SLDR: restoring refusals after a model is fine-tuned for harm
Fine-tuning an open-weight model on a harmless task can strip its refusals; SLDR tries to put them back without hurting the task.
· arXiv · Research by Hui Zhang, Yachao Yuan, Jiayun Wang, Yuanzhuo Li, Hongtao Wang, Yali Yuan
SLDR is a defense against malicious fine-tuning that trains a LoRA recovery adapter on the safety-sensitive layers only and switches it on for harmful queries. The authors report large cuts in harmful output across four model families.
01What happened
Hui Zhang and five co-authors posted SLDR to arXiv on October 7, 2026, accepted at NeurIPS 2026, with code on GitHub. The paper addresses malicious fine-tuning, where training an aligned model on downstream data removes its refusal behaviour.
02How it works
The authors score each layer for safety sensitivity and find that scaling different layers can strengthen refusal, weaken it, or do little. SLDR then trains a LoRA recovery adapter only on the layers with the most extreme sensitivity scores, instead of the whole model. Representation-based dynamic routing activates that adapter only when a query looks malicious, which is how the authors aim to keep downstream accuracy.
03Who is affected
Teams that fine-tune open-weight models and rely on the base model's safety behaviour surviving that training. The released code targets Llama 3.1, Llama 3, Qwen 2.5 and Mistral, and scores harmfulness with Llama Guard across the Alpaca, DirectHarm4, HarmBench, HEx-PHI and Zulu/IJP evaluations.
04What to do
Treat refusal behaviour as something to re-test after every fine-tuning run rather than assume it carries over. The authors released the training and evaluation scripts under an MIT license, so the harmfulness scoring setup can be reused to measure a model before and after fine-tuning.
Sources 2 links, all fetched
- 1arxiv.orgarXiv Paper
- 2github.comSLDR Code