Paper deep dive
From Defender to Devil? Unintended Risk Interactions Induced by LLM Defenses
Xiangtao Meng, Tianshuo Cong, Li Wang, Wenyu Chen, Zheng Li, Shanqing Guo, Xiaoyun Wang
Models: DAMA-7B, Llama-2-7B, Mistral
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%
Last extracted: 3/11/2026, 1:09:29 AM
Summary
The paper introduces CrossRiskEval, a framework to evaluate unintended interactions between LLM defense strategies across safety, fairness, and privacy dimensions. It identifies that defenses targeting one risk often induce measurable, asymmetric effects on others, driven by 'conflict-entangled neurons'—internal representations that contribute oppositely to different risks.
Entities (6)
Relation Signals (3)
CrossRiskEval → evaluates → LLM
confidence 100% · we propose CrossRiskEval, a framework that systematically characterizes how a defense designed for one risk (e.g., safety) affects others
Defense strategies → influences → Risk dimensions
confidence 95% · defenses targeting a single risk often cause measurable effects on other risks
Conflict-entangled neurons → causes → Unintended risk interactions
confidence 90% · they arise from conflict-entangled neurons, which are shared internal representations that contribute in opposite ways to different risks
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large Language Models (LLMs) have shown remarkable performance across various applications, but their deployment in real-world settings faces several risks, including jailbreak attacks and privacy leaks. To mitigate these risks, numerous defense strategies have been proposed. However, most existing studies assess these defenses in isolation and ignore their effects on other risk dimensions. In this work, we introduce a new cross-risk evaluation paradigm and take the first step in investigating unintended interactions among defenses in LLMs. Specifically, we focus on the interplay between safety, fairness, and privacy. To this end, we propose CrossRiskEval, a framework that systematically characterizes how a defense designed for one risk (e.g., safety) affects others (e.g., fairness or privacy). We conduct extensive empirical studies and mechanistic analyses on 14 LLMs with deployed defenses, covering 12 defense strategies. Our results show that defenses targeting a single risk often cause measurable effects on other risks. These effects vary in direction and magnitude across a range of factors (e.g., models, tasks, and defense strategies), and are often asymmetric across risk pairs. Furthermore, our mechanistic analysis shows that these interactions are not random: they arise from conflict-entangled neurons, which are shared internal representations that contribute in opposite ways to different risks. Adjusting one risk therefore perturbs these representations and leads to systematic changes in non-target risks. These findings reveal the limits of single-risk evaluation and highlight the need for holistic and interaction-aware assessment when designing and deploying LLM defenses.
Tags
Links
- Source: https://arxiv.org/abs/2510.07968
- Canonical: https://arxiv.org/abs/2510.07968
Trouble viewing inline? Open PDF directly →
Full Text
85,297 characters extracted from source content.
Expand or collapse full text
From Defender to Devil? Unintended Risk Interactions Induced by LLM Defenses Xiangtao Meng 1 Tianshuo Cong 1 Li Wang 1 Wenyu Chen 1 Zheng Li 1 Shanqing Guo 1 Xiaoyun Wang 2 1 Shandong University 2 Tsinghua University Abstract Large Language Models (LLMs) have shown remarkable performance across various applications, but their deploy- ment in real-world settings faces several risks, including jail- break attacks and privacy leaks. To mitigate these risks, nu- merous defense strategies have been proposed. However, most existing studies assess these defenses in isolation and ignore their effects on other risk dimensions. In this work, we introduce a new cross-risk evaluation paradigm and take the first step in investigating unintended interactions among defenses in LLMs. Specifically, we focus on the interplay between safety, fairness, and privacy. To this end, we pro- pose CrossRiskEval, a framework that systematically char- acterizes how a defense designed for one risk (e.g., safety) affects others (e.g., fairness or privacy). We conduct exten- sive empirical studies and mechanistic analyses on 14 LLMs with deployed defenses, covering 12 defense strategies. Our results show that defenses targeting a single risk often cause measurable effects on other risks. These effects vary in di- rection and magnitude across a range of factors (e.g., mod- els, tasks, and defense strategies), and are often asymmet- ric across risk pairs. Furthermore, our mechanistic analysis shows that these interactions are not random: they arise from conflict-entangled neurons, which are shared internal repre- sentations that contribute in opposite ways to different risks. Adjusting one risk therefore perturbs these representations and leads to systematic changes in non-target risks. These findings reveal the limits of single-risk evaluation and high- light the need for holistic and interaction-aware assessment when designing and deploying LLM defenses. 1 Introduction Large language models (LLMs), such as ChatGPT [8], LLaMA [76], and Mistral [31], have significantly advanced the field of natural language processing, supporting a broad range of applications including content creation [1, 40, 77], code programming [64, 70], and personal assistant [46, 90]. However, as LLMs are increasingly used in sensitive areas such as healthcare, finance, and education, concerns about risks such as safety, fairness, and privacy have grown. For in- stance, OpenAI acknowledged in 2020 that GPT-3 can inad- vertently regurgitate personally identifiable information such as phone numbers or email addresses from its training data 1 , underscoring the inherent privacy risks in large-scale pre- training. Although various defense strategies [12, 38, 39, 92] have been developed to mitigate these risks, it remains unclear whether their deployment inadvertently induces unintended interactions in LLMs.Specifically, most existing stud- ies [16, 35, 47, 85] assess these defenses in isolation, fo- cusing primarily on their effectiveness within a single tar- get risk, such as reducing harmful content or mitigating bias, while overlooking their broader impacts across other risk di- mensions. However, in real-world scenarios, deployed LLMs are exposed to multiple risks simultaneously. These include safety, fairness, privacy, and more, which can interact in complex and unpredictable ways. A defense designed to re- duce one type of risk may unintentionally increase another. For instance, defenses designed to mitigate harmful content may inadvertently exacerbate the risk of privacy leakage, whereas privacy-preserving techniques could conversely am- plify social biases. Therefore, there is an urgent need to sys- tematically study the cross-risk interactions and trade-offs of defense strategies in LLMs. Understanding these dynamics is essential for designing balanced, robust, and trustworthy models for real-world deployment. Our Work. In this paper, we address this gap by introduc- ing a new cross-risk evaluation paradigm. This is the first step toward investigating unintended interactions among de- fenses in LLMs. Specifically, we focus on three key and well-studied risks: safety, fairness, and privacy, and pro- pose CrossRiskEval, a framework that systematically char- acterizes how a defense designed for one risk (e.g., safety) affects others (e.g., fairness or privacy). Its core idea is to situate the LLM within a multi-dimensional risk space and formally define and quantify the cross-dimensional risk in- teractions induced by defense deployment. To cover realis- tic deployment choices, we integrate four representative de- fense paradigms—alignment, unlearning, model editing, and differential privacy. Finally, to rigorously measure these in- teractions, we establish a statistical protocol that integrates 1 OpenAI, GPT-3: Language Models are Few-Shot Learners, 2020, https: //arxiv.org/abs/2005.14165. 1 arXiv:2510.07968v2 [cs.CR] 19 Jan 2026 the Relative Change Rate (RCR) with hypothesis testing to classify interaction effects as Conflict, Synergy, or Neutral. We conduct extensive empirical studies on 14 LLMs with deployed defenses, covering 12 defense strategies. Our re- sults show that defenses targeting a single risk often cause measurable effects on other risks. These effects vary in di- rection and magnitude across a range of factors (e.g., mod- els, tasks, and defense strategies), and are often asymmetric across risk pairs. For example, deploying defenses against privacy may have negligible side effects or even improve fair- ness, whereas deploying fairness defenses significantly exac- erbates privacy vulnerabilities. Furthermore, safety defenses may suppress direct responses to sensitive queries related to bias or privacy, yet still amplify indirect privacy leakage or biased outputs. However, our further mechanistic analysis shows that these interactions are not random: they arise from conflict- entangled neurons, which are shared internal representations that contribute in opposite ways to different risks. Specifi- cally, we investigate the internal mechanisms driving these unintended effects via a fine-grained, neuron-level analy- sis. Using integrated gradient-based attribution, we identify risk-specific neurons that contribute to safety-, fairness-, and privacy-related behaviors. We then detect conflict-entangled neurons—neurons that are simultaneously sensitive to mul- tiple risks but influence them in opposing directions (e.g., increasing activation reduces bias while increasing privacy risk). Our trend consistency analysis reveals that, in most cases, post-deployment variations in these neurons’ acti- vations align with task-level behavioral changes (See Sec- tion 6.2). This consistent alignment suggests that polyseman- tic neurons play a central role in mediating the emergence of unintended behaviors. Abstractly, this paper makes three key contributions: • Novel Evaluation Paradigm: We introduce a new cross-risk evaluation paradigm and take the first step in investigating unintended interactions among defenses in LLMs. To this end, we propose CrossRiskEval, a comprehensive framework that systematically quanti- fies cross-risk interactions, enabling rigorous analysis of unintended side effects across multiple risk dimen- sions. • Empirical Identification of Side Effects: We conduct extensive empirical evaluations on 14 defense-deployed LLMs, covering 12 representative defense strategies, and reveal several alarming unintended interactions. • Mechanistic Understanding: We provide neuron-level evidence that conflict-entangled neurons, which are sen- sitive to multiple risks in opposing directions, serve as the internal origin of cross-risk interactions, offering new insights into the mechanistic basis of unintended behaviors in LLMs. 2 Preliminaries In this section, we first review the Transformer architecture, focusing on FFN neurons. We then categorize LLM risks into safety, fairness, and privacy, and summarize corresponding defense strategies. 2.1 Neurons in Transformer Transformer.Mainstream LLMs often utilize multi-layer Transformer decoders. Concretely, transformer-based lan- guage models typically consist of embedding and unembed- ding layers W E ,W U ∈ R | V | ×d with a series of L transformer blocks in-between [80]. Each layer consists of a multi-head attention (MHA) and a feed-forward network (FFN). Given an input sequence X =⟨x 0 ,..., x t ⟩, the model first applies W E to create an embedding h i ∈ R d for each token x i ∈ X . h i is referred to as residual stream [20]. The computation performed by each Transformer block is a refinement of the residual stream (layer normalization omitted): h l+1 i = h l i +MHA l (h l i )+FFN l (h l i +MHA l (h l i )).(1) The FFNs in Transformer models we used [71, 76] are: FFN(h) = W ⊤ down (σ(W gate h)⊙ W up h),(2) where W down , W gate , W up ∈ R d m ×d are projection matrices, σ(·) is activation function,⊙ is element-wise product opera- tor. FFN Neurons. In the context of neural networks, the term “neuron” can refer to a single dimension of any activation. We choose to study neurons in the intermediate layer of FFN (activation before down projection) since it has been shown that such neurons encode diverse interpretable fea- tures [11, 27, 83]. Furthermore, each row of the down projec- tion matrix in Equation 2 can be interpreted as the value vec- tor of the corresponding neuron. This interpretation allows us to explore the tokens a neuron promotes or suppresses [24]. 2.2 Risks to LLM We conduct an extensive literature review to analyze the cur- rent landscape of LLM defense research and the primary risks it aims to address. Specifically, we first search multi- ple academic databases, including ACM, IEEE Xplore, and arXiv, focusing on LLM defense papers published in the past three years. Next, we manually categorize the identified pa- pers based on the types of risks they targeted. Our analy- sis reveals that existing defense research in LLMs predomi- nantly focuses on three core risk dimensions: Safety Risk refers to the generation of harmful contents or the misuse of LLMs [42, 66], encompassing issues such as toxic content, facilitation of illegal activities, and fraud ac- tions. For example, assigning a specific persona to ChatGPT can amplify its toxicity by up to six times, potentially lead- ing to the generation of harmful dialogue and offensive view- points [14]. Moreover, Kang et al. [32] point out that LLMs can be exploited to generate malicious content, such as scams and hate speech, even without additional training or complex prompt engineering. Fairness Risk refers to biased or discriminatory outcomes generated by LLMs, often resulting from imbalanced train- ing data [42, 82]. This risk includes issues such as stereo- 2 types, disparagement, and preference biases. Recent stud- ies [89] have emphasized ongoing concerns regarding bias and fairness in LLM-based chatbots. Furthermore, Dhin- gra et al. [15] demonstrated that, due to biases embedded in training data, LLM-generated text may inadvertently rein- force stereotypes about marginalized groups. Privacy Risk refers to the potential of LLMs to reveal sensi- tive or personally identifiable information, intentionally or inadvertently. This risk includes issues such as copyright violation and privacy leakage. For instance, recent stud- ies [29, 33, 36, 65, 81] have shown that LLMs may inad- vertently disclose personal information embedded in user- generated text, respond to crafted prompts that exploit prede- fined templates to extract sensitive data, or even be manipu- lated through jailbreak attacks to reveal privacy information. 2.3 Defenses for LLM To mitigate the aforementioned risks, a wide range of defense strategies has been proposed and deployed in both academic and industrial settings. These defense methods vary in de- sign principles, target risk types, and implementation levels (e.g., data, architecture, training, or inference). Since this paper primarily focuses on how defenses affect the intrinsic capabilities of LLMs, we mainly consider defense strategies that directly modify the model itself. We summarize repre- sentative defenses in each risk as follows: Safety Defense. To address safety-related risks such as jail- break, toxicity, and misuse, existing defenses can be broadly categorized into two types: safety alignment and machine unlearning. • Safety Alignment aims to align model behavior with hu- man safety preferences, typically through fine-tuning with human feedback or preference data. For example, Safe RLHF [12] introduces separate reward and cost models to represent helpfulness and harmlessness, respectively, and employs a Lagrangian optimization framework to balance these objectives during fine-tuning. In parallel, preference- based methods such as Direct Preference Optimization (DPO) [62] simplify the alignment process by directly op- timizing over pairwise comparisons, avoiding the need for an explicit reward model. • Machine Unlearning focuses on removing unsafe knowl- edge or concepts from pre-trained models without affect- ing general utility. For instance, Safe Unlearning [92] demonstrates that fine-tuning on a small set of harmful questions, without relying on jailbreak variants, can sig- nificantly reduce the model’s vulnerability to adversarial prompts. Another representative method, Representation Memorization Unlearning (RMU) [37], mitigates mali- cious capability by erasing internal representations associ- ated with unsafe knowledge without degrading the LLM’s general performance. Fairness Defense. To address fairness-related risks, current defense strategies can be broadly categorized into two types: model editing and fairness alignment. • Model Editing aims to identify the internal components of LLMs that contribute to fairness risks and mitigate their in- fluence by directly modifying model parameters while pre- serving performance on unrelated tasks. A representative method is DAMA [39], which addresses gender-related stereotypes in the LLaMA family through causal tracing and projection-based interventions. • Fairness Alignment follows the alignment paradigm by incorporating fairness considerations into the model fine- tuning process, typically using supervised data or pref- erence pairs that reflect desired fairness constraints. For instance, Martin et al. [50] apply supervised fine-tuning (SFT) with gender-balanced instruction-response pairs to guide the LLMs toward more equitable outputs. Similarly, they adopt Direct Preference Optimization (DPO) using pairwise feedback that prefers fairer responses [49]. These approaches align LLM behaviors with fairness principles and have demonstrated improved fairness metrics without significantly sacrificing utility. Privacy Defense. To address privacy-related risks, existing defenses can be broadly categorized into two types: machine unlearning and differential privacy. • Machine Unlearning aims to remove specific sensi- tive or undesired information from pre-trained mod- els without full retraining.A representative approach, Unlearning GA [75], performs gradient ascent on the for- get set to maximize its loss, thereby effectively erasing the corresponding knowledge. To address the issue that gradient ascent may unintentionally degrade the model’s performance on unrelated data, Unlearning GD [41] pro- poses a continual learning strategy to preserve knowl- edge on the retained set during unlearning. Similarly, Unlearning KL [25] formalizes the objective as a trade-off: minimizing the KL divergence between predictions on the retain set from the original and unlearned models (to pre- serve retained knowledge), while simultaneously maximiz- ing the loss on the forget set (to enforce forgetting). More- over, Unlearning PO [62] takes a different approach by di- rectly fine-tuning the model to respond with “I don’t know” when encountering blocklisted content, thereby mitigating undesired behaviors through output suppression. • Differential Privacy aims to mathematically guarantee that the presence or absence of any single data record has a limited impact on the model’s output, thereby providing strong privacy protection for individual training examples. A representative method is DP-SGD [38], which has been widely applied in the finetuning of LLMs to protect train- ing data. 3CrossRiskEval:Paradigm for Cross-Risk Evaluation 3.1 Design Motivation Traditional evaluation paradigms typically treat defense mechanisms as isolated solutions targeting specific risks and measure their effectiveness only along the intended di- mension. However, this isolated view overlooks the intri- cate interactions between different risk dimensions in real- world scenarios. For instance, defenses designed to miti- gate harmful content may inadvertently exacerbate the risk 3 Safety Misuse Toxicity Exaggerated Safety Privacy Fairness Privacy Query Privacy Leakage Privacy Agreement Bias Query Bias Agreement Bias Recognition Risk Space RiskSpaceInstantiation Implementing Defense Operators Base LLMs Quantifying Cross-risk Interactions BaseLLMs Defensed LLMs Fairness Risk ·Relative Change Rate ·t-test (푝<0.05) Safety Risk ·Relative Change Rate ·t-test (푝<0.05) Privacy Risk ·Relative Change Rate ·t-test (푝<0.05) DefenseOperators Alignment Operators Unlearning Operators Model Editing Operators Differential Privacy Operators Defensed LLMs Figure 1: Overview of the CrossRiskEval paradigm. The framework evaluates interactions by applying defense operators (Step 1), measuring shifts across a fine-grained risk space (Step 2), and statistically quantifying the outcomes as Conflict, Synergy, or Neutral (Step 3). of privacy leakage, whereas privacy-preserving techniques could conversely amplify social biases. This interplay be- tween risks, termed cross-risk interaction, represents a criti- cal blind spot in current evaluation frameworks. To address this gap, we propose CrossRiskEval, a new cross-risk evalua- tion paradigm, as shown in Figure 1. Its core idea is to situate the LLM within a multi-dimensional risk space and formally define and quantify the cross-dimensional risk interactions induced by defense deployment. The paradigm not only as- sesses the direct efficacy of a defense on the target risk but, more crucially, systematically measures its unintended im- pact on a set of non-target risks. 3.2 Problem Formulation In this section, we formalize the problem of evaluating cross- risk interactions induced by LLM defenses. We first intro- duce the following definitions: Definition 1: Risk State of LLM (R(M)). Given a large lan- guage model M, we define its risk state as a vector embedded in an n-dimensional risk space S ⊆ R n : R(M) = [r 1 , r 2 ,..., r n ] ⊤ ,(3) where each component r i quantifies the model’s vulnerability along risk dimension i. Let K =1,..., n denote the set of all risk indices. Definition 2: Defense Operator (d). We define a defense strategy d as a transformation operator that acts upon the model’s parameters θ or its internal computational logic: d : M→ M d ,(4) where M d denotes the model in its post-defense state. For a given LLM M, let R(M) represent its pre-defense risk state. Suppose we apply a defense operator d designed to mitigate a specific target risk t ∈ K . Consequently, the model transitions to M d , resulting in an updated risk state R(M d ). While conventional evaluation protocols focus ex- clusively on the defense efficacy (measured by the reduction in the target risk, ∆r t ), we explicitly consider the variation across the full risk vector to capture potential side effects on non-target risks K \t. We quantify this impact by defining the risk interaction induced by defense d on model M as: ∆R(M, d) = R(M d )− R(M),(5) where the k-th component ∆r k captures the change in risk along dimension k. Crucially, a non-zero value in a non- target dimension ( j ̸= t), formally denoted as the risk in- teraction I t→ j , indicates that mitigating risk t has induced a measurable shift in risk j, thereby revealing unintended risk dependencies. 3.3 Risk Space Instantiation In this section, we instantiate the abstract risk state R(M) defined in Equation 3. We first establish a high-level risk taxonomy and then define the specific risk dimensions and measurement protocols that constitute the components of the risk vector. 3.3.1 Risk Taxonomy While the risk space S is theoretically infinite, in this work, we focus on three distinct and critical categories: safety, fair- ness, and privacy. These categories are chosen because they represent the most pervasive and severe threats to the respon- sible deployment of LLMs: • Safety (r safety ).This category measures the model’s propensity to generate harmful or illegal content. An el- evated safety risk implies that the model lacks sufficient constraints against malicious instructions, effectively act- ing as an accomplice to bad actors. For example, LLMs have been observed generating detailed instructions for manufacturing biological weapons [37] or writing poly- morphic malware for cyberattacks [26]. • Fairness (r bias ). This category quantifies the model’s ten- dency to produce biased outcomes.An elevated fair- ness risk indicates a higher probability of the model ex- hibiting stereotypes, particularly in high-stakes decision- making scenarios. For example, LLMs covertly discrim- inate against speakers of African American English, as- signing them significantly lower employability scores and 4 unfairly associating them with criminality compared to speakers of standard American English, despite identical content [28]. • Privacy(r privacy ). This category evaluates the risk of the model leaking sensitive or personally identifiable informa- tion derived from its training data or context. An elevated privacy risk signifies that the model has memorized pri- vate data and lacks the awareness to protect it. For exam- ple, researchers have demonstrated that specific prompts can trigger models to regurgitate valid social security num- bers, credit card details, or private email addresses present in their training corpora [10]. 3.3.2 Risk Dimension Measurement To bridge the gap between abstract taxonomy and empiri- cal quantification, we decompose the three categories into nine specific risk dimensions, which serve as the components r 1 ,..., r 9 of the risk state vector R(M). This fine-grained de- composition allows us to capture failures ranging from cog- nitive competence to behavioral outcomes. All risk scores are mapped to a unified scale where larger values indicate higher risk. Safety-related Dimensions.Safety category evaluation encompasses the generation of intrinsically harmful con- tent, the execution of harmful directives, and the over- defensiveness. • Toxicity measures the model’s propensity to generate harmful content (e.g., hate speech). We adopt the Jail- breakTrigger dataset [66] as the evaluation benchmark for this risk. Specifically, we obtain an instance-level toxicity score for each response via the Perspective API 2 . The ag- gregate risk score S toxicity is defined as the mean value of these toxicity scores. • Misuse measures the model’s tendency to comply with instructions for illegal acts (e.g., crime facilitation). We adopt the Do-Not-Answer dataset [84] as the evaluation benchmark for this risk.Specifically, we employ the fine-tuned Longformer classifier proposed in recent study [66] to automatically identify explicit refusal expressions, quantifying the proportion of valid refusals as the Refusal- to-Answer (RtA) rate. As reported in [66], this evaluator demonstrates performance closely mirroring that of human evaluators and GPT-4, thereby supporting the reliability of our metric. Finally, the aggregate risk score is defined as the proportion of harmful instructions not refused by the model, calculated as S misuse = 1− RtA. • Exaggerated Safety quantifies the side-effects of safety interventions, specifically the incorrect refusal of benign queries arising from excessive sensitivity. We adopt the XSTest dataset [63] as the evaluation benchmark for this risk. Specifically, consistent with the Misuse evaluation, we utilize the same fine-tuned Longformer classifier to calculate Refusal-to-Answer (RtA) rate on these harmless prompts. The aggregate risk score is defined as the pro- portion of benign queries incorrectly refused, denoted as S exagg = RtA benign . 2 Perspective API, https://w.perspectiveapi.com/. Fairness-related Dimensions. We evaluate fairness across cognitive, attitudinal, and behavioral dimensions to capture the nuanced manifestations of social bias. • Bias Recognition evaluates the model’s cognitive ability to distinguish between stereotypical and anti-stereotypical concepts. We adopt the StereoSet dataset [57] as the eval- uation benchmark for this risk. Specifically, we extract the model’s choice among provided options using keyword matching and regular expressions, supplemented by LLM- based extraction (e.g., DeepSeek [13] and GPT-4 [59]) when rule-based methods are insufficient. The accuracy is calculated by comparing these extractions against ground- truth labels. Finally, the aggregate risk score is defined as the error rate, calculated as F recognition = 1− accuracy. • Bias Agreement reflects the model’s attitudinal tendency to favor stereotypical statements over anti-stereotypical ones. We adopt the CrowS-Pair dataset [58] as the eval- uation benchmark for this risk. Specifically, we present the model with stereotypical sentences and directly ask for its agreement. The aggregate risk score is defined as the stereotypical agreement rate, calculated as the percentage of instances where the model explicitly outputs agreement, denoted as F agreement . • Bias Query assesses the behavioral failure to refuse queries containing embedded social stereotypes (e.g., lead- ing questions about group traits). We select stereotype- specific prompts from the Do-Not-Answer dataset [84] as the evaluation benchmark. Specifically, consistent with the Misuse evaluation, we employ the fine-tuned Long- former classifier proposed in [66] to quantify the Refusal- to-Answer (RtA) rate. As reported in [66], this evaluator’s performance closely aligns with human judgment, ensur- ing the reliability of our assessment. The aggregate risk score is defined as the proportion of biased queries not re- fused by the model, calculated as F query = 1− RtA. Privacy-related Dimensions. Privacy category evaluation spans the spectrum from the conceptual understanding of pri- vacy norms to the unintended regurgitation of training data. • Privacy Agreement measures the model’s alignment with human privacy norms by evaluating its endorsement of various privacy-violating scenarios. We adopt the Con- fAID benchmark [54] as the evaluation benchmark for this risk. Specifically, we prompt the model to judge privacy- sensitive situations and calculate the pearson correlation coefficient ρ between model outputs and human consen- sus. The aggregate risk score is defined as the divergence from human norms, denoted as P agreement = 1− ρ. • Privacy Query assesses the model’s adherence to privacy policies when facing direct requests for sensitive informa- tion in hypothetical contexts. We adopt the privacy infor- mation dataset proposed in TrustLLM [66] as the evalua- tion benchmark for this risk. Specifically, consistent with the Misuse evaluation, we employ the fine-tuned Long- former classifier proposed in [66] to quantify the Refusal- to-Answer (RtA) rate. The aggregate risk score is defined as the proportion of privacy-violating queries not refused by the model, calculated as P query = 1− RtA. • Privacy Leakage quantifies the memorization and re- 5 gurgitation of Personally Identifiable Information (PII) present in the training corpora. We adopt the Enron Email dataset [21] as the benchmark to perform extraction at- tacks. Specifically, we prompt the model using four pre- defined templates (e.g., “the email address of [name] is”) to elicit target email addresses, where few-shot prompts include real name-email pairs as additional context to in- crease the likelihood of leakage. Success is determined via exact string matching between the model output and the ground-truth PII. The aggregate risk score represents the ratio of accurate responses out of all responses, denoted as P leakage . 3.4 Implementing Defense Operators In order to comprehensively assess how cross-risk inter- actions manifest under different intervention strategies, we categorize the defense operator d into four representative paradigms based on their technical mechanisms. • Alignment Operators enhance the model by optimizing a global objective function (e.g., reward modeling or pref- erence loss) to align the output distribution with human values. • Unlearning Operators aim to selectively erase specific knowledge or behaviors by disrupting the associations be- tween targeted tokens (or prompts) and their corresponding conceptual representations, while preserving general capa- bilities. • Model Editing Operators apply localized updates to spe- cific internal components identified as causal mediators of a risk. • Differential Privacy Operators intervene during training by injecting calibrated noise to bound the influence of in- dividual data points. We focus on defenses that enhance endogenous safety and exclude system-level filtering. This choice follows our goal of analyzing mechanistic defense conflicts—how internal in- terventions alter inherent dependencies between competing risks. 3.5 Quantifying Cross-risk Interactions To rigorously characterize the cross-risk interactions, we es- tablish a quantification protocol that integrates magnitude measurement with statistical validation. Due to the inher- ent stochasticity in LLMs, a single evaluation pass may not accurately reflect the model’s true risk state. Therefore, for each risk dimension r k , we conduct N independent evalua- tion trials (N = 5 in our implementation) by utilizing differ- ent random seeds. Measurement: Relative Change Rate.As mentioned above, the risk dimensions r 1 ,..., r 9 are derived from differ- ent measurement metircs with varying scales (e.g., S toxicity , S misuse , or P leakage ).To ensure scale-invariance and pre- serve the directionality of risk shifts, we define the Rela- tive Change Rate (RCR) to instantiate each component of ∆R(M, d). For each risk dimension k, let P pre k and P post k denote the sets of risk scores obtained from N independent evaluation trials before and after the deployment of defense d. We define RCR k as: RCR k = P post k −P pre k P pre k × 100%,(6) whereP (·) k denotes the sample mean of P (·) k . This metric normalizes the risk shift ∆r k relative to its baseline, allowing for a direct comparison of defense impacts across different risks. Validation: Statistical Significance. To verify that observed changes surpass stochastic noise, we conduct a t-test between P pre k and P post k for each risk dimension k. We determine sta- tistical significance at the p = 0.05 level. Interaction Determination. Based on the magnitude and statistical validity, we formally categorize the cross-risk in- teraction I t→ j (effect of defending target t on non-target j) into three distinct states: State(I t→ j ) = Con f lict, if p< 0.05∧ RCR> 0 Synergy,if p< 0.05∧ RCR< 0 Neutral,if p≥ 0.05 (7) 4 Empirical Results In this section, we conduct empirical study to evaluate how defenses targeting one risk dimension induce unintended changes in other risks. We first summarize the experimental settings , and then report cross-risk interactions under three realistic deployment scenarios: (i) safety defense deploy- ment, (i) fairness defense deployment, and (i) privacy de- fense deployment. Finally, we summarize patterns of cross- risk interactions induced by LLM defenses. 4.1 Experimental Settings To minimize implementation variance, we use the official re- leased checkpoints from the original defense papers, instead of reproducing training from scratch. Defense Strategies and Base Models. We evaluate 12 rep- resentative defense strategies covering the four defense oper- ator paradigms in Section 3.4. For each strategy, we pair the defended checkpoint with its corresponding base LLM and evaluate the full risk vector R(M) pre- and post-deployment. The complete mapping (operator type, strategy, and model transformation) is summarized in Table 1. Implementation Details. We adopt a multi-trial evalua- tion protocol to mitigate stochasticity. For each risk di- mension, we run 5 independent trials with different random seeds and report averaged results. We use temperature 0 for deterministic-style benchmarks (e.g., multiple-choice / judg- ment tasks) to ensure reproducibility. For open-ended gener- ation tasks (e.g., Toxicity), we use each model’s default gen- eration settings to reflect deployed behavior. All experiments are implemented with PyTorch and HuggingFace Transform- ers, and run on 4 NVIDIA RTX 6000 GPUs. 6 (a) Safety Defense Deployment(b) Fairness Defense Deployment(c) Privacy Defense Deployment #1:Privacy Agreement #2:Privacy Query #3:Privacy Leakage #4:Bias Recognition #5:Bias Agreement #6:Bias Query #7:Misuse #8:Exaggerated Safety #9:Toxicity Privacy Risks:Fairness Risks:Safety Risks: Defense-deployed LLMBase LLM Figure 2: Average cross-risk variation induced by LLM defense deployment. Each radar chart summarizes the statistically significant relative changes in non-target risks after applying defenses aimed at (a) safety, (b) fairness, and (c) privacy, respectively. Results are averaged across all evaluated models per scenario. Table 1: Summary of defense strategies with its corresponding base models. We map each strategy to its corresponding de- fense operator paradigm and the resulting model transforma- tion (Base LLM → Defended Model). To enhance readability, we abbreviate these model names in the main text, full names and corresponding citations see Appendix A. Operator TypeStrategyModel Transformation (Base→ Defended) Target: Safety Risk Alignment Safe-RLHF [12]Alpaca-7b [60]→ Beaver-7B [61] DPO [62]Llama-2-7b [53]→ Llama2_detox [3] Unlearning Safe Unlearning [92] Mistral-v0.2 [55]→ Mistral_SU [73] Vicuna-v1.5 [45]→ Vicuna_SU [74] RMU [37]Zephyr-beta [30]→ Zephyr_RMU [9] Target: Fairness Risk Model EditingDAMA [39] Llama-2-7b [53]→ DAMA-7B [79] Llama-2-13b [52]→ DAMA-13B [78] Alignment SFT [23]Mistral-v0.3 [56]→ Mistral_SFT [86] DPO [22]Mistral-v0.3 [56]→ Mistral_DPO [62] Target: Privacy Risk UnlearningGA / KL / GD / PO [85] Llama-2-chat [69]→ Llama2_chat-GA [4],KL [6],GD [5],PO [7] Differential Privacy DP-SGD (ε = 8) [38]Llama-2-7b [53]→ Llama2_dp8 [43] 4.2 Scenario I: Safety Defense Deployment We evaluate five safety-defense-deployed LLMs, covering two mainstream safety strategies: safety alignment (Beaver- 7B, Llama2_detox) and machine unlearning (Vicuna_SU, Mistral_SU, Zephyr_RMU). Models and sources are listed in Table 1. Cross-risk effect on Privacy.Table 2 reports privacy risk variation induced by safety defenses across Privacy Agreement, Privacy Query, and Privacy Leakage metircs. Overall, safety defense deployment tends to increase pri- vacy risks for most models.For instance, Mistral_SU shows the strongest amplification in both Privacy Agree- ment (+100.0%) and Privacy Leakage (+51.92%) with sta- tistically significant changes ( p< 0.05). Vicuna_SU and Zephyr_RMU also significantly increase leakage (+9.76% Table 2: Impact of safety defense strategies on privacy risk di- mensions.★ indicates statistically significant change ( p< 0.05), while✗ indicates non-significant change ( p≥ 0.05). State ab- breviations: C (Conflict), S (Synergy), and N (Neutral). Defense-Deployed LLM Privacy AgreementPrivacy QueryPrivacy Leakage RCR Sig. StateRCR Sig. StateRCR Sig. State Beaver-7B [61]+5.93%★C-83.11%★S+3.26%★C Vicuna_SU [74]+46.70%★C-6.67%★S+9.76%★C Mistral_SU [73]+100.0%★C+6.16%★C+51.92%★C Zephyr_RMU [9]+19.74%★C-36.84%★S+27.27%★C Llama2_detox [3]+21.48%★C+32.04%✗N+1.72%✗N and +27.27%). A notable nuance is that Privacy Query of- ten decreases (e.g., Beaver-7B: –83.11%, Zephyr_RMU: – 36.84%), while Privacy Leakage still increases. This sug- gests that safety defenses often create a false sense of secu- rity; while they effectively suppress explicit privacy-related inquiries, they paradoxically exacerbate the actual leakage of sensitive information, masking the underlying risk inter- actions. Table 3: Fairness risk variation induced by safety defense de- ployments.★ indicates statistically significant change ( p< 0.05), while✗ indicates non-significant change ( p≥ 0.05). State abbreviations: C (Conflict), S (Synergy), and N (Neutral). Defense-Deployed LLM Bias AgreementBias RecognitionBias Query RCR Sig. StateRCR Sig. StateRCR Sig. State Beaver-7B [61]0.0%✗N-30.95%★S-2.15%★S Vicuna_SU [74] +12.81%★C+56.72%★C0.0%✗N Mistral_SU [73]+35.15%★C+100.0%★C0.0%✗N Zephyr_RMU [9]+3.59%★C+0.95%★C+1.10%★C Llama2_detox [3]-2.40%★S-25.79%★S0.0%✗N 7 Cross-risk effect on Fairness. Table 3 reports fairness risk variation induced by safety defenses across Bias Agreement, Bias Recognition, and Bias Query. Consistent with the ob- servations in Table 4.2, this discrepancy suggests that explicit query metrics are insufficient for capturing cross-risk dynam- ics. If one were to rely exclusively on such metrics, the sig- nificant amplification of latent fairness risks would remain undetectable, leading to a misleading assessment of model safety. 4.3 Scenario I: Fairness Defense Deployment We evaluate four fairness-defense-deployed LLMs spanning model editing (DAMA-7B, DAMA-13B) and fairness align- ment (Mistral_DPO, Mistral_SFT), as listed in Table 1. Table 4: Safety risk variation induced by fairness defense de- ployments.★ indicates statistically significant change ( p< 0.05), while✗ indicates non-significant change ( p≥ 0.05). State abbreviations: C (Conflict), S (Synergy), and N (Neutral). Defense-Deployed LLM MisuseExaggerated SafetyToxicity RCR Sig. StateRCR Sig. StateRCR Sig. State DAMA-7B [79]+72.39%★C+19.97%★C-0.70%✗N DAMA-13B [78] +62.35%★C+16.34%★C+0.21%✗N Mistral_DPO [49]+8.58%★C+10.42%★C+8.75%✗N Mistral_SFT [50]+12.76%★C+17.71%★C+8.07%✗N Cross-risk effect on Safety. Table 4 reports safety risk vari- ation induced by fairness defenses across Misuse, Exagger- ated Safety, and Toxicity. A consistent phenomenon is that Misuse and Exaggerated Safety rise together across all eval- uated fairness defenses. For example, DAMA-7B / DAMA- 13B substantially increase misuse (+72.39%, +62.35%) and also increase exaggerated refusal (+19.97%, +16.34%), both statistically significant. Mistral_DPO and Mistral_SFT show the same co-movement pattern (both risks increase with p< 0.05). This pattern highlights a severe cross-risk conflict: fairness-oriented modifications inadvertently perturb the safety decision manifold. Consequently, the model exhibits a paradoxical degradation in reliability—becoming hypersen- sitive to benign inputs while simultaneously losing robust- ness against malicious attacks. Table 5: Privacy risk variation induced by fairness defense deployments.★ indicates statistically significant change ( p< 0.05), while✗ indicates non-significant change ( p≥ 0.05). State abbreviations: C (Conflict), S (Synergy), and N (Neutral). Defense-Deployed LLM Privacy AgreementPrivacy QueryPrivacy Leakage RCR Sig. StateRCR Sig. StateRCR Sig. State DAMA-7B [79]+100.0%★C+91.69%★C+21.18%★C DAMA-13B [78] +98.32%★C+74.24%★C+17.65%★C Mistral_DPO [49] +34.27%★C+5.00%★C+71.43%★C Mistral_SFT [50]+44.79%★C+18.89%★C+67.86%★C Cross-risk effect on Privacy. Table 5 reports privacy risk variation induced by fairness defenses across Privacy Agree- ment, Privacy Query, and Privacy Leakage.All evalu- ated models exhibit privacy risk amplification on all three sub-dimensions, often with large effect sizes.For in- stance, DAMA-7B increases Privacy Agreement and Pri- vacy Query by +100.0% and +91.69%, and also raises Pri- vacy Leakage by +21.18%, all statistically significant. The alignment-based models (Mistral_DPO / Mistral_SFT) show particularly strong increases in Privacy Leakage (+71.43%, +67.86%). Overall, fairness defenses can meaningfully ag- gravate privacy risks even when they achieve their intended debiasing goal. 4.4 Scenario I: Privacy Defense Deployment We evaluate five privacy-defense-deployed LLMs spanning machine unlearning (Llama2_chat-GA, KL, GD, PO) and differential privacy (Llama2_dp8), as listed in Table 1. Table 6: Safety risk variation induced by privacy defense de- ployments.★ indicates statistically significant change ( p< 0.05), while✗ indicates non-significant change ( p≥ 0.05). State abbreviations: C (Conflict), S (Synergy), and N (Neutral). Defense-Deployed LLM MisuseExaggerated SafetyToxicity RCR Sig. StateRCR Sig. StateRCR Sig. State Llama2_chat-GA [4]-0.49%★S-3.81%✗N+21.06%✗N Llama2_chat-KL [6]+1.62%★C+65.71%★C+33.60%✗N Llama2_chat-GD [5]+2.37%★C+100.0%★C+27.88%✗N Llama2_chat-PO [7] +7.99%★C+41.90%★C-23.30%✗N Llama2_dp8 [43] +45.12%★C+7.28%★C-1.50%✗N Cross-risk effect on Safety. Table 6 reports safety risk changes induced by privacy defenses across Misuse, Ex- aggerated Safety, and Toxicity. Most privacy defenses in- crease safety risks, with particularly strong amplification in Exaggerated Safety (e.g., Llama2_chat-GD: +100.0%; Llama2_chat-KL: +65.71%; Llama2_chat-PO: +41.90%, all significant). Misuse also increases in multiple cases, includ- ing a large rise for Llama2_dp8 (+45.12%, significant). In contrast, Toxicity changes are generally small and mostly non-significant. Table 7: Fairness risk variation induced by privacy defense deployments.★ indicates statistically significant change ( p< 0.05), while✗ indicates non-significant change ( p≥ 0.05). State abbreviations: C (Conflict), S (Synergy), and N (Neutral). Defense-Deployed LLM Bias AgreementBias RecognitionBias Query RCR Sig. StateRCR Sig. StateRCR Sig. State Llama2_chat-GA [4]-0.84%★S+21.16%✗N+0.21%✗N Llama2_chat-KL [6]+11.63%★C+6.14%✗N+2.53%★C Llama2_chat-GD [5] +11.53%★C+45.39%★C+1.68%✗N Llama2_chat-PO [7]+14.15%★C-46.76%★S+10.32%★C Llama2_dp8 [43]+0.59%✗N+19.59%★C+39.55%★C Cross-risk effect on Fairness.Table 7 reports fairness risk variation induced by privacy defenses. Privacy inter- ventions tend to increase Bias Agreement and Bias Query (e.g., Llama2_chat-PO: +14.15% and +10.32%, both signif- icant; Llama2_dp8: +39.55% on Bias Query, significant). 8 Furthermore, these interactions vary in direction and magni- tude across a range of factors. For instance, within the Bias Recognition metric, Llama2_chat-GD triggers a sharp risk increase (+45.39%), whereas Llama2_chat-PO results in a significant risk reduction (–46.76%). 4.5 Summary of Cross-risk Interactions By integrating empirical evidence from safety, fairness, and privacy defense domains, we distill the following patterns of cross-risk interactions induced by LLM defenses. The Complexity of Cross-Risk Interactions. Our empiri- cal results demonstrate that defenses targeting a single risk are rarely isolated interventions; rather, they frequently in- duce measurable collateral effects on other risk dimensions. Specifically, optimizing for a particular risk dimension often triggers significant shifts elsewhere, manifesting as a com- plex coexistence of conflicts (exacerbated non-target risks) and synergies (mitigated non-target risks).Furthermore, these interactions vary in direction and magnitude across a range of factors (e.g., models, tasks, and defense strategies). For instance, the same defense category may induce risk shifts in opposite directions across different models, while the same model may exhibit significant variations in the mag- nitude of shifts across different evaluation dimensions. This phenomenon reveals critical security implications: if evalua- tion and deployment focus solely on mitigating target risks, defenses may systematically introduce vulnerabilities in un- monitored dimensions, thereby creating new failure modes and expanding the overall attack surface. Asymmetry of Risk Interactions. Our investigation reveals that interactions are often asymmetric across risk pairs. We initially observed this asymmetry in safety-fairness interac- tions, where the interplay between Llama2-Detox (safety de- fense) and DAMA-7B (fairness defense) on the same Llama- 2-7b-hf base model exhibited distinct directional patterns. To exclude the possibility of case-specific idiosyncrasies and verify the universality of this phenomenon, we con- ducted extensive controlled experiments focusing on the privacy-fairness interactions. Specifically, we employed two distinct base models (gemma-2-2b-it [72] and Llama-3.2-1B- Instruct [17]) and applied representative defense paradigms: NPO [91] and RMU [37] for privacy defense, versus Un- bias [93] and Task Vector [88] for fairness defense. See Ap- pendix B for implementation details. As visualized in Fig- ure 3, the results confirm a robust asymmetry: • Fairness → Privacy (Risk Increase): Fairness defenses precipitated a sharp decline in privacy risks, manifested as a dominant “deep red” zone in the heatmap. For instance, Unbias on Gemma increased the privacy aggrement risk by 98.17%. • Privacy → Fairness (Minimal Impact or Synergy): In contrast, privacy defenses exerted minimal negative impact on fairness, occasionally even fostering improvements. For instance, RMU on Gemma unexpectedly decreased the fairness agreement risk by 58.82%. Hidden Risk Interactions. Our results highlight a critical “masking effect” inherent in safety defenses. In both privacy Bias RecognitionBias AgreementBias Query Llama +NPO Llama +RMU Gemma +NPO Gemma +RMU 0.0+1.50.0 0.0-1.9-2.9 -29.6+32.2-1.1 +5.6-58.8-1.1 (a) Privacy Defenses Deployment Privacy AgreementPrivacy Query Privacy Leakage Llama+ Unbias Llama+ Task Vector Gemma+ Unbias Gemma+ Task Vector +18.1+25.9+3.3 +77.8+25.9+14.4 +98.2+16.7+32.1 +38.6+71.4+7.1 (b) Fairness Defenses Deployment 80604020020406080 Relative Change Rate (%) Risk DecreaseRisk Increase Figure 3: Asymmetry of Cross-Risk Interactions. Visualizing Relative Change Rate (RCR) of non-target risks. and fairness domains, defenses effectively mitigate explicit risks (via direct queries) but paradoxically amplify implicit risks (via leakage and recognition tasks). This suggests that safety defenses often operate superficially, masking the de- terioration of internal safety mechanisms behind a veil of refusal behaviors. Consequently, if one were to rely exclu- sively on explicit metrics, these detrimental risk interactions would remain undetectable, failing to capture how safety in- terventions inadvertently compromise the latent stability of other ethical dimensions. 5 Neuron-Level Risk Mechanism Analysis Given that the task-level results indicate that cross-risk in- teractions exhibit significant complexity, we turn to a fine- grained neuron-level analysis to trace and reveal their under- lying mechanistic origins. Overview. As shown in Figure 4, our neuron-level analysis framework consists of three sequential stages: 1. Attributing Risk Neurons: We first apply a risk attri- bution method based on integrated gradients to attribute neurons that are sensitive to specific risk dimensions. 2. Identifying Conflict-entangled Neurons: We then iden- tify conflict-entangled neurons that are simultaneously sensitive to multiple risk dimensions but contribute in op- posite directions. 3. Assessing Trend Consistency: Finally, we compare the change in activation of conflict-entangled neurons before and after defense deployment against observed task-level variations, assessing their alignment through trend con- sistency. This neuron-level analysis provides mechanistic evidence that polysemantic neurons [2]—those conflict-entangled neurons—can explain unintended interactions emerging from defense deployment. We now detail each component of the framework. 5.1 Attributing Risk-Specific Neurons As introduced in Section 2.1, neurons in the intermedi- ate layer of FFNs have been shown to encode diverse in- terpretable features. We hypothesize that risk-specific fea- tures—such as toxicity, bias, or private content—are encoded in FFNs memories and expressed through a set of dedicated neurons, which we refer to as risk-specific neurons. In this 9 Step2:Identifying Conflict-entangledNeurons Step1:Attributing Risk Neurons Step3:Assessing Trend Consistency LLM Safety risk neurons Fairness risk neurons l-thFF layer Privacy risk neurons Integrated Gradients: 퐴푡푛 푖 푙 = ҧ 푣 푖 푙 න 훼=0 1 휕푃(훼ҧ푣 푖 푙 ) 휕푣 푖 푙 푑훼 Safety Privacy 휼 풆풏풕풂풏품풍풆풅 =휂 푟푖푠푘 1 ∩휂 푟푖푠푘 2 휼 풄풐풏풇풍풊풄풕 = 휂∈휂 푒푛푡푎푛푔푙푒푑 | 퐴푡 푟푖푠푘 1 휂∙퐴푡 푟푖푠푘 2 휂<0 Neuron-level vs.Task-level ∆풗 휼 =푣 휂 푑푒푓푒푛푠푒 −푣 휂 푏푎푠푒 Fairness 휼 풄풐풏풇풍풊풄풕 휼 풆풏풕풂풏품풍풆풅 Risk↑ Risk↓ RCR 푁 푟푖푠푘 푖 ✘ ❍ ▾FairnessRisk▾ 푵 풓풊풔풌 풊 = σ 휂∈휂 푐표푛푓푙푖푐푡 핀푠푖푔푛∆푣 휂 =푠푖푔푛퐴푡푟 푟푖푠푘 푖 (휂) 휂 푐표푛푓푙푖푐푡 Trend Consistency: Conflict-entangledNeurons: Figure 4: Neuron-level framework for explaining cross-risk interactions in LLMs. Our framework comprises three stages: (1) attribut- ing risk-specific neurons via integrated gradients, (2) identifying conflict-entangled neurons sensitive to multiple risks with opposing effects, and (3) assessing trend consistency between neuron-level activations and task-level risk variations after defense deployment. part, we aim to attribute which neurons are primarily re- sponsible for producing risk-relevant outputs in LLMs. In- spired by recent works [11, 87], we propose a risk attribution method based on integrated gradients [67], which estimates each neuron’s contribution to risk-relevant output. The risk attribution score of each neuron to be evaluated is denoted as Attr(n l i ), where n l i represents the intermedi- ate neuron at the i-th position in the l-th FFN layer of the LLM. Given a risk-related prompt–response pair, where the prompt x is the malicious query and response y ∗ contains risk-sensitive information. Initially, we take the prompt as input, record the activation value of each neuron and denote it as ̄v l i . To calculate the risk attribution score Attr(n l i ), we gradually change the activation value of a neuron n l i from 0 to its original value ̄v l i . At the same time, the output prob- ability of the model changes accordingly. We calculate the probability of the risk-relevant output predicted by the lan- guage model, denoted as: P(v l i ) = p(y ∗ |x, A(n l i ) = v l i ),(8) where y ∗ denotes the risk-relevant output; v l i is the activa- tion value of the neuron n l i . We integrate the gradient of the probability during this process as the neuron’s risk attribution score, as follows: Attr(n l i ) = ̄v l i Z 1 α=0 ∂P α ̄v l i ∂v l i dα,(9) where ∂P ( α ̄v l i ) ∂v l i calculates the gradient of the model probabil- ity with regard to v l i , α controls the integration from 0 to ̄v l i . Theoretically, the integrated gradients technique adheres to two fundamental axioms of attribution methods: Sensi- tivity and Implementation Invariance [68]. The Sensitivity axiom stipulates that if modifying a neuron alters the pre- diction, that neuron should be assigned a non-zero attribu- tion score. The Implementation Invariance axiom dictates that the attributions should remain identical for two networks with equivalent functionality. Adherence to these axioms en- sures that the attribution scores accurately reflect the impor- tance of neurons and are invariant to implementation details. Intuitively, by integrating over the gradient as α changes from 0 to 1, Attr(n l i ) accumulates the output probability changes caused by the activation value changes from the ab- sence to the presence of context. If the neuron has a strong perception and processing capability regarding the context, the gradient will be significant, resulting in a large integra- tion value. Therefore, the attribution score can measure the neuron’s sensitivity to the context and its contribution to pro- cessing the context. Directly calculating continuous integrals is intractable. We instead use the Riemann approximation of the integration to efficiently compute the attribution score [11]. Specifically, we sum the gradients at points occurring at sufficiently small intervals from 0 to its original value ̄v l i : ̃ Attr(n l i ) = ̄v l i m m ∑ k=1 ∂P k m ̄v l i ∂v l i ,(10) where m is the number of approximation steps. Following previous work [11], we set m to 20, which performs well in our experiments. We aggregate risk attribution score for each neuron over all prompt–response pairs to obtain a final risk attribution score, and select the top-z% neurons by absolute aggregated attri- bution score as risk-specific. To ensure the validity of the selected risk-specific neurons, we determine z via causal in- tervention [51]. Specifically, we sweep candidate values of z and pick the largest z whose zeroing-ablation induces a drop in risk-token probability that exceeds a significance threshold estimated from natural perturbations of non-risk neurons. 10 5.2 Identifying Conflict-entangled Neurons Once risk-specific neurons are identified for each risk di- mension, we investigate whether there exist entangled neu- rons—neurons that are simultaneously sensitive to multiple types of risk. Such polysemantic neurons [19] may serve as shared representational channels across different risk behav- iors, and are therefore likely candidates for cross-risk inter- actions. Formally, let η risk 1 and η risk 2 denote the sets of risk- specific neurons for two distinct risk dimensions. We define the set of entangled neurons as their intersection: η entangled = η risk 1 ∩ η risk 2 (11) These neurons contribute substantially to both risk behaviors, potentially leading to functional interference or conflict. To further investigate this potential conflict, we interpret the sign of each neuron’s attribution score. Recall that attri- bution scores indicate the direction and strength of a neuron’s influence on risk-related output generation. A positive score implies that increasing the neuron’s activation amplifies the expression of the associated risk, whereas a negative score suggests that activation suppresses risk manifestation. We further validated the causal impact of these identified neu- rons through causal intervention. Based on this insight, we define conflict-entangled neu- rons as a subset of entangled neurons that exert opposing in- fluences across different risks. Specifically, we identify neu- rons whose risk attribution scores under two risk dimensions have opposite signs: η conflict = η∈ η entangled Attr risk 1 (η)· Attr risk 2 (η)< 0 (12) Here, Attr risk i (η) denotes the attribution score of neuron η under risk dimension i. A negative product indicates that the neuron increases one risk while simultaneously decreasing the other, revealing a fundamental directional conflict. 5.3 Assessing Trend Consistency To quantify how defense deployment alters neuron behavior, we measure the change in activation value of each conflict- entangled neuron. Prior mechanistic studies [24, 35] sug- gest that defense interventions mainly modulate activation routing—suppressing or amplifying specific circuits—rather than rewriting the semantic content stored in FFN neurons. Hence, risk-specific neurons largely preserve their functional semantics after defense deployment, enabling direct activa- tion comparisons. Based on this premise, we calculate the activation shift for each conflict-entangled neuron η: ∆v η = v (defense) η − v (base) η , η∈ η conflict (13) We then assess the aggregate directional tendency of these neurons towards risk i using a metric we term N risk i . For each conflict-entangled neuron, we compare the sign of its activa- tion change ∆v η with the sign of its attribution score toward the targeted risk dimension, Attr r i (η). Formally, N risk i is de- fined as the proportion of conflict-entangled neurons whose direction of activation change aligns with their attribution po- larity: N risk i = ∑ η∈η con f lict I[sign(∆v η ) = sign(Attr risk i (η))] |η con f lict | (14) where I[·] is the indicator function that returns 1 when the condition holds and 0 otherwise. N risk i > 0.5 indicates a net shift that increases risk i , while N risk i < 0.5 indicates suppres- sion; values near 0.5 suggest weak or mixed signals. 6 Analysis Results We conduct empirical analyses to validate the mechanisms underlying unintended behaviors induced by defense deploy- ment. 6.1 Existence of Conflict-Entangled Neurons We first verify whether LLMs exhibit neurons that are si- multaneously sensitive to multiple risks with opposing influ- ences. To maintain analytical clarity, we select one represen- tative evaluation dimension for each risk category—misuse for safety, privacy leakage for privacy, and bias recogni- tion for fairness—and randomly sample 100 diverse prompt- answer pairs per dimension for attribution analysis. The hyperparameter top-z%, which serves as the selec- tion threshold for risk-specific neurons, is calibrated for each model and risk category, typically ranging from 0.05% to 0.15%. For example, in the Mistral-7B-Instruct-v0.3 model, setting z = 0.1% for the fairness dimension identifies ap- proximately 458 risk neurons.Our analysis reveals the widespread presence of conflict-entangled neurons across all evaluated base models. For instance, in Mistral-7B-Instruct- v0.3, we identify 26 neurons exhibiting conflicting influences between fairness and privacy, and 19 between fairness and safety. Similar patterns are observed in Llama-2-7b-hf, with the strongest entanglement consistently occurring between fairness and privacy risks. While the absolute number of risk-specific neurons varies across LLMs, the proportion of conflict-entangled neurons consistently remains below 10% of the risk-specific set. 6.2 Trend Consistency Across Defense Scenar- ios We aim to assess whether task-level risk variations align with neuron-level activation changes. To this end, we compare the relative change rate (RCR) with the neuron-level directional trend, inferred from conflict-entangled neurons via N risk i , un- der three representative defense deployments: safety, pri- vacy, and fairness. To facilitate interpretation, we annotate each model with a consistency indicator:✓ denotes consis- tency between RCR and N trend ,✗ indicates inconsistency, and ⃝ marks uncertainty (i.e., when N trend is near 0.5). As shown in Figure 5–Figure 7, across all three risk di- mensions and defense strategies, the majority of defense de- ployments exhibit high trend consistency. Specifically, for most defense deployments, when the RCR indicates an in- crease or decrease in a given risk, the majority of conflict- 11 Beaver-7BVicuna_SUMistral_SUzephyr_RMULlama2_detoxBeaver-7BVicuna_SUMistral_SUzephyr_RMULlama2_detox Risk Risk Fairness Risk Privacy Risk RCR N risk i Figure 5: Trend consistency of risks after safety defense deployment. Abbreviated names are used due to layout constraints. Llama2_chat-GALlama2_chat-KLLlama2_chat-GDLlama2_chat-POLlama2_dp8Llama2_chat-GALlama2_chat-KLLlama2_chat-GDLlama2_chat-POLlama2_dp8 Risk Risk Safety Risk Fairness Risk RCR N risk i Figure 6: Trend consistency of risks after privacy defense deployment. Abbreviated names are used due to layout constraints. entangled neurons exhibit a corresponding directional influ- ence on that risk. For example, under safety defense deploy- ment (Figure 5), 4 out of 5 defenses show consistent trends for both fairness and privacy risks—including Beaver-7B, Vicuna_SU, and zephyr_RMU—indicating that neuron-level shifts faithfully reflect task-level behavior. For the few uncer- tain cases (e.g., Llama2_detox in fairness and Llama2_chat- PO in safety/fairness), we further analyzed the neuron’s at- tribution scores and frequencies. These supplementary re- sults reveal that most high-attribution neurons still exhibited activation changes aligned with the task-level risk variation, thereby indicating an consistency in trend despite the weak overall signal. Overall, these results indicate that defense-induced vari- ations in task-level risks are not random artifacts but stem from a structural root. Our mechanistic analysis reveals that these intricate cross-risk interactions arise from conflict- entangled neurons—shared internal representations that con- tribute in opposite ways to different risks. Consequently, interventions targeting one risk inevitably perturb these shared representations, leading to systematic and predictable changes in non-target risks. This provides crucial mechanis- tic guidance for future defense designs. 7 Related Work Recent works have begun to highlight trade-offs between safety-enhancing defenses and model usability. Kumar et al. [34] introduce a framework to explore whether current guardrails effectively prevent misuse while maintaining prac- tical utility. Likewise, Mai et al. [48] propose USEBench, a comprehensive benchmark that systematically assess util- ity degradation and safety improvements induced by jail- break defenses. In contrast, our work takes a multi-risk per- spective and investigates whether a defense targeting one risk (e.g., fairness) could exacerbate other risks (e.g., pri- vacy leakage). To the best of our knowledge, we are the first to systematically quantify and analyze these cross-risk interactions in LLMs. This expands the discussion from risk–utility trade-offs to a broader understanding of risk–risk entanglement, which has been overlooked in prior research. The notion of competing desiderata—such as accuracy, fair- ness, and robustness—has been explored in classical ma- chine learning. For example, Duddu et al. [18] present a systematization of knowledge (SoK) that surfaces the unin- tended interactions among defense mechanisms across vari- ous trustworthiness dimensions. Our study extends this line of research to high-capacity, dynamically aligned LLMs, and uniquely integrates neuron-level attribution to expose the in- ternal causes of risk entanglement. Unlike existing work that remains at the behavioral or metric level, we develop an interpretable framework to identify conflict-entangled neu- rons—those contributing to multiple conflicting risks. This enables us to not only detect unintended consequences but also to elucidate their mechanistic origins. 8 Discussion and Conclusion In this paper, we uncover a critical paradox in LLM safety: defense mechanisms designed to act as shields can inadver- tently act as saboteurs. By introducing CrossRiskEval, we systematically quantify these cross-risk interactions across 14 LLMs and 12 defense strategies. Our extensive empiri- cal study reveals that defenses are rarely isolated interven- tions; instead, they frequently induce significant collateral damage, such as fairness editors exacerbating privacy leak- age and safety alignment amplifying latent biases. Crucially, our mechanistic analysis traces these behavioral conflicts to conflict-entangled neurons—shared internal representations that pull the model in opposing directions across different 12 DAMA-7BDAMA-13BMistral_DPOMistral_SFTDAMA-7BDAMA-13BMistral_DPOMistral_SFT Risk Risk Safety Risk Privacy Risk RCR N risk i Figure 7: Trend consistency of risks after fairness defense deployment. Abbreviated names are used due to layout constraints. risk dimensions. These findings demonstrate that current defenses are insufficient for the complex risk landscape of LLMs. We hope this work catalyzes a shift from single- dimensional toward interaction-aware alignment strategies that address the root causes of neural entanglement. Possible Defense Solutions. Our analysis reveals that in- troducing defense mechanisms can alter the activation states of conflict-entangled neurons, thereby triggering new unin- tended behaviors. To mitigate such effects, future defense designs should strive to minimize perturbations to conflict- entangled neurons. One possible strategy is to apply selective fine-tuning that deliberately avoids updating high-attribution neurons associated with non-target risks. By integrating such neuron-aware strategies into the defense design process, we can move toward more robust and risk-isolated LLM deploy- ments. Limitations. Our work takes the first step toward system- atically evaluating cross-risk interactions; however, certain aspects remain to be explored in future research. First, while our evaluation spans a broad spectrum of models and de- fenses, the field’s rapid evolution precludes exhaustiveness. However, the ubiquity of cross-risk trade-offs across diverse paradigms suggests that our findings reveal a fundamental phenomenon rather than model-specific artifacts. Second, regarding the risk taxonomy, we prioritize safety, fairness, and privacy as they represent the primary alignment axes in current defense literature. While the risk landscape encom- passes other dimensions (e.g., hallucination), we focus on these three to enable a deep, fine-grained mechanistic analy- sis of their interplay. Crucially, our proposed CrossRiskEval framework is designed to be modular and can be readily ex- tended to incorporate additional risk dimensions in future studies. Finally, we focus on endogenous defenses (model weights/training) to understand intricate internal interactions of LLMs; exogenous system-level filters are outside our cur- rent scope. References [1] Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023. 1 [2] Sanjeev Arora, Yuanzhi Li, Yingyu Liang, Tengyu Ma, and Andrej Risteski. Linear algebraic structure of word senses, with applications to polysemy. Transactions of the Association for Computational Linguistics, 6:483– 495, 2018. 9 [3] BatsResearch.llama2-7b-detox-qlora. https: //huggingface.co/BatsResearch/llama2-7b- detox-qlora, 2025. 7, 17 [4] boyiwei.llama2-7b_chat_newsqa_ga_1.5e-6_1. https://huggingface.co/boyiwei/llama2- 7b_chat_newsqa_GA_1.5e-6_1, 2025. 7, 8, 17 [5] boyiwei.llama2-7b_chat_newsqa_gd_3e-6_1. https://huggingface.co/boyiwei/llama2- 7b_chat_newsqa_GD_3e-6_1, 2025. 7, 8, 17 [6] boyiwei.llama2-7b_chat_newsqa_kl_2e-6_1. https://huggingface.co/boyiwei/llama2- 7b_chat_newsqa_KL_2e-6_1, 2025. 7, 8, 17 [7] boyiwei.llama2-7b_chat_newsqa_po_5e-5_4. https://huggingface.co/boyiwei/llama2- 7b_chat_newsqa_PO_5e-5_4, 2025. 7, 8, 17 [8] Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learn- ers. Advances in neural information processing sys- tems, 33:1877–1901, 2020. 1 [9] cais. Zephyr_rmu. https://huggingface.co/cais/ Zephyr_RMU, 2025. 7, 17 [10] Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlings- son, et al. Extracting training data from large language models. In 30th USENIX security symposium (USENIX Security 21), pages 2633–2650, 2021. 5 [11] Damai Dai, Li Dong, Yaru Hao, Zhifang Sui, Baobao Chang, and Furu Wei. Knowledge neurons in pretrained transformers. arXiv preprint arXiv:2104.08696, 2021. 2, 10 [12] Josef Dai, Xuehai Pan, Ruiyang Sun, Jiaming Ji, Xinbo Xu, Mickel Liu, Yizhou Wang, and Yaodong Yang. Safe rlhf: Safe reinforcement learning from human feedback. arXiv preprint arXiv:2310.12773, 2023. 1, 3, 7 13 [13] DeepSeek-AI, codes:, Aiyuan Liu, Bin Feng, Bin Wang, Bingxuan Wang, Bo Liu, Bo Wu, Chenggang Wang, Chenghao Luo, et al. Deepseek-v3 technical re- port, 2024. 5 [14] Ameet Deshpande, Vishvak Murahari, Tanmay Ra- jpurohit, Ashwin Kalyan, and Karthik Narasimhan. Toxicity in chatgpt: Analyzing persona-assigned lan- guage models. arXiv preprint arXiv:2304.05335, 2023. 2 [15] Harnoor Dhingra, Preetiha Jayashanker, Sayali Moghe, and Emma Strubell.Queer people are people first: Deconstructing sexual identity stereotypes in large lan- guage models. arXiv preprint arXiv:2307.00101, 2023. 3 [16] Xiangjue Dong, Yibo Wang, Philip S Yu, and James Caverlee. Disclosure and mitigation of gender bias in llms. arXiv preprint arXiv:2402.11190, 2024. 1 [17] Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024. 9 [18] Vasisht Duddu, Sebastian Szyller, and N Asokan. Sok: Unintended interactions among machine learning de- fenses and risks. In 2024 IEEE Symposium on Security and Privacy (SP), pages 2996–3014. IEEE, 2024. 12 [19] Nelson Elhage, Tristan Hume, Catherine Olsson, Nicholas Schiefer, Tom Henighan, Shauna Kravec, Zac Hatfield-Dodds, Robert Lasenby, Dawn Drain, Carol Chen, et al. Toy models of superposition. arXiv preprint arXiv:2209.10652, 2022. 11 [20] Nelson Elhage, Neel Nanda, Catherine Olsson, Tom Henighan, Nicholas Joseph, Ben Mann, Amanda Askell, Yuntao Bai, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Deep Ganguli, Zac Hatfield- Dodds, Danny Hernandez, Andy Jones, Jackson Kernion, Liane Lovitt, Kamal Ndousse, Dario Amodei, Tom Brown, Jack Clark, Jared Kaplan, Sam McCan- dlish, and Chris Olah.A mathematical framework for transformer circuits. Transformer Circuits Thread, 2021. 2 [21] Enron Corporation. Enron email dataset. https:// w.cs.cmu.edu/~enron/. Accessed: May 2025. 6 [22] fhnw.Mistral-7b-instruct-gender-bias-dpo. https://huggingface.co/fhnw/Mistral-7B- Instruct-gender-bias-dpo, 2025. 7, 17 [23] fhnw.Mistral-7b-instruct-gender-bias-sft. https://huggingface.co/fhnw/Mistral-7B- Instruct-gender-bias-sft, 2025. 7, 17 [24] Mor Geva, Avi Caciularu, Kevin Ro Wang, and Yoav Goldberg.Transformer feed-forward layers build predictions by promoting concepts in the vocabulary space. arXiv preprint arXiv:2203.14680, 2022. 2, 11 [25] Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selec- tive forgetting in deep networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9304–9312, 2020. 3 [26] Maanak Gupta, CharanKumar Akiri, Kshitiz Aryal, Eli Parker, and Lopamudra Praharaj.From chatgpt to threatgpt: Impact of generative ai in cybersecurity and privacy. IEEE access, 11:80218–80245, 2023. 4 [27] Wes Gurnee, Neel Nanda, Matthew Pauly, Kather- ine Harvey, Dmitrii Troitskii, and Dimitris Bertsimas. Finding neurons in a haystack: Case studies with sparse probing. Transactions on Machine Learning Research, 2023. 2 [28] Valentin Hofmann, Pratyusha Ria Kalluri, Dan Juraf- sky, and Sharese King. Dialect prejudice predicts ai decisions about people’s character, employability, and criminality. arXiv preprint arXiv:2403.00742, 2024. 5 [29] Jie Huang, Hanyin Shao, and Kevin Chen-Chuan Chang. Are large pre-trained language models leak- ing your personal information?arXiv preprint arXiv:2205.12628, 2022. 3 [30] HuggingFaceH4.zephyr-7b-beta. https: //huggingface.co/HuggingFaceH4/zephyr- 7b-beta, 2025. 7, 17 [31] Albert Q. Jiang, Alexandre Sablayrolles, Arthur Men- sch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guil- laume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mistral 7b, 2023. 1 [32] Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. Exploiting programmatic behavior of llms: Dual-use through stan- dard security attacks. In 2024 IEEE Security and Pri- vacy Workshops (SPW), pages 132–143. IEEE, 2024. 2 [33] Siwon Kim, Sangdoo Yun, Hwaran Lee, Martin Gubri, Sungroh Yoon, and Seong Joon Oh. Propile: Probing privacy leakage in large language models. Advances in Neural Information Processing Systems, 36:20750– 20762, 2023. 3 [34] Divyanshu Kumar, Nitin Aravind Birur, Tanay Baswa, Sahil Agarwal, and Prashanth Harshangi. No free lunch with guardrails.arXiv preprint arXiv:2504.00441, 2025. 12 [35] Andrew Lee, Xiaoyan Bai, Itamar Pres, Martin Wat- tenberg, Jonathan K Kummerfeld, and Rada Mihal- cea. A mechanistic understanding of alignment algo- rithms: A case study on dpo and toxicity. arXiv preprint arXiv:2401.01967, 2024. 1, 11 14 [36] Haoran Li, Dadi Guo, Wei Fan, Mingshi Xu, Jie Huang, Fanpu Meng, and Yangqiu Song.Multi-step jail- breaking privacy attacks on chatgpt. arXiv preprint arXiv:2304.05197, 2023. 3 [37] Nathaniel Li, Alexander Pan, Anjali Gopal, Sum- mer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, et al. The wmdp benchmark: Measuring and reduc- ing malicious use with unlearning.arXiv preprint arXiv:2403.03218, 2024. 3, 4, 7, 9, 17 [38] Qinbin Li, Junyuan Hong, Chulin Xie, Jeffrey Tan, Rachel Xin, Junyi Hou, Xavier Yin, Zhun Wang, Dan Hendrycks, Zhangyang Wang, et al. Llm-pbe: As- sessing data privacy in large language models. arXiv preprint arXiv:2408.12787, 2024. 1, 3, 7 [39] Tomasz Limisiewicz, David Mare ˇ cek, and Tomáš Musil. Debiasing algorithm through model adaptation. arXiv preprint arXiv:2310.18913, 2023. 1, 3, 7 [40] Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek- v3 technical report. arXiv preprint arXiv:2412.19437, 2024. 1 [41] Bo Liu, Qiang Liu, and Peter Stone. Continual learn- ing and private unlearning. In Conference on Lifelong Learning Agents, pages 243–254. PMLR, 2022. 3 [42] Yang Liu, Yuanshun Yao, Jean-Francois Ton, Xi- aoying Zhang, Ruocheng Guo, Hao Cheng, Yegor Klochkov, Muhammad Faaiz Taufiq, and Hang Li. Trustworthy llms: a survey and guideline for evaluat- ing large language models’ alignment. arXiv preprint arXiv:2308.05374, 2023. 2 [43] LLM-PBE.echr-llama2-7b-dp8-4epochs. https://huggingface.co/LLM-PBE/echr- llama2-7b-dp8-4epochs, 2025. 7, 8, 17 [44] LLM-PBE.echr-llama2-7b-undefended-4epochs. https://huggingface.co/LLM-PBE/echr- llama2-7b-undefended-4epochs, 2025. 17 [45] lmsys. vicuna-7b-v1.5. https://huggingface.co/ lmsys/vicuna-7b-v1.5, 2025. 7, 17 [46] Yizhen Luo, Jiahuan Zhang, Siqi Fan, Kai Yang, Yushuai Wu, Mu Qiao, and Zaiqing Nie. Biomedgpt: Open multimodal generative pre-trained transformer for biomedicine.arXiv preprint arXiv:2308.09442, 2023. 1 [47] Aengus Lynch, Phillip Guo, Aidan Ewart, Stephen Casper, and Dylan Hadfield-Menell. Eight methods to evaluate robust unlearning in llms. arXiv preprint arXiv:2402.16835, 2024. 1 [48] Wuyuao Mai, Geng Hong, Pei Chen, Xudong Pan, Bao- jun Liu, Yuan Zhang, Haixin Duan, and Min Yang. You can’t eat your cake and have it too: The performance degradation of llms with jailbreak defense. In Proceed- ings of the ACM on Web Conference 2025, pages 872– 883, 2025. 12 [49] Andreas Martin et al. Mistral-7b-instruct-gender-bias- dpo. https://huggingface.co/fhnw/Mistral-7B- Instruct-gender-bias-dpo, 2024. Accessed: 2025- 05-09. 3, 8 [50] Andreas Martin et al. Mistral-7b-instruct-gender-bias- sft. https://huggingface.co/fhnw/Mistral-7B- Instruct-gender-bias-sft, 2024. Accessed: 2025- 05-09. 3, 8 [51] Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. Locating and editing factual associations in gpt. Advances in neural information processing sys- tems, 35:17359–17372, 2022. 10 [52] Meta-Llama.Llama-2-13b-hf. https: //huggingface.co/meta-llama/Llama-2-13b-hf, 2025. 7, 17 [53] Meta-Llama. Llama-2-7b-hf. https://huggingface. co/meta-llama/Llama-2-7b-hf, 2025. 7, 17 [54] Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, and Yejin Choi. Can llms keep a secret? testing privacy implica- tions of language models via contextual integrity the- ory. arXiv preprint arXiv:2310.17884, 2023. 5 [55] mistralai.Mistral-7b-instruct-v0.2. https: //huggingface.co/mistralai/Mistral-7B- Instruct-v0.2, 2025. 7, 17 [56] mistralai.Mistral-7b-instruct-v0.3. https: //huggingface.co/mistralai/Mistral-7B- Instruct-v0.3, 2025. 7, 17 [57] Moin Nadeem, Anna Bethke, and Siva Reddy. Stere- oset: Measuring stereotypical bias in pretrained lan- guage models. arXiv preprint arXiv:2004.09456, 2020. 5 [58] Nikita Nangia, Clara Vania, Rasika Bhalerao, and Samuel R Bowman. Crows-pairs: A challenge dataset for measuring social biases in masked language mod- els. arXiv preprint arXiv:2010.00133, 2020. 5 [59] OpenAI.Gpt-4 technical report.arXiv preprint arXiv:2303.08774, 2023. 5 [60] PKU-Alignment.alpaca-7b-reproduced. https: //huggingface.co/PKU-Alignment/alpaca-7b- reproduced, 2025. 7, 17 [61] PKU-Alignment.beaver-7b-v1.0. https: //huggingface.co/PKU-Alignment/beaver- 7b-v1.0, 2025. 7, 17 15 [62] Rafael Rafailov, Archit Sharma, Eric Mitchell, Christo- pher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Infor- mation Processing Systems, 36:53728–53741, 2023. 3, 7 [63] Paul Röttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. arXiv preprint arXiv:2308.01263, 2023. 5 [64] Baptiste Roziere, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, Jingyu Liu, Romain Sauvestre, Tal Remez, et al. Code llama: Open foundation models for code.arXiv preprint arXiv:2308.12950, 2023. 1 [65] Robin Staab, Mark Vero, Mislav Balunovi ́ c, and Martin Vechev. Beyond memorization: Violating privacy via inference with large language models. arXiv preprint arXiv:2310.07298, 2023. 3 [66] Lichao Sun, Yue Huang, Haoran Wang, Siyuan Wu, Qi- hui Zhang, Chujie Gao, Yixin Huang, Wenhan Lyu, Yixuan Zhang, Xiner Li, et al.Trustllm: Trust- worthiness in large language models. arXiv preprint arXiv:2401.05561, 3, 2024. 2, 5 [67] Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Ax- iomatic attribution for deep networks. In International conference on machine learning, pages 3319–3328. PMLR, 2017. 10 [68] Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Ax- iomatic attribution for deep networks. In Doina Precup and Yee Whye Teh, editors, Proceedings of the 34th International Conference on Machine Learning, ICML 2017, Sydney, NSW, Australia, 6-11 August 2017, vol- ume 70 of Proceedings of Machine Learning Research, pages 3319–3328. PMLR, 2017. 10 [69] swj0419.llama2-7b_chat_newsqa. https: //huggingface.co/swj0419/llama2-7b_chat_ newsqa, 2025. 7, 17 [70] Cursor AI team. Cursor ai, 2025. 1 [71] Gemini Team, Rohan Anil, Sebastian Borgeaud, Yonghui Wu, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, et al. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805, 2023. 2 [72] Gemma Team. Gemma. 2024. 9 [73] thu coai.Mistral-7b-instruct-v0.2-safeunlearning. https://huggingface.co/thu-coai/Mistral- 7B-Instruct-v0.2-safeunlearning, 2025. 7, 17 [74] thucoai.vicuna-7b-v1.5-safeunlearning. https://huggingface.co/thu-coai/vicuna- 7b-v1.5-safeunlearning, 2025. 7, 17 [75] Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. Unrolling sgd: Understanding factors influencing machine unlearning. In 2022 IEEE 7th European Symposium on Security and Privacy (Eu- roS&P), pages 303–319. IEEE, 2022. 3 [76] Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation lan- guage models. arXiv preprint arXiv:2302.13971, 2023. 1, 2 [77] Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine- tuned chat models. arXiv preprint arXiv:2307.09288, 2023. 1 [78] ufal. Dama-13b. https://huggingface.co/ufal/ DAMA-13B, 2025. 7, 8, 17 [79] ufal.Dama-7b. https://huggingface.co/ufal/ DAMA-7B, 2025. 7, 8, 17 [80] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017. 2 [81] Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ritik Dutta, Rylan Schaeffer, et al. Decod- ingtrust: A comprehensive assessment of trustworthi- ness in gpt models. In NeurIPS, 2023. 3 [82] Lu Wang, Max Song, Rezvaneh Rezapour, Bum Chul Kwon, and Jina Huh-Yoo. People’s perceptions toward bias and related concepts in large language models: A systematic review. arXiv preprint arXiv:2309.14504, 2023. 2 [83] Xiaozhi Wang, Kaiyue Wen, Zhengyan Zhang, Lei Hou, Zhiyuan Liu, and Juanzi Li. Finding skill neu- rons in pre-trained transformer-based language mod- els. In Proceedings of the 2022 Conference on Empir- ical Methods in Natural Language Processing, pages 11132–11152, 2022. 2 [84] Yuxia Wang, Haonan Li, Xudong Han, Preslav Nakov, and Timothy Baldwin.Do-not-answer: A dataset for evaluating safeguards in llms.arXiv preprint arXiv:2308.13387, 2023. 5 [85] Boyi Wei, Weijia Shi, Yangsibo Huang, Noah A Smith, Chiyuan Zhang, Luke Zettlemoyer, Kai Li, and Peter Henderson. Evaluating copyright takedown methods for language models. arXiv preprint arXiv:2406.18664, 2024. 1, 7 16 [86] Jason Wei, Maarten Bosma, Vincent Y Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M Dai, and Quoc V Le.Finetuned language models are zero-shot learners. In International Conference on Learning Representations, 2022. 7 [87] Xinwei Wu, Junzhuo Li, Minghui Xu, Weilong Dong, Shuangzhi Wu, Chao Bian, and Deyi Xiong. Depn: De- tecting and editing privacy neurons in pretrained lan- guage models. arXiv preprint arXiv:2310.20138, 2023. 10 [88] Xin Xu et al. BiasFreeBench: A benchmark for miti- gating bias in large language model responses. arXiv preprint arXiv:2510.00232, 2025. 9, 17 [89] Jintang Xue, Yun-Cheng Wang, Chengwei Wei, Xi- aofeng Liu, Jonghye Woo, C-C Jay Kuo, et al. Bias and fairness in chatbots: An overview. APSIPA Trans- actions on Signal and Information Processing, 13(2), 2024. 3 [90] Mingze Yuan, Peng Bao, Jiajia Yuan, Yunhao Shen, Zi- fan Chen, Yi Xie, Jie Zhao, Quanzheng Li, Yang Chen, Li Zhang, et al. Large language models illuminate a progressive pathway to artificial intelligent healthcare assistant. Medicine Plus, page 100030, 2024. 1 [91] Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei. Negative preference optimization: From catastrophic collapse to effective unlearning.arXiv preprint arXiv:2404.05868, 2024. 9, 17 [92] Zhexin Zhang, Junxiao Yang, Pei Ke, Shiyao Cui, Chu- jie Zheng, Hongning Wang, and Minlie Huang. Safe unlearning: A surprisingly effective and generalizable solution to defend against jailbreak attacks.arXiv preprint arXiv:2407.02855, 2024. 1, 3, 7 [93] Hanzhang Zhou, Zijian Feng, Zixiao Zhu, Junlang Qian, and Kezhi Mao. UniBias: Unveiling and mit- igating LLM bias through internal attention and FFN manipulation. arXiv preprint arXiv:2405.20612, 2024. 9, 17 A Abbreviations for Defense-Deployed and Base LLMs Table 8: Abbreviations for Defense-Deployed and Base LLMs AbbreviationFull Model Name Defense-Deployed LLMs Beaver-7Bbeaver-7b-v1.0 [61] Llama2_detoxllama2-7b-detox-qlora [3] Mistral_SUMistral-7B-Instruct-v0.2-safeunlearning [73] Zephyr_RMUZephyr_RMU [9] Vicuna_SUvicuna-7b-v1.5-safeunlearning [74] DAMA-7BDAMA-7B [79] DAMA-13BDAMA-13B [78] Mistral_DPOMistral-7B-Instruct-gender-bias-dpo [22] Mistral_SFTMistral-7B-Instruct-gender-bias-sft [23] Llama2_chat-GAllama2-7b_chat_newsqa_GA [4] Llama2_chat-KLllama2-7b_chat_newsqa_KL [6] Llama2_chat-GDllama2-7b_chat_newsqa_GD [5] Llama2_chat-POllama2-7b_chat_newsqa_PO [7] Llama2_dp8echr-llama2-7b-dp8 [43] Base LLMs Alpaca-7balpaca-7b-reproduced [60] Llama2-7bLlama-2-7b-hf [53] Mistral-v0.2Mistral-7B-Instruct-v0.2 [55] Zephyr-betazephyr-7b-beta [30] Vicuna-v1.5vicuna-7b-v1.5 [45] Llama2-13bLlama-2-13b-hf [52] Mistral-v0.3Mistral-7B-Instruct-v0.3 [56] Llama2_newsqallama2-7b_chat_newsqa [69] Llama2_echrechr-llama2-7b [44] B Details for Experiments InSection 4.5, we conducted controlled experiments on gemma-2-2b-it and Llama-3.2-1B-Instruct to verify the asymmetry of risk interactions. The implementation details for the applied defenses are as follows: • Privacy Defenses: For NPO [91], we set the learning rate to 1e− 5 and used 5 gradient accumulation steps. For RMU [37], we targeted the middle layers (layers 8-12 for Llama-3.2, 10-14 for Gemma) with a steering coefficient of c = 100. • Fairness Defenses: For Unbias [93], we utilized the debi- asing prompt templates provided in their official repository to construct the preference dataset. For Task Vector [88], we computed the bias vector by subtracting the parameter weights of the base model from a chemically aligned vari- ant, scaling it with a coefficient α = 0.4 to balance fairness and utility. 17