from harmful samples whose hidden states fall in a calibrated protected region, while the Inverse Adapter restores the base model’s forward behavior. In practice, we calibrate a threshold using defender-held harmful data, allowing protection to generalize to nearby in-distribution harmful samples. Across six evaluated model–dataset settings, USG keeps post-finetuning attack success rate close to the pre-release level under a fixed release threshold, while maintaining high safe-pass rates on easier settings and exhibiting a clearer safety–utility trade-off on unsafe samples from BeaverTails. These results suggest that release-time representation-space blocking can raise the cost of malicious downstream adaptation without requiring downstream cooperation. The code is available at https://github.com/OpenCausaLab/Gradient-Immunity. Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning Yuxuan Huang1,2, Xingyu Zeng3∗, Tianhang Zheng4, Chaochao Lu1†thanks: Corresponding authors. 1Shanghai Artificial Intelligence Laboratory 2Shanghai Jiao Tong University 3Shenzhen University of Advanced Technology 4Zhejiang University huangyuxuan@pjlab.org.cn, zengxingyu@suat-sz.edu.cn zthzheng@zju.edu.cn, luchaochao@pjlab.org.cn 1 Introduction Recent years have witnessed remarkable performance leaps in Large Language Models (LLMs), driven by architectural innovations like Mixture-of-Experts (MoE) (Cai et al., 2025; Liu et al., 2024) and advanced reasoning techniques such as Chain-of-Thought (CoT) (Wei et al., 2022) and Reinforcement Learning with Verifiable Rewards (RLVR) (Su et al., 2025; Mroueh, 2025). These advances have significantly enhanced the reasoning capabilities of models, enabling them to achieve strong performance across downstream tasks such as mathematical reasoning, code generation, and causal understanding (Liu et al., 2024; Grattafiori et al., 2024; Achiam et al., 2023; Zhang et al., 2025; Chen et al., 2026). However, LLMs still face numerous safety challenges (Shanghai AI Lab, 2025; Purpura et al., 2025; Qi et al., 2024a; Lin et al., 2025; Qi et al., 2026). Beyond the inherent vulnerabilities during inference, such as insufficient depth in safety alignment (Qi et al., 2024a; Zhang et al., 2026b; Wu et al., 2026) and susceptibility to misleading prompts that fail to counter toxic input (Melamed et al., 2024; Li et al., 2026; Zeng et al., 2026; He et al., 2026a, b), they also exhibit significant weaknesses when confronted with malicious AI trainers (Huang et al., 2024b). Research has shown that a small amount of toxic training data can completely break a model’s original safety alignment (Wei et al., 2024; Wu et al., 2026). Existing fine-tuning defense methods are primarily designed for the fine-tuning-as-a-service (FTaaS) paradigm (Huang et al., 2024b; Weng et al., 2025; Li et al., 2026; Zhang et al., 2026a; Wen et al., 2026) and therefore do not directly match the provider-controlled PPOW release setting studied here, in which most weights remain trainable after release while a small safety-critical subset must remain protected under provider-side hardening (Qi et al., 2024b). We focus on low-budget downstream SFT under this same release assumption; FTaaS can be viewed as a special case in which stronger provider-side control makes the protected-subset assumption easier to satisfy. Current defense approaches can be categorized into three types (Huang et al., 2024b): alignment-based methods (Rosati et al., 2024; Huang et al., 2024c, a), fine-tuning stage methods (Bianchi et al., 2023; Zong et al., 2024), and post-fine-tuning stage methods (Casper et al., 2024; Yi et al., 2024). Alignment stage defenses, such as Vaccine (Huang et al., 2024c), can only defend against specific types of data attacks and may weaken under stronger downstream adaptation. Fine-tuning stage defenses, like SafeInstr (Bianchi et al., 2023), require the trainer to use a specific training framework; however, in this PPOW setting, a downstream fine-tuner may simply choose a different training pipeline for the exposed weights. Post-fine-tuning stage defenses, such as SafetyLock (Zhu et al., 2024), require users to perform activation steering toward safe directions after training, which cannot be relied upon once the model is released. These methods therefore share a common limitation: they depend on downstream compliance with additional safety procedures (Huang et al., 2024b). This motivates a built-in safety mechanism that remains active after release and reduces reliance on user cooperation. To address this challenge, we propose a novel Unidirectional Safety Gate (USG), a mechanism intended for the PPOW setting rather than a fully productized hardening artifact. Inspired by null-space theory (Fang et al., 2024), our USG can be inserted as a plug-in module into a pretrained model. During downstream fine-tuning, it acts as a selective safety filter: for inputs that trigger harmful behaviors, their hidden states are projected toward a protected null-space region. Empirically, non-participating but in-distribution harmful samples also tend to exhibit lower norm-ratio values than safe samples, which gives the defender room to choose a release-time threshold that extends blocking coverage beyond the null-space build set. This mechanism prevents gradient propagation from blocked harmful samples to earlier layers of the model, thereby reducing harmful pattern acquisition during downstream SFT. The main contributions of this work are summarized as follows: 1) Conceptual Framing: We introduce the concept of Unidirectional Safety Gate (USG), a release-time blocking mechanism for the PPOW setting that reduces reliance on downstream user cooperation. 2)Mechanism Design: We instantiate USG with a Null Space Cubic Layer and an Inverse Adapter. The cubic layer induces a calibrated protected region for harmful representations and blocks harmful gradient propagation during downstream fine-tuning, while the Inverse Adapter restores the base model’s forward behavior. 3) Practical Modularity: Our method introduces minimal parameter overhead and can be inserted as a plug-in module into compatible pretrained models. In our evaluated setting, it preserves safe utility while the norm-ratio statistics show that non-participating but in-distribution harmful samples also tend to fall closer to the protected region than safe samples, allowing threshold calibration to extend blocking coverage beyond the participating harmful samples. The present paper evaluates this blocking behavior directly rather than claiming a fully validated deployment artifact. 2 Related Work Fine-tuning Attacks and Defenses. While the safety capabilities of LLMs during inference have become increasingly robust, their resistance to malicious fine-tuning remains insufficient (Qi et al., 2024b). In the last two years, several works have addressed this challenge under the fine-tuning-as-a-service (FTaaS) paradigm, e.g., (Rosati et al., 2024; Huang et al., 2024c; Bianchi et al., 2023; Zong et al., 2024; Casper et al., 2024; Yi et al., 2024; Hu et al., 2025b; Jiang and Pan, 2025; Liu et al., 2025; Huang et al., 2024a). For example, Huang et al. (2024a) preserve alignment performance by attenuating harmful perturbations, whereas Rosati et al. (2024) erase harmful representations to make them harder to recover during fine-tuning. Null Space Applications in LLMs. Null-space methods have shown promising results in privacy protection (Cao et al., 2026), preserving unrelated knowledge during fine-tuning or knowledge injection (Fang et al., 2024; Hu et al., 2025a; Sun et al., 2025), mitigating catastrophic forgetting, and reducing hallucinations (Yang et al., 2025b). To the best of our knowledge, our work is the first to apply null-space methods to fine-tuning defense. 3 Problem Formulation 3.1 Threat Model We study a provider-controlled partially protected open-weight (PPOW) release setting. The provider releases a model in which most parameters remain open and trainable for downstream users, preserving standard fine-tuning capability, while a small safety-critical parameter subset is preserved through provider-side hardening such as freezing, encryption, structural entanglement, or deployment-time fusion with downstream computation. The attacker has white-box access to the released architecture and full control over downstream training on the exposed weights, including the choice of data, optimizer, and training pipeline. We exclude attacks that require deleting, bypassing, replacing, or independently retraining the protected component, because such attacks are substantially more expensive than ordinary downstream fine-tuning in the PPOW setting. Accordingly, we focus on jailbreak by parameter update on the exposed weights. Our experiments further restrict attention to downstream supervised fine-tuning (SFT) under a low-budget regime, with materially fewer resources than were used to train the released model, e.g. a single GPU with 80 GB memory and on the order of 100 harmful samples. We do not claim coverage of more general post-release optimization procedures. If an attacker had substantially greater resources, they could instead train or heavily repurpose a separate harmful model directly, making protection of the released model less relevant. Let M0M_0 denote the released model with parameters W0=(Wopen0,Wprot)W_0=(W_open^0,W_prot), where Wopen0W_open^0 are the exposed trainable weights and WprotW_prot is the protected safety-critical subset. We consider an adversarial trainer whose goal is to erode the safety alignment of M0M_0 through malicious downstream fine-tuning while preserving benign utility. We assume the adversary possesses a fully harmful QA dataset advD_adv consisting of adversarial question–answer pairs designed to elicit prohibited behaviors (e.g. bypassing safety filters or leaking private data). The attacker updates only the exposed weights, yielding a corrupted model M1M_1 with parameters W1=(Wopen1,Wprot)W_1=(W_open^1,W_prot): Wopen1=argminWopenL(M(Wopen,Wprot),adv)W_open^1= _W_openL (M(W_open,W_prot),D_adv ) (1) where L is typically the standard cross-entropy loss. The adversary’s objective is to maximize harmful response success on advD_adv while retaining as much benign capability as possible. Formally, let IsToxic(M,x)∈0,1IsToxic(M,x)∈\0,1\ be a binary indicator of whether model M generates a harmful response to input x. A successful attack satisfies: • ∀x∈adv,IsToxic(M0,x)=0∀ x _adv,IsToxic(M_0,x)=0 but IsToxic(M1,x)=1IsToxic(M_1,x)=1 • M1M_1 retains or improves performance on benign benchmarks compared to M0M_0. 3.2 Defensive Objectives and Robust Alignment Our goal is to develop a proactive defense mechanism that transforms M0M_0 into a robust variant M0′M_0^ (with weights W0′W_0^ ) before it is released to downstream users. Let DtoxicD_toxic denote a poisoned dataset drawn from the same distribution as advD_adv. This defense aims to ensure that even if M0′M_0^ is subsequently fine-tuned on DtoxicD_toxic to produce M1′M_1^ , the resulting model remains resilient to the adversarial influence of DtoxicD_toxic while maintaining performance on the safe dataset DsafeD_safe. We assume that the model provider has a defensive dataset DdefenseD_defense, and Dtoxic∪Dsafe⊆DdefenseD_toxic∪ D_safe D_defense. Formally, we view the following as ideal design objectives for a release-time defense in the PPOW setting: • Safety Invariance (idealized): For adversarial inputs x∈Dtoxicx∈ D_toxic with IsToxic(M0,x)=0IsToxic(M_0,x)=0, the desired outcome is that the safety state remains stable: IsToxic(M1′,x)=IsToxic(M0′,x)=0IsToxic(M_1^ ,x)=IsToxic(M_0^ ,x)=0 (2) • Utility Generalization (desired): The transformation from M0M_0 to M0′M_0^ should not hinder legitimate learning. For safe data, the model should still converge to an improved state: Perform(M1′,safe) (M_1^ ,D_safe) ≥Perform(M0′,safe) (M_0^ ,D_safe) (3) ≈Perform(M0,safe) (M_0,D_safe) • Strict Constraint Enforcement (idealized): In the fully blocked regime, the defense would keep M1′M_1^ from becoming more harmful than M0M_0 on the protected harmful distribution, thereby reducing the adversarial utility of DtoxicD_toxic while preserving the released model’s capacity for safe downstream adaptation. 3.3 Formal Definition of the Unidirectional Safety Gate To achieve the transformation from M0M_0 to M0′M_0 , we introduce a safeguard module into the original model. Specifically, inputs from the safe dataset can pass through the safeguard structure normally, while the gradient backpropagation for inputs from the prohibited subset is blocked by this structure. The prohibited subset is denoted as forbiddenD_forbidden. Unidirectional Safety Gate(USG) Definition: Suppose a layer with parameters W is inserted after the k-th transformer layer. Let defenseD_defense be the input dataset and forbidden⊆defenseD_forbidden _defense be a subset of prohibited inputs. For any input sample x∈defensex _defense, let hx=f(k)(x)h_x=f^(k)(x) denote the hidden-state tensor at the input of this layer, where f(k)(.)f^(k)(.) denotes the forward function of the embedding layer and the first k Transformer layers. Let the forward propagation output of this layer be denoted as f(hx,W)f(h_x,W). During the training process of the network, let ℒL denote the overall loss function of the network. The gradient of the loss with respect to the layer input is ∂ℒ(hx,W)∂hx (h_x,W)∂ h_x. If the following conditions hold: • Forward Normality: For any input x∈defensex _defense, the forward computation f(hx,W)f(h_x,W) is well-defined, producing a valid output tensor. • Backward Blocking: For any prohibited input x∈forbiddenx _forbidden, we have ∂ℒ(hx,W)∂hx=0. (h_x,W)∂ h_x=0. (4) For any input x∈defense∖forbiddenx _defense _forbidden, no additional constraints are imposed on the gradient. Then the layer is defined as a USG upon the prohibited input subset forbiddenD_forbidden. It should be noted that USG is an abstract mechanism class rather than a specific architectural instantiation; the Null Space Cubic Layer and Inverse Adapter introduced later provide one concrete realization. The role of USG in the model is as illustrated in Figure 1. Figure 1: The figure illustrates the idealized behavior of a USG-style safeguard. For harmful data, it functions as a diode: during backpropagation, the USG sets gradients to zero, inducing gradient vanishing and thereby blocking gradient propagation. For safe data, it acts as a wire without inducing gradient vanishing in the idealized exact-blocking definition. Its core idea is the controllable induction of gradient vanishing—normally an undesirable behavior in model training. 4 Methodology 4.1 Overall Framework To implement the aforementioned USG, we employ a cascade of a Null Space Cubic Layer and an Inverse Adapter. The cubic layer provides backward blocking on protected harmful inputs, while the Inverse Adapter compensates for the forward distortion and preserves the base-model behavior. In practice, exact null-space construction is approximated by a threshold on the norm ratio, implemented as a backward gate, rather than a hard semantic decision about whether a sample is harmful. The provider can calibrate a fixed harmful block-rate target on harmful reference data, and freeze a release threshold for deployment. Appendix A gives the gate implementation details, and Appendix B reports the observation that, under a fixed threshold, safe fine-tuning still preserves a degree of harmful-blocking functionality. 4.2 Cubic Layer As a concrete instantiation of the abstract USG, we introduce the cubic layer. The cubic layer is inserted after a Transformer layer, specifically after the residual connection of the preceding Transformer layer and before the input to the subsequent layer (which need not be a Transformer layer). Suppose the cubic layer is inserted after the k-th Transformer layer; we denote it as CLkCL_k, where CL stands for Cubic Layer. Given a model M composed of n Transformer layers, if a cubic layer is inserted after its k-th Transformer layer, we refer to the resulting model as MkCLM^CL_k. Let f(i)f^(i) denote the submodel of M consisting of the embedding layer and the first i Transformer layers, such that its output for an input x is fx(i)f^(i)_x. Clearly, because the first k Transformer layers of MkCLM^CL_k are identical to those of M, the submodel formed by the first i Transformer layers (i≤ki≤ k) of MkCLM^CL_k is also fx(i)f^(i)_x. Moreover, to avoid compromising the original performance of the model, an Inverse Adapter is appended after the cubic layer to analytically recover its forward output. The role of the Cubic Layer in the model is as illustrated in Figure 2. Figure 2: The roles of the Cubic Layer and Inverse Adapter in the model are illustrated in the figure. Here, M denotes the original model, MkCLM_k^CL represents the model obtained by inserting the Cubic Layer and the Inverse Adapter after the k-th Transformer, and MNCLM_N^CL represents the model obtained by inserting the Cubic Layer and the Inverse Adapter after the N-th Transformer. 4.2.1 Definition Definition. Let h∈ℝB×L×Dh ^B× L× D be the layer-input hidden-state tensor, where - B denotes the batch size (the number of independent samples processed in one forward pass), - L denotes the sequence length (the number of tokens per sample, possibly after padding or truncation), - D denotes the hidden dimension (the dimensionality of the feature vector for each token). Let W∈ℝD×DW ^D× D be a pre-set and unlearnable parameter. To facilitate the matrix operations defined below, we reshape this hidden-state tensor as h∈ℝB×L×1×Dh ^B× L× 1× D, i.e., we introduce a singleton dimension. The output of the cubic layer is then defined as O(h)=((hW)h)h,O(h)=((hW)h T)h, (5) In this paper, all matrix multiplications and the transpose operation (⋅)(·) T are applied to the last two dimensions of the tensors, i.e., treating the first two dimensions B and L as batch dimensions via broadcasting. Specifically, for h∈ℝB×L×1×Dh ^B× L× 1× D, its transpose h∈ℝB×L×D×1h T ^B× L× D× 1 is obtained by swapping its last two dimensions. If W satisfies hW=0hW=0 and hW=0hW T=0, then this cubic layer is referred to as a Null Space Cubic Layer. 4.2.2 Gradient of Cubic Layer Consider a backward pass with loss L, and let ∂L∂O(h)=GB ∂ L∂ O(h)=G_B. Given the output of the cubic layer O(h)=((hW)h)hO(h)=((hW)h T)h, ∂L∂h ∂ L∂ h can be decomposed into the following three terms. term1 _1 =(GBh)(hW) =(G_Bh T)(hW T) (6) term2 _2 =(hGB)(hW) =(hG_B T)(hW) term3 _3 =((hW)h)GB =((hW T)h T)G_B where ⋅· denotes matrix multiplication. The total gradient is then given by ∂L∂h=term1+term2+term3. ∂ L∂ h=term_1+term_2+term_3. (7) Detailed calculation is provided in Appendix C. Observing term1term_1, term2term_2, and term3term_3, we note that each contains the factors hWhW T and hWhW. If W is such that both hWhW T and hWhW are approximately zero, the vanishing gradient phenomenon can be induced, thereby blocking backward propagation through the model. To achieve this effect, we construct a symmetric matrix W from the common right null space of the dataset DforbiddenD_forbidden for which gradient blocking is intended. In other words, for layer-input hidden-state tensors h induced by samples in DforbiddenD_forbidden, W is chosen so that hW=hW=0hW=hW T=0 in the exact setting. In our experiments, we use ‖hW‖\|hW\| to quantify how close hWhW is to the zero vector, where ∥⋅∥\|·\| denotes the Frobenius norm. 4.2.3 Null Space Cubic Layer Preliminary. For a model MkCLM^CL_k, let SY=Y1,Y2,…,YnS_Y=\Y_1,Y_2,…,Y_n\ denote the tokenized inputs obtained from dataset D, and define the set of layer-input hidden-state tensors SfY(k)=f(k)(Y1),f(k)(Y2),…,f(k)(Yn),S_f^(k)_Y=\f^(k)(Y_1),f^(k)(Y_2),…,f^(k)(Y_n)\, (8) By construction, SfY(k)S_f^(k)_Y is precisely the set of layer-input hidden-state tensors for the cubic layer in MkCLM^CL_k. Define hj=f(k)(Yj)h_j=f^(k)(Y_j) for j=1,2,…,nj=1,2,…,n, and let Sh=h1,h2,…,hnS_h=\h_1,h_2,…,h_n\ (9) The right null space of a matrix H∈ℝN×NH ^N× N is defined as null(H)=p∈ℝN∣Hp=0,null(H)=\p ^N Hp=0\, (10) and the common right null space of the set ShS_h of matrices is defined as nullcommon(Sh)=p∈ℝN∣∀h∈Sh,hp=0.null_common(S_h)=\p ^N ∀ h∈ S_h,\,hp=0\. (11) Definition. A cubic layer is called a Null Space Cubic Layer if and only if ∀h∈Sh,hW=hW=0.∀ h∈ S_h,hW=hW T=0. (12) To construct such a cubic layer, we first compute a symmetric matrix W from the common right null space of ShS_h. Specifically, let nullcommon(Sh)null_common(S_h) denote the common right null space of ShS_h. Let V∈ℝN×rV ^N× r be the matrix whose columns form a basis of nullcommon(Sh)null_common(S_h), where r is the dimension of the common null space. Consequently, V satisfies ∀h∈Sh,hV=0.∀ h∈ S_h, hV=0. (13) To ensure both hW=0hW=0 and hW=0hW T=0 for all h∈Shh∈ S_h, we choose W=VV.W=V T. (14) Since W is symmetric, we have W=W T=W, and because the columns of V span the common right null space of ShS_h, it follows that hW=hVV=0hW=hVV T=0 for every h∈Shh∈ S_h. Note that the parameter W of the cubic layer is not learnable; it is fixed and computed as described above. 4.3 Inverse Adapter In the forward pass of the model MkCLM^CL_k, the hidden states after the cubic layer differ from those in the original model M0M_0; specifically, O(h)≠hO(h)≠ h for the cubic layer. This mismatch renders the subsequent modules incompatible with the current output. Moreover, the parameter W of the cubic layer is fixed and not learnable. Therefore, we append an Inverse Adapter after the cubic layer to analytically undo this deterministic distortion and almost exactly recover the hidden states that would be produced without the cubic layer. To derive this adapter, we first characterize the structure of the cubic-layer transformation. The output of the cubic layer has the form O(h)=((hW)h)h.O(h)=((hW)h T)h. (15) Since h∈ℝB×L×1×Dh ^B× L× 1× D with matrix multiplications applied only on the last two dimensions, for each sample index b∈1,…,Bb∈1,…,B and token index ℓ∈1,…,L ∈1,…,L the layer acts independently on hb,ℓ∈ℝ1×Dh_b, ^1× D, yielding O(h)b,ℓ=sb,ℓhb,ℓO(h)_b, =s_b, h_b, with sb,ℓ=hb,ℓWhb,ℓs_b, =h_b, Wh_b, T. Hence, for every batch element and every token position, the cubic layer preserves the direction of the local hidden-state vector and only rescales it by a scalar determined by that local hidden state and W. Since W is positive semidefinite, this structure yields an analytic inverse in the non-degenerate case sb,ℓ>0s_b, >0: if yb,ℓ=O(h)b,ℓy_b, =O(h)_b, , then yb,ℓWyb,ℓ=sb,ℓ3y_b, Wy_b, T=s_b, ^3, and thus the inverse function is hb,ℓ=yb,ℓ((yb,ℓWyb,ℓ)−1/3).h_b, =y_b, ((y_b, Wy_b, T)^-1/3). (16) By contrast, when sb,ℓ=0s_b, =0, the inverse mapping at that position collapses to yb,ℓ=0y_b, =0 and becomes many-to-one, so there is no unique inverse. The collapse cases are discussed in the Appendix D. Here, it suffices to note that the Inverse Adapter can be applied to any sample in our evaluated setting, compensating for the deterministic distortion introduced by the cubic layer without introducing additional trainable parameters. 4.4 Combined USG Realization The proposed safeguard is formed by composing the Null Space Cubic Layer with the Inverse Adapter. Together, these two components realize the USG-style behavior studied in this paper: the cubic layer provides threshold-based backward blocking of gradient propagation for inputs from the prohibited subset forbiddenD_forbidden, while the Inverse Adapter analytically compensates for the distortion introduced by the cubic layer. • Forward Normality: For any layer-input hidden-state tensor h, the forward computation remains well-defined. The cubic layer first applies the deterministic distortion O(h)=((hW)h)hO(h)=((hW)h T)h, and the Inverse Adapter then analytically compensates for this distortion. Thus, the combined cubic-layer-plus-adapter structure preserves the base-model forward behavior whenever the backward gate is inactive, up to negligible numerical error. • Backward Blocking: In the exact null-space formulation, if h=f(k)(x)h=f^(k)(x) for some input sample x∈forbiddenx _forbidden, then hW=hW=0hW=hW T=0. Since term1term_1, term2term_2, and term3term_3 all contain factors hWhW or hWhW T, the backward gradient becomes exactly zero. In the practical instantiation used in this paper, we instead compute the norm ratio r(h)=‖hW‖/‖h‖r(h)=\|hW\|/\|h\| and implement backward blocking through a threshold gate: gradients are suppressed when r(h)≤τr(h)≤τ and passed otherwise. 4.5 Protected Release Assumptions and Tampering Resistance The threat model in Section 3.1 assumes that the protected component cannot be removed at negligible cost after release. Here we only note one plausible realization of that assumption: the provider may fuse the safeguard with adjacent computation so that isolating and deleting it requires additional reconstruction or retraining. We treat parameter fusion as one concrete supporting instantiation; Appendix E gives a theoretical discussion and a gating-based training method. 4.6 Pipeline The proposed safeguard mechanism is implemented through the following steps: Step 1. Cubic Layer Insertion. Starting from a pre-trained model M, we insert a cubic layer followed by an Inverse Adapter after its last Transformer layer, resulting in the modified model MNCLM^CL_N, where N denotes the number of Transformer layers in M. Step 2. Collecting Hidden-State Tensors for the Cubic Layer. Let TD_T be a set of harmful question–answer pairs collected by the model provider. The set of tokenized inputs obtained from DTD_T is SY=Y1,Y2,…,YnS_Y=\Y_1,Y_2,…,Y_n\. For every input Y∈SYY∈ S_Y, we compute its layer-input hidden-state tensor for the cubic layer, i.e., its hidden representation after the N-th Transformer layer, by forward-propagating through the original model M. This yields a set of hidden-state tensors f(N)=f(N)(Y1),f(N)(Y2),…,f(N)(Yn),S_f^(N)=\f^(N)(Y_1),f^(N)(Y_2),…,f^(N)(Y_n)\, where f(N)f^(N) denotes the submodel consisting of the embedding layer and the first N Transformer layers of M. Step 3. Null Space Extraction and Cubic-Layer Parameter Construction. We compute the common right null space of the matrices in f(N)S_f^(N), each treated as a row vector. Let V∈ℝN×rV ^N× r be a matrix whose columns form a basis of this null space, where r is the dimension of the common null space. The parameter matrix of the cubic layer is then set to W=VVW=V T, which is symmetric and constructed from that common right null space, thereby ensuring that for any h∈f(N)h _f^(N), we have hW≈0hW≈ 0 and hW≈0hW T≈ 0. We refer to harmful samples that participate in the null-space computation as participating harmful samples, namely harmful samples in DforbiddenD_forbidden, and those that do not participate as non‑participating harmful samples, namely harmful samples in Dtoxic∖DforbiddenD_toxic D_forbidden. For more details, refer to the corresponding section in the Appendix F. Step 4. Obtaining the Inverse Adapter. The Inverse Adapter is given directly by the analytic inverse function of the cubic layer, and therefore requires no iterative training. Its purpose is to preserve the base model’s forward behavior on both safe and harmful samples, whereas the gradient blocking studied in this paper is entirely produced by the Null Space Cubic Layer. Step 5. Model Release. After construction, the Null Space Cubic Layer and the Inverse Adapter are assumed to be preserved under the PPOW setting. One possible realization is discussed in Appendix E. The final model M0′=MNCLM_0 =M^CL_N, equipped with the fixed cubic layer and the Inverse Adapter, is then released. 5 Experiment We evaluate our method on two tasks: (1) resistance to harmful fine-tuning and (2) forward restoration by the Inverse Adapter. For the resistance task, we use a practical threshold-based instantiation of the null-space mechanism, implemented as a backward gate. To extend the sample limit, we use extended null-space selection; details are provided in Appendix F. Our main resistance results adopt a strict fixed-threshold 100% harmful-block setting, where the threshold is calibrated once on defender-held harmful reference data and then kept fixed during evaluation. Let r(h)=‖hW‖/‖h‖r(h)=\|hW\|/\|h\| and let τ denote the threshold. The safe pass rate is the proportion of safe samples satisfying r(h)>τr(h)>τ, while the harmful block rate is the proportion of harmful samples satisfying r(h)≤τr(h)≤τ. Further threshold-calibration details for the strict fixed-threshold 100% harmful-block release setting are reported in Appendix A. Model Safeguard JailbreakBench HarmfulBench BeaverTails-H Pre Post Pre Post Pre Post Qwen-14B None 0.04 0.55 0.05 0.29 0.07 0.215 Booster 0.04 0.16 0.05 0.09 0.07 0.30 RepNoise 0.04 0.53 0.05 / 0.07 0.38 Antibody 0.04 0.04 0.05 0.19 0.07 0.135 Null Space Cubic 0.04 0.04 0.05 0.05 0.07 0.07 Llama-8B None 0.01 0.74 0.04 0.37 0.035 0.78 Booster 0.01 0.62 0.04 0.10 0.035 0.435 RepNoise 0.01 0.08 0.04 / 0.035 / Antibody 0.01 0.00 0.04 0.13 0.035 0.07 Null Space Cubic 0.01 0.01 0.04 0.04 0.035 0.035 Table 1: ASR before and after harmful fine-tuning under different safeguarding methods on JailbreakBench, HarmfulBench, and BeaverTails-H. Pre refers to ASR before harmful fine-tuning, while Post refers to ASR after harmful fine-tuning on the corresponding harmful dataset. Under the strict fixed-threshold 100% harmful-block release policy used for Null Space Cubic, post-fine-tuning ASR remains at the pre-release level across all six settings, indicating that harmful downstream updates do not further erode the safeguard in this evaluated strict-threshold setting once the frozen release threshold fully blocks the participating harmful reference set. Boldface marks the best post-fine-tuning defense result (lowest ASR) within each model–dataset block. The symbol ‘/‘ denotes runs with severe generation-quality degradation, including substantial utility loss, nonsensical generations, or mode collapse, for which the resulting ASR is not reported as a meaningful comparison. Model JailbreakBench HarmfulBench BeaverTails-H Qwen-14B 100% 100% 79% Llama-8B 100% 100% 69% Table 2: Safe pass rate under the strict fixed-threshold 100% harmful-block release policy used in Table 1. This policy preserves perfect safe pass rate in the JailbreakBench and HarmfulBench settings for both model families, but becomes visibly more conservative in the harder BeaverTails-H setting. 5.1 Setup 5.1.1 Models and Datasets We adopt Qwen3-14B (reported as Qwen-14B in tables) (Yang et al., 2025a) and Llama-3.1-8B (reported as Llama-8B in tables) (Grattafiori et al., 2024) as our test models for both tasks. Restoration datasets. We evaluate forward restoration on 2,000 samples from the Alpaca dataset (Taori et al., 2023). Resistance datasets. We use harmful QA examples from JailbreakBench (Chao et al., 2024), HarmfulBench (Mazeika et al., 2024), and BeaverTails-H (Ji et al., 2023), where BeaverTails-H denotes the unsafe subset of BeaverTails in this paper. For JailbreakBench and HarmfulBench, we use 100 harmful training examples per dataset; these same 100 examples serve both as the participating harmful build set used to construct the Null Space Cubic Layer and as the downstream harmful fine-tuning set in the strict persistence experiments. For BeaverTails-H, we use 100 harmful training examples to construct the Null Space Cubic Layer, while the remaining 100 harmful samples do not participate in the null-space computation but are used for threshold calibration as non-participating harmful samples. This strict persistence setting matches the PPOW setting above, in which the attacker’s harmful training data are covered by the defender-held harmful reference set. For each harmful build set, the resulting Null Space Cubic Layer is inserted after the last Transformer layer to obtain a safeguarded model MNCLM^CL_N. This yields three safeguarded models per base model family; with two base model families, Qwen and Llama, we obtain a total of six models. 5.1.2 Baselines. Restoration baselines. The original pre-trained model serves as the baseline for the restoration task. Specifically, we compare the performance of our defended model against that of the original model, both evaluated on the same safe dataset without any fine-tuning. Resistance baselines. Among different defense strategies, both fine-tuning-stage and post-fine-tuning-stage methods can be trivially circumvented by an attacker with full control over the training pipeline. Consequently, we select the model without any safeguard, as well as models protected by alignment-stage defense methods, including Rep Noise (Rosati et al., 2024), Booster (Huang et al., 2024a), and the latest gradient-based alignment method AntiBody (Nguyen et al., 2026), as our baselines. 5.1.3 Hyper-Parameters and Training Settings. For the resistance tasks, supervised fine-tuning (SFT) is conducted. The AdamW optimizer (Loshchilov and Hutter, 2017) is employed with full-precision training. The learning rate is set to 4e-5, with a maximum gradient norm of 1.0 and a warmup ratio of 0.2. Restoration setting. No restoration-stage parameter training is performed; the Inverse Adapter is applied directly through the analytic inverse map. Resistance setting. We adopt the Inverse Adapter fixed throughout the resistance tests, while the Null Space Cubic Layer provides the blocking behavior. As a concrete low-budget attack instantiation, we fine-tune only the last five Transformer layers using a standard SFT objective. All other hyper-parameters remain identical to those used in the restoration setting. 5.2 Resistance Results We report the attack success rate (ASR) of models trained on harmful datasets under different safeguard mechanisms. Concretely, we first apply a safeguard (e.g., Null Space Cubic or Booster) to a base model M0M_0 (e.g., Qwen3-14B or Llama-3.1-8B) to obtain a safeguarded model M0′M_0 , and then measure its ASR before and after harmful fine-tuning. The column pre denotes the ASR before harmful training, and post denotes the ASR on the same dataset after training. For the strict fixed-threshold 100% harmful-block release policy used by Null Space Cubic, this comparison should be read together with the safe pass rates: unchanged post-ASR with high safe pass indicates persistence of the safeguard rather than blanket refusal. For the Null Space Cubic method, the main resistance experiments use the strict fixed-threshold 100% harmful-block release setting. The threshold is chosen as the maximum observed ratio ‖hW‖/‖h‖\|hW\|/\|h\| over defender-held harmful reference samples at release time, and is then kept fixed throughout downstream harmful fine-tuning and evaluation. Table 1 reports the resulting pre/post ASR, and Table 2 reports the associated safe pass rates under the same frozen threshold. Under this setting, Null Space Cubic keeps post-fine-tuning ASR at the pre-release level in all six model–dataset settings. The backward gate induced by this frozen threshold preserves 100% safe pass rate for both Qwen-14B and Llama-8B on JailbreakBench and HarmfulBench, while BeaverTails-H is more conservative, reducing safe pass rate to 79% for Qwen-14B and 69% for Llama-8B. 5.3 Restoration Results Since Alpaca is a question-answering dataset, we evaluate restoration quality using the QA-pair accuracy (ACC). The results are shown in Table 3, where response correctness is judged by DeepSeek-V3. Table 3 shows that, in our evaluated setting, the Inverse Adapter preserves base-model performance on the restoration benchmark. This is consistent with the intended role of the Inverse Adapter: it restores the cubic-layer outputs back toward the base model’s outputs, while the gradient blocking itself is carried out by the Null Space Cubic Layer. To directly verify that the Inverse Adapter is not merely preserving one downstream benchmark but is almost exactly undoing the cubic-layer distortion on benign data, we further evaluate the Inverse Adapter in isolation. Concretely, we load the released safeguarded model, feed the original last-layer hidden states through the Inverse Adapter, and compare the recovered hidden states and logits against the base-model outputs on a 500-sample benign mixed evaluation set. The results in Table 4 show perfect top-1 token agreement for all six runs, hidden-state cosine similarity numerically indistinguishable from 1, and very small relative reconstruction error. Additional details on the Inverse Adapter implementation and its practical behavior are provided in Appendix D. Model Method ACC Qwen-14B Base Model 66.0% Inverse Adapter 66.0% Llama-8B Base Model 60.0% Inverse Adapter 60.0% Table 3: Restoration ACC on the Alpaca dataset. In our evaluated setting, the Inverse Adapter matches the original base-model performance on this benchmark, consistent with its role as an analytic forward-restoration map rather than a separate trainable component. Model Safeguard Source Top-1 Agr. ↑ Logits KL ↓ Hidden Cos. ↑ Hidden Rel. L2 ↓ Qwen-14B JailbreakBench 1.000000 4.93e-06 1.000000000 5.91e-06 HarmfulBench 1.000000 2.10e-04 1.000000000 1.04e-03 BeaverTails 1.000000 1.91e-03 1.000000000 2.75e-03 Llama-8B JailbreakBench 1.000000 1.82e-10 1.000000000 1.50e-07 HarmfulBench 1.000000 2.88e-05 1.000000000 6.04e-05 BeaverTails 1.000000 1.70e-05 1.000000000 5.57e-05 Table 4: Inverse-only fidelity on a 500-sample benign mixed evaluation set. For each released safeguarded model, we apply only the Inverse Adapter and compare the recovered outputs against the original base-model hidden states and logits. Across all six runs, top-1 token agreement is perfect, hidden-state cosine similarity is numerically indistinguishable from 1, and hidden relative L2 error remains very small, supporting the claim that the Inverse Adapter almost exactly undoes the cubic-layer distortion. Under the inverse-adapter-plus-extended-null-space regime studied here, strict zeros are practically absent, so this same forward-preservation property extends to essentially all samples while the gradient blocking itself remains the responsibility of the Null Space Cubic Layer. 5.4 Blocking Generalization and Conditional Persistence To better characterize the behavior of the safeguard on unseen harmful data, we distinguish two questions. The first is blocking generalization: whether a safeguard constructed from participating harmful samples, i.e., harmful samples in DforbiddenD_forbidden, can still induce lower ‖hW‖/‖h‖\|hW\|/\|h\| ratios on non-participating harmful samples, i.e., harmful samples in Dtoxic∖DforbiddenD_toxic D_forbidden, drawn from the same harmful distribution. The second is conditional persistence: whether the safeguard remains effective under continued harmful retraining once some harmful samples escape blocking. These two questions are related but not identical. We first examine blocking generalization at a fixed release-time safeguard. Figure 3 visualizes the norm ratio ‖hW‖h‖ \|hW\|\|h\| for different sample groups in the Qwen-14B BeaverTails-H setting. Although non-participating harmful samples are not used to construct the null space, their norm ratios still tend to be smaller than those of safe samples, indicating that the induced protected region extends beyond the participating harmful build set at the representation level. This is the main sense in which the null-space safeguard generalizes beyond DforbiddenD_forbidden. It also clarifies why threshold calibration matters: because the defender controls the release-time threshold, this representation-level separation can be translated into practical blocking coverage on in-distribution harmful samples while preserving high pass rates on safe data. We next consider a boundary case of conditional persistence under continued adaptation, in which the in-distribution harmful samples used for threshold calibration remain inside the protected region while a small fraction of out-of-distribution (OOD) harmful samples falls beyond the threshold. In this setting, the frozen threshold-controlled gate is typically preserved under small updates but can be breached by sufficiently large updates; details are deferred to Appendix G. This yields a safety–utility trade-off through threshold calibration. Lower calibration thresholds reduce the risk of unnecessarily gating safe data but weaken harmful blocking coverage, whereas higher calibration thresholds improve harmful blocking at the cost of gating more safe data. USG should therefore be understood as a release-time calibrated threshold mechanism implemented as a backward gate, whose persistence depends on blocking coverage of harmful fine-tuning signals. Figure 3: Norm-ratio visualization in the Qwen-14B BeaverTails-H setting of participating harmful samples DforbiddenD_forbidden, non-participating harmful samples Dtoxic∖DforbiddenD_toxic D_forbidden, and safe samples. Although the non-participating harmful samples are not used to construct the null space, they still tend to lie closer to the protected region than safe samples, showing a representation-level tendency that supports defender-calibrated threshold-based blocking beyond the build set. 6 Conclusion In conclusion, this paper proposes a Unidirectional Safety Gate implemented by a Null Space Cubic Layer together with an Inverse Adapter, which serves as a defense against malicious downstream fine-tuning in a PPOW setting by blocking the gradient backpropagation of harmful data inside a calibrated protected region under provider-side hardening assumptions. Experimental results across various datasets demonstrate two complementary findings: non-participating but in-distribution harmful data also tend to exhibit lower ‖hW‖/‖h‖\|hW\|/\|h\| ratios than safe data, allowing appropriate defender-calibrated thresholds to extend blocking coverage beyond the participating harmful build set; and under the strict deployment-style setting in which the release threshold is calibrated on the complete defender-held harmful reference set available at release time, the safeguard can keep post-fine-tuning ASR at its pre-release level, although the accompanying safe-pass measurements show that this policy becomes more conservative in harder settings such as BeaverTails-H. In our evaluated restoration setting, the Inverse Adapter also preserves the base model’s forward behavior and regains useful safe-side performance. We hope that this work will inspire future research on architectural safeguards for released LLMs that must remain trainable while preserving core safety guarantees. Limitations Sensitivity of Null Space. The null space is sensitive to the input space; even minor perturbations can render it ineffective. Therefore, hard gradient blocking that relies on the null space, e.g., directly and completely blocking gradient backward, is highly susceptible to variations in the format and form of the input data. More precisely, the persistence of our safeguard depends on whether harmful training samples continue to be blocked. Like other representation-space defenses, USG relies on preserving a specific hidden-state geometry for harmful data. The main vulnerability arises when some harmful data fall outside the coverage of the defense corpus or otherwise escape blocking: those unblocked harmful updates gradually deform the original null-space structure used for blocking and can drive harmful representations back toward an attack-effective manifold. Soft gradient blocking based on the null space represents a promising direction for future research. Dependence on Inverse-Branch Availability. Our strongest forward-preservation claim is tied to the inverse-adapter-plus-extended-null-space regime emphasized in this paper, where exact zeros are practically absent and the inverse branch therefore remains defined for essentially all samples. If a future deployment were to operate closer to the exact-null-space limit, then some hidden states could collapse to strict zero and the analytic inverse would no longer be uniquely defined at those positions. In that regime, preserving exact base-model outputs for every sample would require an additional design beyond the analytic inverse used here. Limited Harmful Sample Number. As the number of harmful samples increases, the stacked harmful hidden-state matrix tends to approach full rank, so a non-trivial common null space may disappear. In that regime, the strict constraint used by our method can become infeasible. An Extended Null Space Selection strategy approximation instead of exact zero singular directions, see Appendix F can partially mitigate this issue by replacing exact null-space constraints with approximate ones. Appendix F shows that exact null-space selection remains feasible for only tens of harmful samples in our evaluated settings, whereas extended null-space selection substantially enlarges the usable sample regime in the BeaverTails/Qwen case under a fixed 95% harmful-block target. However, when the harmful sample size becomes sufficiently large, the resulting projected statistics of harmful and safe samples can overlap, making them difficult to separate reliably with a fixed threshold. Therefore, although Extended Null Space Selection improves robustness under moderate rank pressure, it does not remove the fundamental scalability limit: at large enough harmful-data scale, the method faces a decreasing margin between harmful and safe representations, which weakens discriminability and defense reliability. References Achiam et al. (2023) Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774. Bianchi et al. (2023) Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Röttger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. 2023. Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions. arXiv preprint arXiv:2309.07875. Cai et al. (2025) Weilin Cai, Juyong Jiang, Fan Wang, Jing Tang, Sunghun Kim, and Jiayi Huang. 2025. A survey on mixture of experts in large language models. IEEE Transactions on Knowledge and Data Engineering. Cao et al. (2026) Zhiyuan Cao, Zeyu Ma, Chenhao Yang, Han Zheng, and Mingang Chen. 2026. Osnip: Breaking the privacy-utility-efficiency trilemma in llm inference via obfuscated semantic null space. arXiv preprint arXiv:2601.22752. Casper et al. (2024) Stephen Casper, Lennart Schulze, Oam Patel, and Dylan Hadfield-Menell. 2024. Defending against unforeseen failure modes with latent adversarial training. arXiv preprint arXiv:2403.05030. Chao et al. (2024) Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, and 1 others. 2024. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. Advances in Neural Information Processing Systems, 37:55005–55029. Chen et al. (2026) Junqi Chen, Sirui Chen, and Chaochao Lu. 2026. Can post-training transform llms into causal reasoners? In Findings of the Association for Computational Linguistics: ACL 2026, pages 17020–17038. Fang et al. (2024) Junfeng Fang, Houcheng Jiang, Kun Wang, Yunshan Ma, Shi Jie, Xiang Wang, Xiangnan He, and Tat-Seng Chua. 2024. Alphaedit: Null-space constrained knowledge editing for language models. arXiv preprint arXiv:2410.02355. Grattafiori et al. (2024) Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, and 1 others. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783. He et al. (2026a) Zhida He, Xia Hu, Baichen Le, Chunxiao Li, Jiajia Li, Lijun Li, Chaochao Lu, Jing Shao, Youbang Sun, Hua Tang, and 1 others. 2026a. An early warning of emerging biosecurity risks in frontier llms. arXiv preprint arXiv:2607.18056. He et al. (2026b) Zhida He, Xiaoyu Wen, Han Qi, Ziyuan Zhou, Peng Yu, Xingcheng Xu, Dongrui Liu, Xia Hu, Chaochao Lu, and Qiaosheng Zhang. 2026b. Not all turns matter: Credit assignment for multi-turn jailbreaking. arXiv preprint arXiv:2605.08778. Hu et al. (2025a) Guoqing Hu, An Zhang, Shuo Liu, Zhibo Cai, Xun Yang, and Xiang Wang. 2025a. Alphafuse: Learn id embeddings for sequential recommendation in null space of language embeddings. In Proceedings of the 48th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 1614–1623. Hu et al. (2025b) Zixuan Hu, Li Shen, Zhenyi Wang, Yongxian Wei, and Dacheng Tao. 2025b. Adaptive defense against harmful fine-tuning for large language models via bayesian data scheduler. arXiv preprint arXiv:2510.27172. Huang et al. (2024a) Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, and Ling Liu. 2024a. Booster: Tackling harmful fine-tuning for large language models via attenuating harmful perturbation. arXiv preprint arXiv:2409.01586. Huang et al. (2024b) Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, and Ling Liu. 2024b. Harmful fine-tuning attacks and defenses for large language models: A survey. arXiv preprint arXiv:2409.18169. Huang et al. (2024c) Tiansheng Huang, Sihao Hu, and Ling Liu. 2024c. Vaccine: Perturbation-aware alignment for large language model. The Thirty-Eighth Annual Conference on Neural Information Processing Systems …. Ji et al. (2023) Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2023. Beavertails: Towards improved safety alignment of llm via a human-preference dataset. Advances in Neural Information Processing Systems, 36:24678–24704. Jiang and Pan (2025) Weisen Jiang and Sinno Jialin Pan. 2025. Metadefense: Defending finetuning-based jailbreak attack before and during generation. arXiv preprint arXiv:2510.07835. Li et al. (2026) Yu Li, Yuenan Hou, Yingmei Wei, Yanming Guo, and Chaochao Lu. 2026. Evodefense: Co-evolving black-box defense with large language models. arXiv preprint arXiv:2605.31140. Lin et al. (2025) Lizhi Lin, Honglin Mu, Zenan Zhai, Minghan Wang, Yuxia Wang, Renxi Wang, Junjie Gao, Yixuan Zhang, Wanxiang Che, Timothy Baldwin, and 1 others. 2025. Against the achilles’ heel: A survey on red teaming for generative models. Journal of Artificial Intelligence Research, 82:687–775. Liu et al. (2024) Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, and 1 others. 2024. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437. Liu et al. (2025) Zihan Liu, Yizhen Wang, Rui Wang, and Sai Wu. 2025. Dualguard: A parameter space transformation approach for bidirectional defense in split-based llm fine-tuning. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 17065–17080. Loshchilov and Hutter (2017) Ilya Loshchilov and Frank Hutter. 2017. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101. Mazeika et al. (2024) Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, and 1 others. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249. Melamed et al. (2024) Rimon Melamed, Lucas Hurley McCabe, Tanay Wakhare, Yejin Kim, H Howie Huang, and Enric Boix-Adsera. 2024. Prompts have evil twins. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 46–74. Mroueh (2025) Youssef Mroueh. 2025. Reinforcement learning with verifiable rewards: Grpo’s effective loss, dynamics, and success amplification. arXiv preprint arXiv:2503.06639. Nguyen et al. (2026) Quoc Minh Nguyen, Trung Le, Jing Wu, Anh Tuan Bui, and Mehrtash Harandi. 2026. Antibody: Strengthening defense against harmful fine-tuning for large language models via attenuating harmful gradient influence. In International Conference on Learning Representations (ICLR). ArXiv preprint arXiv:2603.00498. Purpura et al. (2025) Alberto Purpura, Sahil Wadhwa, Jesse Zymet, Akshay Gupta, Andy Luo, Melissa Kazemi Rad, Swapnil Shinde, and Mohammad Shahed Sorower. 2025. Building safe genai applications: An end-to-end overview of red teaming for large language models. In Proceedings of the 5th Workshop on Trustworthy NLP (TrustNLP 2025), pages 335–350. Qi et al. (2026) Weiwei Qi, Zefeng Wu, Zhilin Guo, Tianhang Zheng, Chaochao Lu, Liang He, Zhan Qin, and Kui Ren. 2026. Darwin: Evolving jailbreak adversary and guardrail for llm safety evaluation and protection. arXiv preprint arXiv:2607.19829. Qi et al. (2024a) Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2024a. Safety alignment should be made more than just a few tokens deep. arXiv preprint arXiv:2406.05946. Qi et al. (2024b) Xiangyu Qi, Boyi Wei, Nicholas Carlini, Yangsibo Huang, Tinghao Xie, Luxi He, Matthew Jagielski, Milad Nasr, Prateek Mittal, and Peter Henderson. 2024b. On evaluating the durability of safeguards for open-weight llms. arXiv preprint arXiv:2412.07097. Rosati et al. (2024) Domenic Rosati, Jan Wehner, Kai Williams, Łukasz Bartoszcze, David Atanasov, Robie Gonzales, Subhabrata Majumdar, Carsten Maple, Hassan Sajjad, and Frank Rudzicz. 2024. Representation noising effectively prevents harmful fine-tuning on llms. arXiv preprint arXiv:2405.14577, 24. Shanghai AI Lab (2025) Shanghai AI Lab. 2025. Safework-r1: Coevolving safety and intelligence under the ai-45 law. arXiv preprint arXiv:2507.18576. Su et al. (2025) Yi Su, Dian Yu, Linfeng Song, Juntao Li, Haitao Mi, Zhaopeng Tu, Min Zhang, and Dong Yu. 2025. Crossing the reward bridge: Expanding rl with verifiable rewards across diverse domains. arXiv preprint arXiv:2503.23829. Sun et al. (2025) Wei Sun, Tingyu Qu, Mingxiao Li, Jesse Davis, and Marie Francine Moens. 2025. Mitigating negative interference in multilingual knowledge editing through null-space constraints. In Findings of the Association for Computational Linguistics: ACL 2025, pages 8796–8810. Taori et al. (2023) Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B Hashimoto. 2023. Stanford alpaca: An instruction-following llama model. Wei et al. (2024) Boyi Wei, Kaixuan Huang, Yangsibo Huang, Tinghao Xie, Xiangyu Qi, Mengzhou Xia, Prateek Mittal, Mengdi Wang, and Peter Henderson. 2024. Assessing the brittleness of safety alignment via pruning and low-rank modifications. arXiv preprint arXiv:2402.05162. Wei et al. (2022) Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, and 1 others. 2022. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824–24837. Wen et al. (2026) Xiaoyu Wen, Zhida He, Han Qi, Ziyu Wan, Zhongtian Ma, Ying Wen, Tianhang Zheng, Xingcheng Xu, Chaochao Lu, and Qiaosheng Zhang. 2026. Magic: A co-evolving attacker-defender adversarial game for robust llm safety. arXiv preprint arXiv:2602.01539. Weng et al. (2025) Fenghua Weng, Chaochao Lu, Xia Hu, Wenqi Shao, and Wenjie Wang. 2025. Think-reflect-revise: A policy-guided reflective framework for safety alignment in large vision language models. arXiv preprint arXiv:2512.07141. Wu et al. (2026) Zefeng Wu, Weiwei Qi, Jielong Chen, Tianhang Zheng, Di Hong, Chaochao Lu, Liang He, Zhan Qin, and Kui Ren. 2026. Datashield: Uncovering risky fine-tuning data across llms through consensus subspace alignment. arXiv preprint arXiv:2607.15081. Yang et al. (2025a) An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025a. Qwen3 technical report. arXiv preprint arXiv:2505.09388. Yang et al. (2025b) Le Yang, Ziwei Zheng, Boxu Chen, Zhengyu Zhao, Chenhao Lin, and Chao Shen. 2025b. Nullu: Mitigating object hallucinations in large vision-language models via halluspace projection. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 14635–14645. Yi et al. (2024) Xin Yi, Shunfan Zheng, Linlin Wang, Xiaoling Wang, and Liang He. 2024. A safety realignment framework via subspace-oriented model fusion for large language models. Knowledge-Based Systems, 306:112701. Zeng et al. (2026) Churui Zeng, Weiwei Qi, Kedong Xiu, Tianhang Zheng, Chaochao Lu, Liang He, Zhan Qin, and Kui Ren. 2026. Trace: Task-aware adaptive self-evolving agentic jailbreaking. arXiv preprint arXiv:2605.30883. Zhang et al. (2026a) Dongcheng Zhang, Yi Zhang, Yuxin Chen, An Zhang, Xiang Wang, and Chaochao Lu. 2026a. Self-reset: Learning to self-recover from unsafe reasoning trajectories. arXiv preprint arXiv:2605.08936. Zhang et al. (2026b) Yi Zhang, Yuxin Chen, Leheng Sheng, Dongcheng Zhang, Chaochao Lu, Xiang Wang, and An Zhang. 2026b. Internalizing safety understanding in large reasoning models via verification. arXiv preprint arXiv:2605.08930. Zhang et al. (2025) Yize Zhang, Meiqi Chen, Sirui Chen, Bo Peng, Yanxi Zhang, Tianyu Li, and Chaochao Lu. 2025. Causight: Learning to supersense for visual causal discovery. arXiv preprint arXiv:2512.01827. Zhu et al. (2024) Minjun Zhu, Linyi Yang, Yifan Wei, Ningyu Zhang, and Yue Zhang. 2024. Locking down the finetuned llms safety. arXiv preprint arXiv:2410.10343. Zong et al. (2024) Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. 2024. Safety fine-tuning at (almost) no cost: A baseline for vision large language models. arXiv preprint arXiv:2402.02207. Appendix A Threshold Selection As discussed above, threshold selection mediates the trade-off between safety and continued trainability. Conceptually, the exact null-space analysis defines an ideal limit in which harmful samples satisfy hW=hW=0hW=hW T=0 and are therefore blocked by exact gradient cancellation. In the practical implementation, we realize this as a backward gate on the norm ratio r(h)=‖hW‖/‖h‖r(h)=\|hW\|/\|h\|: g(h)=[r(h)≤τ],∂ℒ∂h←(1−g(h))∂ℒ∂h.g(h)=1[r(h)≤τ], ∂ h←(1-g(h)) ∂ h. (17) This threshold mechanism is an operational approximation to the ideal exact-null-space case for two concrete reasons: first, exact common-null-space construction becomes capacity-limited as the harmful sample set grows as mentioned above; second, finite-precision computation leaves numerically small but non-zero residual gradients, and these can still be amplified during backpropagation. The optimal threshold therefore depends on the model architecture, the harmful-data distribution, and the difficulty of the safe/alignment data. For example, using Alpaca as the safe dataset yields different behavior from using safe samples from BeaverTails, which is more challenging and therefore shifts the operating threshold between safe and harmful samples. Our intended deployment protocol is not to keep retuning the threshold after release. Instead, the provider uses pre-release safe/alignment fine-tuning as a calibration stage and fixes a stable release threshold before deployment; the threshold is implemented post-release as a backward gate rather than an online decision rule. In our experiments, we assess threshold quality using safe pass rate. During calibration, thresholds are selected by a harmful-ratio rule on the defender-held harmful reference set. Let r1≤r2≤⋯≤rnr_1≤ r_2≤·s≤ r_n denote the sorted norm ratios ‖hW‖/‖h‖\|hW\|/\|h\| of the harmful reference samples at a given checkpoint. For a target harmful block rate b∈(0,1]b∈(0,1], we choose the calibration threshold as the empirical harmful quantile τb=r⌈bn⌉ _b=r_ bn , so that approximately a fraction b of harmful reference samples activates the backward gate. The strict 100% release policy used in the main text is the limiting case b=1b=1, i.e., the threshold is set to the maximum observed ratio over all defender-held harmful reference samples, including harmful samples that did not participate in constructing the null space. The resulting 100%-block calibration thresholds are shown in Table 5, and the corresponding visualizations are shown in Figure 4. These thresholds should be interpreted as intermediate operating points produced by the pre-release calibration procedure rather than as final release thresholds. The visualizations further show that BeaverTails is the most challenging setting: as the harmful sample set grows, harmful and safe statistics become harder to separate, and more held-out harmful samples approach the safe-side threshold region. This marks an upper-bound regime for blocking generalization under a fixed threshold and motivates the extended-null-space analysis discussed above. (a) Qwen3-14B Threshold on JailbreakBench (b) Qwen3-14B Threshold on HarmfulBench (c) Qwen3-14B Threshold on BeaverTails-H (d) Llama-3.1-8B Threshold on JailbreakBench (e) Llama-3.1-8B Threshold on HarmfulBench (f) Llama-3.1-8B Threshold on BeaverTails-H Figure 4: Visual Threshold Selection Appendix B Null Space Stability during Safe Training As discussed earlier, the persistence of our method under harmful retraining depends on whether harmful samples continue to be blocked: if all harmful data are blocked, the safeguard can remain effective, whereas failure arises when some harmful samples escape blocking and inject gradients. We therefore do not revisit harmful fine-tuning here. Instead, we study the complementary question that is important for practical downstream use: whether continued safe training, unrelated to harmful content, also breaks the alignment induced by the cubic layer. To answer this question, we continue safe training on Alpaca in a front-Transformer setting in which the Inverse Adapter remains frozen, only the last five Transformer layers are updated, and the cubic layer is inserted after the last Transformer layer. Training runs for 4 epochs with a learning rate of 4×10−54× 10^-5, cosine scheduling, 3% warmup, no weight decay, gradient clipping at 1.0, BF16 precision, a per-device batch size of 1, gradient accumulation of 8 steps, and a maximum sequence length of 1024. We monitor the model every 20 training steps. We fix the threshold on the norm ratio ‖hW‖/‖h‖\|hW\|/\|h\| to obtain a 95% harmful block rate at the beginning and then evaluate the resulting safe pass rate in Alpaca. We use JailbreakBench, HarmfulBench, and 1000 samples from BeaverTails-H as harmful reference datasets to assess whether harmful and safe samples remain distinguishable throughout continued benign training. Figure 5 shows that the tuned threshold changes noticeably early in training but becomes relatively stable later across all six model–dataset settings. This suggests that benign adaptation shifts the hidden-state geometry without destroying the operating threshold induced by the cubic layer. Figure 6 further shows that the corresponding backward gate remains practically useful throughout training: the safe pass rate stays at 100% for all monitored checkpoints in Qwen3-14B on JailbreakBench and HarmfulBench and in Llama-3.1-8B on JailbreakBench; it remains between 98% and 100% for Qwen3-14B on BeaverTails-H and between 95% and 100% for Llama-3.1-8B on HarmfulBench; and even in the hardest setting, Llama-3.1-8B on BeaverTails-H, it remains above 75%. Overall, these results show that safe training unrelated to harmful content does not collapse the alignment into indiscriminate rejection and instead preserves a clear safe–harmful separation under a stringent operating point. The ratio-scatter comparisons in Figures 7 and 8 are consistent with this interpretation. In each row, the left panel shows the model before continued safe training and the right panel shows the same model after training completes under the above configuration. Although the empirical threshold boundary shifts during training, safe samples remain largely above the tuned threshold, whereas harmful samples remain near or below it. Even in the more difficult settings, where the margin narrows, the qualitative separation is preserved. Taken together, these results suggest that continued benign fine-tuning does not by itself destroy the null-space alignment and instead provides a natural calibration phase for fixing a stable release-time threshold. (a) Qwen3-14B on JailbreakBench. (b) Qwen3-14B on HarmfulBench. (c) Qwen3-14B on BeaverTails-H. (d) Llama-3.1-8B on JailbreakBench. (e) Llama-3.1-8B on HarmfulBench. (f) Llama-3.1-8B on BeaverTails-H. Figure 5: Threshold trajectories during continued safe training. For each model–dataset pair, we tune the threshold on ‖hW‖/‖h‖\|hW\|/\|h\| at every monitored checkpoint to target a 95% harmful block rate. Across all six settings, the threshold undergoes an early adjustment phase and then becomes relatively stable later in training. (a) Qwen3-14B on JailbreakBench. (b) Qwen3-14B on HarmfulBench. (c) Qwen3-14B on BeaverTails-H. (d) Llama-3.1-8B on JailbreakBench. (e) Llama-3.1-8B on HarmfulBench. (f) Llama-3.1-8B on BeaverTails-H. Figure 6: Safe pass rate during continued safe training under thresholds tuned to maintain a 95% harmful block rate. The safe pass rate remains at 100% for all monitored checkpoints in three settings, remains nearly perfect in two additional settings, and stays above 75% even in the hardest case, showing that safe and harmful samples remain distinguishable under a stringent blocking constraint. (a) Qwen3-14B on JailbreakBench. (b) Qwen3-14B on HarmfulBench. (c) Qwen3-14B on BeaverTails-H. Figure 7: Ratio-scatter comparisons for Qwen3-14B before and after continued safe training. Within each row, the left panel shows the model before training and the right panel shows the same model after training completes. Across all three harmful-data settings, the tuned threshold shifts upward during training, but the qualitative separation between safe and harmful samples is largely preserved. (a) Llama-3.1-8B on JailbreakBench. (b) Llama-3.1-8B on HarmfulBench. (c) Llama-3.1-8B on BeaverTails-H. Figure 8: Ratio-scatter comparisons for Llama-3.1-8B before and after continued safe training. Within each row, the left panel shows the model before training and the right panel shows the same model after training completes. The empirical boundary shifts during training, but the safe–harmful separation remains visible in all three settings, with the margin narrowing most noticeably on BeaverTails-H. Appendix C Cubic Layer Gradient Calculation The forward pass of a cubic layer is defined as follows: f(h) f(h) =((hW)h)h, =((hW)h T)h, (A1) h∈ℝB×M×N,W∈ℝN×N. h ^B× M× N, W ^N× N. For a given loss function L(h)L(h), we aim to compute ∂L(h)∂h ∂ L(h)∂ h. Let ∂L(h)∂f(h)=GB. ∂ L(h)∂ f(h)=G_B. (A2) The differential of L can be expressed as dL=tr((∂L(h)∂h)dh)=tr(GBdf),dL=tr ( ( ∂ L(h)∂ h ) Tdh )=tr (G_B Tdf ), (A3) where df=∂f∂h:dhdf= ∂ f∂ h:dh, with the colon denoting the double dot product (Frobenius inner product). Set A=hW,B=h,C=h,A=hW, B=h T, C=h, (A4) so that f(h)=(AB)C.f(h)=(AB)C. (A5) Taking the differential, df df =d((AB)C) =d((AB)C) (A6) =d(AB)C+ABdC =d(AB)C+AB\,dC =dABC+AdBC+ABdC. =dA\,BC+A\,dB\,C+AB\,dC. Substituting the expressions for dAdA, dBdB, and dCdC: dA=dhW,dB=dh,dC=dh,dA=dhW, dB=dh T, dC=dh, (A7) we obtain df=(dhW)BC+AdhC+ABdh.df=(dhW)BC+A\,dh TC+AB\,dh. (A8) Since dL=tr(GBdf)dL=tr(G_B Tdf), it follows that dL dL =tr(GB(dhW)BC) =tr (G_B T(dhW)BC ) (A9) +tr(GBAdhC) +tr (G_B TA\,dh TC ) +tr(GBABdh). +tr (G_B TAB\,dh ). We now rewrite each term in the form tr((∂L∂h)dh)tr (( ∂ L∂ h) Tdh ) to extract the gradient. First term: tr(GB(dhW)BC)=tr(GBdhWBC).tr (G_B T(dhW)BC )=tr (G_B TdhWBC ). (A10) Using the cyclic property of the trace, tr(UV)=tr(VU)tr(UV)=tr(VU), tr((GBdh)(WBC)) ((G_B Tdh)(WBC) ) =tr((WBC)(GBdh)) =tr ((WBC)(G_B Tdh) ) (A11) =tr((WBCGB)dh). =tr ((WBCG_B T)dh ). Thus, the contribution to the gradient from the first term is M1=(WBCGB)=GBhhW.M_1=(WBCG_B T) T=G_Bh ThW T. (A12) Second term: tr(GBAdhC).tr (G_B TA\,dh TC ). (A13) First, move dhdh T to the left using cyclic permutations: tr((GBA)(dhC))=tr((dhC)(GBA)).tr ((G_B TA)(dh TC) )=tr ((dh TC)(G_B TA) ). (A14) Then apply the identity tr(dhM)=tr(dhM)=tr(Mdh)tr(dh TM)=tr(dhM T)=tr(M Tdh) with M=CGBAM=CG_B TA. This yields tr(dhCGBA) (dh TCG_B TA ) =tr(dh(CGBA)) =tr (dh(CG_B TA) T ) (A15) Therefore, M2=CGBA=hGBhW.M_2=CG_B TA=hG_B ThW. (A16) Third term: tr(GBABdh)tr (G_B TAB\,dh ) (A17) is already in the desired form, so M3 M_3 =(GBAB) =(G_B TAB) T (A18) =hWhGB. =hW Th TG_B. Finally, combining all contributions, ∂L(h)∂h=M1+M2+M3, ∂ L(h)∂ h=M_1+M_2+M_3, (A19) where M1 M_1 =(GBh)(hW), =(G_Bh T)(hW T), (A20) M2 M_2 =(hGB)(hW), =(hG_B T)(hW), M3 M_3 =hWhGB. =hW Th TG_B. Figure 9: Hidden states matrix rank increases with sample size Appendix D Details of Inverse Adapter Implementation The Inverse Adapter cannot be inserted before the Null Space Cubic Layer, because doing so would alter the layer-input hidden states used by the cubic-layer null-space construction. Therefore, the Inverse Adapter is placed strictly after the Null Space Cubic Layer and serves only as a forward-restoration component. Its role is distinct from that of the safeguard itself. The Null Space Cubic Layer is the component that realizes gradient blocking for harmful samples inside the protected region. The Inverse Adapter does not contribute additional blocking; instead, it analytically compensates for the deterministic rescaling introduced by the cubic layer so that the released model’s outputs remain aligned with those of the base model. More concretely, for each token position the cubic layer outputs y=shy=sh, where s=hWh≥0s=hWh T≥ 0. Whenever s>0s>0, the inverse map is uniquely defined and recovers the original hidden state through h=y(yWy)−1/3.h=y(yWy T)^-1/3. (A21) Therefore, whenever the inverse branch is defined, both safe samples and harmful samples can in principle preserve the same forward outputs as the base model, which means preserving both the base model’s utility and its original alignment behavior. In the inverse-adapter-plus-extended-null-space regime studied in this paper, strict zeros are practically absent: exact common-null-space directions are replaced by smallest-singular-value directions, and finite-precision computation leaves suppressed but non-zero activations rather than mathematically exact zeros for almost all samples. As a result, the analytic inverse remains applicable to essentially all samples in our evaluated setting, so the Inverse Adapter still receives valid inputs outside the thresholded blocked regime and the forward behavior of both safe and harmful inputs is preserved up to negligible numerical error. Under this interpretation, the practical utility question is dominated by whether benign data remain outside the protected region rather than by inverse reconstruction error itself. The cubic layer is responsible for deciding which samples have their gradients blocked, while the Inverse Adapter is responsible for keeping the forward pass close to the original base-model computation. Appendix E A Preliminary Parameter-Fusion Instantiation of the Protected-Release Assumption The main paper studies the blocking mechanism itself under the PPOW setting. As one feasible hardening path for this assumption, we further explore parameter fusion, in which the explicit safeguard-facing computation is absorbed into downstream Transformer computation to reduce the extent to which the released artifact exposes a locally detachable module. Importantly, the goal of fusion is not to improve the blocking mechanism itself, but to provide a more entangled release form that may raise the cost of naive structural removal. Concretely, our preliminary fusion path targets the computation immediately downstream of the cubic layer: we treat the explicit Inverse Adapter together with the following Transformer block as the teacher-side protected computation, and train a single fused Transformer-like block to reproduce their combined behavior. In this way, the released artifact no longer needs to expose the original explicit safeguard-facing interface in modular form. If the fused block has already co-adapted to the safeguarded hidden-state manifold, then simply deleting the explicit safeguarded transformation is no longer a purely local edit, because the downstream fused computation itself has been fit against that safeguarded geometry. At the same time, this study should be interpreted as a preliminary feasibility check rather than as a fully optimized hardening pipeline. In our current setting, the fused block is fitted with limited calibration/distillation data and limited optimization budget, so it does not yet cover the full hidden-state manifold induced by the safeguarded model. As a result, the current fusion quality should not be read as the best achievable fidelity–hardening trade-off; rather, it provides an initial demonstration that the protected computation can in principle be absorbed into downstream Transformer computation while still motivating the protected-release threat model used in the main paper. Model Dataset Variant Threshold Selection Safe Pass Rate Harmful Block Rate Qwen JailbreakBench 0.00049 100.0% 100.0% Qwen HarmfulBench 0.0021 100.0% 100.0% Qwen BeaverTails 0.0036 79.0% 100.0% Llama JailbreakBench 0.00044 100.0% 100.0% Llama HarmfulBench 0.0031 100.0% 100.0% Llama BeaverTails 0.0046 69.0% 100.0% Table 5: Calibration Thresholds in the 100%-Block Experimental Setting Appendix F Extended Null Space Selection As shown in Figure 9, when the number of harmful samples used to build ShS_h increases, the stacked hidden-state matrix tends to become full rank in practice, so nullcommon(Sh)null_common(S_h) can become trivial and the strict constraint hW=hW=0hW=hW T=0 may have no non-zero solution. To keep the same objective while avoiding this rank-collapse issue, we replace strict common-null-space selection with a smallest-singular-direction approximation. Concretely, let X denote the stacked matrix formed from vectors in ShS_h, and compute X=UΣVX=U V T. Instead of taking basis vectors from the exact null space (singular value exactly zero), we take the right singular vectors associated with the smallest singular values to form VsmallV_small, and set W=VsmallVsmallW=V_smallV_small T (or its symmetric equivalent) so that, for h∈Shh∈ S_h, ‖hW‖\|hW\| and ‖hW‖\|hW T\| are minimized rather than forced to be exactly zero. This yields an extended null-space criterion that is numerically stable under large-sample, near-full-rank conditions, while preserving the gradient-blocking mechanism through small residual factors in the cubic-layer gradient terms. F.1 Sample Limit for Exact Null-space Selection For exact null-space selection, the key question is how many harmful training examples can be incorporated before the shared null space collapses. To measure this limit, we construct harmful hidden-state matrices from the exact same prompt/response formatting used in the null-space pipeline for each model–dataset pair. For every harmful example, we run the model forward, collect the layer-input hidden states for the target Cubic layer, and stack the token-level hidden states of the first n harmful samples into a single matrix. We then perform exact null-space extraction on this stacked matrix and increase n until the extracted null space becomes empty. We define the sample limit as the largest number of harmful samples for which the exact construction still yields a non-trivial null space, and the corresponding token limit as the cumulative number of tokens contained in those samples. In this way, the table reports the maximal harmful-data scale under which exact null-space selection remains feasible. Geometrically, this behavior is expected. As more harmful samples are added, the stacked hidden-state matrix spans a progressively larger subspace and its rank correspondingly increases. Once the harmful hidden states become sufficiently diverse, the intersection of their orthogonal complements rapidly shrinks, so the common null space approaches zero dimension. At that point, the exact symmetric matrix construction satisfying hW=hW=0hW=hW T=0 becomes trivial or disappears entirely. Therefore, the sample limit for exact null-space selection is fundamentally governed by rank growth and null-space degeneracy: beyond a certain harmful-sample scale, the exact construction can no longer provide a meaningful non-zero solution. Table 6 shows that this feasible region is in fact quite small for both model families. First, the exact construction supports only tens of harmful samples rather than hundreds, confirming that exact null-space selection is intrinsically capacity-limited. Second, the limit depends strongly on dataset diversity: HarmfulBench reaches the limit the fastest for both Qwen and Llama, indicating that its harmful hidden states span the relevant subspace more efficiently and thus eliminate the shared null space with fewer examples. By contrast, JailbreakBench permits the largest exact null-space construction, while BeaverTails lies in between. Third, the same trend is reflected in token space: even when measured by cumulative token count instead of sample count, the feasible region remains narrow, typically only a few thousand to roughly ten thousand tokens. Overall, these results show that exact null-space selection is structurally fragile at scale, which motivates moving to extended / approximate null-space constructions when broader harmful coverage is required. Model Dataset Sample Limit Token Limit Qwen JailbreakBench 91 11744 Qwen HarmfulBench 14 5503 Qwen BeaverTails 45 8067 Llama JailbreakBench 73 9239 Llama HarmfulBench 13 4671 Llama BeaverTails 35 6256 Table 6: Maximum harmful-data scale at which exact null-space selection remains non-trivial. For each model–dataset pair, we increase the number of harmful samples used to build the stacked hidden-state matrix and report the largest sample count for which the exact null space is still non-empty. Token limit reports the corresponding cumulative token count of those harmful samples. The small limits across all settings show that exact null-space selection quickly degenerates as harmful hidden-state diversity increases. F.2 Sample Limit for Extended Null Space Selection For extended null-space selection, the exact null-space degeneracy described above is alleviated by replacing zero-singular-value directions with smallest-singular-value directions. As a result, its sample limit is no longer best defined by whether the exact symmetric matrix construction exists, but rather by how much useful safe behavior can still be preserved under a fixed safety requirement. Accordingly, we adopt a utility-oriented operational definition of sample limit for the extended setting. Specifically, we first determine a build-time threshold that enforces a 95% harmful block rate on the participating harmful samples and then evaluate the resulting held-out safe pass rate. This metric asks a concrete question: as more harmful samples are used to construct the extended null space, how much safe-data utility can still be retained while maintaining a stringent safety target? Under this definition, larger harmful build sets are not automatically better. If the threshold chosen to satisfy the build-time 95% harmful block criterion leads to a declining held-out safe pass rate, then the usable capacity of the construction is approaching its limit. We therefore use the safe-pass-rate curve under the fixed 95% safety target to characterize the sample limit of extended null-space selection, and compare it against exact null-space selection to determine which method better delays the onset of performance degradation. We additionally report the corresponding held-out harmful block rate to verify that the lower ratio tendency also extends beyond the build set strongly enough to support threshold-based blocking on held-out harmful data. Given the limited sample sizes of JailbreakBench and HarmfulBench, we demonstrate the sample capacity of the extended null space method using the Qwen3-14B model on the BeaverTails dataset. The threshold for each method is selected to achieve a 95% harmful block rate while maximizing the safe sample pass rate. As shown in Figure 10, the extended null space method maintains a 100% safe pass rate with approximately 200 samples, and still preserves over 60% safe pass rate even with 500 samples. In this evaluated BeaverTails/Qwen3-14B setting, this indicates markedly higher sample capacity than the Exact Null-space Selection approach. Figure 10: Safe sample pass rate (with 95% harmful block rate) as a function of the number of participating harmful samples on the BeaverTails dataset, evaluated with the Qwen3-14B model. The extended null space method maintains 100% safe pass rate at 200 samples and over 60% at 500 samples, substantially outperforming Exact Null-space Selection. Appendix G Frozen-Threshold Stability under Incomplete OOD Coverage The main paper focuses on a strict frozen-threshold release regime in which the calibrated threshold fully blocks the relevant harmful reference set used for deployment-style evaluation. Here we study a more conservative boundary case on Qwen3-14B with BeaverTails-H: the frozen threshold is fixed from the strict 100% coverage reference run, but the subsequent continued training data are benign yet distribution-shifted with respect to the release-time calibration set. This setting lets us test whether the same threshold-controlled gate remains stable under such adaptation, without any online threshold retuning. Table 7 summarizes the final monitored operating points. The strict 100% reference run remains stable throughout training, with safe pass rate 0.79 and harmful block rate 1.00 at the final checkpoint. Under incomplete OOD coverage with learning rate 1×10−51× 10^-5, the behavior remains nearly unchanged, ending at safe pass rate 0.78 and harmful block rate 1.00. At learning rate 4×10−54× 10^-5, the harmful block rate still remains at 1.00, but the safe pass rate decreases to 0.59, indicating that the backward gate induced by the frozen threshold remains active but becomes more conservative on safe samples. By contrast, at learning rate 3×10−43× 10^-4, the final safe pass rate rises to 1.00 while the harmful block rate drops to 0.00, showing that the original harmful–safe separation no longer remains stable in this high-update regime. Figure 11 shows the corresponding dynamics over training. The strict 100% reference run is flat across all monitored checkpoints, and the 1×10−51× 10^-5 run stays close to that reference trajectory. The 4×10−54× 10^-5 run preserves harmful blocking but gradually shifts toward lower safe pass rate, whereas the 3×10−43× 10^-4 run rapidly loses harmful blocking after only a few monitored steps. Figure 12 is consistent with this interpretation: the ratio-scatter geometry remains visually similar for the strict reference and 1×10−51× 10^-5 runs, compresses toward the threshold boundary at 4×10−54× 10^-5, and collapses at 3×10−43× 10^-4 so that the frozen threshold no longer cleanly separates harmful from safe samples. Taken together, these results support a conservative interpretation of fixed-threshold deployment. When the release-time threshold is calibrated with complete harmful coverage, the corresponding backward gate can remain stable under mild continued training. When continued adaptation is OOD with respect to the release-time calibration set, however, stability becomes update-dependent: small updates can preserve the threshold-controlled gate, intermediate updates can make it more conservative, and sufficiently large updates can erase the original harmful–safe separation. Setting LR Final Safe Pass Final Harmful Block threshold policy – 0.79 1.00 Frozen threshold 1×10−51× 10^-5 0.78 1.00 Frozen threshold 4×10−54× 10^-5 0.59 1.00 Frozen threshold 3×10−43× 10^-4 1.00 0.00 Table 7: Final monitored operating points on Qwen3-14B with BeaverTails-H under a fixed strict-100 release threshold. Mild benign distribution shift preserves the reference operating point, moderate learning rate reduces safe pass while keeping full harmful blocking, and aggressive learning rate destroys the original harmful–safe separation. (a) Strict100 reference. (b) Frozen threshold, lr=1×10−5lr=1× 10^-5. (c) Frozen threshold, lr=4×10−5lr=4× 10^-5. (d) Frozen threshold, lr=3×10−4lr=3× 10^-4. Figure 11: Safe-pass and harmful-block trajectories under a fixed strict-100 release threshold. The strict reference run and the 1×10−51× 10^-5 OOD run remain close to their initial operating points, the 4×10−54× 10^-5 run keeps harmful blocking but sacrifices safe pass rate, and the 3×10−43× 10^-4 run rapidly loses harmful blocking. (a) Strict100 reference. (b) Frozen threshold, lr=1×10−5lr=1× 10^-5. (c) Frozen threshold, lr=4×10−5lr=4× 10^-5. (d) Frozen threshold, lr=3×10−4lr=3× 10^-4. Figure 12: Ratio-scatter comparisons at initialization and the final monitored step under a fixed strict-100 release threshold. The strict reference and 1×10−51× 10^-5 runs preserve the original safe–harmful separation, the 4×10−54× 10^-5 run pushes safe samples toward the threshold boundary, and the 3×10−43× 10^-4 run collapses the separation so that the frozen threshold no longer cleanly separates harmful from safe samples.