Safety Anchor: Defending Harmful Fine-tuning via Geometric Bottlenecks

The safety alignment of Large Language Models (LLMs) remains vulnerable to Harmful Fine-tuning (HFT). While existing defenses impose constraints on parameters, gradients, or internal representations, we observe that they can be effectively circumvented under persistent HFT. Our analysis traces this failure to the inherent redundancy of the high-dimensional parameter space: attackers exploit optimization trajectories that are orthogonal to defense constraints to restore harmful capabilities while deceptively adhering to safety restrictions. To address this, we propose Safety Bottleneck Regularization (SBR). SBR shifts the defensive focus from the redundant parameter space to the unembedding layer, which serves as a geometric bottleneck. By anchoring the final hidden states of harmful queries to those of the safety-aligned model, SBR enables the model to maintain safe responses even under persistent HFT. Extensive experiments confirm SBR's effectiveness, demonstrating that utilizing just a single safety anchor is sufficient to reduce the Harmful Score to $<$10 while preserving competitive performance on benign downstream tasks. The code is available at https://github.com/soyoaaa/SBR.

Large Language Models (LLMs) are vulnerable to "Harmful Fine-tuning". Bad actors can easily strip away the safety guardrails by lightly retraining the model with a few malicious examples. Current defenses try to prevent this by restricting changes to the model's complex internal workings. However, we found that because these models are so massive, they contain inherent redundancy. This allows attackers to easily find alternative pathways inside the model to bypass these internal locks and make the LLM dangerous again. To solve this, we introduce a new defense called Safety Bottleneck Regularization (SBR). Instead of trying to lock down the vast internal space, SBR locks the last step of the LLM's generation process, the "bottleneck" right before it outputs a word. By anchoring the LLM's final output for dangerous questions to the safe responses of the original model, SBR ensures the LLM remains safe no matter how its internal settings are altered. Our experiments show that using just a single safety anchor is enough to keep the model secure while preserving its ability to perform normal, helpful tasks.