SPARD: Defending Harmful Fine-Tuning Attack via Safety Projection with Relevance–Diversity Data Selection

Fine-tuning large language models often undermines their safety alignment, a problem further amplified by harmful fine-tuning attacks in which adversarial data removes safeguards and induces unsafe behaviors. We propose SPARD, a defense framework that integrates Safety-Projected Alternating optimization with Relevance-Diversity aware data selection. SPARD employs SPAG, which optimizes alternatively between utility updates and explicit safety projections with a set of safe data to enforce safety constraints. To curate safe data, we introduce a Relevance–Diversity Determinantal Point Process to select compact safe data, balancing task relevance and safety coverage. Experiments on GSM8K and OpenBookQA under four harmful fine-tuning attacks demonstrate that SPARD consistently achieves the lowest average attack success rates, substantially outperforming state-of-the-art defense methods, while maintaining high task accuracy. Code is available at https://github.com/shuhao02/SPARD.

Large Language Models are carefully trained to refuse dangerous requests, but this safety can be easily broken when users customize the models with new data. This is especially concerning as cloud services increasingly allow users to fine-tune AI models for their own tasks, since malicious users can deliberately inject harmful data to strip away safety protections. We developed SPARD, a defense method that keeps AI models safe during customization. It works in two steps: first, after each training update, the system checks whether the model has drifted toward unsafe behavior and mathematically corrects it back to a safe state. Second, it intelligently selects the most effective safety examples to guide these corrections, choosing data that is both relevant to the user's task and diverse enough to cover a wide range of potential risks. In experiments across math reasoning, science question answering, sentiment classification, and code generation under multiple attack scenarios, SPARD consistently prevented harmful outputs while preserving the model's performance on its intended task. This enables AI service providers to safely offer model customization without risking that their models can be repurposed to generate dangerous content.