ML Security PapersSaLoRA: Safety-Alignment Preserved Low-Rank Adaptation
Mingjie Li 1, Wai Man Si 1, Michael Backes 1, Yang Zhang 1, Yisen Wang 2
Published on arXiv
2501.01765
Transfer Learning Attack
OWASP ML Top 10 — ML07
Prompt Injection
OWASP LLM Top 10 — LLM01
Key Finding
SaLoRA preserves safety alignment during LoRA fine-tuning on benign data (e.g., Alpaca) while outperforming vanilla LoRA and adapter variants across multiple evaluation metrics on Llama-2-chat-7B.
SaLoRA
Novel technique introduced
As advancements in large language models (LLMs) continue and the demand for personalized models increases, parameter-efficient fine-tuning (PEFT) methods (e.g., LoRA) will become essential due to their efficiency in reducing computation costs. However, recent studies have raised alarming concerns that LoRA fine-tuning could potentially compromise the safety alignment in LLMs, posing significant risks for the model owner. In this paper, we first investigate the underlying mechanism by analyzing the changes in safety alignment related features before and after fine-tuning. Then, we propose a fixed safety module calculated by safety data and a task-specific initialization for trainable parameters in low-rank adaptations, termed Safety-alignment preserved Low-Rank Adaptation (SaLoRA). Unlike previous LoRA methods and their variants, SaLoRA enables targeted modifications to LLMs without disrupting their original alignments. Our experiments show that SaLoRA outperforms various adapters-based approaches across various evaluation metrics in different fine-tuning tasks.
Key Contributions
- Analysis identifying that LoRA fine-tuning degrades safety alignment by altering safety-related feature representations in LLM hidden states
- SaLoRA: a fixed safety module pre-calculated from safety data combined with task-specific initialization for trainable LoRA adapters, preserving alignment without rerunning RLHF
- Empirical demonstration that SaLoRA outperforms vanilla LoRA and other adapter-based methods on both downstream task performance and safety alignment retention
🛡️ Threat Analysis
The paper's primary concern is that the fine-tuning (transfer learning) process via LoRA degrades safety alignment — a safety behavior that should survive adapter tuning. SaLoRA is a defense that ensures safety alignment persists through fine-tuning, directly addressing the ML07 threat of alignment being undermined by the transfer learning process.