# SLDR: restoring refusals after a model is fine-tuned for harm

> Fine-tuning an open-weight model on a harmless task can strip its refusals; SLDR tries to put them back without hurting the task.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research
- **Published by:** arXiv
- **Disclosed:** 2026-10-07
- **Affects:** Llama 3.1, Llama 3, Qwen 2.5, Mistral
- **Research by:** Hui Zhang, Yachao Yuan, Jiayun Wang, Yuanzhuo Li, Hongtao Wang, Yali Yuan
- **Primary source:** https://arxiv.org/abs/2610.10345
- **Page:** https://theinjection.dev/items/sldr-malicious-finetuning-recovery/

SLDR is a defense against malicious fine-tuning that trains a LoRA recovery adapter on the safety-sensitive layers only and switches it on for harmful queries. The authors report large cuts in harmful output across four model families.

## What happened

Hui Zhang and five co-authors posted SLDR to arXiv on October 7, 2026, accepted at NeurIPS 2026, with code on GitHub. The paper addresses malicious fine-tuning, where training an aligned model on downstream data removes its refusal behaviour.

## How it works

The authors score each layer for safety sensitivity and find that scaling different layers can strengthen refusal, weaken it, or do little. SLDR then trains a LoRA recovery adapter only on the layers with the most extreme sensitivity scores, instead of the whole model. Representation-based dynamic routing activates that adapter only when a query looks malicious, which is how the authors aim to keep downstream accuracy.

## Who is affected

Teams that fine-tune open-weight models and rely on the base model's safety behaviour surviving that training. The released code targets Llama 3.1, Llama 3, Qwen 2.5 and Mistral, and scores harmfulness with Llama Guard across the Alpaca, DirectHarm4, HarmBench, HEx-PHI and Zulu/IJP evaluations.

## What to do

Treat refusal behaviour as something to re-test after every fine-tuning run rather than assume it carries over. The authors released the training and evaluation scripts under an MIT license, so the harmfulness scoring setup can be reused to measure a model before and after fine-tuning.

## Sources

1. [arXiv Paper](https://arxiv.org/abs/2610.10345)
2. [SLDR Code](https://github.com/Stardust457/SLDR)